@dharma-ai-labs/agent-fabric 0.2.152 → 0.2.154

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { execFile, spawn } from 'node:child_process';
 import { createHash, createPrivateKey, createPublicKey, randomUUID } from 'node:crypto';
-import { realpathSync } from 'node:fs';
+import { constants as fsConstants, realpathSync } from 'node:fs';
 import { access, chmod, link, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, relative, resolve } from 'node:path';
@@ -12,7 +12,7 @@ import { canonicalize, createActionDecisionPublicKeyResolver, sha256, validateCo
 import { buildTrajectoryCapsule, containsDisallowedLocalPath, redactValue, referencesExcludedPath, trajectoryCapsuleHash } from '@dharma-ai-labs/agent-fabric-evidence-reduction';
 import { assertPolicy, loadOrganizationPolicy, verifyServerAuthorizedPolicy } from '@dharma-ai-labs/agent-fabric-policy';
 import { agyAdapter, claudeAdapter, codexAdapter, hermesAdapter, providerAdapters, providerExecutionRecords, providerProcessEnvironment } from '@dharma-ai-labs/agent-fabric-provider-adapters';
-import { AgentFabricClient, beginEnrollment, loadOrCreateDeviceIdentity, normalizeHqUrl, pollEnrollment, deleteActiveSkillAuthorizationAnchor, loadActiveSkillAuthorizationAnchor, loadDeviceEnrollmentAnchor, saveActiveSkillAuthorizationAnchor, isDefinitiveAgentFabricRejection, recoverDeviceEnrollmentConsistency, loadOrganizationApiToken, redeemBootstrapGrant, claimSetupReference, setupClaimSourceRegistration, saveDeviceConfig, saveDeviceEnrollmentAnchor, saveOrganizationApiToken, } from '@dharma-ai-labs/agent-fabric-relay-client';
+import { AgentFabricClient, beginEnrollment, loadDeviceIdentity, loadOrCreateDeviceIdentity, normalizeHqUrl, pollEnrollment, deleteActiveSkillAuthorizationAnchor, loadActiveSkillAuthorizationAnchor, loadDeviceEnrollmentAnchor, saveActiveSkillAuthorizationAnchor, isDefinitiveAgentFabricRejection, recoverDeviceEnrollmentConsistency, loadOrganizationApiToken, redeemBootstrapGrant, claimSetupReference, setupClaimSourceRegistration, saveDeviceConfig, saveDeviceEnrollmentAnchor, saveOrganizationApiToken, } from '@dharma-ai-labs/agent-fabric-relay-client';
 import { AgentFabricClient as AgentFabricApiClient, } from '@dharma-ai-labs/agent-fabric-sdk';
 import { contentHash, getActiveSkillBundleAuthorization, getExpiredSkillBundleAuthorizationForReplacement, getLegacySkillBundleIdForUpgrade, installSkillBundle, readVerifiedRepositoryKnowledge, rollbackUnconfirmedSkillBundle, verifySkillBundle } from '@dharma-ai-labs/agent-fabric-skill-manager';
 import { executeTask, FileActionExecutionJournal, FileTaskReceiptStore, providerInstructionsForTask, } from '@dharma-ai-labs/agent-fabric-task-runner';
@@ -20,7 +20,7 @@ import { CLI_USAGE } from './usage.js';
 import { superviseRelay } from './relaySupervisor.js';
 import { currentRepositoryRelayFailure, repositoryRelayObservationReady, runRegisteredRepositoryRelays, selectRepositoryRelayRegistrations, serializeRelayWork, waitForRelayRefresh, withRepositoryRelayStage } from './repositoryRelaySupervisor.js';
 import { disableRelayAutostart, enableRelayAutostart, inspectOwnedRelayAutostart, relayAutostartStatus, startRelayAutostart, stopRelayAutostart } from './relayAutostart.js';
-import { runOwnedContainerEntrypoint } from './containerRelayLifecycle.js';
+import { runOwnedContainerEntrypoint, readContainerProcessIdentity } from './containerRelayLifecycle.js';
 import { readWorkspaceRegistry } from './workspaceRegistry.js';
 import { appendRecoveredWorkspace, applyRegistryRecoveryFile, inspectRegistryRecoveryFile, resolveRegistryRecoveryProjection } from './workspaceRegistryRecovery.js';
 import { relayRuntimeObservationReady, upgradeRelayRuntime } from './relayRuntimeUpgrade.js';
@@ -31,7 +31,7 @@ import { inventoryRepositoryPackage, readRepositoryPackageSnapshot, readReposito
 import { validateRepositorySourceAuthorization } from './repositorySourceAuthorization.js';
 import { createNamedPeerContentAuthorization } from './namedPeerContentAuthorization.js';
 import { advanceRepositorySourceBaseline, BlockedRepositorySourceRetry, fetchRepositorySourceAuthorization, recoverPublishedLocalSourceBaseline, repositorySourcePollInvalidatesWatcher, RepositorySourceWatcher, scanRepositorySourceChanges, seedRepositorySourceWatcher } from './repositorySourceSync.js';
-import { assertRepositoryInstallerOwnership, writeRepositoryInstallerFile } from './repositoryInstallerFiles.js';
+import { captureRepositoryInstallerInput, prepareRepositoryInstallerWorkspace, writeRepositoryInstallerFile } from './repositoryInstallerFiles.js';
 import { installRepositoryJoinConnection } from './repositoryJoinConnection.js';
 import { recoverLegacyRepositoryInstaller, selectLegacyInstallerRecoveryWorkspace } from './legacyInstallerRecovery.js';
 import { onboardingResumeCommand, selectDeviceWorkspace, workspaceIdForDevice } from './onboardingWorkspace.js';
@@ -70,10 +70,25 @@ import { openCodexAppServerTransport } from '@dharma-ai-labs/agent-fabric-provid
 import { readCodexPublicContext } from '@dharma-ai-labs/agent-fabric-provider-adapters/experimental/codex-session';
 import { createNamedSessionTrust, isNamedSessionOwnerReceipt, renewNamedSessionLifetime } from './namedSessionTrust.js';
 import { startNamedCodexThread } from './namedCodexThread.js';
+import { observeNamedCodexSkill, parseNamedCodexSkillObservation } from './namedCodexSkillDiscovery.js';
 import { namedCodexEnvironment } from './namedCodexEnvironment.js';
 import { namedCodexFilesystem } from './namedCodexFilesystem.js';
+import { createNamedSessionChildOwner, currentNamedSessionChildOwner } from './namedSessionChildOwner.js';
+import { awaitCodexSetupSession, consumeCodexSetupSessions, currentAcceptedSetupSessionScope, originalCodexSetupSessionSender, withCodexSetupSessionSender } from './codexSetupSessionHandoff.js';
+import { receiveCodexSetupChildStart, runCodexSetupChildStartup, sendCodexSetupChildStart } from './codexSetupChildStartup.js';
+import { assertBootstrapHostSource, captureBootstrapHostChild, currentBootstrapHostScope, inspectCodexBootstrapHostPreparation, prepareCodexBootstrapHost, runCodexBootstrapHost, runCodexBootstrapHostScope } from './bootstrapHostScope.js';
+// Trusted runtime composition only; these exports do not enable effectful setup.
+import { startCodexSetupNativeHost } from './codexSetupNativeHost.js';
+import { openCodexSetupOwnedConnection } from './codexSetupOwnedConnection.js';
+export { startCodexSetupNativeHost } from './codexSetupNativeHost.js';
+export { openCodexSetupVaultJournal } from './codexSetupVaultJournal.js';
+import { createCodexSetupReadinessOwner } from './codexSetupReadiness.js';
+export { createCodexSetupReadinessOwner } from './codexSetupReadiness.js';
+import { assertCodexSetupExecutionLease } from './codexSetupAdmission.js';
+import { parseLocalCodexSetupReadiness } from '@dharma-ai-labs/agent-fabric-local-vault/setup-readiness';
+import { writeBootstrapHostJson, writeBootstrapHostText } from './bootstrapHostFiles.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.152';
+const VERSION = '0.2.154';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -157,6 +172,36 @@ async function loadVaultModule() {
         process.emitWarning = original;
     }
 }
+async function openBootstrapVault(options) {
+    const scope = currentBootstrapHostScope(), snapshot = { root: options.root, rawLocalDays: options.rawLocalDays };
+    let key;
+    let vault;
+    try {
+        await scope?.assert();
+        const { LocalVault, loadOrCreateVaultMasterKey } = scope
+            ? await scope.step(() => loadVaultModule()) : await loadVaultModule();
+        key = await loadOrCreateVaultMasterKey(undefined, scope);
+        await scope?.assert();
+        vault = scope ? await LocalVault.open({ ...snapshot, masterKey: key }, scope)
+            : await LocalVault.open({ ...snapshot, masterKey: key });
+        await scope?.assert();
+        return vault;
+    }
+    catch (error) {
+        if (vault) {
+            try {
+                await vault.close();
+            }
+            catch {
+                throw new Error('vault_cleanup_unconfirmed');
+            }
+        }
+        throw error;
+    }
+    finally {
+        key?.fill(0);
+    }
+}
 export function isDirectExecution(argvPath, moduleUrl) {
     if (!argvPath)
         return false;
@@ -176,43 +221,56 @@ function workspaceRegistryPath() { return resolve(dharmaHome(), 'registry', 'wor
 function evidenceUploadLedgerPath() { return resolve(dharmaHome(), 'relay', 'evidence-upload-ledger.json'); }
 function evidenceRequestReceiptPath(requestId) { return resolve(dharmaHome(), 'relay', 'evidence-requests', `${requestId}.json`); }
 export async function loadOrCreateInstallationId(path = installationIdentityPath()) {
+    const scope = currentBootstrapHostScope();
+    const step = (operation) => scope ? scope.step(operation) : operation();
     const readExisting = async () => {
-        const value = JSON.parse(await readFile(path, 'utf8'));
+        const value = JSON.parse(await step(() => readFile(path, 'utf8')));
         if (value.schema !== 'dharma.installation-identity/v1'
             || typeof value.installationId !== 'string'
             || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value.installationId)) {
             throw new Error('Installation identity is invalid. Preserve the file and re-enroll this installation.');
         }
+        await scope?.assert();
         return value.installationId;
     };
     try {
-        return await readExisting();
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-    }
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    const installationId = randomUUID();
-    let handle;
-    try {
-        handle = await open(path, 'wx', 0o600);
-        await handle.writeFile(`${JSON.stringify({
-            schema: 'dharma.installation-identity/v1',
-            installationId,
-            createdAt: new Date().toISOString(),
-        }, null, 2)}\n`);
-        await handle.sync();
+        try {
+            return await readExisting();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        await step(() => mkdir(dirname(path), { recursive: true, mode: 0o700 }));
+        const installationId = randomUUID();
+        let handle;
+        try {
+            // Capture ownership before the post-acquisition fence can refuse continuation.
+            await step(async () => { handle = await open(path, 'wx', 0o600); });
+            await step(() => handle.writeFile(`${JSON.stringify({
+                schema: 'dharma.installation-identity/v1',
+                installationId,
+                createdAt: new Date().toISOString(),
+            }, null, 2)}\n`));
+            await step(() => handle.sync());
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            return await readExisting();
+        }
+        finally {
+            await handle?.close();
+        }
+        await scope?.assert();
+        return installationId;
     }
     catch (error) {
-        if (error.code !== 'EEXIST')
+        if (!scope)
             throw error;
-        return await readExisting();
-    }
-    finally {
-        await handle?.close();
+        await scope.assert();
+        throw new Error('codex_setup_host_installation_failed');
     }
-    return installationId;
 }
 function newEvidenceUploadLedger(day) {
     return { schema: 'dharma.evidence-upload-ledger/v2', day, totalBytes: 0, capsuleHashes: [], capsuleBytes: {} };
@@ -328,12 +386,12 @@ export async function syncPendingRetentionCapsules(vault, fabric, policy, worksp
                 assertCapsuleIntegrity(item.capsule);
             }
             catch {
-                vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'capsule_integrity_failed');
+                await vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'capsule_integrity_failed');
                 continue;
             }
             if (item.capsule.organizationId === fabric.config.organizationId
                 && item.capsule.deviceId !== fabric.config.deviceId) {
-                vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'device_binding_changed');
+                await vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'device_binding_changed');
                 if (!warnedPreviousDevice) {
                     process.stderr.write('Queued trajectory capsules from a previous device were preserved locally and excluded from upload. Recapture eligible provider sessions under the current device.\n');
                     warnedPreviousDevice = true;
@@ -350,7 +408,7 @@ export async function syncPendingRetentionCapsules(vault, fabric, policy, worksp
                 assertPolicy(policy);
                 // A successfully refreshed policy is authoritative. Retire only the
                 // superseded capsule so it cannot permanently block later valid work.
-                vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'authorization_superseded');
+                await vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'authorization_superseded');
                 continue;
             }
             const oversized = Buffer.byteLength(canonicalize(item.capsule)) > policy.evidence.maximumCapsuleBytes;
@@ -361,7 +419,7 @@ export async function syncPendingRetentionCapsules(vault, fabric, policy, worksp
                 }), item.trajectoryId);
                 if (serverHead && serverHead.revision === item.revision
                     && serverHead.capsuleHash === item.capsule.capsuleHash) {
-                    vault.markCapsuleSynced(item.trajectoryId, item.revision);
+                    await vault.markCapsuleSynced(item.trajectoryId, item.revision);
                     synced += 1;
                     continue;
                 }
@@ -370,7 +428,7 @@ export async function syncPendingRetentionCapsules(vault, fabric, policy, worksp
                     : item.revision !== 1 || item.capsule.previousRevisionHash !== null) {
                     throw new Error('Rejected pending trajectory revision conflicts with the accepted server head.');
                 }
-                vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, containsLocalPath ? 'local_path_disclosure_superseded' : 'capsule_size_limit_superseded');
+                await vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, containsLocalPath ? 'local_path_disclosure_superseded' : 'capsule_size_limit_superseded');
                 process.stderr.write(containsLocalPath
                     ? 'An unsent trajectory capsule containing a local path was retired from the upload queue. Encrypted raw evidence remains local and eligible sessions can be recaptured under the current policy.\n'
                     : 'An unsent oversized trajectory capsule was retired from the upload queue. Encrypted raw evidence remains local and eligible sessions can be recaptured under the current policy.\n');
@@ -383,10 +441,10 @@ export async function syncPendingRetentionCapsules(vault, fabric, policy, worksp
             catch (error) {
                 if (!isDefinitiveSecretDisclosureRejection(error))
                     throw error;
-                vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'secret_disclosure_forbidden');
+                await vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'secret_disclosure_forbidden');
                 continue;
             }
-            vault.markCapsuleSynced(item.trajectoryId, item.revision);
+            await vault.markCapsuleSynced(item.trajectoryId, item.revision);
             synced += 1;
         }
         if (matched === 0) {
@@ -618,93 +676,198 @@ export function assertCapsuleAuthorizedByCurrentPolicy(capsule, policy) {
     }
 }
 async function acquirePidLock(lockPath, timeoutMs, timeoutMessage) {
-    await mkdir(dirname(lockPath), { recursive: true, mode: 0o700 });
-    const deadline = Date.now() + timeoutMs;
-    for (;;) {
-        const candidate = `${lockPath}.${process.pid}.${randomUUID()}.candidate`;
-        try {
-            await writeFile(candidate, `${process.pid}\n`, { mode: 0o600, flag: 'wx' });
-            await link(candidate, lockPath);
-            await unlink(candidate);
-            return async () => { await unlink(lockPath).catch(() => undefined); };
+    const scope = currentBootstrapHostScope();
+    const step = (operation) => scope ? scope.step(operation) : operation();
+    const owned = new Map();
+    const recordOwned = async (path) => {
+        if (!scope)
+            return;
+        owned.set(path, null);
+        // Metadata for cooperative cleanup is captured even if creation withdrew authority.
+        const metadata = await lstat(path, { bigint: true });
+        if (metadata.isSymbolicLink() || !metadata.isFile() && !metadata.isDirectory()) {
+            throw new Error('codex_setup_host_lock_cleanup_unconfirmed');
         }
-        catch (error) {
-            await unlink(candidate).catch(() => undefined);
-            if (error.code !== 'EEXIST')
+        owned.set(path, { dev: metadata.dev, ino: metadata.ino, directory: metadata.isDirectory() });
+    };
+    const cleanupOwned = async (path, directory = false) => {
+        if (!scope) {
+            if (directory)
+                await rm(path, { recursive: true, force: true });
+            else
+                await unlink(path).catch(() => undefined);
+            return;
+        }
+        if (!owned.has(path))
+            return;
+        try {
+            const expected = owned.get(path);
+            if (!expected)
+                throw new Error();
+            const metadata = await lstat(path, { bigint: true }).catch(error => {
+                if (error.code === 'ENOENT')
+                    return null;
                 throw error;
-            const recoveryPath = `${lockPath}.recovery`;
-            const recoveryCandidate = `${recoveryPath}.${process.pid}.${randomUUID()}.candidate`;
-            let windowsRecoveryOwner;
+            });
+            if (metadata) {
+                if (metadata.isSymbolicLink() || metadata.dev !== expected.dev || metadata.ino !== expected.ino
+                    || metadata.isDirectory() !== expected.directory || !expected.directory && !metadata.isFile())
+                    throw new Error();
+                if (expected.directory)
+                    await rm(path, { recursive: true, force: true });
+                else
+                    await unlink(path);
+            }
+            owned.delete(path);
+        }
+        catch {
+            throw new Error('codex_setup_host_lock_cleanup_unconfirmed');
+        }
+    };
+    try {
+        await step(() => mkdir(dirname(lockPath), { recursive: true, mode: 0o700 }));
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            const candidate = `${lockPath}.${process.pid}.${randomUUID()}.candidate`;
             try {
-                await mkdir(recoveryCandidate);
-                await writeFile(resolve(recoveryCandidate, 'owner'), `${process.pid}\n`, { mode: 0o600 });
-                for (;;) {
-                    try {
-                        await rename(recoveryCandidate, recoveryPath);
-                        break;
-                    }
-                    catch (renameError) {
-                        if (process.platform !== 'win32' || renameError.code !== 'EPERM')
-                            throw renameError;
-                        // Windows uses EPERM for an existing destination. Its owner can
-                        // finish during inspection; retry publication, never ignore denial.
+                await step(async () => {
+                    await writeFile(candidate, `${process.pid}\n`, { mode: 0o600, flag: 'wx' });
+                    await recordOwned(candidate);
+                });
+                await step(async () => {
+                    await link(candidate, lockPath);
+                    if (scope)
+                        owned.set(lockPath, owned.get(candidate));
+                });
+                await step(() => cleanupOwned(candidate));
+                let release;
+                return () => release ??= cleanupOwned(lockPath);
+            }
+            catch (error) {
+                await cleanupOwned(candidate);
+                if (error.code !== 'EEXIST')
+                    throw error;
+                const recoveryPath = `${lockPath}.recovery`;
+                const recoveryCandidate = `${recoveryPath}.${process.pid}.${randomUUID()}.candidate`;
+                let windowsRecoveryOwner;
+                try {
+                    await step(async () => { await mkdir(recoveryCandidate); await recordOwned(recoveryCandidate); });
+                    await step(() => writeFile(resolve(recoveryCandidate, 'owner'), `${process.pid}\n`, { mode: 0o600 }));
+                    for (;;) {
                         try {
-                            const directory = await lstat(recoveryPath);
-                            const ownerPath = resolve(recoveryPath, 'owner');
-                            const ownerFile = await lstat(ownerPath);
-                            const ownerText = (await readFile(ownerPath, 'utf8')).trim();
-                            const owner = Number(ownerText);
-                            if (!directory.isDirectory() || directory.isSymbolicLink()
-                                || !ownerFile.isFile() || ownerFile.isSymbolicLink()
-                                || !/^[1-9][0-9]*$/.test(ownerText) || !Number.isSafeInteger(owner))
-                                throw renameError;
-                            windowsRecoveryOwner = owner;
+                            await step(async () => {
+                                await rename(recoveryCandidate, recoveryPath);
+                                if (scope) {
+                                    owned.set(recoveryPath, owned.get(recoveryCandidate));
+                                    owned.delete(recoveryCandidate);
+                                }
+                            });
+                            break;
                         }
-                        catch (inspectionError) {
-                            let disappeared = inspectionError.code === 'ENOENT';
-                            if (!disappeared && inspectionError.code === 'EPERM') {
-                                // Windows can deny owner reads while its directory is being
-                                // deleted. Retry only when fresh metadata confirms absence.
-                                try {
-                                    await lstat(recoveryPath);
+                        catch (renameError) {
+                            if (process.platform !== 'win32' || renameError.code !== 'EPERM')
+                                throw renameError;
+                            // Windows uses EPERM for an existing destination. Its owner can
+                            // finish during inspection; retry publication, never ignore denial.
+                            try {
+                                const directory = await step(() => lstat(recoveryPath));
+                                const ownerPath = resolve(recoveryPath, 'owner');
+                                const ownerFile = await step(() => lstat(ownerPath));
+                                const ownerText = (await step(() => readFile(ownerPath, 'utf8'))).trim();
+                                const owner = Number(ownerText);
+                                if (!directory.isDirectory() || directory.isSymbolicLink()
+                                    || !ownerFile.isFile() || ownerFile.isSymbolicLink()
+                                    || !/^[1-9][0-9]*$/.test(ownerText) || !Number.isSafeInteger(owner))
+                                    throw renameError;
+                                windowsRecoveryOwner = owner;
+                            }
+                            catch (inspectionError) {
+                                let disappeared = inspectionError.code === 'ENOENT';
+                                if (!disappeared && inspectionError.code === 'EPERM') {
+                                    // Windows can deny owner reads while its directory is being
+                                    // deleted. Retry only when fresh metadata confirms absence.
+                                    try {
+                                        await step(() => lstat(recoveryPath));
+                                    }
+                                    catch (readbackError) {
+                                        disappeared = readbackError.code === 'ENOENT';
+                                    }
                                 }
-                                catch (readbackError) {
-                                    disappeared = readbackError.code === 'ENOENT';
+                                if (disappeared && Date.now() < deadline) {
+                                    await step(() => new Promise((resolvePromise) => setTimeout(resolvePromise, 25)));
+                                    continue;
                                 }
+                                throw renameError;
                             }
-                            if (disappeared && Date.now() < deadline) {
-                                await new Promise((resolvePromise) => setTimeout(resolvePromise, 25));
+                            throw renameError;
+                        }
+                    }
+                    try {
+                        let ownerPid = 0;
+                        try {
+                            ownerPid = Number((await step(() => readFile(lockPath, 'utf8'))).trim());
+                        }
+                        catch (readError) {
+                            if (readError.code === 'ENOENT')
                                 continue;
+                        }
+                        let ownerAlive = Number.isSafeInteger(ownerPid) && ownerPid > 0;
+                        if (ownerAlive) {
+                            try {
+                                await step(async () => { process.kill(ownerPid, 0); });
+                            }
+                            catch (killError) {
+                                ownerAlive = killError.code === 'EPERM';
                             }
-                            throw renameError;
                         }
-                        throw renameError;
+                        if (!ownerAlive) {
+                            const quarantine = `${lockPath}.dead.${randomUUID()}`;
+                            try {
+                                await step(() => rename(lockPath, quarantine));
+                                await step(() => unlink(quarantine));
+                                continue;
+                            }
+                            catch (renameError) {
+                                if (renameError.code !== 'ENOENT')
+                                    throw renameError;
+                            }
+                        }
+                    }
+                    finally {
+                        await cleanupOwned(recoveryPath, true);
                     }
                 }
-                try {
-                    let ownerPid = 0;
-                    try {
-                        ownerPid = Number((await readFile(lockPath, 'utf8')).trim());
+                catch (recoveryError) {
+                    await cleanupOwned(recoveryCandidate, true);
+                    const recoveryCode = recoveryError.code || '';
+                    let recoveryOwner = 0;
+                    if (process.platform === 'win32' && recoveryCode === 'EPERM') {
+                        if (windowsRecoveryOwner === undefined)
+                            throw recoveryError;
+                        recoveryOwner = windowsRecoveryOwner;
                     }
-                    catch (readError) {
-                        if (readError.code === 'ENOENT')
-                            continue;
+                    else {
+                        if (!['EEXIST', 'ENOTEMPTY'].includes(recoveryCode))
+                            throw recoveryError;
+                        try {
+                            recoveryOwner = Number((await step(() => readFile(resolve(recoveryPath, 'owner'), 'utf8'))).trim());
+                        }
+                        catch { }
                     }
-                    let ownerAlive = Number.isSafeInteger(ownerPid) && ownerPid > 0;
-                    if (ownerAlive) {
+                    let recoveryOwnerAlive = Number.isSafeInteger(recoveryOwner) && recoveryOwner > 0;
+                    if (recoveryOwnerAlive) {
                         try {
-                            process.kill(ownerPid, 0);
+                            await step(async () => { process.kill(recoveryOwner, 0); });
                         }
                         catch (killError) {
-                            ownerAlive = killError.code === 'EPERM';
+                            recoveryOwnerAlive = killError.code === 'EPERM';
                         }
                     }
-                    if (!ownerAlive) {
-                        const quarantine = `${lockPath}.dead.${randomUUID()}`;
+                    if (!recoveryOwnerAlive) {
+                        const quarantine = `${recoveryPath}.dead.${randomUUID()}`;
                         try {
-                            await rename(lockPath, quarantine);
-                            await unlink(quarantine);
-                            continue;
+                            await step(() => rename(recoveryPath, quarantine));
+                            await step(() => rm(quarantine, { recursive: true, force: true }));
                         }
                         catch (renameError) {
                             if (renameError.code !== 'ENOENT')
@@ -712,64 +875,49 @@ async function acquirePidLock(lockPath, timeoutMs, timeoutMessage) {
                         }
                     }
                 }
-                finally {
-                    await rm(recoveryPath, { recursive: true, force: true });
-                }
-            }
-            catch (recoveryError) {
-                await rm(recoveryCandidate, { recursive: true, force: true });
-                const recoveryCode = recoveryError.code || '';
-                let recoveryOwner = 0;
-                if (process.platform === 'win32' && recoveryCode === 'EPERM') {
-                    if (windowsRecoveryOwner === undefined)
-                        throw recoveryError;
-                    recoveryOwner = windowsRecoveryOwner;
-                }
-                else {
-                    if (!['EEXIST', 'ENOTEMPTY'].includes(recoveryCode))
-                        throw recoveryError;
-                    try {
-                        recoveryOwner = Number((await readFile(resolve(recoveryPath, 'owner'), 'utf8')).trim());
-                    }
-                    catch { }
-                }
-                let recoveryOwnerAlive = Number.isSafeInteger(recoveryOwner) && recoveryOwner > 0;
-                if (recoveryOwnerAlive) {
-                    try {
-                        process.kill(recoveryOwner, 0);
-                    }
-                    catch (killError) {
-                        recoveryOwnerAlive = killError.code === 'EPERM';
-                    }
-                }
-                if (!recoveryOwnerAlive) {
-                    const quarantine = `${recoveryPath}.dead.${randomUUID()}`;
-                    try {
-                        await rename(recoveryPath, quarantine);
-                        await rm(quarantine, { recursive: true, force: true });
-                    }
-                    catch (renameError) {
-                        if (renameError.code !== 'ENOENT')
-                            throw renameError;
-                    }
-                }
+                if (Date.now() >= deadline)
+                    throw new Error(scope ? 'codex_setup_host_lock_timeout' : timeoutMessage);
+                await step(() => new Promise((resolvePromise) => setTimeout(resolvePromise, 25)));
             }
-            if (Date.now() >= deadline)
-                throw new Error(timeoutMessage);
-            await new Promise((resolvePromise) => setTimeout(resolvePromise, 25));
         }
     }
+    catch (error) {
+        let cleanupFailed = false;
+        for (const path of owned.keys())
+            try {
+                await cleanupOwned(path);
+            }
+            catch {
+                cleanupFailed = true;
+            }
+        if (cleanupFailed)
+            throw new Error('codex_setup_host_lock_cleanup_unconfirmed');
+        if (!scope)
+            throw error;
+        await scope.assert();
+        if (error instanceof Error && error.message === 'codex_setup_host_lock_timeout')
+            throw error;
+        throw new Error('codex_setup_host_lock_failed');
+    }
 }
 async function withEvidenceLedgerLock(operation) {
-    const release = await acquirePidLock(`${evidenceUploadLedgerPath()}.lock`, 5_000, 'Timed out waiting for the evidence upload ledger lock.');
+    const scope = currentBootstrapHostScope();
+    const step = (effect) => scope ? scope.step(effect) : effect();
+    let release;
     try {
-        return await operation();
+        await step(async () => {
+            release = await acquirePidLock(`${evidenceUploadLedgerPath()}.lock`, 5_000, 'Timed out waiting for the evidence upload ledger lock.');
+        });
+        return await step(operation);
     }
     finally {
-        await release();
+        await release?.();
     }
 }
 async function writeJsonAtomic(path, value) {
+    const hostScope = currentBootstrapHostScope();
+    if (hostScope)
+        return writeBootstrapHostJson(path, value, hostScope);
     const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
     await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
@@ -918,104 +1066,130 @@ export async function acquireRelaySupervisorLease(home = dharmaHome()) {
     };
 }
 export async function materializeWorkspacePolicy(input) {
-    const allowedCommands = {};
+    const scope = currentBootstrapHostScope();
+    const step = (effect) => scope ? scope.step(effect) : effect();
+    const exists = (path) => step(() => scope ? pathExistsOrThrow(path) : pathExists(path));
     try {
-        const packageJson = JSON.parse(await readFile(resolve(input.workspace, 'package.json'), 'utf8'));
-        const scripts = packageJson.scripts || {};
-        for (const [script, commandId, timeoutSeconds] of [
-            ['test', 'repo.test', 1_200],
-            ['lint', 'repo.lint', 600],
-            ['typecheck', 'repo.typecheck', 600],
-            ['type-check', 'repo.typecheck', 600],
-            ['build', 'repo.build', 1_200],
-        ]) {
-            if (typeof scripts[script] === 'string' && !allowedCommands[commandId]) {
-                allowedCommands[commandId] = { argv: ['npm', 'run', script], timeoutSeconds };
+        if (scope)
+            input = { ...input, serverPolicyAuthorization: structuredClone(input.serverPolicyAuthorization) };
+        await scope?.assert();
+        const allowedCommands = {};
+        try {
+            const packageJson = JSON.parse(await step(() => readFile(resolve(input.workspace, 'package.json'), 'utf8')));
+            const scripts = packageJson.scripts || {};
+            for (const [script, commandId, timeoutSeconds] of [
+                ['test', 'repo.test', 1_200],
+                ['lint', 'repo.lint', 600],
+                ['typecheck', 'repo.typecheck', 600],
+                ['type-check', 'repo.typecheck', 600],
+                ['build', 'repo.build', 1_200],
+            ]) {
+                if (typeof scripts[script] === 'string' && !allowedCommands[commandId]) {
+                    allowedCommands[commandId] = { argv: ['npm', 'run', script], timeoutSeconds };
+                }
             }
         }
-    }
-    catch { }
-    const writePaths = [];
-    for (const candidate of ['src', 'app', 'apps', 'lib', 'packages', 'test', 'tests', 'docs']) {
-        if (await pathExists(resolve(input.workspace, candidate)))
-            writePaths.push(`${candidate}/**`);
-    }
-    let policy = {
-        schema: 'dharma.organization-policy/v2',
-        organizationId: input.organizationId,
-        revision: input.revision,
-        evidence: {
-            defaultMode: 'deep',
-            automaticDisclosure: { mode: 'local_analysis' },
-            registeredWorkspaceOnly: true,
-            excludePaths: ['.env', '.env.*', '.git/**', 'node_modules/**', 'dist/**', 'build/**', '**/*.pem', '**/*.key'],
-            maximumCapsuleBytes: 1_000_000,
-            maximumDailyUploadBytes: 50_000_000,
-            maximumExpansionBytes: 65_536,
-            pseudonymizeIdentity: true,
-        },
-        tasks: {
-            defaultNetwork: 'deny',
-            defaultGit: 'task_branch',
-            allowedCommands,
-            writePaths,
-            requireLocalConfirmationFor: ['network.allowlisted_domains', 'git.push', 'merge', 'deploy'],
-        },
-        skills: { automaticInstall: true, automaticPromotionMaxRisk: 'R2', canaryPercent: 10 },
-        retention: { rawLocalDays: 30, capsuleServerDays: 90 },
-        budgets: { dailyAnalysisCents: 1_000 },
-    };
-    const existingPath = resolve(input.workspace, '.dharma', 'approved-policy.json');
-    if (await pathExists(existingPath)) {
-        const existing = await loadOrganizationPolicy(existingPath);
-        if (existing.organizationId === input.organizationId)
-            policy = existing;
-    }
-    if (input.serverPolicyAuthorization !== undefined && input.serverPolicyAuthorization !== null) {
-        if (!input.serverPublicKeyEd25519 || !input.workspaceId) {
-            throw new Error('Server policy authorization requires the enrolled server key and workspace ID.');
-        }
-        policy = applyServerEvidencePolicy(policy, input.serverPolicyAuthorization, input.serverPublicKeyEd25519, input.organizationId, input.workspaceId);
-        if (!input.dryRun) {
-            await applyWorkspaceAuthorizationAtomically({
-                workspaceId: input.workspaceId,
-                authorization: policy.serverAuthorization,
-                policyPath: existingPath,
-                policy,
-                secureStore: input.secureStore,
-            });
+        catch {
+            await scope?.assert();
+        }
+        const writePaths = [];
+        for (const candidate of ['src', 'app', 'apps', 'lib', 'packages', 'test', 'tests', 'docs']) {
+            if (await exists(resolve(input.workspace, candidate)))
+                writePaths.push(`${candidate}/**`);
+        }
+        let policy = {
+            schema: 'dharma.organization-policy/v2',
+            organizationId: input.organizationId,
+            revision: input.revision,
+            evidence: {
+                defaultMode: 'deep',
+                automaticDisclosure: { mode: 'local_analysis' },
+                registeredWorkspaceOnly: true,
+                excludePaths: ['.env', '.env.*', '.git/**', 'node_modules/**', 'dist/**', 'build/**', '**/*.pem', '**/*.key'],
+                maximumCapsuleBytes: 1_000_000,
+                maximumDailyUploadBytes: 50_000_000,
+                maximumExpansionBytes: 65_536,
+                pseudonymizeIdentity: true,
+            },
+            tasks: {
+                defaultNetwork: 'deny',
+                defaultGit: 'task_branch',
+                allowedCommands,
+                writePaths,
+                requireLocalConfirmationFor: ['network.allowlisted_domains', 'git.push', 'merge', 'deploy'],
+            },
+            skills: { automaticInstall: true, automaticPromotionMaxRisk: 'R2', canaryPercent: 10 },
+            retention: { rawLocalDays: 30, capsuleServerDays: 90 },
+            budgets: { dailyAnalysisCents: 1_000 },
+        };
+        const existingPath = resolve(input.workspace, '.dharma', 'approved-policy.json');
+        if (await exists(existingPath)) {
+            const existing = await step(() => loadOrganizationPolicy(existingPath));
+            if (existing.organizationId === input.organizationId)
+                policy = existing;
+        }
+        if (input.serverPolicyAuthorization !== undefined && input.serverPolicyAuthorization !== null) {
+            const workspaceId = input.workspaceId;
+            if (!input.serverPublicKeyEd25519 || !workspaceId) {
+                throw new Error('Server policy authorization requires the enrolled server key and workspace ID.');
+            }
+            policy = applyServerEvidencePolicy(policy, input.serverPolicyAuthorization, input.serverPublicKeyEd25519, input.organizationId, workspaceId);
+            if (!input.dryRun) {
+                await step(() => applyWorkspaceAuthorizationAtomically({
+                    workspaceId,
+                    authorization: policy.serverAuthorization,
+                    policyPath: existingPath,
+                    policy,
+                    secureStore: input.secureStore,
+                }));
+            }
+            else {
+                await step(() => assertWorkspaceAuthorizationCurrent(workspaceId, policy.serverAuthorization, false));
+            }
         }
-        else {
-            await assertWorkspaceAuthorizationCurrent(input.workspaceId, policy.serverAuthorization, false);
+        assertPolicy(policy);
+        const relativePath = '.dharma/approved-policy.json';
+        if (!input.dryRun && !policy.serverAuthorization) {
+            await step(() => mkdir(resolve(input.workspace, '.dharma'), { recursive: true, mode: 0o700 }));
+            await step(() => writeJsonAtomic(resolve(input.workspace, relativePath), policy));
         }
+        await scope?.assert();
+        return { relativePath, policy, applied: !input.dryRun };
     }
-    assertPolicy(policy);
-    const relativePath = '.dharma/approved-policy.json';
-    if (!input.dryRun && !policy.serverAuthorization) {
-        await mkdir(resolve(input.workspace, '.dharma'), { recursive: true, mode: 0o700 });
-        await writeJsonAtomic(resolve(input.workspace, relativePath), policy);
+    catch (error) {
+        if (!scope)
+            throw error;
+        await scope.assert();
+        throw new Error('workspace_policy_materialization_failed');
     }
-    return { relativePath, policy, applied: !input.dryRun };
 }
 function workspaceAuthorizationStatePath(workspaceId) {
     return resolve(dharmaHome(), 'registry', 'workspace-authorizations', `${workspaceId}.json`);
 }
 async function withFileLock(lockPath, operation, timeoutMessage = 'Timed out waiting for the workspace authorization lock.') {
-    const release = await acquirePidLock(lockPath, 10_000, timeoutMessage);
+    const scope = currentBootstrapHostScope();
+    const step = (effect) => scope ? scope.step(effect) : effect();
+    let release;
     try {
-        return await operation();
+        await step(async () => { release = await acquirePidLock(lockPath, 10_000, timeoutMessage); });
+        return await step(operation);
     }
     finally {
-        await release();
+        await release?.();
     }
 }
 export async function withRelayStartupMutation(operation, home = dharmaHome()) {
-    const release = await acquirePidLock(resolve(home, 'autostart-mutation.lock'), 30_000, 'demo_watch_startup_busy: another startup operation is still running.');
+    const scope = currentBootstrapHostScope();
+    const step = (effect) => scope ? scope.step(effect) : effect();
+    let release;
     try {
-        return await operation();
+        await step(async () => {
+            release = await acquirePidLock(resolve(home, 'autostart-mutation.lock'), 30_000, 'demo_watch_startup_busy: another startup operation is still running.');
+        });
+        return await step(operation);
     }
     finally {
-        await release();
+        await release?.();
     }
 }
 export async function withWorkspacePolicyRefreshLock(workspaceId, operation) {
@@ -1031,67 +1205,102 @@ export async function withWorkspaceSkillActivationLock(workspaceId, provider, op
     return withFileLock(resolve(dharmaHome(), 'registry', 'skill-activation-locks', `${key}.lock`), operation, 'Timed out waiting for the workspace skill activation lock.');
 }
 async function assertWorkspaceAuthorizationCurrent(workspaceId, authorization, requireExisting = true) {
-    const statePath = workspaceAuthorizationStatePath(workspaceId);
-    let previous = null;
+    const scope = currentBootstrapHostScope();
+    const step = (effect) => scope ? scope.step(effect) : effect();
     try {
-        const parsed = JSON.parse(await readFile(statePath, 'utf8'));
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)
-            || typeof parsed.issuedAt !== 'string'
-            || !Number.isFinite(Date.parse(parsed.issuedAt))
-            || typeof parsed.signature !== 'string'
-            || !parsed.signature) {
-            throw new Error('Workspace authorization replay state is missing or invalid; apply a fresh server policy.');
+        if (scope)
+            authorization = structuredClone(authorization);
+        await scope?.assert();
+        const statePath = workspaceAuthorizationStatePath(workspaceId);
+        let previous = null;
+        try {
+            const parsed = JSON.parse(await step(() => readFile(statePath, 'utf8')));
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)
+                || typeof parsed.issuedAt !== 'string'
+                || !Number.isFinite(Date.parse(parsed.issuedAt))
+                || typeof parsed.signature !== 'string'
+                || !parsed.signature) {
+                throw new Error('Workspace authorization replay state is missing or invalid; apply a fresh server policy.');
+            }
+            previous = parsed;
+        }
+        catch (error) {
+            await scope?.assert();
+            if (error.code === 'ENOENT' && !requireExisting)
+                return;
+            throw new Error(scope ? 'workspace_authorization_replay_state_invalid'
+                : 'Workspace authorization replay state is missing or invalid; apply a fresh server policy.');
+        }
+        if (previous) {
+            const incomingTime = Date.parse(authorization.issuedAt);
+            const previousTime = Date.parse(previous.issuedAt);
+            if (!Number.isFinite(previousTime)
+                || incomingTime < previousTime
+                || (incomingTime === previousTime && authorization.signature !== previous.signature)) {
+                throw new Error(scope ? 'workspace_authorization_replay_superseded'
+                    : 'Server workspace policy authorization is older than the last accepted authorization.');
+            }
         }
-        previous = parsed;
+        await scope?.assert();
     }
     catch (error) {
-        if (error.code === 'ENOENT' && !requireExisting)
-            return;
-        throw new Error('Workspace authorization replay state is missing or invalid; apply a fresh server policy.');
-    }
-    if (previous) {
-        const incomingTime = Date.parse(authorization.issuedAt);
-        const previousTime = Date.parse(previous.issuedAt);
-        if (!Number.isFinite(previousTime)
-            || incomingTime < previousTime
-            || (incomingTime === previousTime && authorization.signature !== previous.signature)) {
-            throw new Error('Server workspace policy authorization is older than the last accepted authorization.');
-        }
+        if (!scope)
+            throw error;
+        await scope.assert();
+        if (error instanceof Error && ['workspace_authorization_replay_state_invalid',
+            'workspace_authorization_replay_superseded'].includes(error.message))
+            throw error;
+        throw new Error('workspace_authorization_replay_failed');
     }
 }
 async function applyWorkspaceAuthorizationAtomically(input) {
-    const statePath = workspaceAuthorizationStatePath(input.workspaceId);
-    await withFileLock(`${statePath}.lock`, async () => {
-        await assertWorkspaceAuthorizationCurrent(input.workspaceId, input.authorization, false);
-        let previous = null;
-        try {
-            previous = JSON.parse(await readFile(statePath, 'utf8'));
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT') {
-                throw new Error('Workspace authorization replay state is missing or invalid; apply a fresh server policy.');
+    const scope = currentBootstrapHostScope();
+    const step = (effect) => scope ? scope.step(effect) : effect();
+    try {
+        if (scope)
+            input = { ...input, authorization: structuredClone(input.authorization), policy: structuredClone(input.policy) };
+        await scope?.assert();
+        const statePath = workspaceAuthorizationStatePath(input.workspaceId);
+        await step(() => withFileLock(`${statePath}.lock`, async () => {
+            await step(() => assertWorkspaceAuthorizationCurrent(input.workspaceId, input.authorization, false));
+            let previous = null;
+            try {
+                previous = JSON.parse(await step(() => readFile(statePath, 'utf8')));
             }
-        }
-        const contentAuthorized = input.policy.evidence.automaticDisclosure?.mode === 'customer_authorized_content';
-        const ledgerExists = await pathExists(evidenceUploadLedgerPath());
-        if (contentAuthorized && ledgerExists) {
-            const current = JSON.parse(await readFile(evidenceUploadLedgerPath(), 'utf8'));
-            const ledger = evidenceLedgerForPolicyActivation(current, new Date().toISOString().slice(0, 10));
-            if (JSON.stringify(current) !== JSON.stringify(ledger)) {
-                await writeJsonAtomic(evidenceUploadLedgerPath(), ledger);
+            catch (error) {
+                await scope?.assert();
+                if (error.code !== 'ENOENT') {
+                    throw new Error('Workspace authorization replay state is missing or invalid; apply a fresh server policy.');
+                }
             }
-        }
-        if (contentAuthorized && !ledgerExists) {
-            const ledger = newEvidenceUploadLedger(new Date().toISOString().slice(0, 10));
-            await writeJsonAtomic(evidenceUploadLedgerPath(), ledger);
-        }
-        await writeJsonAtomic(statePath, {
-            issuedAt: input.authorization.issuedAt,
-            signature: input.authorization.signature,
-            contentLedgerInitialized: previous?.contentLedgerInitialized === true || contentAuthorized,
-        });
-        await writeJsonAtomic(input.policyPath, input.policy);
-    });
+            const contentAuthorized = input.policy.evidence.automaticDisclosure?.mode === 'customer_authorized_content';
+            const ledgerExists = await step(() => scope ? pathExistsOrThrow(evidenceUploadLedgerPath()) : pathExists(evidenceUploadLedgerPath()));
+            if (contentAuthorized && ledgerExists) {
+                const current = JSON.parse(await step(() => readFile(evidenceUploadLedgerPath(), 'utf8')));
+                const ledger = evidenceLedgerForPolicyActivation(current, new Date().toISOString().slice(0, 10));
+                if (JSON.stringify(current) !== JSON.stringify(ledger)) {
+                    await step(() => writeJsonAtomic(evidenceUploadLedgerPath(), ledger));
+                }
+            }
+            if (contentAuthorized && !ledgerExists) {
+                const ledger = newEvidenceUploadLedger(new Date().toISOString().slice(0, 10));
+                await step(() => writeJsonAtomic(evidenceUploadLedgerPath(), ledger));
+            }
+            await step(() => writeJsonAtomic(statePath, {
+                issuedAt: input.authorization.issuedAt,
+                signature: input.authorization.signature,
+                contentLedgerInitialized: previous?.contentLedgerInitialized === true || contentAuthorized,
+            }));
+            await step(() => writeJsonAtomic(input.policyPath, input.policy));
+        }));
+        await scope?.assert();
+    }
+    catch (error) {
+        if (!scope)
+            throw error;
+        await scope.assert();
+        throw new Error('workspace_policy_activation_failed');
+    }
 }
 export function applyServerEvidencePolicy(base, value, serverPublicKeyEd25519, organizationId, workspaceId, now = new Date()) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -1348,13 +1557,35 @@ async function registry() {
     return (await readWorkspaceRegistry(workspaceRegistryPath())).records;
 }
 async function saveRegistry(items) {
-    await mkdir(resolve(dharmaHome(), 'registry'), { recursive: true, mode: 0o700 });
-    await writeJsonAtomic(workspaceRegistryPath(), items);
+    const scope = currentBootstrapHostScope();
+    try {
+        await scope?.assert();
+        const snapshot = scope ? structuredClone(items) : items;
+        const directory = resolve(dharmaHome(), 'registry');
+        if (scope)
+            await scope.step(() => mkdir(directory, { recursive: true, mode: 0o700 }));
+        else
+            await mkdir(directory, { recursive: true, mode: 0o700 });
+        await writeJsonAtomic(workspaceRegistryPath(), snapshot);
+    }
+    catch (error) {
+        if (!scope)
+            throw error;
+        await scope.assert();
+        throw new Error('workspace_registry_write_failed');
+    }
 }
 async function saveWorkspaceRecord(entry) {
-    const release = await acquirePidLock(`${workspaceRegistryPath()}.mutation.lock`, 10_000, 'Workspace registry is busy; preserve it for recovery.');
+    const scope = currentBootstrapHostScope();
+    const step = (operation) => scope ? scope.step(operation) : operation();
+    let release;
     try {
-        const value = await readFile(workspaceRegistryPath(), 'utf8').catch(error => {
+        await scope?.assert();
+        const snapshot = scope ? structuredClone(entry) : entry;
+        await step(async () => {
+            release = await acquirePidLock(`${workspaceRegistryPath()}.mutation.lock`, 10_000, 'Workspace registry is busy; preserve it for recovery.');
+        });
+        const value = await step(() => readFile(workspaceRegistryPath(), 'utf8')).catch(error => {
             if (error.code === 'ENOENT')
                 return '[]';
             throw error;
@@ -1362,28 +1593,49 @@ async function saveWorkspaceRecord(entry) {
         const items = JSON.parse(value);
         if (!Array.isArray(items))
             throw new Error('Workspace registry is invalid; preserve it for recovery.');
-        await saveRegistry([...items.filter(item => item.workspaceId !== entry.workspaceId), entry]);
+        await saveRegistry([...items.filter(item => item.workspaceId !== snapshot.workspaceId), snapshot]);
+    }
+    catch (error) {
+        if (!scope)
+            throw error;
+        if (error instanceof Error && error.message === 'codex_setup_host_lock_cleanup_unconfirmed')
+            throw error;
+        await scope.assert();
+        if (error instanceof Error && error.message === 'Workspace registry is invalid; preserve it for recovery.') {
+            throw new Error('workspace_registry_invalid');
+        }
+        throw new Error('workspace_registry_write_failed');
     }
     finally {
-        await release();
+        await release?.();
     }
 }
 async function gitValue(workspace, argv) {
+    const scope = currentBootstrapHostScope(), args = ['-C', workspace, ...argv];
+    const operation = () => execFileAsync('git', args, scope ? {
+        timeout: 10_000, maxBuffer: 65_536, windowsHide: true, signal: scope.signal,
+        env: providerProcessEnvironment(process.env),
+    } : { timeout: 10_000 });
     try {
-        return (await execFileAsync('git', ['-C', workspace, ...argv], { timeout: 10_000 })).stdout.trim() || null;
+        const result = scope ? await scope.step(operation) : await operation();
+        return result.stdout.trim() || null;
     }
     catch {
+        // An optional Git value may be absent; withdrawn setup authority may not.
+        await scope?.assert();
         return null;
     }
 }
 async function client() {
-    const instance = await AgentFabricClient.open({ configPath: configPath(), statePath: protocolStatePath() });
+    const instance = await AgentFabricClient.open({ configPath: configPath(), statePath: protocolStatePath(),
+        hostScope: currentBootstrapHostScope() });
     await instance.openSession(VERSION);
     return instance;
 }
 export async function probeRelayConnection(openClient = async () => AgentFabricClient.open({
     configPath: configPath(),
     statePath: protocolStatePath(),
+    hostScope: currentBootstrapHostScope(),
 })) {
     const instance = await openClient();
     const acknowledgement = await instance.openSession(VERSION);
@@ -1398,6 +1650,8 @@ export async function probeRelayConnection(openClient = async () => AgentFabricC
     };
 }
 async function organizationApi(flags) {
+    const hostScope = currentBootstrapHostScope();
+    await hostScope?.assert();
     let enrolled = null;
     try {
         enrolled = JSON.parse(await readFile(configPath(), 'utf8'));
@@ -1406,11 +1660,12 @@ async function organizationApi(flags) {
     const organizationId = String(flags.get('organization-id') || enrolled?.organizationId || '').trim();
     if (!organizationId)
         throw new Error('Organization command requires --organization-id or an enrolled device.');
-    const token = String(process.env.DHARMA_ORG_API_TOKEN || '').trim()
+    const token = (hostScope ? '' : String(process.env.DHARMA_ORG_API_TOKEN || '').trim())
         || await loadOrganizationApiToken({
             hqUrl: enrolled?.hqUrl || portalUrl(flags),
             organizationId,
             installationId: enrolled?.installationId,
+            hostScope,
         }) || '';
     if (!token)
         throw new Error('Organization command requires a token in the OS credential store or DHARMA_ORG_API_TOKEN. Tokens are not accepted on the command line.');
@@ -1570,14 +1825,40 @@ export function stableRepositoryLauncherContents(version = VERSION, runtime) {
     return repositoryLauncherContents(version, runtime);
 }
 async function installStableRepositoryLauncher(workspace) {
+    const scope = currentBootstrapHostScope();
     const launcherRoot = resolve(workspace, '.dharma', 'bin');
-    await mkdir(launcherRoot, { recursive: true, mode: 0o700 });
     const shellPath = resolve(launcherRoot, 'dharma');
     const cmdPath = resolve(launcherRoot, 'dharma.cmd');
     const contents = stableRepositoryLauncherContents(VERSION, { platform: process.platform, nodeDirectory: dirname(process.execPath) });
-    await writeFile(shellPath, contents.shell, { mode: 0o700 });
-    await chmod(shellPath, 0o700);
-    await writeFile(cmdPath, contents.windows, { mode: 0o600 });
+    if (scope) {
+        await scope.assert();
+        if (await scope.step(() => realpath(workspace)) !== workspace)
+            throw new Error('codex_setup_host_launcher_path_invalid');
+        for (const directory of [resolve(workspace, '.dharma'), launcherRoot]) {
+            await scope.step(async () => {
+                try {
+                    await mkdir(directory, { mode: 0o700 });
+                }
+                catch (error) {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                }
+            });
+            const entry = await scope.step(() => lstat(directory));
+            if (!entry.isDirectory() || entry.isSymbolicLink() || await scope.step(() => realpath(directory)) !== directory
+                || process.platform !== 'win32' && (entry.uid !== process.getuid() || (entry.mode & 0o022))) {
+                throw new Error('codex_setup_host_launcher_path_invalid');
+            }
+        }
+        await writeBootstrapHostText(shellPath, contents.shell, scope, 0o700);
+        await writeBootstrapHostText(cmdPath, contents.windows, scope, 0o600);
+    }
+    else {
+        await mkdir(launcherRoot, { recursive: true, mode: 0o700 });
+        await writeFile(shellPath, contents.shell, { mode: 0o700 });
+        await chmod(shellPath, 0o700);
+        await writeFile(cmdPath, contents.windows, { mode: 0o600 });
+    }
     return { shell: '.dharma/bin/dharma', windows: '.dharma/bin/dharma.cmd' };
 }
 async function relayUpgrade(flags) {
@@ -1600,10 +1881,7 @@ async function relayUpgrade(flags) {
         || startup.policy !== resolve(workspace, '.dharma', 'approved-policy.json')) {
         throw new Error('relay_upgrade_workspace_conflict');
     }
-    const assertStopped = async () => {
-        if (await relaySupervisorProcessState(home) !== 'stopped' || await relayProcessState(home) !== 'stopped') {
-            throw new Error('relay_upgrade_runtime_busy: finish current work, then stop the owned relay before upgrading.');
-        }
+    const assertSessionsStopped = async () => {
         const entries = await readdir(resolve(home, 'sessions'), { withFileTypes: true }).catch(error => {
             if (error.code === 'ENOENT')
                 return [];
@@ -1617,6 +1895,12 @@ async function relayUpgrade(flags) {
             }
         }
     };
+    const assertStopped = async () => {
+        if (await relaySupervisorProcessState(home) !== 'stopped' || await relayProcessState(home) !== 'stopped') {
+            throw new Error('relay_upgrade_runtime_busy: finish current work, then stop the owned relay before upgrading.');
+        }
+        await assertSessionsStopped();
+    };
     return withRelayStartupMutation(async () => {
         const receipt = await upgradeRelayRuntime({ home, workspace, version: VERSION,
             organizationId: config.organizationId, deviceId: config.deviceId, workspaceId: selected.workspaceId,
@@ -1637,6 +1921,7 @@ async function relayUpgrade(flags) {
                 launcher: startup.launcher, policy: startup.policy, version }),
             start: () => startRelayAutostart(startupOptions),
             stop: async () => {
+                await assertSessionsStopped();
                 const activationLocks = resolve(home, 'registry', 'skill-activation-locks');
                 const locks = await readdir(activationLocks).catch(error => {
                     if (error.code === 'ENOENT')
@@ -1714,6 +1999,9 @@ export async function waitForRelayReadiness(options = {}) {
     throw new Error(`The outbound relay did not become ready after bootstrap (${reason}).`);
 }
 async function startRelayDaemon(policyPath) {
+    const hostScope = currentBootstrapHostScope();
+    const step = (operation) => hostScope ? hostScope.step(operation) : operation();
+    await hostScope?.assert();
     const config = await readDeviceConfig();
     if (!config)
         throw new Error('Relay startup requires current device enrollment.');
@@ -1723,23 +2011,32 @@ async function startRelayDaemon(policyPath) {
         && row.organizationId === config.organizationId && resolve(row.path, '.dharma', 'approved-policy.json') === policyPath);
     if (!selected)
         throw new Error('Relay policy must belong to this enrolled repository.');
+    await assertBootstrapHostSource(selected.path, String(selected.repositoryRemoteHash || ''));
     const alreadyRunning = await relayProcessState() === 'running';
     const supervisorState = await relaySupervisorProcessState();
     if (supervisorState === 'unknown')
         throw new Error('Relay supervisor process state is unknown.');
     if (supervisorState === 'stopped') {
-        if ((await relayAutostartStatus({ home: dharmaHome() })).backend === 'container-entrypoint') {
-            await startRelayAutostart({ home: dharmaHome() });
+        const startupBackend = (await relayAutostartStatus({ home: dharmaHome() })).backend;
+        // A setup turn cannot own a supervisor intended to outlive that turn.
+        if (hostScope || startupBackend === 'container-entrypoint') {
+            await step(() => startRelayAutostart({ home: dharmaHome() }));
         }
         else {
-            const child = spawn(process.execPath, [fileURLToPath(import.meta.url), 'relay', 'supervise', '--policy', policyPath], {
-                cwd: dirname(dirname(policyPath)), detached: true, stdio: 'ignore', env: process.env,
+            await step(async () => {
+                const child = spawn(process.execPath, [fileURLToPath(import.meta.url), 'relay', 'supervise', '--policy', policyPath], {
+                    cwd: dirname(dirname(policyPath)), detached: !hostScope, stdio: 'ignore', env: process.env,
+                });
+                if (hostScope)
+                    captureBootstrapHostChild(hostScope, child);
+                else
+                    child.unref();
             });
-            child.unref();
         }
     }
     let supervisorReady = false;
     for (let attempt = 0; attempt < 80; attempt += 1) {
+        await hostScope?.assert();
         if (await relaySupervisorProcessState() === 'running') {
             const pid = Number((await readFile(resolve(dharmaHome(), 'relay', 'supervisor.pid'), 'utf8')
                 .catch(() => '0')).trim());
@@ -1762,6 +2059,7 @@ async function startRelayDaemon(policyPath) {
     if (!supervisorReady)
         throw new Error('The relay supervisor did not become ready after bootstrap.');
     const readiness = await waitForRelayReadiness({ expectedVersion: VERSION, attempts: 120, delayMs: 1000, processState: async () => {
+            await hostScope?.assert();
             if (await relayProcessState() !== 'running')
                 return 'stopped';
             const pid = Number((await readFile(resolve(dharmaHome(), 'relay', 'relay.pid'), 'utf8')).trim());
@@ -1769,6 +2067,7 @@ async function startRelayDaemon(policyPath) {
             return repositoryRelayObservationReady({ observation: poll, workspaceId: selected.workspaceId,
                 version: VERSION, pid }) ? 'running' : 'stopped';
         } });
+    await hostScope?.assert();
     return { started: !alreadyRunning, supervisor: 'running', ...readiness };
 }
 async function supervisedDemoCycle(registration, signal) {
@@ -1869,10 +2168,15 @@ async function relaySupervise(flags) {
     }
     finally {
         controller.abort();
-        await Promise.allSettled(services);
+        const settled = await Promise.allSettled(services);
         await health.drain();
         process.removeListener('SIGINT', stop);
         process.removeListener('SIGTERM', stop);
+        // Preserve ownership records when an owned child may still be running.
+        if (settled.some(result => result.status === 'rejected'
+            && result.reason instanceof Error && result.reason.message === 'owned_child_stop_unconfirmed')) {
+            throw new Error('relay_supervisor_child_stop_unconfirmed');
+        }
         const binding = await readFile(bindingPath, 'utf8')
             .then(value => JSON.parse(value)).catch(() => null);
         if (binding?.pid === process.pid)
@@ -1883,37 +2187,160 @@ async function relaySupervise(flags) {
 async function superviseNamedSessions(signal) {
     if (process.platform !== 'linux')
         return;
-    while (!signal.aborted) {
-        const root = resolve(dharmaHome(), 'sessions');
-        const entries = await readdir(root, { withFileTypes: true }).catch(error => {
-            if (error.code === 'ENOENT')
-                return [];
-            throw error;
-        });
-        for (const entry of entries.slice(0, 50)) {
-            if (signal.aborted)
-                break;
-            if (!entry.isDirectory() || !/^[a-z][a-z0-9-]{0,47}$/.test(entry.name))
-                continue;
-            try {
-                const registration = await readNamedSession(dharmaHome(), entry.name);
-                if (!registration?.enabled)
-                    continue;
-                await namedSessionCommand('start', new Map([
-                    ['name', registration.name], ['workspace-id', registration.identity.workspaceId], ['apply', true],
-                ]));
-            }
-            catch {
-                process.stderr.write(`${JSON.stringify({ event: 'named_session_reconnect_pending', name: entry.name })}\n`);
+    const owner = createNamedSessionChildOwner(signal);
+    return owner.run(async () => {
+        let vault;
+        try {
+            while (!signal.aborted) {
+                try {
+                    // The original setup initializes the protected vault before staging.
+                    // A missing/unavailable store is not permission for a plaintext fallback.
+                    await access(resolve(dharmaHome(), 'vault', 'vault.sqlite'));
+                    owner.assert();
+                    vault ??= await openBootstrapVault({ root: resolve(dharmaHome(), 'vault') });
+                    owner.assert();
+                    await consumeCodexSetupSessions({ vault, owner, signal,
+                        authorize: qualifyCodexSetupSessionRequest,
+                        start: async (scope) => {
+                            const request = scope.request;
+                            const status = await namedSessionCommand('start', new Map([
+                                ['name', request.name], ['workspace-id', request.workspaceId], ['apply', true]
+                            ]));
+                            const pid = owner.ownedPid(request.name);
+                            if (!pid || status.ok !== true || status.membershipId !== request.membershipId
+                                || status.deviceId !== request.deviceId || status.organizationId !== request.organizationId
+                                || status.workspaceId !== request.workspaceId || status.repositoryBindingId !== request.repositoryBindingId
+                                || status.endpointId !== request.endpointId || status.provider !== 'codex') {
+                                throw new Error('setup_session_owner_unconfirmed');
+                            }
+                            const [child, supervisor] = await scope.step(() => Promise.all([
+                                readContainerProcessIdentity(pid), readContainerProcessIdentity(process.pid)
+                            ]));
+                            if (child.parentPid !== process.pid || child.uid !== process.getuid() || supervisor.uid !== process.getuid()) {
+                                throw new Error('setup_session_owner_unconfirmed');
+                            }
+                            return { state: 'started', bindingId: String(status.bindingId), sessionId: String(status.sessionId),
+                                sessionPid: pid, supervisorPid: process.pid, sessionStartTicks: child.startTicks, supervisorStartTicks: supervisor.startTicks };
+                        } });
+                }
+                catch {
+                    if (!signal.aborted)
+                        process.stderr.write(`${JSON.stringify({ event: 'named_session_setup_pending' })}\n`);
+                }
+                const root = resolve(dharmaHome(), 'sessions');
+                const entries = await readdir(root, { withFileTypes: true }).catch(error => {
+                    if (error.code === 'ENOENT')
+                        return [];
+                    throw error;
+                });
+                for (const entry of entries.slice(0, 50)) {
+                    if (signal.aborted)
+                        break;
+                    if (!entry.isDirectory() || !/^[a-z][a-z0-9-]{0,47}$/.test(entry.name))
+                        continue;
+                    try {
+                        const registration = await readNamedSession(dharmaHome(), entry.name);
+                        if (!registration?.enabled)
+                            continue;
+                        await namedSessionCommand('start', new Map([
+                            ['name', registration.name], ['workspace-id', registration.identity.workspaceId], ['apply', true],
+                        ]));
+                    }
+                    catch {
+                        process.stderr.write(`${JSON.stringify({ event: 'named_session_reconnect_pending', name: entry.name })}\n`);
+                    }
+                }
+                await new Promise(resolveWait => {
+                    const finish = () => { clearTimeout(timer); signal.removeEventListener('abort', finish); resolveWait(); };
+                    const timer = setTimeout(finish, 10_000);
+                    signal.addEventListener('abort', finish, { once: true });
+                    if (signal.aborted)
+                        finish();
+                });
             }
         }
-        await new Promise(resolveWait => {
-            const finish = () => { clearTimeout(timer); signal.removeEventListener('abort', finish); resolveWait(); };
-            const timer = setTimeout(finish, 10_000);
-            signal.addEventListener('abort', finish, { once: true });
-            if (signal.aborted)
-                finish();
-        });
+        finally {
+            vault?.close();
+        }
+    });
+}
+/** Standing owner rechecks the exact approved source/device without adopting
+ * a caller PID, changing enrollment or contacting another member's device. */
+async function qualifyCodexSetupSessionRequest(request) {
+    const owner = currentNamedSessionChildOwner();
+    if (!owner)
+        return false;
+    try {
+        owner.assert();
+        const qualified = await qualifyCodexSetupSessionSource(request);
+        owner.assert();
+        return qualified;
+    }
+    catch {
+        return false;
+    }
+}
+async function qualifyCodexSetupSessionSource(request) {
+    try {
+        if (process.platform !== 'linux' || request.maximumCostCents !== 1000 || request.maximumTurnCostCents !== 25)
+            return false;
+        const config = await readDeviceConfig();
+        if (!config || config.deviceId !== request.deviceId || config.organizationId !== request.organizationId
+            || normalizeHqUrl(config.hqUrl) !== request.origin || config.setupClaimReference !== request.setupReference
+            || config.setupClaimRepositoryFingerprint !== request.repositoryFingerprint)
+            return false;
+        const sender = await readContainerProcessIdentity(request.senderPid);
+        if (sender.uid !== process.getuid() || sender.startTicks !== request.senderStartTicks)
+            return false;
+        const rows = (await registry()).filter(row => row.path === request.workspaceRoot && row.workspaceId === request.workspaceId
+            && row.organizationId === request.organizationId && row.repositoryRemoteHash === request.repositoryFingerprint && row.status === 'active');
+        if (rows.length !== 1 || request.name !== `codex-${request.workspaceId.slice(0, 8)}`)
+            return false;
+        const item = rows[0], role = repositoryRoleScope(item);
+        if (role.repositoryBindingId !== request.repositoryBindingId || role.endpointId !== request.endpointId)
+            return false;
+        const source = await preflightBootstrapWorkspaceIdentity(request.workspaceRoot);
+        if (source.fingerprint !== request.repositoryFingerprint || await realpath(request.workspaceRoot) !== request.workspaceRoot)
+            return false;
+        const contract = await loadAgentFabricOnboardingContract();
+        if (`sha256:${contract.sha256}` !== request.contractDigest)
+            return false;
+        const enrollment = await loadDeviceEnrollmentAnchor({ config });
+        const device = await enrolledDeviceIdentity(config);
+        if (device.publicKeyEd25519 !== enrollment.devicePublicKeyEd25519)
+            return false;
+        const policy = await loadVerifiedWorkspacePolicy(resolve(request.workspaceRoot, '.dharma', 'approved-policy.json'), request.workspaceId);
+        verifyServerAuthorizedPolicy({ policy, publicKeyEd25519: enrollment.serverPublicKeyEd25519,
+            organizationId: request.organizationId, workspaceId: request.workspaceId });
+        await assertWorkspaceAuthorizationCurrent(request.workspaceId, policy.serverAuthorization);
+        if (policy.revision !== request.policyRevision || sha256(canonicalize(policy)) !== request.policyHash)
+            return false;
+        const fabric = await client();
+        await fetchRepositorySourceAuthorization(fabric, role);
+        const existing = await readNamedSession(dharmaHome(), request.name);
+        if (existing && (existing.identity.membershipId !== request.membershipId || existing.identity.deviceId !== request.deviceId
+            || existing.identity.organizationId !== request.organizationId || existing.identity.workspaceId !== request.workspaceId
+            || existing.identity.repositoryBindingId !== request.repositoryBindingId || existing.identity.endpointId !== request.endpointId))
+            return false;
+        return Date.parse(request.issuedAt) <= Date.now() && Date.now() < Date.parse(request.expiresAt);
+    }
+    catch {
+        return false;
+    }
+}
+async function qualifyCodexSetupChildRequest(request) {
+    try {
+        if (!await qualifyCodexSetupSessionSource(request))
+            return false;
+        const startup = await inspectOwnedRelayAutostart({ home: dharmaHome() });
+        const parent = await readContainerProcessIdentity(process.ppid);
+        return ['systemd-user', 'container-entrypoint'].includes(startup.backend) && startup.version === VERSION
+            && parent.uid === process.getuid() && canonicalize(parent.argv) === canonicalize([
+            process.execPath, fileURLToPath(import.meta.url), 'relay', 'supervise', '--policy', startup.policy
+        ]);
+    }
+    catch {
+        return false;
     }
 }
 async function relayStop() {
@@ -2057,7 +2484,472 @@ export function assertBootstrapResumeAuthority(input) {
         throw new Error('Bootstrap resume requires an existing device enrolled to this organization and portal.');
     }
 }
-async function bootstrap(flags) {
+/** Planning-only trusted host entry. Effectful admission remains unavailable
+ * until the full continuation and native owner lifecycle are qualified. */
+export async function bootstrapFromCodexSetup(input) {
+    try {
+        return await runCodexBootstrapHost(input, prepared => bootstrap(prepared.flags, prepared.scope));
+    }
+    catch (error) {
+        const safe = new Set(['codex_setup_host_scope_invalid', 'codex_setup_host_scope_unavailable', 'codex_setup_host_context_conflict', 'codex_setup_host_source_mismatch']);
+        let code = 'codex_setup_host_operation_failed';
+        try {
+            if (error instanceof Error && safe.has(error.message))
+                code = error.message;
+        }
+        catch { }
+        throw new Error(code);
+    }
+}
+/** Native-owner continuation: no caller-selected flags or replacement authority. */
+export async function bootstrapFromCodexSetupScope(scope) {
+    try {
+        return await runCodexBootstrapHostScope(scope, prepared => run(['bootstrap',
+            ...[...prepared.flags].flatMap(([key, value]) => value === true ? [`--${key}`] : [`--${key}`, String(value)]),
+        ]));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'setup_session_sender_unavailable') {
+            return { ok: false, stage: 'host_setup_unavailable',
+                code: 'codex_setup_host_execution_unqualified', effects: false, grantRedeemed: false };
+        }
+        const safe = new Set(['codex_setup_host_scope_invalid', 'codex_setup_host_scope_unavailable',
+            'codex_setup_host_context_conflict', 'codex_setup_host_source_mismatch', 'codex_setup_host_command_mismatch']);
+        let code = 'codex_setup_host_operation_failed';
+        try {
+            if (error instanceof Error && safe.has(error.message))
+                code = error.message;
+        }
+        catch { }
+        throw new Error(code);
+    }
+}
+async function readBootstrapRuntimeJson(path, scope) {
+    let file;
+    try {
+        const before = await scope.step(() => lstat(path, { bigint: true }));
+        if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n || before.size > 32768n
+            || before.uid !== BigInt(process.getuid()) || (before.mode & 63n) !== 0n) {
+            throw new Error('setup_runtime_state_unconfirmed');
+        }
+        await scope.step(async () => { file = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK); });
+        const opened = await scope.step(() => file.stat({ bigint: true }));
+        const bytes = Buffer.alloc(Number(before.size) + 1);
+        const read = await scope.step(() => file.read(bytes, 0, bytes.length, 0));
+        const after = await scope.step(() => file.stat({ bigint: true }));
+        const current = await scope.step(() => lstat(path, { bigint: true }));
+        if (read.bytesRead !== Number(before.size) || [opened, after, current].some(value => !value.isFile()
+            || value.nlink !== 1n || value.dev !== before.dev || value.ino !== before.ino || value.size !== before.size
+            || value.mtimeNs !== before.mtimeNs || value.ctimeNs !== before.ctimeNs || value.mode !== before.mode
+            || value.uid !== before.uid || value.gid !== before.gid)) {
+            throw new Error('setup_runtime_state_unconfirmed');
+        }
+        return JSON.parse(bytes.subarray(0, read.bytesRead).toString('utf8'));
+    }
+    finally {
+        await file?.close();
+    }
+}
+/** Actual scoped runtime readback. No callback-supplied ready flag or receipt ID. */
+async function observeCodexBootstrapRuntime(prepared, vault, firstLearning, intentDigest) {
+    const { scope, intent } = prepared, workspace = String(prepared.flags.get('workspace'));
+    const step = (operation) => scope.step(operation);
+    await scope.assert();
+    if (process.platform !== 'linux')
+        throw new Error('setup_runtime_route_unqualified');
+    const source = await step(() => preflightBootstrapWorkspaceIdentity(workspace));
+    await assertBootstrapHostSource(workspace, source.fingerprint);
+    const contract = await step(() => loadAgentFabricOnboardingContract());
+    if (`sha256:${contract.sha256}` !== intent.contractDigest)
+        throw new Error('setup_runtime_contract_changed');
+    const config = await step(() => readDeviceConfig());
+    if (!config || config.organizationId !== intent.organizationId || normalizeHqUrl(config.hqUrl) !== intent.origin) {
+        throw new Error('setup_runtime_identity_unconfirmed');
+    }
+    const enrollment = await step(() => loadDeviceEnrollmentAnchor({ config, hostScope: scope }));
+    const device = await step(() => enrolledDeviceIdentity(config));
+    if (device.publicKeyEd25519 !== enrollment.devicePublicKeyEd25519)
+        throw new Error('setup_runtime_identity_unconfirmed');
+    const rows = (await step(() => registry())).filter(row => row.path === workspace
+        && row.organizationId === intent.organizationId && row.repositoryRemoteHash === intent.repositoryFingerprint && row.status === 'active');
+    if (rows.length !== 1 || !rows[0].repositoryRole)
+        throw new Error('setup_runtime_repository_unconfirmed');
+    const item = rows[0], roleScope = repositoryRoleScope(item);
+    const policyPath = resolve(workspace, '.dharma', 'approved-policy.json');
+    const policy = await step(() => loadVerifiedWorkspacePolicy(policyPath, item.workspaceId));
+    verifyServerAuthorizedPolicy({ policy, publicKeyEd25519: enrollment.serverPublicKeyEd25519,
+        organizationId: intent.organizationId, workspaceId: item.workspaceId });
+    await step(() => assertWorkspaceAuthorizationCurrent(item.workspaceId, policy.serverAuthorization));
+    if (policy.revision !== intent.policyRevision)
+        throw new Error('setup_runtime_policy_changed');
+    const signed = await step(() => activeSkillAuthorization('codex', item.workspaceId, roleScope.repositoryAgentId, config));
+    const anchor = await step(() => loadActiveSkillAuthorizationAnchor({ config, workspaceId: item.workspaceId,
+        organizationAgentId: roleScope.repositoryAgentId, provider: 'codex', fresh: true, hostScope: scope }));
+    if (!signed || !anchor || signed.bundleId !== anchor.bundleId)
+        throw new Error('setup_runtime_package_unconfirmed');
+    const installation = await step(() => verifyAgentFabricSkillInstallation({ provider: 'codex', workspace }));
+    const content = await step(() => readNamedSessionPackageContent(installation, true));
+    if (!installation.ready || content.bundleId !== signed.bundleId || content.bundleHash !== signed.bundleHash) {
+        throw new Error('setup_runtime_package_unconfirmed');
+    }
+    const fabric = await step(() => client());
+    const roles = await step(() => discoverRepositoryRoleMetadata(fabric, roleScope));
+    const peers = roles.discovery?.peers;
+    const own = peers?.filter(peer => peer.endpointId === roleScope.endpointId && peer.workspaceId === item.workspaceId);
+    if (own?.length !== 1 || own[0].provider !== 'codex' || own[0].revision !== item.repositoryRole.revision
+        || sha256(canonicalize({ roleName: own[0].roleName, description: own[0].description,
+            questionCategories: own[0].questionCategories })) !== item.repositoryRole.profileHash) {
+        throw new Error('setup_runtime_role_unconfirmed');
+    }
+    const name = `codex-${item.workspaceId.slice(0, 8)}`;
+    const session = await step(() => readNamedSession(dharmaHome(), name));
+    if (!session?.enabled || session.identity.membershipId !== intent.recipientMembershipId
+        || session.identity.deviceId !== config.deviceId || session.identity.organizationId !== intent.organizationId
+        || session.identity.workspaceId !== item.workspaceId || session.identity.endpointId !== roleScope.endpointId
+        || session.identity.repositoryBindingId !== roleScope.repositoryBindingId)
+        throw new Error('setup_runtime_session_unconfirmed');
+    const binding = await step(() => vault.getProviderSessionBinding(session.bindingId, session.identity));
+    if (!binding || binding.owner !== 'dharma_bridge' || binding.workspaceRoot !== workspace
+        || binding.bindingId !== session.bindingId || Object.entries(session.identity).some(([key, value]) => binding[key] !== value)
+        || Date.parse(binding.expiresAt) <= Date.now())
+        throw new Error('setup_runtime_session_unconfirmed');
+    const remote = await step(() => fabric.signedPost('/agent-fabric/provider-sessions', {
+        schema: 'dharma.provider-session-registration/v1', action: 'inspect', provider: 'codex', mode: 'bridge_owned',
+        workspaceId: item.workspaceId, endpointId: roleScope.endpointId, repositoryBindingId: roleScope.repositoryBindingId,
+        bindingId: session.bindingId, expectedRevision: 0, leaseSeconds: 60,
+    }));
+    if (!isNamedSessionOwnerReceipt(remote, session.bindingId, session.identity))
+        throw new Error('setup_runtime_session_unconfirmed');
+    const native = await step(() => namedSessionCommand('readiness', new Map([
+        ['name', name], ['workspace-id', item.workspaceId],
+    ])));
+    const nativeSkill = parseNamedCodexSkillObservation(native.nativeSkill);
+    if (native.ok !== true || native.name !== name || native.bindingId !== binding.bindingId || native.sessionId !== binding.sessionId
+        || Object.entries(session.identity).some(([key, value]) => native[key] !== value)
+        || Object.keys(content).some(key => nativeSkill[key] !== content[key])) {
+        throw new Error('setup_runtime_session_unconfirmed');
+    }
+    const startup = await step(() => inspectOwnedRelayAutostart({ home: dharmaHome() }));
+    const startupState = await step(() => relayAutostartStatus({ home: dharmaHome() }));
+    if (!['systemd-user', 'container-entrypoint'].includes(startup.backend) || startupState.state !== 'enabled'
+        || startupState.backend !== startup.backend || startup.version !== VERSION || startupState.version !== VERSION
+        || resolve(startup.workspace) !== startup.workspace
+        || startup.policy !== resolve(startup.workspace, '.dharma', 'approved-policy.json')
+        || startup.launcher !== resolve(startup.workspace, '.dharma', 'bin', 'dharma')
+        || startup.backend === 'container-entrypoint' && startupState.lifecycle !== 'running') {
+        throw new Error('setup_runtime_startup_unconfirmed');
+    }
+    // A standard relay can retain another repository as its same-device anchor.
+    // Verify that anchor independently; selected-repository evidence stays scoped.
+    const anchorRows = await step(() => registry());
+    const startupItem = selectDeviceWorkspace(anchorRows, { organizationId: intent.organizationId,
+        deviceId: config.deviceId, path: startup.workspace });
+    if (!startupItem || startupItem.status !== 'active' || startupItem.routeHash !== sha256(startup.workspace)) {
+        throw new Error('setup_runtime_startup_unconfirmed');
+    }
+    const startupRoute = canonicalize({ workspaceId: startupItem.workspaceId, path: startupItem.path,
+        routeHash: startupItem.routeHash, repositoryRemoteHash: startupItem.repositoryRemoteHash, status: startupItem.status });
+    const startupPolicy = await step(() => loadVerifiedWorkspacePolicy(startup.policy, startupItem.workspaceId));
+    verifyServerAuthorizedPolicy({ policy: startupPolicy, publicKeyEd25519: enrollment.serverPublicKeyEd25519,
+        organizationId: intent.organizationId, workspaceId: startupItem.workspaceId });
+    await step(() => assertWorkspaceAuthorizationCurrent(startupItem.workspaceId, startupPolicy.serverAuthorization));
+    const startupSnapshot = canonicalize(startup), startupStateSnapshot = canonicalize(startupState);
+    const startupPolicyHash = sha256(canonicalize(startupPolicy));
+    const pidFrom = async (path) => {
+        const value = await readBootstrapRuntimeJson(path, scope);
+        if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 2147483647) {
+            throw new Error('setup_runtime_process_unconfirmed');
+        }
+        return Number(value);
+    };
+    const home = dharmaHome(), entry = fileURLToPath(import.meta.url);
+    const supervisorPid = await pidFrom(resolve(home, 'relay', 'supervisor.pid'));
+    const relayPid = await pidFrom(resolve(home, 'relay', 'relay.pid'));
+    const sessionPid = await pidFrom(resolve(namedSessionPaths(home, name).root, 'service.lock'));
+    const processes = await step(() => Promise.all([supervisorPid, relayPid, sessionPid].map(pid => readContainerProcessIdentity(pid))));
+    const argv = [[process.execPath, entry, 'relay', 'supervise', '--policy', startup.policy],
+        [process.execPath, entry, 'relay', 'start', '--policy', startup.policy],
+        [process.execPath, entry, 'sessions', 'serve', '--name', name, '--workspace-id', item.workspaceId, '--apply']];
+    if (processes.some((value, i) => value.uid !== process.getuid() || !/^\d+$/.test(value.startTicks)
+        || canonicalize(value.argv) !== canonicalize(argv[i])
+            && (i !== 2 || canonicalize(value.argv) !== canonicalize([...argv[i], '--setup-handoff']))) || processes[1].parentPid !== supervisorPid
+        || processes[2].parentPid !== supervisorPid) {
+        throw new Error('setup_runtime_process_unconfirmed');
+    }
+    if (intentDigest !== undefined || processes[2].argv.includes('--setup-handoff')) {
+        if (!intentDigest || !/^sha256:[a-f0-9]{64}$(?![\s\S])/.test(intentDigest))
+            throw new Error('setup_runtime_session_unconfirmed');
+        const handoff = await step(() => vault.readCodexSetupSession(intent.operationId, intentDigest));
+        const request = handoff?.request, result = handoff?.result;
+        if (handoff?.state !== 'accepted' || !request || result?.state !== 'started'
+            || request.setupReference !== intent.setupReference || request.membershipId !== intent.recipientMembershipId
+            || request.organizationId !== intent.organizationId || request.deviceId !== config.deviceId
+            || request.workspaceId !== item.workspaceId || request.workspaceRoot !== workspace || request.name !== name
+            || request.repositoryBindingId !== roleScope.repositoryBindingId || request.endpointId !== roleScope.endpointId
+            || request.repositoryFingerprint !== intent.repositoryFingerprint || request.policyRevision !== intent.policyRevision
+            || request.scopeDigest !== intent.scopeDigest || request.contractDigest !== intent.contractDigest
+            || result.bindingId !== binding.bindingId || result.sessionId !== binding.sessionId || result.sessionPid !== sessionPid
+            || result.supervisorPid !== supervisorPid || result.sessionStartTicks !== processes[2].startTicks
+            || result.supervisorStartTicks !== processes[0].startTicks)
+            throw new Error('setup_runtime_session_unconfirmed');
+    }
+    const supervisor = await readBootstrapRuntimeJson(resolve(home, 'relay', 'supervisor-workspace.json'), scope);
+    if (supervisor.pid !== supervisorPid || supervisor.organizationId !== intent.organizationId || supervisor.deviceId !== config.deviceId
+        || supervisor.policyPath !== startup.policy || supervisor.version !== VERSION || supervisor.standardRepositories !== true) {
+        throw new Error('setup_runtime_process_unconfirmed');
+    }
+    const poll = await readBootstrapRuntimeJson(resolve(home, 'relay', 'repositories', item.workspaceId, 'last-successful-poll.json'), scope);
+    if (!repositoryRelayObservationReady({ observation: poll, workspaceId: item.workspaceId, version: VERSION, pid: relayPid })) {
+        throw new Error('setup_runtime_poll_unconfirmed');
+    }
+    const currentContent = await step(async () => readNamedSessionPackageContent(await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace }), true));
+    if (Object.keys(content).some(key => currentContent[key] !== content[key])) {
+        throw new Error('setup_runtime_package_changed');
+    }
+    const currentProcesses = await step(() => Promise.all([supervisorPid, relayPid, sessionPid].map(pid => readContainerProcessIdentity(pid))));
+    if (processes.some((value, i) => canonicalize(value) !== canonicalize(currentProcesses[i])))
+        throw new Error('setup_runtime_process_changed');
+    const currentStartup = await step(() => inspectOwnedRelayAutostart({ home }));
+    const currentStartupState = await step(() => relayAutostartStatus({ home }));
+    const currentStartupItem = selectDeviceWorkspace(await step(() => registry()), { organizationId: intent.organizationId,
+        deviceId: config.deviceId, path: startup.workspace });
+    const currentConfig = await step(() => readDeviceConfig());
+    if (canonicalize(currentStartup) !== startupSnapshot || canonicalize(currentStartupState) !== startupStateSnapshot
+        || !currentStartupItem || canonicalize({ workspaceId: currentStartupItem.workspaceId, path: currentStartupItem.path,
+        routeHash: currentStartupItem.routeHash, repositoryRemoteHash: currentStartupItem.repositoryRemoteHash,
+        status: currentStartupItem.status }) !== startupRoute
+        || !currentConfig || currentConfig.deviceId !== config.deviceId || currentConfig.organizationId !== intent.organizationId
+        || normalizeHqUrl(currentConfig.hqUrl) !== intent.origin)
+        throw new Error('setup_runtime_startup_changed');
+    const currentStartupPolicy = await step(() => loadVerifiedWorkspacePolicy(startup.policy, startupItem.workspaceId));
+    if (sha256(canonicalize(currentStartupPolicy)) !== startupPolicyHash)
+        throw new Error('setup_runtime_startup_changed');
+    await step(() => assertWorkspaceAuthorizationCurrent(startupItem.workspaceId, currentStartupPolicy.serverAuthorization));
+    await step(() => assertWorkspaceAuthorizationCurrent(item.workspaceId, policy.serverAuthorization));
+    return parseLocalCodexSetupReadiness({ schema: 'dharma.local-codex-setup-readiness/v1',
+        operationId: intent.operationId, organizationId: intent.organizationId, membershipId: session.identity.membershipId,
+        deviceId: config.deviceId, workspaceId: item.workspaceId, repositoryBindingId: roleScope.repositoryBindingId,
+        repositoryAgentId: roleScope.repositoryAgentId, endpointId: roleScope.endpointId, sessionBindingId: binding.bindingId,
+        sessionId: binding.sessionId, repositoryFingerprint: intent.repositoryFingerprint, policyRevision: policy.revision,
+        policyHash: sha256(canonicalize(policy)), manifestHash: content.manifestHash, catalogHash: content.catalogHash,
+        bundleId: content.bundleId, bundleHash: content.bundleHash, activeReceiptHash: anchor.receiptHash,
+        roleRevision: item.repositoryRole.revision, roleProfileHash: item.repositoryRole.profileHash, nativeSkillHash: content.skillsHash,
+        contractDigest: intent.contractDigest, cliVersion: VERSION, relayPid, relayPolledAt: poll.at,
+        startupBackend: startup.backend, firstLearning, verifiedAt: new Date().toISOString(),
+        expiresAt: new Date(Math.min(Date.parse(intent.expiresAt), Date.parse(policy.serverAuthorization.expiresAt), Date.parse(startupPolicy.serverAuthorization.expiresAt), Date.parse(binding.expiresAt), signed.expiresAt ? Date.parse(signed.expiresAt) : Infinity)).toISOString() });
+}
+/** Trusted native host composition, not an MCP/model/peer tool. */
+export async function createCodexBootstrapCompletionOwner(scope, vault) {
+    const prepared = await runCodexBootstrapHostScope(scope, async (value) => value);
+    let firstLearning;
+    const readiness = createCodexSetupReadinessOwner({ intent: prepared.intent,
+        workspace: String(prepared.flags.get('workspace')), scope, vault,
+        observe: async (_intent, _scope, retained, intentDigest) => {
+            const disposition = firstLearning ?? retained?.firstLearning;
+            if (!disposition)
+                throw new Error('setup_runtime_first_learning_unconfirmed');
+            // Keep the original execution's disposition; reobserve all live state.
+            return runCodexBootstrapHostScope(scope, current => observeCodexBootstrapRuntime(current, vault, disposition, intentDigest));
+        } });
+    return Object.freeze({
+        execute: async (lease) => {
+            await scope.step(() => assertCodexSetupExecutionLease(lease, prepared.intent));
+            const result = await withCodexSetupSessionSender({ scope, vault, lease }, () => bootstrapFromCodexSetupScope(scope));
+            await scope.step(() => assertCodexSetupExecutionLease(lease, prepared.intent));
+            const workflow = result.workflowReadiness;
+            if (result.ok !== true || result.stage !== 'complete' || !workflow
+                || !['synchronized', 'no_eligible_history', 'denied_disclosure'].includes(String(workflow.firstLearning))) {
+                return { state: 'unconfirmed', code: 'setup_execution_unconfirmed' };
+            }
+            firstLearning = workflow.firstLearning;
+            return readiness.record(lease);
+        },
+        verify: readiness.verify,
+    });
+}
+/** Controller entry: owns the official connection and never accepts a peer transport. */
+export async function openCodexBootstrapNativeHost(input) {
+    if (currentBootstrapHostScope())
+        throw new Error('codex_setup_host_context_conflict');
+    const { workspace, name, signal, current, reserve, maximumProviderCostCents, expectedAccountEmail } = input;
+    if (!/^[a-z][a-z0-9-]{0,47}$/.test(name) || typeof reserve !== 'function'
+        || !Number.isInteger(maximumProviderCostCents) || maximumProviderCostCents < 1 || maximumProviderCostCents > 10_000) {
+        throw new Error('codex_setup_owned_input_invalid');
+    }
+    const prepared = prepareCodexBootstrapHost({ intent: input.intent, workspace, signal, current });
+    let connection;
+    let host;
+    try {
+        await prepared.scope.assert();
+        const source = await preflightBootstrapWorkspaceIdentity(workspace);
+        const contract = await loadAgentFabricOnboardingContract();
+        if (source.fingerprint !== prepared.intent.repositoryFingerprint || `sha256:${contract.sha256}` !== prepared.intent.contractDigest) {
+            throw new Error('codex_setup_owned_source_unconfirmed');
+        }
+        await prepared.scope.assert();
+        connection = await openCodexSetupOwnedConnection({ workspace, deviceHome: dharmaHome(),
+            expectedAccountEmail, signal, current });
+        await prepared.scope.assert();
+        host = await startCodexBootstrapNativeHost({ workspace, name,
+            intent: prepared.intent, signal, maximumProviderCostCents,
+            reserve, current: connection.current, transport: connection.transport,
+            additionalFilesystemRules: connection.additionalFilesystemRules });
+        await prepared.scope.assert();
+        const ownedHost = host, ownedConnection = connection;
+        let closing;
+        const close = () => closing ??= (async () => {
+            try {
+                await ownedHost.close();
+            }
+            finally {
+                await ownedConnection.close();
+            }
+        })();
+        // A terminal native turn must also release its owned transport.
+        const settled = ownedHost.settled.then(close, async () => {
+            try {
+                await close();
+            }
+            finally {
+                throw new Error('codex_setup_owned_completion_unconfirmed');
+            }
+        });
+        void settled.catch(() => { });
+        return Object.freeze({ threadId: host.threadId, turnId: host.turnId, close, settled });
+    }
+    catch {
+        let cleanupFailed = false;
+        try {
+            await host?.close();
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        try {
+            await connection?.close();
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        if (cleanupFailed)
+            throw new Error('codex_setup_owned_close_unconfirmed');
+        throw new Error('codex_setup_owned_start_unqualified');
+    }
+    finally {
+        prepared.scope.close();
+    }
+}
+/** Prepared controller ingress for the portal's public command, never a shell evaluator. */
+export async function openCodexBootstrapFromPortalCommand(input) {
+    if (currentBootstrapHostScope())
+        throw new Error('codex_setup_host_context_conflict');
+    const { workspace, name, signal, current, reserve, maximumProviderCostCents, expectedAccountEmail } = input;
+    if (!Array.isArray(input.portalArgs) || input.portalArgs.length > 64) {
+        throw new Error('codex_setup_portal_command_mismatch');
+    }
+    const args = [...input.portalArgs];
+    if (args.some(value => typeof value !== 'string' || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value))) {
+        throw new Error('codex_setup_portal_command_mismatch');
+    }
+    const prepared = prepareCodexBootstrapHost({ intent: input.intent, workspace, signal, current });
+    try {
+        const parsed = parseCliOptions(args);
+        const expected = prepared.flags;
+        const allowed = new Set([...expected.keys(), 'repository-url-base64url']);
+        if (parsed.positional.length !== 1 || parsed.positional[0] !== 'bootstrap'
+            || [...parsed.flags.keys()].some(key => !allowed.has(key))
+            || [...parsed.repeated.values()].some(values => values.length !== 1)) {
+            throw new Error('codex_setup_portal_command_mismatch');
+        }
+        for (const [key, value] of expected) {
+            const supplied = parsed.flags.get(key);
+            if (key === 'workspace') {
+                if (supplied !== undefined && (typeof supplied !== 'string' || resolve(workspace, supplied) !== workspace)) {
+                    throw new Error('codex_setup_portal_command_mismatch');
+                }
+            }
+            else if (key === 'provider') {
+                if (supplied !== undefined && supplied !== 'auto' && supplied !== 'codex')
+                    throw new Error('codex_setup_portal_command_mismatch');
+            }
+            else if (supplied !== value)
+                throw new Error('codex_setup_portal_command_mismatch');
+        }
+        const selected = parsed.flags.get('repository-url-base64url');
+        if (selected !== undefined) {
+            if (typeof selected !== 'string' || !/^[A-Za-z0-9_-]+$/.test(selected))
+                throw new Error('codex_setup_portal_command_mismatch');
+            const bytes = Buffer.from(selected, 'base64url'), decoded = bytes.toString('utf8');
+            let url, fingerprint;
+            try {
+                url = new URL(decoded);
+                fingerprint = sourceRepositoryFingerprint(decoded).fingerprint;
+            }
+            catch {
+                throw new Error('codex_setup_portal_command_mismatch');
+            }
+            if (bytes.toString('base64url') !== selected || !Buffer.from(decoded, 'utf8').equals(bytes)
+                || /[\u0000-\u0020\u007f]/.test(decoded) || url.protocol !== 'https:' || url.username || url.password || url.search || url.hash
+                || fingerprint !== prepared.intent.repositoryFingerprint) {
+                throw new Error('codex_setup_portal_command_mismatch');
+            }
+        }
+        await prepared.scope.assert();
+        return await openCodexBootstrapNativeHost({ workspace, name, signal, current, reserve, maximumProviderCostCents,
+            expectedAccountEmail, intent: prepared.intent });
+    }
+    finally {
+        prepared.scope.close();
+    }
+}
+/** Official native-host composition. The caller supplies its already owned
+ * transport and qualification, never a vault, executor or readiness callback. */
+export async function startCodexBootstrapNativeHost(input) {
+    const root = resolve(dharmaHome(), 'vault');
+    let completion;
+    let ownerScope;
+    return startCodexSetupNativeHost({ ...input,
+        openJournal: async (scope) => {
+            let vault;
+            try {
+                await runCodexBootstrapHostScope(scope, async () => {
+                    // Capture the owned handle before the borrower's post-open check.
+                    // The original ALS scope selects the scoped LocalVault overload.
+                    vault = await openBootstrapVault({ root });
+                });
+                completion = await createCodexBootstrapCompletionOwner(scope, vault);
+                ownerScope = scope;
+                return Object.freeze({
+                    claim: (operationId, intentDigest) => vault.claimCodexSetupOperation(operationId, intentDigest),
+                    read: (operationId, intentDigest) => vault.readCodexSetupOperation(operationId, intentDigest),
+                    finish: (leaseId, intentDigest, result) => vault.finishCodexSetupOperation(leaseId, intentDigest, result),
+                    close: async () => { await vault.close(); },
+                });
+            }
+            catch (error) {
+                try {
+                    await vault?.close();
+                }
+                catch {
+                    throw new Error('codex_setup_native_journal_close_unconfirmed');
+                }
+                throw error;
+            }
+        },
+        execute: async (_intent, _signal, _current, lease, scope) => {
+            if (!completion || scope !== ownerScope)
+                throw new Error('codex_setup_host_scope_unavailable');
+            return completion.execute(lease);
+        },
+        verifyReadiness: async (receiptId, intent, digest) => {
+            if (!completion)
+                return false;
+            return completion.verify(receiptId, intent, digest);
+        }, });
+}
+async function bootstrap(flags, hostScope) {
+    const step = (operation) => hostScope ? hostScope.step(operation) : operation();
+    await hostScope?.assert();
     const hqUrl = normalizeHqUrl(portalUrl(flags));
     const organizationId = required(flags, 'organization-id');
     const resuming = flags.has('resume');
@@ -2084,10 +2976,21 @@ async function bootstrap(flags) {
             if (!/^sha256:[a-f0-9]{64}$/.test(required(flags, key)))
                 throw new Error('setup_claim_context_invalid');
         }
-        const installedContract = await loadAgentFabricOnboardingContract();
+        const installedContract = await step(() => loadAgentFabricOnboardingContract());
         if (required(flags, 'setup-contract-digest') !== `sha256:${installedContract.sha256}`) {
             throw new Error('setup_claim_contract_mismatch: the portal setup must match this published client operating contract.');
         }
+        // A prepared scope alone is not execution admission. Only the original
+        // native turn's still-live private lease may enter this continuation.
+        if (hostScope && !flags.has('dry-run')) {
+            try {
+                await originalCodexSetupSessionSender(hostScope);
+            }
+            catch {
+                return { ok: false, stage: 'host_setup_unavailable',
+                    code: 'codex_setup_host_execution_unqualified', effects: false, grantRedeemed: false };
+            }
+        }
         if (flags.has('dry-run'))
             return { ok: true, stage: 'plan', setupTransport: 'public_claim_v1',
                 organizationId, portalUrl: hqUrl, setupReference: required(flags, 'setup-reference'),
@@ -2111,15 +3014,15 @@ async function bootstrap(flags) {
         repositorySelection = joinedBindingId
             ? { workspace: resolve(dharmaHome(), 'joined-repositories', joinedBindingId), selection: 'existing_organization_binding' }
             : typeof selectedRemote === 'string'
-                ? await resolveBootstrapRepositoryWorkspace({
+                ? await step(() => resolveBootstrapRepositoryWorkspace({
                     workspace: String(flags.get('workspace') || '.'),
                     selectedRemoteBase64url: selectedRemote,
                     organizationId,
                     home: dharmaHome(),
                     normalizeRemote: normalizeGitRemoteIdentity,
                     withLock: (path) => acquirePidLock(path, 30_000, 'repository_checkout_busy: another setup is selecting this repository; retry after it finishes.'),
-                })
-                : { workspace: await realpath(String(flags.get('workspace') || '.')), selection: 'provided' };
+                }))
+                : { workspace: await step(() => realpath(String(flags.get('workspace') || '.'))), selection: 'provided' };
     }
     catch (error) {
         const message = error && typeof error === 'object' && 'message' in error && typeof error.message === 'string'
@@ -2136,15 +3039,16 @@ async function bootstrap(flags) {
     const policyRevision = required(flags, 'policy-revision');
     const repositoryIdentity = joinedBindingId
         ? { fingerprint: joinedFingerprint }
-        : await preflightBootstrapWorkspaceIdentity(workspace, typeof flags.get('repository-key') === 'string' ? String(flags.get('repository-key')) : null);
+        : await step(() => preflightBootstrapWorkspaceIdentity(workspace, typeof flags.get('repository-key') === 'string' ? String(flags.get('repository-key')) : null));
     const requestedProvider = String(flags.get('provider') || 'auto').trim().toLowerCase();
+    await assertBootstrapHostSource(workspace, repositoryIdentity.fingerprint);
     const provider = requestedProvider === 'auto'
-        ? await detectBootstrapProvider(joinedBindingId ? String(flags.get('workspace') || '.') : workspace)
+        ? await step(() => detectBootstrapProvider(joinedBindingId ? String(flags.get('workspace') || '.') : workspace))
         : requestedProvider;
     if (!isLocalProviderId(provider)) {
         throw new Error('Bootstrap provider must be auto, codex, claude, agy, or hermes.');
     }
-    let existing = await readDeviceConfig();
+    let existing = await step(() => readDeviceConfig());
     const enrollmentMismatch = Boolean(existing
         && (existing.organizationId !== organizationId || normalizeHqUrl(existing.hqUrl) !== hqUrl));
     if (resuming)
@@ -2167,20 +3071,27 @@ async function bootstrap(flags) {
         config = existing;
     }
     else if (grantMode === 'reference') {
-        const result = await claimSetupReference({ hqUrl, organizationId,
+        const claimPlatform = await step(() => platform());
+        const claimInstallationId = existing?.installationId ?? await step(() => loadOrCreateInstallationId());
+        const result = await step(() => claimSetupReference({ hqUrl, organizationId,
             setupReference: required(flags, 'setup-reference'),
             recipientMembershipId: required(flags, 'setup-recipient-membership-id'),
             repositoryFingerprint: repositoryIdentity.fingerprint, policyRevision,
             scopeDigest: required(flags, 'setup-scope-digest'), contractDigest: required(flags, 'setup-contract-digest'),
             name: String(flags.get('device-name') || `${process.env.USER || process.env.USERNAME || 'developer'} device`),
-            platform: await platform(), installationId: existing?.installationId ?? await loadOrCreateInstallationId(),
+            platform: claimPlatform, installationId: claimInstallationId,
             existingConfig: existing, configPath: configPath(),
+            hostScope,
+            onFailureDiagnostic: diagnostic => {
+                process.stderr.write(`${JSON.stringify(diagnostic)}\n`);
+            },
             onRecipientApprovalRequired: async (approval) => {
                 recipientApproval.required = true;
-                recipientApproval.browserOpened = flags.has('no-browser') ? false : await openVerificationUri(approval.url);
+                recipientApproval.browserOpened = flags.has('no-browser') ? false : await step(() => openVerificationUri(approval.url));
+                await hostScope?.assert();
                 process.stderr.write(`Approve this exact device in the authenticated portal before ${approval.expiresAt}: ${approval.url}\n`);
             },
-        });
+        }));
         config = result.config;
         scopes = result.scopes;
     }
@@ -2250,22 +3161,24 @@ async function bootstrap(flags) {
             config.serverSigningKeyset = redeemed.serverSigningKeyset;
         }
         await saveDeviceConfig(configPath(), config);
-        await saveDeviceEnrollmentAnchor({ config });
+        await saveDeviceEnrollmentAnchor({ config, hostScope: currentBootstrapHostScope() });
         await saveOrganizationApiToken({
             hqUrl,
             organizationId,
             installationId: config.installationId,
             token: redeemed.organizationApiToken,
+            hostScope: currentBootstrapHostScope(),
         });
         scopes = redeemed.organizationApiTokenScopes;
     }
     let organizationApiTokenStored = false;
     let credentialFailure = null;
     try {
-        organizationApiTokenStored = Boolean(await loadOrganizationApiToken({
+        organizationApiTokenStored = Boolean(await step(() => loadOrganizationApiToken({
             hqUrl, organizationId, installationId: config.installationId,
-        }));
-        if (!organizationApiTokenStored && !String(process.env.DHARMA_ORG_API_TOKEN || '').trim()) {
+            hostScope: currentBootstrapHostScope(),
+        })));
+        if (!organizationApiTokenStored && (currentBootstrapHostScope() || !String(process.env.DHARMA_ORG_API_TOKEN || '').trim())) {
             credentialFailure = 'organization_api_credentials_required';
         }
     }
@@ -2297,9 +3210,9 @@ async function bootstrap(flags) {
     onboardFlags.set('workspace', workspace);
     onboardFlags.set('policy-revision', policyRevision);
     onboardFlags.set('provider', provider);
-    const onboarded = await retryBootstrapOnboarding(async () => joinedBindingId
-        ? await joinExistingRepository(onboardFlags, joinedBindingId, joinedFingerprint)
-        : await onboard(onboardFlags));
+    const onboarded = await step(() => retryBootstrapOnboarding(async () => joinedBindingId
+        ? await step(() => joinExistingRepository(onboardFlags, joinedBindingId, joinedFingerprint))
+        : await step(() => onboard(onboardFlags))));
     if (onboarded.ok !== true || onboarded.stage === 'approve_device') {
         return {
             ok: onboarded.ok === true,
@@ -2319,40 +3232,40 @@ async function bootstrap(flags) {
             repository: onboarded,
         };
     }
-    const launcher = await installStableRepositoryLauncher(workspace);
+    const launcher = await step(() => installStableRepositoryLauncher(workspace));
     const autostart = flags.has('no-relay-daemon')
         ? { state: 'disabled', backend: null }
-        : await withOnboardingStage('autostart', String(onboarded.workspaceId || ''), `dharma bootstrap --resume --complete --portal-url ${hqUrl} --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`
+        : await step(() => withOnboardingStage('autostart', String(onboarded.workspaceId || ''), `dharma bootstrap --resume --complete --portal-url ${hqUrl} --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`
             + (joinedBindingId ? ` --join-repository-binding-id ${joinedBindingId} --join-source-fingerprint ${joinedFingerprint}` : ''), () => withRelayStartupMutation(async () => {
             const home = dharmaHome();
-            const existing = await relayAutostartStatus({ home });
+            const existing = await step(() => relayAutostartStatus({ home }));
             if (existing.backend !== null || existing.state !== 'disabled') {
-                const anchor = await inspectOwnedRelayAutostart({ home });
+                const anchor = await step(() => inspectOwnedRelayAutostart({ home }));
                 if (anchor.policy !== null) {
-                    const current = await readDeviceConfig();
+                    const current = await step(() => readDeviceConfig());
                     if (!current || current.organizationId !== organizationId || current.deviceId !== config.deviceId) {
                         throw new Error('relay_workspace_conflict: startup enrollment changed.');
                     }
-                    const selected = selectDeviceWorkspace(await registry(), { organizationId,
+                    const selected = selectDeviceWorkspace(await step(() => registry()), { organizationId,
                         deviceId: config.deviceId, path: anchor.workspace });
                     if (!selected)
                         throw new Error('relay_workspace_conflict: startup anchor is not registered to this device.');
                     if (anchor.policy !== resolve(anchor.workspace, '.dharma', 'approved-policy.json')) {
                         throw new Error('relay_workspace_conflict: startup policy is not canonical.');
                     }
-                    const authorized = await loadOrganizationPolicy(anchor.policy);
-                    const canonical = (await registry()).filter(row => row.workspaceId === authorized.serverAuthorization?.workspaceId
+                    const authorized = await step(() => loadOrganizationPolicy(anchor.policy));
+                    const canonical = (await step(() => registry())).filter(row => row.workspaceId === authorized.serverAuthorization?.workspaceId
                         && row.organizationId === organizationId && row.path === anchor.workspace
                         && row.routeHash === selected.routeHash && row.repositoryRemoteHash === selected.repositoryRemoteHash);
                     if (canonical.length !== 1)
                         throw new Error('relay_workspace_conflict: startup policy route changed.');
-                    await loadVerifiedWorkspacePolicy(anchor.policy, authorized.serverAuthorization?.workspaceId ?? '');
+                    await step(() => loadVerifiedWorkspacePolicy(anchor.policy, authorized.serverAuthorization?.workspaceId ?? ''));
                 }
             }
-            return enableRelayAutostart({ home, workspace, policy: resolve(workspace, '.dharma', 'approved-policy.json'),
+            return step(() => enableRelayAutostart({ home, workspace, policy: resolve(workspace, '.dharma', 'approved-policy.json'),
                 launcher: resolve(workspace, process.platform === 'win32' ? launcher.windows : launcher.shell),
-                version: VERSION, preserveStandardAnchor: true });
-        }));
+                version: VERSION, preserveStandardAnchor: true }));
+        })));
     let sharedRepositoryReady = onboarded.sharedRepositoryReady === true;
     const completionRequested = flags.has('complete');
     if (!completionRequested) {
@@ -2376,7 +3289,7 @@ async function bootstrap(flags) {
             autostart,
         };
     }
-    const skill = await verifyAgentFabricSkillInstallation({ provider, workspace });
+    const skill = await step(() => verifyAgentFabricSkillInstallation({ provider, workspace }));
     if (!skill.ready)
         throw new Error(`Provider skill did not become ready: ${JSON.stringify(skill)}`);
     const policyPath = resolve(workspace, '.dharma', 'approved-policy.json');
@@ -2385,13 +3298,13 @@ async function bootstrap(flags) {
         || joinedBindingId !== null && firstLearning?.state === 'shared_package_inherited';
     const relay = flags.has('no-relay-daemon')
         ? { started: false, ...(await waitForRelayReadiness()) }
-        : await startRelayDaemon(policyPath);
+        : await step(() => startRelayDaemon(policyPath));
     let repositoryReadiness = null;
     if (!sharedRepositoryReady && relay.state === 'running') {
         const workspaceId = String(onboarded.workspaceId || '');
         const resumeCommand = `dharma onboard --resume --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision} --provider ${provider}`;
-        repositoryReadiness = await withOnboardingStage('readiness', workspaceId, resumeCommand, () => waitForRepositoryReadiness(async () => {
-            const current = (await registry()).find(item => item.workspaceId === workspaceId
+        repositoryReadiness = await step(() => withOnboardingStage('readiness', workspaceId, resumeCommand, () => waitForRepositoryReadiness(async () => {
+            const current = (await step(() => registry())).find(item => item.workspaceId === workspaceId
                 && item.organizationId === organizationId && item.path === workspace);
             if (!current)
                 throw new Error('Enrolled repository workspace disappeared during publication.');
@@ -2400,20 +3313,20 @@ async function bootstrap(flags) {
                 ready: await repositorySharedReady(current),
                 candidateId: current.repositoryPackage?.candidateId || null,
             };
-        }));
+        })));
         sharedRepositoryReady = repositoryReadiness.outcome === 'ready';
     }
     const apiFlags = new Map([
         ['organization-id', organizationId], ['portal-url', hqUrl],
     ]);
     const [organization, agents, experiments, failures, remediations, skills, usage] = await Promise.all([
-        runOrganizationCommand('organization', 'status', apiFlags),
-        runOrganizationCommand('agents', 'list', apiFlags),
-        runOrganizationCommand('experiments', 'list', apiFlags),
-        runOrganizationCommand('failures', 'list', apiFlags),
-        runOrganizationCommand('remediations', 'list', apiFlags),
-        runOrganizationCommand('skills', 'list', apiFlags),
-        runOrganizationCommand('usage', 'list', apiFlags),
+        step(() => runOrganizationCommand('organization', 'status', apiFlags)),
+        step(() => runOrganizationCommand('agents', 'list', apiFlags)),
+        step(() => runOrganizationCommand('experiments', 'list', apiFlags)),
+        step(() => runOrganizationCommand('failures', 'list', apiFlags)),
+        step(() => runOrganizationCommand('remediations', 'list', apiFlags)),
+        step(() => runOrganizationCommand('skills', 'list', apiFlags)),
+        step(() => runOrganizationCommand('usage', 'list', apiFlags)),
     ]);
     const organizationApi = summarizeBootstrapOrganizationApi({
         organizationId,
@@ -2425,23 +3338,35 @@ async function bootstrap(flags) {
         skills,
         usage,
     });
-    const operatingContract = await loadAgentFabricOnboardingContract();
-    const namedSession = !joinedBindingId && provider === 'codex' && process.platform === 'linux' && sharedRepositoryReady
-        ? await withOnboardingStage('named_session', String(onboarded.workspaceId), `dharma bootstrap --resume --complete --portal-url ${hqUrl} --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`, () => namedSessionCommand('start', new Map([
+    const operatingContract = await step(() => loadAgentFabricOnboardingContract());
+    let namedSession = !joinedBindingId && provider === 'codex' && process.platform === 'linux' && sharedRepositoryReady
+        ? await step(() => withOnboardingStage('named_session', String(onboarded.workspaceId), `dharma bootstrap --resume --complete --portal-url ${hqUrl} --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`, () => namedSessionCommand('start', new Map([
             ['name', String(flags.get('session-name') || `codex-${String(onboarded.workspaceId).slice(0, 8)}`)],
             ['workspace-id', String(onboarded.workspaceId)], ['apply', true],
             ...(typeof flags.get('session-budget-cents') === 'string'
                 ? [['session-budget-cents', String(flags.get('session-budget-cents'))]] : []),
-        ])))
+        ]))))
         : null;
+    if (namedSession) {
+        const native = await step(() => withOnboardingStage('readiness', String(onboarded.workspaceId), `dharma bootstrap --resume --complete --portal-url ${hqUrl} --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`, () => namedSessionCommand('readiness', new Map([
+            ['name', String(flags.get('session-name') || `codex-${String(onboarded.workspaceId).slice(0, 8)}`)],
+            ['workspace-id', String(onboarded.workspaceId)],
+        ]))));
+        if (['name', 'bindingId', 'sessionId', 'organizationId', 'repositoryBindingId', 'workspaceId',
+            'endpointId', 'membershipId', 'deviceId', 'provider'].some(key => native[key] !== namedSession[key])) {
+            throw new Error('named_session_readiness_scope_mismatch');
+        }
+        namedSession = { ...namedSession, nativeSkill: parseNamedCodexSkillObservation(native.nativeSkill) };
+    }
     const repositoryReceipt = onboarded;
     const namedSessionReady = Boolean(joinedBindingId) || provider !== 'codex' || process.platform !== 'linux'
-        || Boolean(namedSession?.ok === true && ['running', 'executing'].includes(String(namedSession.state)));
+        || Boolean(namedSession?.ok === true && namedSession.nativeSkill
+            && ['running', 'executing'].includes(String(namedSession.state)));
     const role = repositoryReceipt.repositoryRole;
     const roleReady = Boolean(role);
     const relayReady = relay.state === 'running';
     const observedAutostart = autostart.backend === 'container-entrypoint'
-        ? await relayAutostartStatus({ home: dharmaHome() }) : autostart;
+        ? await step(() => relayAutostartStatus({ home: dharmaHome() })) : autostart;
     const startupReady = !['win32', 'linux', 'darwin'].includes(process.platform)
         || observedAutostart.state === 'enabled'
             && (observedAutostart.backend !== 'container-entrypoint' || observedAutostart.lifecycle === 'running');
@@ -2900,7 +3825,7 @@ async function login(flags) {
                 config.serverSigningKeyset = candidate;
             }
             await saveDeviceConfig(configPath(), config);
-            await saveDeviceEnrollmentAnchor({ config });
+            await saveDeviceEnrollmentAnchor({ config, hostScope: currentBootstrapHostScope() });
             await rm(pendingEnrollmentPath(), { force: true });
             return { ok: true, status: 'approved', deviceId: config.deviceId, organizationId: pending.organizationId, relayUrl: config.relayUrl };
         }
@@ -2975,7 +3900,6 @@ async function capture(flags, batch = false) {
         taskReceiptHash: null,
     });
     let policy = await loadVerifiedWorkspacePolicy(policyPath, registered.workspaceId);
-    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
     const fabric = flags.has('sync')
         ? await client()
         : null;
@@ -2985,9 +3909,8 @@ async function capture(flags, batch = false) {
     }
     if (fabric)
         policy = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, registered.workspaceId, fabric);
-    const vault = await LocalVault.open({
+    const vault = await openBootstrapVault({
         root: resolve(dharmaHome(), 'vault'),
-        masterKey: await loadOrCreateVaultMasterKey(),
         rawLocalDays: rawLocalRetentionDays(policy),
     });
     try {
@@ -3012,7 +3935,7 @@ async function capture(flags, batch = false) {
             if (fabric) {
                 await vault.discardCapsuleRevisionsAfter(firstRevision.trajectoryId, serverHead?.revision || 0);
             }
-            const latestMetadata = vault.getLatestCapsuleMetadata(firstRevision.trajectoryId);
+            const latestMetadata = await vault.getLatestCapsuleMetadata(firstRevision.trajectoryId);
             const latestCapsule = latestMetadata
                 ? await vault.getLatestCapsule(firstRevision.trajectoryId)
                 : null;
@@ -3055,7 +3978,7 @@ async function capture(flags, batch = false) {
             }
             capsules.push(capsule);
             if (fabric) {
-                vault.queueCapsuleSync(capsule.trajectoryId, capsule.revision);
+                await vault.queueCapsuleSync(capsule.trajectoryId, capsule.revision);
                 try {
                     await reserveDailyContentUpload(capsule, policy);
                     // An unknown delivery outcome retains the local advisory reservation.
@@ -3064,11 +3987,11 @@ async function capture(flags, batch = false) {
                 }
                 catch (error) {
                     if (isDefinitiveSecretDisclosureRejection(error)) {
-                        vault.discardPendingCapsuleSync(capsule.trajectoryId, capsule.revision, 'secret_disclosure_forbidden');
+                        await vault.discardPendingCapsuleSync(capsule.trajectoryId, capsule.revision, 'secret_disclosure_forbidden');
                     }
                     throw error;
                 }
-                vault.markCapsuleSynced(capsule.trajectoryId, capsule.revision);
+                await vault.markCapsuleSynced(capsule.trajectoryId, capsule.revision);
             }
         }
         const output = flags.get('output');
@@ -3102,7 +4025,7 @@ async function capture(flags, batch = false) {
         return manifest;
     }
     finally {
-        vault.close();
+        await vault.close();
     }
 }
 async function evidencePreview(flags) {
@@ -3255,7 +4178,7 @@ async function workspaceRecoverRegistry(flags) {
     const config = await readDeviceConfig();
     if (!config)
         throw new Error('registry_recovery_enrollment_required');
-    const enrollment = await loadDeviceEnrollmentAnchor({ config });
+    const enrollment = await loadDeviceEnrollmentAnchor({ config, hostScope: currentBootstrapHostScope() });
     const workspace = await realpath(String(flags.get('workspace') || '.'));
     const home = dharmaHome();
     const startup = await inspectOwnedRelayAutostart({ home });
@@ -3455,14 +4378,17 @@ function selectedProviderAdapters(providerIds) {
         : providerAdapters;
 }
 export async function receiptAwareProviderCapabilities(providers, now = new Date()) {
+    const hostScope = currentBootstrapHostScope();
+    await hostScope?.assert();
     const selfTestedAt = now.toISOString();
     let freshUntil = now.toISOString();
     let receiverState = 'unavailable';
     let reason = 'device_not_enrolled';
     let trustedKeyVersions = [];
     try {
-        const config = await recoverDeviceEnrollmentConsistency({ configPath: configPath(), now });
-        await loadDeviceEnrollmentAnchor({ config });
+        const config = await recoverDeviceEnrollmentConsistency({ configPath: configPath(), now,
+            hostScope });
+        await loadDeviceEnrollmentAnchor({ config, hostScope });
         const keyset = config.serverSigningKeyset;
         if (!keyset)
             throw new Error('trusted_server_signing_keyset_unavailable');
@@ -3477,13 +4403,15 @@ export async function receiptAwareProviderCapabilities(providers, now = new Date
         if (trustedKeyVersions.length === 0)
             throw new Error('trusted_server_signing_keys_unavailable');
         freshUntil = actionDecisionCapabilityFreshUntil(keyset, trustedKeyVersions, now);
-        await new FileActionExecutionJournal(resolve(dharmaHome(), 'relay', 'action-execution-journal')).selfTest();
+        await new FileActionExecutionJournal(resolve(dharmaHome(), 'relay', 'action-execution-journal')).selfTest(hostScope);
         receiverState = 'available';
         reason = '';
     }
     catch (error) {
-        reason = error instanceof Error ? error.message : String(error);
+        await hostScope?.assert();
+        reason = hostScope ? 'codex_setup_host_receiver_unavailable' : error instanceof Error ? error.message : String(error);
     }
+    await hostScope?.assert();
     return providers.map((provider) => {
         const available = provider.taskExecution === 'available' && receiverState === 'available';
         return {
@@ -3695,18 +4623,95 @@ async function repositoryRoleCommand(action, flags) {
             targetEndpointId: typeof flags.get('target-endpoint-id') === 'string' ? String(flags.get('target-endpoint-id')) : undefined });
     return readRepositoryRoleReply({ transport, scope, questionId: required(flags, 'question-id') });
 }
+/** Original setup submits to the standing owner; it never spawns its worker. */
+async function requestBootstrapNamedSession(hostScope, flags) {
+    const sender = await originalCodexSetupSessionSender(hostScope);
+    const prepared = await inspectCodexBootstrapHostPreparation(hostScope);
+    const workspace = String(prepared.flags.get('workspace')), intent = sender.intent;
+    const workspaceId = required(flags, 'workspace-id'), name = `codex-${workspaceId.slice(0, 8)}`;
+    if (flags.get('name') !== name || [...flags.keys()].some(key => !['name', 'workspace-id', 'apply'].includes(key))) {
+        throw new Error('setup_session_scope_changed');
+    }
+    const step = (operation) => hostScope.step(operation);
+    const config = await step(() => readDeviceConfig());
+    const rows = (await step(() => registry())).filter(row => row.workspaceId === workspaceId && row.path === workspace
+        && row.organizationId === intent.organizationId && row.repositoryRemoteHash === intent.repositoryFingerprint && row.status === 'active');
+    if (!config || config.organizationId !== intent.organizationId || normalizeHqUrl(config.hqUrl) !== intent.origin
+        || config.setupClaimReference !== intent.setupReference || config.setupClaimRepositoryFingerprint !== intent.repositoryFingerprint
+        || rows.length !== 1)
+        throw new Error('setup_session_scope_changed');
+    const item = rows[0], role = repositoryRoleScope(item);
+    await step(() => assertBootstrapHostSource(workspace, intent.repositoryFingerprint));
+    const enrollment = await step(() => loadDeviceEnrollmentAnchor({ config, hostScope }));
+    const policy = await step(() => loadVerifiedWorkspacePolicy(resolve(workspace, '.dharma', 'approved-policy.json'), workspaceId));
+    verifyServerAuthorizedPolicy({ policy, publicKeyEd25519: enrollment.serverPublicKeyEd25519,
+        organizationId: intent.organizationId, workspaceId });
+    await step(() => assertWorkspaceAuthorizationCurrent(workspaceId, policy.serverAuthorization));
+    if (policy.revision !== intent.policyRevision)
+        throw new Error('setup_session_scope_changed');
+    const senderProcess = await step(() => readContainerProcessIdentity(process.pid));
+    if (senderProcess.uid !== process.getuid())
+        throw new Error('setup_session_scope_changed');
+    const result = await awaitCodexSetupSession({ vault: sender.vault, scope: hostScope, leaseId: sender.lease.leaseId,
+        request: { schema: 'dharma.local-codex-setup-session/v1', operationId: intent.operationId, intentDigest: sender.lease.intentDigest,
+            setupReference: intent.setupReference, senderPid: process.pid, senderStartTicks: senderProcess.startTicks,
+            organizationId: intent.organizationId, membershipId: intent.recipientMembershipId, deviceId: config.deviceId,
+            workspaceId, repositoryBindingId: role.repositoryBindingId, endpointId: role.endpointId, provider: 'codex',
+            origin: intent.origin, repositoryFingerprint: intent.repositoryFingerprint, policyRevision: policy.revision,
+            policyHash: sha256(canonicalize(policy)), scopeDigest: intent.scopeDigest, contractDigest: intent.contractDigest,
+            name, workspaceRoot: workspace, maximumCostCents: 1000, maximumTurnCostCents: 25,
+            issuedAt: new Date().toISOString(), expiresAt: new Date(Math.min(Date.parse(intent.expiresAt), Date.parse(policy.serverAuthorization.expiresAt))).toISOString() } });
+    await step(() => assertCodexSetupExecutionLease(sender.lease, intent));
+    if (result.state !== 'started')
+        throw new Error('setup_session_start_unconfirmed');
+    const status = await step(() => namedSessionCommand('status', new Map([
+        ['name', name], ['workspace-id', workspaceId]
+    ])));
+    if (status.ok !== true || status.bindingId !== result.bindingId || status.sessionId !== result.sessionId
+        || status.membershipId !== intent.recipientMembershipId || status.deviceId !== config.deviceId
+        || status.organizationId !== intent.organizationId || status.workspaceId !== workspaceId
+        || status.repositoryBindingId !== role.repositoryBindingId || status.endpointId !== role.endpointId || status.provider !== 'codex') {
+        throw new Error('setup_session_scope_changed');
+    }
+    return status;
+}
 async function namedSessionCommand(action, flags) {
+    const hostScope = currentBootstrapHostScope();
+    const setupSessionScope = currentAcceptedSetupSessionScope();
+    const supervisorOwner = currentNamedSessionChildOwner();
+    if (hostScope && (supervisorOwner || setupSessionScope))
+        throw new Error('named_session_child_owner_conflict');
+    if (setupSessionScope && !['start', 'status', 'readiness'].includes(action))
+        throw new Error('setup_session_scope_changed');
+    const step = (operation) => hostScope ? hostScope.step(operation)
+        : setupSessionScope ? setupSessionScope.step(operation) : operation();
+    await hostScope?.assert();
+    if (action === 'start' && hostScope && flags.has('apply')) {
+        return requestBootstrapNamedSession(hostScope, flags);
+    }
     const name = String(flags.get('name') || 'codex');
     const paths = namedSessionPaths(dharmaHome(), name);
     if (process.platform !== 'linux')
         throw new Error('codex_session_sandbox_unqualified');
     const workspaceId = required(flags, 'workspace-id');
-    const item = (await registry()).find(row => row.workspaceId === workspaceId);
-    const config = await readDeviceConfig();
+    let childMessage;
+    if (flags.has('setup-handoff')) {
+        if (action !== 'serve' || flags.get('setup-handoff') !== true
+            || [...flags.keys()].some(key => !['name', 'workspace-id', 'apply', 'setup-handoff'].includes(key))) {
+            throw new Error('setup_child_unavailable');
+        }
+        childMessage = await receiveCodexSetupChildStart({ process, signal: new AbortController().signal });
+    }
+    const item = (await step(() => registry())).find(row => row.workspaceId === workspaceId);
+    const config = await step(() => readDeviceConfig());
     if (!item || !config || item.organizationId !== config.organizationId)
         throw new Error('named_session_scope_mismatch');
+    await assertBootstrapHostSource(item.path, String(item.repositoryRemoteHash || ''));
     const scope = repositoryRoleScope(item);
-    const existing = await readNamedSession(dharmaHome(), name);
+    const existing = await step(() => readNamedSession(dharmaHome(), name));
+    if (setupSessionScope && (name !== setupSessionScope.request.name || workspaceId !== setupSessionScope.request.workspaceId
+        || existing && existing.identity.membershipId !== setupSessionScope.request.membershipId))
+        throw new Error('setup_session_scope_changed');
     if (existing && (existing.identity.workspaceId !== item.workspaceId
         || existing.identity.organizationId !== config.organizationId || existing.identity.deviceId !== config.deviceId
         || existing.identity.endpointId !== scope.endpointId || existing.identity.repositoryBindingId !== scope.repositoryBindingId)) {
@@ -3721,6 +4726,18 @@ async function namedSessionCommand(action, flags) {
                 bindingId: existing?.bindingId ?? null };
         }
     }
+    if (action === 'readiness') {
+        if (!existing?.enabled)
+            throw new Error('named_session_readiness_unavailable');
+        const result = await namedSessionRequest(dharmaHome(), name, { action: 'readiness' });
+        if (Object.keys(result).sort().join(',') !== 'bindingId,deviceId,endpointId,membershipId,name,nativeSkill,ok,organizationId,provider,repositoryBindingId,schema,sessionId,workspaceId'
+            || result.schema !== 'dharma.named-session-readiness/v1' || result.name !== name || result.bindingId !== existing.bindingId
+            || typeof result.sessionId !== 'string' || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(result.sessionId)
+            || Object.entries(existing.identity).some(([key, value]) => result[key] !== value)) {
+            throw new Error('named_session_readiness_scope_mismatch');
+        }
+        return { ...result, nativeSkill: parseNamedCodexSkillObservation(result.nativeSkill) };
+    }
     if (action === 'work')
         return namedSessionRequest(dharmaHome(), name, { action: 'work',
             workId: String(flags.get('work-id') || randomUUID()), prompt: required(flags, 'prompt') });
@@ -3741,101 +4758,155 @@ async function namedSessionCommand(action, flags) {
     if (!flags.has('apply'))
         return { ok: true, planned: true, name, workspaceId,
             provider: 'codex', localWork: 'workspace_write', peerQuestions: 'read_only', network: 'deny' };
-    await verifyNamedSessionVisibleSkill(await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace: item.path }), await repositorySharedReady(item));
+    await step(async () => verifyNamedSessionVisibleSkill(await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace: item.path }), await repositorySharedReady(item)));
     if (action === 'start') {
         if (existing && !existing.enabled)
-            await saveNamedSession(dharmaHome(), { ...existing, enabled: true });
+            await step(() => saveNamedSession(dharmaHome(), { ...existing, enabled: true }));
         try {
-            return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+            return await step(() => namedSessionRequest(dharmaHome(), name, { action: 'status' }));
         }
         catch { /* Start an owned worker below. */ }
         const args = [fileURLToPath(import.meta.url), 'sessions', 'serve', '--name', name,
             '--workspace-id', workspaceId, '--apply'];
+        if (setupSessionScope)
+            args.push('--setup-handoff');
         for (const key of ['session-budget-cents', 'turn-budget-cents']) {
             if (flags.has(key))
                 args.push(`--${key}`, required(flags, key));
         }
-        const child = spawn(process.execPath, args, { cwd: item.path, detached: true, stdio: 'ignore', env: process.env });
-        child.on('error', () => { });
-        child.unref();
+        await step(async () => {
+            const start = () => spawn(process.execPath, args, { cwd: item.path, detached: !hostScope && !supervisorOwner,
+                stdio: setupSessionScope ? ['ignore', 'ignore', 'ignore', 'ipc'] : 'ignore', env: process.env });
+            if (supervisorOwner) {
+                const child = await supervisorOwner.spawn(name, start);
+                if (setupSessionScope)
+                    await sendCodexSetupChildStart({ owner: supervisorOwner, child, scope: setupSessionScope });
+                return;
+            }
+            const child = start();
+            if (hostScope)
+                captureBootstrapHostChild(hostScope, child);
+            else {
+                child.on('error', () => { });
+                child.unref();
+            }
+        });
         for (let attempt = 0; attempt < 80; attempt++) {
-            await new Promise(resolveWait => setTimeout(resolveWait, 250));
+            await step(() => new Promise(resolveWait => setTimeout(resolveWait, 250)));
+            await hostScope?.assert();
             try {
-                return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+                return await step(() => namedSessionRequest(dharmaHome(), name, { action: 'status' }));
             }
             catch { /* Await service initialization. */ }
         }
         throw new Error('named_session_startup_failed');
     }
     await mkdir(paths.root, { recursive: true, mode: 0o700 });
-    const releaseLock = await acquirePidLock(resolve(paths.root, 'service.lock'), 250, 'named_session_already_running');
-    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
-    const vault = await LocalVault.open({ root: resolve(dharmaHome(), 'vault'), masterKey: await loadOrCreateVaultMasterKey() });
+    const vault = await openBootstrapVault({ root: resolve(dharmaHome(), 'vault') });
+    let releaseLock;
     const controller = new AbortController(), stop = () => controller.abort();
     process.once('SIGTERM', stop);
     process.once('SIGINT', stop);
+    if (childMessage)
+        process.once('disconnect', stop);
     let transport;
     try {
-        const fabric = await AgentFabricClient.open({ configPath: configPath(), statePath: resolve(paths.root, 'protocol-state.json') });
-        if (fabric.config.organizationId !== config.organizationId || fabric.config.deviceId !== config.deviceId
-            || fabric.config.publicKeyEd25519 !== config.publicKeyEd25519)
-            throw new Error('named_session_trust_scope_mismatch');
-        const trust = createNamedSessionTrust({ configPath: configPath(), identity: fabric.config });
-        await trust.refresh();
-        await fabric.openSession(VERSION);
-        const policyPath = resolve(item.path, '.dharma', 'approved-policy.json');
-        const policy = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
-        const writeRoots = policy.tasks.writePaths.filter(path => /^[a-zA-Z0-9_-]+\/\*\*$/.test(path))
-            .map(path => path.slice(0, -3));
-        if (!writeRoots.length)
-            throw new Error('named_session_workspace_write_not_authorized');
-        const environment = namedCodexEnvironment(process.env);
-        const privateRoots = [dharmaHome(), resolve(environment.CODEX_HOME || resolve(homedir(), '.codex'))];
-        if (environment.XDG_RUNTIME_DIR)
-            privateRoots.push(environment.XDG_RUNTIME_DIR);
-        if (environment.DBUS_SESSION_BUS_ADDRESS)
-            privateRoots.push(environment.DBUS_SESSION_BUS_ADDRESS.slice('unix:path='.length));
-        const filesystem = await namedCodexFilesystem({ environment, workspace: item.path, privateRoots, writeRoots });
-        transport = await openCodexAppServerTransport({ command: 'codex', cwd: item.path,
-            environment, experimentalApi: true, toolCallTimeoutMs: 60_000,
-            argv: ['-c', 'default_permissions="dharma_bridge"',
-                '-c', `permissions.dharma_bridge.filesystem=${filesystem.peer}`,
-                '-c', 'permissions.dharma_bridge.network={enabled=false}',
-                '-c', `permissions.dharma_work.filesystem=${filesystem.work}`,
-                '-c', 'permissions.dharma_work.network={enabled=false}', 'app-server'] });
-        const account = await transport.request('account/read', { refreshToken: false });
-        if (!account.account)
-            throw new Error('named_session_provider_authentication_required');
-        let registration = existing;
-        if (!registration) {
-            const maximumCostCents = boundedInteger(flags.get('session-budget-cents'), 1000, 1, 10000, '--session-budget-cents');
-            const maximumTurnCostCents = boundedInteger(flags.get('turn-budget-cents'), 25, 1, maximumCostCents, '--turn-budget-cents');
-            const threadId = await startNamedCodexThread(transport, item.path, name);
-            const bindingId = randomUUID();
-            const response = await fabric.signedPost('/agent-fabric/provider-sessions', {
-                schema: 'dharma.provider-session-registration/v1', action: 'attach', provider: 'codex', mode: 'bridge_owned',
-                workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
-                bindingId, expectedRevision: 0, leaseSeconds: 60,
+        releaseLock = await acquirePidLock(resolve(paths.root, 'service.lock'), 250, 'named_session_already_running');
+        const startProvider = async (childScope) => {
+            const startupStep = (operation) => childScope ? childScope.step(operation) : operation();
+            if (childScope && existing && existing.identity.membershipId !== childScope.request.membershipId) {
+                throw new Error('setup_child_unavailable');
+            }
+            const fabric = await startupStep(() => AgentFabricClient.open({ configPath: configPath(), statePath: resolve(paths.root, 'protocol-state.json'),
+                hostScope: currentBootstrapHostScope() }));
+            if (fabric.config.organizationId !== config.organizationId || fabric.config.deviceId !== config.deviceId
+                || fabric.config.publicKeyEd25519 !== config.publicKeyEd25519)
+                throw new Error('named_session_trust_scope_mismatch');
+            const trust = createNamedSessionTrust({ configPath: configPath(), identity: fabric.config });
+            await startupStep(() => trust.refresh());
+            await startupStep(() => fabric.openSession(VERSION));
+            const policyPath = resolve(item.path, '.dharma', 'approved-policy.json');
+            const policy = await startupStep(() => refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric));
+            const writeRoots = policy.tasks.writePaths.filter(path => /^[a-zA-Z0-9_-]+\/\*\*$/.test(path))
+                .map(path => path.slice(0, -3));
+            if (!writeRoots.length)
+                throw new Error('named_session_workspace_write_not_authorized');
+            let registration = existing, pending;
+            let ownerReceipt;
+            // Resolve authenticated ownership before opening any provider transport.
+            if (registration) {
+                const response = await startupStep(() => fabric.signedPost('/agent-fabric/provider-sessions', {
+                    schema: 'dharma.provider-session-registration/v1', action: 'inspect', provider: 'codex', mode: 'bridge_owned',
+                    workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                    bindingId: registration.bindingId, expectedRevision: 0, leaseSeconds: 60,
+                }));
+                if (!isNamedSessionOwnerReceipt(response, registration.bindingId, registration.identity)) {
+                    throw new Error('named_session_registration_invalid');
+                }
+                ownerReceipt = response;
+            }
+            else {
+                const maximumCostCents = boundedInteger(flags.get('session-budget-cents'), 1000, 1, 10000, '--session-budget-cents');
+                const maximumTurnCostCents = boundedInteger(flags.get('turn-budget-cents'), 25, 1, maximumCostCents, '--turn-budget-cents');
+                const bindingId = randomUUID();
+                const response = await startupStep(() => fabric.signedPost('/agent-fabric/provider-sessions', {
+                    schema: 'dharma.provider-session-registration/v1', action: 'attach', provider: 'codex', mode: 'bridge_owned',
+                    workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                    bindingId, expectedRevision: 0, leaseSeconds: 60,
+                }));
+                const remote = response.registration;
+                if (!remote || !UUID_PATTERN.test(String(remote.membershipId))
+                    || childScope && remote.membershipId !== childScope.request.membershipId || remote.revision !== 1) {
+                    throw new Error('named_session_registration_invalid');
+                }
+                const identity = { organizationId: config.organizationId, repositoryBindingId: scope.repositoryBindingId,
+                    workspaceId, endpointId: scope.endpointId, membershipId: String(remote.membershipId), deviceId: config.deviceId,
+                    provider: 'codex' };
+                if (!isNamedSessionOwnerReceipt(response, bindingId, identity))
+                    throw new Error('named_session_registration_invalid');
+                ownerReceipt = response;
+                pending = { schema: 'dharma.named-session/v1', name, bindingId, identity,
+                    maximumCostCents, maximumTurnCostCents, enabled: true };
+            }
+            const environment = namedCodexEnvironment(process.env);
+            const privateRoots = [dharmaHome(), resolve(environment.CODEX_HOME || resolve(homedir(), '.codex'))];
+            if (environment.XDG_RUNTIME_DIR)
+                privateRoots.push(environment.XDG_RUNTIME_DIR);
+            if (environment.DBUS_SESSION_BUS_ADDRESS)
+                privateRoots.push(environment.DBUS_SESSION_BUS_ADDRESS.slice('unix:path='.length));
+            const filesystem = await startupStep(() => namedCodexFilesystem({ environment, workspace: item.path, privateRoots, writeRoots }));
+            await startupStep(async () => {
+                const expectedOwner = registration ?? pending;
+                if (!isNamedSessionOwnerReceipt(ownerReceipt, expectedOwner.bindingId, expectedOwner.identity)) {
+                    throw new Error('named_session_registration_invalid');
+                }
+                transport = await openCodexAppServerTransport({ command: 'codex', cwd: item.path,
+                    environment, experimentalApi: true, toolCallTimeoutMs: 60_000,
+                    argv: ['-c', 'default_permissions="dharma_bridge"',
+                        '-c', `permissions.dharma_bridge.filesystem=${filesystem.peer}`,
+                        '-c', 'permissions.dharma_bridge.network={enabled=false}',
+                        '-c', `permissions.dharma_work.filesystem=${filesystem.work}`,
+                        '-c', 'permissions.dharma_work.network={enabled=false}', 'app-server'] });
+                return transport;
             });
-            const remote = response.registration;
-            if (response.ok !== true || response.organizationId !== config.organizationId || !remote
-                || remote.bindingId !== bindingId || remote.workspaceId !== workspaceId || remote.endpointId !== scope.endpointId
-                || remote.repositoryBindingId !== scope.repositoryBindingId || remote.deviceId !== config.deviceId
-                || !UUID_PATTERN.test(String(remote.membershipId)) || remote.provider !== 'codex'
-                || remote.mode !== 'bridge_owned' || remote.state !== 'attached' || remote.revision !== 1) {
-                throw new Error('named_session_registration_invalid');
-            }
-            const identity = { organizationId: config.organizationId, repositoryBindingId: scope.repositoryBindingId,
-                workspaceId, endpointId: scope.endpointId, membershipId: String(remote.membershipId), deviceId: config.deviceId,
-                provider: 'codex' };
-            vault.saveProviderSessionBinding({ schema: 'dharma.local-provider-session-binding/v1', ...identity,
-                bindingId, owner: 'dharma_bridge', sessionId: threadId, workspaceRoot: item.path,
-                createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
-                maximumProviderCostCents: maximumTurnCostCents });
-            registration = { schema: 'dharma.named-session/v1', name, bindingId, identity,
-                maximumCostCents, maximumTurnCostCents, enabled: true };
-            await saveNamedSession(dharmaHome(), registration);
-        }
+            const account = await startupStep(() => transport.request('account/read', { refreshToken: false }));
+            if (!account.account)
+                throw new Error('named_session_provider_authentication_required');
+            if (pending) {
+                const threadId = await startupStep(() => startNamedCodexThread(transport, item.path, name));
+                await startupStep(async () => vault.saveProviderSessionBinding({ schema: 'dharma.local-provider-session-binding/v1', ...pending.identity,
+                    bindingId: pending.bindingId, owner: 'dharma_bridge', sessionId: threadId, workspaceRoot: item.path,
+                    createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
+                    maximumProviderCostCents: pending.maximumTurnCostCents }));
+                registration = pending;
+                await startupStep(async () => saveNamedSession(dharmaHome(), registration));
+            }
+            return { registration: registration, filesystem, fabric, trust, policyPath, writeRoots };
+        };
+        const { registration, filesystem, fabric, trust, policyPath, writeRoots } = childMessage
+            ? await runCodexSetupChildStartup({ vault: vault, message: childMessage, name, workspaceId,
+                signal: controller.signal, authorize: qualifyCodexSetupChildRequest }, startProvider)
+            : await startProvider();
         const authorizeLifetime = async () => {
             const current = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
             if (!writeRoots.every(root => current.tasks.writePaths.includes(`${root}/**`)))
@@ -3867,6 +4938,17 @@ async function namedSessionCommand(action, flags) {
         };
         return await runNamedSessionService({ home: dharmaHome(), registration, vault, signal: controller.signal,
             localWriteRoots: writeRoots, additionalFilesystemRules: filesystem.additionalFilesystemRules,
+            observeNativeSkill: async () => {
+                const installation = await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace: item.path });
+                const native = await observeNamedCodexSkill(transport, { workspace: item.path, installation,
+                    sharedRepositoryReady: await repositorySharedReady(item) });
+                const current = await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace: item.path });
+                if (!current.signedLifecycleReady || current.activeBundleId !== native.bundleId
+                    || current.activeBundleHash !== native.bundleHash || current.nativeSkillPath !== installation.nativeSkillPath
+                    || !await repositorySharedReady(item))
+                    throw new Error('named_session_native_skill_unavailable');
+                return native;
+            },
             syncTaskExports: () => syncNamedSessionTaskExports({ vault, bindingId: registration.bindingId,
                 identity: registration.identity,
                 loadPolicy: () => refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric),
@@ -3884,7 +4966,7 @@ async function namedSessionCommand(action, flags) {
                     if (current.evidence.automaticDisclosure?.mode === 'customer_authorized_content' && skill.activeBundleHash) {
                         try {
                             taskStateFailure = 'public_context_unavailable';
-                            const binding = vault.getProviderSessionBinding(registration.bindingId, registration.identity);
+                            const binding = await vault.getProviderSessionBinding(registration.bindingId, registration.identity);
                             if (!binding)
                                 throw new Error('named_session_binding_unavailable');
                             const retained = await readCodexPublicContext(transport, { threadId: binding.sessionId, workspaceRoot: binding.workspaceRoot });
@@ -3935,7 +5017,7 @@ async function namedSessionCommand(action, flags) {
                     || current.evidence.automaticDisclosure.consentReceiptId !== taskState.consentReceiptId) {
                     throw new Error('named_session_repository_state_consent_changed');
                 }
-                const binding = vault.getProviderSessionBinding(registration.bindingId, registration.identity);
+                const binding = await vault.getProviderSessionBinding(registration.bindingId, registration.identity);
                 if (!binding)
                     throw new Error('named_session_binding_unavailable');
                 const receipt = await retainNamedSessionRepositoryState({ vault, binding, capture, workId: taskState.workId,
@@ -3952,7 +5034,7 @@ async function namedSessionCommand(action, flags) {
             },
             queueEvidence: async (capture) => {
                 const current = await loadVerifiedWorkspacePolicy(policyPath, workspaceId);
-                const binding = vault.getProviderSessionBinding(registration.bindingId, registration.identity);
+                const binding = await vault.getProviderSessionBinding(registration.bindingId, registration.identity);
                 if (!binding)
                     throw new Error('named_session_binding_unavailable');
                 // The existing relay rechecks current authority, disclosure limits and device binding before upload.
@@ -3971,10 +5053,16 @@ async function namedSessionCommand(action, flags) {
                 await transport.close();
         }
         finally {
-            vault.close();
-            await releaseLock();
-            process.removeListener('SIGTERM', stop);
-            process.removeListener('SIGINT', stop);
+            try {
+                await vault.close();
+            }
+            finally {
+                await releaseLock?.();
+                process.removeListener('SIGTERM', stop);
+                process.removeListener('SIGINT', stop);
+                if (childMessage)
+                    process.removeListener('disconnect', stop);
+            }
         }
     }
 }
@@ -4168,13 +5256,22 @@ async function joinExistingRepository(flags, bindingId, sourceFingerprint) {
         workspaceSync: synchronized, relay };
 }
 async function readDeviceConfig() {
+    const scope = currentBootstrapHostScope();
     try {
-        return JSON.parse(await readFile(configPath(), 'utf8'));
+        const bytes = scope ? await scope.step(() => readFile(configPath(), 'utf8')) : await readFile(configPath(), 'utf8');
+        return JSON.parse(bytes);
     }
     catch {
+        await scope?.assert();
         return null;
     }
 }
+async function enrolledDeviceIdentity(config, store) {
+    const hostScope = currentBootstrapHostScope();
+    return hostScope ? loadDeviceIdentity({ config, store, hostScope }) : loadOrCreateDeviceIdentity({
+        hqUrl: config.hqUrl, organizationId: config.organizationId, installationId: config.installationId, store
+    });
+}
 async function activeSkillAuthorization(provider, workspaceId, organizationAgentId, config) {
     const root = await nativeSkillDirectoryForWorkspace({ provider, workspaceId });
     const pointer = resolve(root, '.dharma-managed', 'workspaces', workspaceId, 'ACTIVE_BUNDLE');
@@ -4183,13 +5280,9 @@ async function activeSkillAuthorization(provider, workspaceId, organizationAgent
     if (!organizationAgentId)
         throw new Error('Workspace is not bound to a repository agent. Run dharma workspace sync.');
     const [identity, enrollment, active] = await Promise.all([
-        loadOrCreateDeviceIdentity({
-            hqUrl: config.hqUrl,
-            organizationId: config.organizationId,
-            installationId: config.installationId,
-        }),
-        loadDeviceEnrollmentAnchor({ config }),
-        loadActiveSkillAuthorizationAnchor({ config, workspaceId, organizationAgentId, provider }),
+        enrolledDeviceIdentity(config),
+        loadDeviceEnrollmentAnchor({ config, hostScope: currentBootstrapHostScope() }),
+        loadActiveSkillAuthorizationAnchor({ config, workspaceId, organizationAgentId, provider, hostScope: currentBootstrapHostScope() }),
     ]);
     if (!active)
         throw new Error('Active skill state is not anchored in secure storage. Run dharma skill sync again.');
@@ -4197,6 +5290,7 @@ async function activeSkillAuthorization(provider, workspaceId, organizationAgent
         throw new Error('Active skill device identity does not match secure enrollment state.');
     }
     const authorizationInput = (expectedReceiptHash) => ({
+        hostScope: currentBootstrapHostScope(),
         nativeSkillDirectory: root,
         workspaceId,
         provider,
@@ -4222,6 +5316,7 @@ async function activeSkillAuthorization(provider, workspaceId, organizationAgent
             throw error;
         const refreshed = await loadActiveSkillAuthorizationAnchor({
             config, workspaceId, organizationAgentId, provider, fresh: true,
+            hostScope: currentBootstrapHostScope(),
         });
         if (!refreshed)
             throw error;
@@ -4233,13 +5328,9 @@ async function expiredSkillAuthorizationForReplacement(provider, workspaceId, or
     if (!organizationAgentId)
         throw new Error('Workspace is not bound to a repository agent. Run dharma workspace sync.');
     const [identity, enrollment, active] = await Promise.all([
-        loadOrCreateDeviceIdentity({
-            hqUrl: config.hqUrl,
-            organizationId: config.organizationId,
-            installationId: config.installationId,
-        }),
-        loadDeviceEnrollmentAnchor({ config }),
-        loadActiveSkillAuthorizationAnchor({ config, workspaceId, organizationAgentId, provider }),
+        enrolledDeviceIdentity(config),
+        loadDeviceEnrollmentAnchor({ config, hostScope: currentBootstrapHostScope() }),
+        loadActiveSkillAuthorizationAnchor({ config, workspaceId, organizationAgentId, provider, hostScope: currentBootstrapHostScope() }),
     ]);
     if (!active)
         throw new Error('Active skill state is not anchored in secure storage. Run dharma skill sync again.');
@@ -4247,6 +5338,7 @@ async function expiredSkillAuthorizationForReplacement(provider, workspaceId, or
         throw new Error('Active skill device identity does not match secure enrollment state.');
     }
     const authorizationInput = (expectedReceiptHash) => ({
+        hostScope: currentBootstrapHostScope(),
         nativeSkillDirectory: root,
         workspaceId,
         provider,
@@ -4272,6 +5364,7 @@ async function expiredSkillAuthorizationForReplacement(provider, workspaceId, or
             throw error;
         const refreshed = await loadActiveSkillAuthorizationAnchor({
             config, workspaceId, organizationAgentId, provider, fresh: true,
+            hostScope: currentBootstrapHostScope(),
         });
         if (!refreshed)
             throw error;
@@ -4295,22 +5388,18 @@ async function loadVerifiedWorkspacePolicy(path, workspaceId) {
     return verified;
 }
 export async function installRepositoryAgentFabricSkill(input) {
-    if (input.sourceAuthorization !== undefined)
-        input = { ...input,
-            sourceAuthorization: validateRepositorySourceAuthorization(input.sourceAuthorization, input, new Date()) };
-    await assertRepositoryInstallerOwnership(input.workspace, input.workspaceId);
-    input = { ...input, workspace: await realpath(input.workspace) };
-    const ownership = await assertRepositoryInstallerOwnership(input.workspace, input.workspaceId);
-    const skillRoot = resolve(input.workspace, '.agents', 'skills', 'dharma-agent-fabric');
-    if (ownership !== 'signed')
-        await mkdir(resolve(skillRoot, 'references'), { recursive: true, mode: 0o700 });
-    await mkdir(resolve(input.workspace, '.dharma'), { recursive: true, mode: 0o700 });
+    const scope = currentBootstrapHostScope();
+    input = captureRepositoryInstallerInput(input);
+    const prepared = await prepareRepositoryInstallerWorkspace(input.workspace, input.workspaceId);
+    input = { ...input, workspace: prepared.workspace };
+    const ownership = prepared.ownership;
+    const contract = scope ? await scope.step(() => loadAgentFabricOnboardingContract()) : await loadAgentFabricOnboardingContract();
     const skill = `---
 name: dharma-agent-fabric
 description: Connect this repository to Dharma Agent Fabric for shared knowledge, signed skills, and team coordination.
 ---
 
-${(await loadAgentFabricOnboardingContract()).markdown}
+${contract.markdown}
 `;
     const reference = `# Organization connection
 
@@ -4369,6 +5458,7 @@ The CLI enrolls this device through browser-confirmed Clerk organization consent
     });
     await writeRepositoryInstallerFile(input.workspace, '.dharma/agent-fabric.json', `${JSON.stringify(connection, null, 2)}\n`);
     await writeRepositoryInstallerFile(input.workspace, '.dharma/repository-agent.json', `${JSON.stringify(repositoryAgent, null, 2)}\n`);
+    await scope?.assert();
     return {
         skillPath: '.agents/skills/dharma-agent-fabric/SKILL.md',
         connectionPath: '.dharma/agent-fabric.json',
@@ -4387,7 +5477,7 @@ async function repositoryInstallerRecoveryCommand(flags) {
     const config = await readDeviceConfig();
     if (!config || config.organizationId !== organizationId)
         throw new Error('Recovery requires current organization enrollment.');
-    await loadDeviceEnrollmentAnchor({ config });
+    await loadDeviceEnrollmentAnchor({ config, hostScope: currentBootstrapHostScope() });
     const identity = await preflightBootstrapWorkspaceIdentity(workspace);
     const registered = selectLegacyInstallerRecoveryWorkspace(await registry(), { organizationId, deviceId: config.deviceId,
         path: workspace, repositoryRemoteHash: identity.fingerprint, workspaceId });
@@ -4451,6 +5541,8 @@ async function onboard(flags) {
     const requestedHqUrl = normalizeHqUrl(portalUrl(flags));
     let config = await readDeviceConfig();
     if (!config) {
+        if (currentBootstrapHostScope())
+            throw new Error('codex_setup_host_enrollment_missing');
         const loginFlags = new Map(flags);
         loginFlags.set('hq-url', requestedHqUrl);
         loginFlags.set('organization-id', organizationId);
@@ -4722,10 +5814,8 @@ async function evidenceSync(flags) {
     assertCapsuleIntegrity(capsule);
     const trajectoryId = String(capsule.trajectoryId || '');
     const revision = Number(capsule.revision);
-    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
-    const vault = await LocalVault.open({
+    const vault = await openBootstrapVault({
         root: resolve(dharmaHome(), 'vault'),
-        masterKey: await loadOrCreateVaultMasterKey(),
     });
     try {
         const storedCapsule = await vault.getCapsule(trajectoryId, revision);
@@ -4739,7 +5829,7 @@ async function evidenceSync(flags) {
         return fabric.syncTrajectory(storedCapsule);
     }
     finally {
-        vault.close();
+        await vault.close();
     }
 }
 async function processEvidenceRequest(fabric, policy, workspaceId) {
@@ -4797,10 +5887,8 @@ async function processEvidenceRequest(fabric, policy, workspaceId) {
     finally {
         await requestHandle?.close().catch(() => undefined);
     }
-    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
-    const vault = await LocalVault.open({
+    const vault = await openBootstrapVault({
         root: resolve(dharmaHome(), 'vault'),
-        masterKey: await loadOrCreateVaultMasterKey(),
         rawLocalDays: rawLocalRetentionDays(policy),
     });
     try {
@@ -4906,7 +5994,7 @@ async function processEvidenceRequest(fabric, policy, workspaceId) {
         const receipt = accepted.receipt && typeof accepted.receipt === 'object' ? accepted.receipt : {};
         const receiptHash = typeof receipt.hash === 'string' && /^sha256:[a-f0-9]{64}$/.test(receipt.hash)
             ? receipt.hash : response.responseHash;
-        vault.recordDisclosure(unsignedResponse.responseId, receiptHash, bytesPrepared);
+        await vault.recordDisclosure(unsignedResponse.responseId, receiptHash, bytesPrepared);
         await writeJsonAtomic(requestReceipt, {
             schema: 'dharma.evidence-request-receipt/v1',
             requestId: request.requestId,
@@ -4922,7 +6010,7 @@ async function processEvidenceRequest(fabric, policy, workspaceId) {
         };
     }
     finally {
-        vault.close();
+        await vault.close();
     }
 }
 async function runOneEvidenceRequest(flags) {
@@ -5034,14 +6122,12 @@ async function syncSignedTaskTrajectory(input) {
     if (!validation.ok)
         throw new Error(`Signed task capsule failed schema validation: ${JSON.stringify(validation.errors)}`);
     assertCapsuleAuthorizedByCurrentPolicy(capsule, input.policy);
-    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
-    const vault = await LocalVault.open({
+    const vault = await openBootstrapVault({
         root: resolve(dharmaHome(), 'vault'),
-        masterKey: await loadOrCreateVaultMasterKey(),
         rawLocalDays: rawLocalRetentionDays(input.policy),
     });
     try {
-        const existing = vault.getCapsuleMetadata(capsule.trajectoryId, capsule.revision);
+        const existing = await vault.getCapsuleMetadata(capsule.trajectoryId, capsule.revision);
         if (!existing) {
             await vault.commitCapture({
                 raw: { plaintext: rawTurn, kind: 'raw-provider-turn', expectedContentId: rawContentId },
@@ -5058,14 +6144,14 @@ async function syncSignedTaskTrajectory(input) {
         else if (existing.capsuleHash !== capsule.capsuleHash) {
             throw new Error('Signed task evidence already exists with different immutable content.');
         }
-        vault.queueCapsuleSync(capsule.trajectoryId, capsule.revision);
+        await vault.queueCapsuleSync(capsule.trajectoryId, capsule.revision);
         await reserveDailyContentUpload(capsule, input.policy);
         const synced = await input.fabric.syncTrajectory(capsule);
-        vault.markCapsuleSynced(capsule.trajectoryId, capsule.revision);
+        await vault.markCapsuleSynced(capsule.trajectoryId, capsule.revision);
         return synced;
     }
     finally {
-        vault.close();
+        await vault.close();
     }
 }
 export function assertRecoveredTaskWorkspacePolicy(input) {
@@ -5108,10 +6194,8 @@ export async function postTaskOutcome(input) {
     return input.postEvent(input.task.taskId, input.receipt.status, input.payload);
 }
 async function stageSignedTaskTrajectoryRecovery(taskId, workspaceId, policy, prepared) {
-    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
-    const vault = await LocalVault.open({
+    const vault = await openBootstrapVault({
         root: resolve(dharmaHome(), 'vault'),
-        masterKey: await loadOrCreateVaultMasterKey(),
         rawLocalDays: rawLocalRetentionDays(policy),
     });
     try {
@@ -5127,7 +6211,7 @@ async function stageSignedTaskTrajectoryRecovery(taskId, workspaceId, policy, pr
         await vault.stageTaskCompletionRecovery(taskId, Buffer.from(JSON.stringify(recovery)));
     }
     finally {
-        vault.close();
+        await vault.close();
     }
 }
 async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, onlyTaskId) {
@@ -5135,10 +6219,8 @@ async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, only
         .filter((item) => !onlyTaskId || item.taskId === onlyTaskId);
     const finalized = [];
     for (const completion of completions) {
-        const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
-        const vault = await LocalVault.open({
+        const vault = await openBootstrapVault({
             root: resolve(dharmaHome(), 'vault'),
-            masterKey: await loadOrCreateVaultMasterKey(),
             rawLocalDays: rawLocalRetentionDays(vaultPolicy),
         });
         let recovery;
@@ -5146,7 +6228,7 @@ async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, only
             recovery = await vault.getTaskCompletionRecovery(completion.taskId);
         }
         finally {
-            vault.close();
+            await vault.close();
         }
         if (!recovery || recovery.schema !== 'dharma.signed-task-trajectory-recovery/v1'
             || recovery.taskId !== completion.taskId) {
@@ -5177,13 +6259,12 @@ async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, only
         };
         assertCapsuleIntegrity(capsule);
         if (recoveredTaskPolicyWasSuperseded(capsule, recoveryPolicy)) {
-            const supersededVault = await LocalVault.open({
+            const supersededVault = await openBootstrapVault({
                 root: resolve(dharmaHome(), 'vault'),
-                masterKey: await loadOrCreateVaultMasterKey(),
                 rawLocalDays: rawLocalRetentionDays(vaultPolicy),
             });
             try {
-                const existing = supersededVault.getCapsuleMetadata(capsule.trajectoryId, capsule.revision);
+                const existing = await supersededVault.getCapsuleMetadata(capsule.trajectoryId, capsule.revision);
                 if (!existing) {
                     await supersededVault.commitCapture({
                         raw: { plaintext: rawTurn, kind: 'raw-provider-turn', expectedContentId: recovery.prepared.rawContentId },
@@ -5204,22 +6285,21 @@ async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, only
                 else if (existing.capsuleHash !== capsule.capsuleHash) {
                     throw new Error('Recovered task evidence already exists with different immutable content.');
                 }
-                supersededVault.discardPendingCapsuleSync(capsule.trajectoryId, capsule.revision, 'policy_revision_superseded');
+                await supersededVault.discardPendingCapsuleSync(capsule.trajectoryId, capsule.revision, 'policy_revision_superseded');
             }
             finally {
-                supersededVault.close();
+                await supersededVault.close();
             }
             await fabric.acknowledgeRecoveredTaskCompletion(completion.taskId, completion.receiptHash);
-            const acknowledgedVault = await LocalVault.open({
+            const acknowledgedVault = await openBootstrapVault({
                 root: resolve(dharmaHome(), 'vault'),
-                masterKey: await loadOrCreateVaultMasterKey(),
                 rawLocalDays: rawLocalRetentionDays(vaultPolicy),
             });
             try {
                 await acknowledgedVault.clearTaskCompletionRecovery(completion.taskId);
             }
             finally {
-                acknowledgedVault.close();
+                await acknowledgedVault.close();
             }
             finalized.push({
                 taskId: completion.taskId,
@@ -5243,16 +6323,15 @@ async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, only
             },
         });
         await fabric.acknowledgeRecoveredTaskCompletion(completion.taskId, completion.receiptHash);
-        const cleanupVault = await LocalVault.open({
+        const cleanupVault = await openBootstrapVault({
             root: resolve(dharmaHome(), 'vault'),
-            masterKey: await loadOrCreateVaultMasterKey(),
             rawLocalDays: rawLocalRetentionDays(vaultPolicy),
         });
         try {
             await cleanupVault.clearTaskCompletionRecovery(completion.taskId);
         }
         finally {
-            cleanupVault.close();
+            await cleanupVault.close();
         }
         finalized.push({ taskId: completion.taskId, trajectory });
     }
@@ -5463,6 +6542,7 @@ export async function nativeSkillDirectoryForWorkspace(input) {
                 const anchor = await loadActiveSkillAuthorizationAnchor({
                     config, workspaceId: input.workspaceId, organizationAgentId: registered.repositoryAgentId,
                     provider: input.provider, fresh: true,
+                    hostScope: currentBootstrapHostScope(),
                 });
                 if (anchor) {
                     const matching = await nativeSkillRootMatchingAuthorization({
@@ -6104,6 +7184,7 @@ export function validateSkillBundleSources(bundle) {
 }
 export async function recoverLegacySkillBundleIdAfterAuthorizationFailure(input) {
     const legacyBundleId = await getLegacySkillBundleIdForUpgrade({
+        hostScope: currentBootstrapHostScope(),
         nativeSkillDirectory: input.nativeSkillDirectory,
         workspaceId: input.workspaceId,
     });
@@ -6134,7 +7215,7 @@ export async function loadSkillSynchronizationPolicy(policyPath, workspaceId, se
     verifyServerAuthorizedPolicy({ policy, publicKeyEd25519: config.serverPublicKeyEd25519,
         organizationId: config.organizationId, workspaceId });
     await assertWorkspaceAuthorizationCurrent(workspaceId, policy.serverAuthorization);
-    const enrollment = await loadDeviceEnrollmentAnchor({ config, store: secureStore });
+    const enrollment = await loadDeviceEnrollmentAnchor({ config, store: secureStore, hostScope: currentBootstrapHostScope() });
     await assertWorkspaceAuthorizationCurrent(workspaceId, policy.serverAuthorization);
     verifyServerAuthorizedPolicy({ policy, publicKeyEd25519: enrollment.serverPublicKeyEd25519,
         organizationId: config.organizationId, workspaceId });
@@ -6174,7 +7255,8 @@ export async function prepareSkillUpdate(input) {
     let legacyBaselineMigrationRequested = false;
     if (input.automatic) {
         activeBundleId = (await loadActiveSkillAuthorizationAnchor({ config, workspaceId,
-            organizationAgentId: String(workspace.repositoryAgentId || ''), provider, store: input.store, fresh: true }))?.bundleId ?? null;
+            organizationAgentId: String(workspace.repositoryAgentId || ''), provider, store: input.store, fresh: true,
+            hostScope: currentBootstrapHostScope() }))?.bundleId ?? null;
         assertRunning();
     }
     else {
@@ -6294,7 +7376,7 @@ export async function prepareSkillUpdate(input) {
             assertCurrent();
         }
         for (const skill of bundle.skills) {
-            const actual = await contentHash(containedInlinePath(sourceRoot, skill.path));
+            const actual = await contentHash(containedInlinePath(sourceRoot, skill.path), currentBootstrapHostScope());
             assertCurrent();
             if (actual !== skill.contentHash)
                 throw new Error('Prepared skill tree does not match the signed content hash.');
@@ -6319,12 +7401,9 @@ async function activatePreparedSkillUpdate(input) {
             workspaceId,
             organizationAgentId: String(workspace.repositoryAgentId || ''),
             provider,
+            hostScope: currentBootstrapHostScope(),
         });
-        const identity = await loadOrCreateDeviceIdentity({
-            hqUrl: config.hqUrl,
-            organizationId: config.organizationId,
-            installationId: config.installationId,
-        });
+        const identity = await enrolledDeviceIdentity(config);
         repositoryDelivery?.assertCurrent();
         const current = await loadSkillSynchronizationPolicy(policyPath, workspaceId);
         if (canonicalize(current.policy) !== canonicalize(policy)
@@ -6334,6 +7413,7 @@ async function activatePreparedSkillUpdate(input) {
         }
         repositoryDelivery?.assertCurrent();
         const receipt = await installSkillBundle({
+            hostScope: currentBootstrapHostScope(),
             bundle,
             sourceDirectory: sourceRoot,
             nativeSkillDirectory: destination,
@@ -6371,16 +7451,18 @@ async function activatePreparedSkillUpdate(input) {
                     receiptHash: previousAnchor.receiptHash,
                     activatedAt: previousAnchor.activatedAt,
                     expiresAt: previousAnchor.expiresAt,
+                    hostScope: currentBootstrapHostScope(),
                 });
             }
             else {
-                await deleteActiveSkillAuthorizationAnchor({ config, workspaceId, provider });
+                await deleteActiveSkillAuthorizationAnchor({ config, workspaceId, provider, hostScope: currentBootstrapHostScope() });
             }
         };
         const recoverLocalInstallation = async (error) => {
             const recoveryErrors = [];
             try {
                 await rollbackUnconfirmedSkillBundle({
+                    hostScope: currentBootstrapHostScope(),
                     nativeSkillDirectory: destination,
                     workspaceId,
                     receipt,
@@ -6411,6 +7493,7 @@ async function activatePreparedSkillUpdate(input) {
                     receiptHash: receipt.receiptHash,
                     activatedAt: receipt.completedAt,
                     expiresAt: bundle.expiresAt ?? null,
+                    hostScope: currentBootstrapHostScope(),
                 });
             }
         }
@@ -6458,12 +7541,8 @@ async function installedRepositoryKnowledge(workspace, selectedProvider) {
     if (!config || config.organizationId !== workspace.organizationId || !workspace.repositoryBindingId || !workspace.repositoryAgentId) {
         throw new Error('Installed repository knowledge requires current enrolled workspace scope.');
     }
-    const identity = await loadOrCreateDeviceIdentity({
-        hqUrl: config.hqUrl,
-        organizationId: config.organizationId,
-        installationId: config.installationId,
-    });
-    const enrollment = await loadDeviceEnrollmentAnchor({ config });
+    const identity = await enrolledDeviceIdentity(config);
+    const enrollment = await loadDeviceEnrollmentAnchor({ config, hostScope: currentBootstrapHostScope() });
     if (identity.publicKeyEd25519 !== enrollment.devicePublicKeyEd25519)
         throw new Error('Installed knowledge device identity mismatch.');
     const organizationAgentId = workspace.repositoryAgentId;
@@ -6477,11 +7556,13 @@ async function installedRepositoryKnowledge(workspace, selectedProvider) {
             });
             if (!await pathExistsOrThrow(resolve(root, '.dharma-managed/workspaces', workspace.workspaceId, 'ACTIVE_BUNDLE')))
                 return null;
-            const anchorInput = { config, workspaceId: workspace.workspaceId, organizationAgentId, provider };
+            const anchorInput = { config, workspaceId: workspace.workspaceId, organizationAgentId, provider,
+                hostScope: currentBootstrapHostScope() };
             const active = await loadActiveSkillAuthorizationAnchor(anchorInput);
             if (!active)
                 throw new Error('Installed knowledge release lacks a protected authorization anchor.');
             const read = (expectedReceiptHash) => readVerifiedRepositoryKnowledge({
+                hostScope: currentBootstrapHostScope(),
                 nativeSkillDirectory: root, workspaceId: workspace.workspaceId, provider,
                 organizationId: config.organizationId, organizationAgentId, deviceId: config.deviceId,
                 serverPublicKey: createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: enrollment.serverPublicKeyEd25519 }, format: 'jwk' }),
@@ -6519,7 +7600,7 @@ async function takeCachedSkillUpdate(input) {
         const serverPublicKey = createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: config.serverPublicKeyEd25519 }, format: 'jwk' });
         verifySkillBundle(bundle, serverPublicKey);
         for (const skill of bundle.skills) {
-            if (await contentHash(containedInlinePath(cached.sourceRoot, skill.path)) !== skill.contentHash) {
+            if (await contentHash(containedInlinePath(cached.sourceRoot, skill.path), currentBootstrapHostScope()) !== skill.contentHash) {
                 throw new Error('Cached skill tree does not match the signed content hash.');
             }
         }
@@ -6686,14 +7767,12 @@ async function relayWorkspaceLoop(flags, signal, serialized) {
     let repositorySourceState = 'not_scanned';
     let sourceScanFlight = null;
     let sourceScanReady = null;
-    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
-    const vault = await LocalVault.open({
+    const vault = await openBootstrapVault({
         root: resolve(dharmaHome(), 'vault'),
-        masterKey: await loadOrCreateVaultMasterKey(),
         rawLocalDays: rawLocalRetentionDays(policy),
     });
     if (signal.aborted)
-        vault.close();
+        await vault.close();
     signal.throwIfAborted();
     signal.addEventListener('abort', stop, { once: true });
     if (signal.aborted)
@@ -7019,7 +8098,7 @@ async function relayWorkspaceLoop(flags, signal, serialized) {
             await sourceScanFlight;
         await consumeSourceScan();
         await skillPreparationPump.stop();
-        vault.close();
+        await vault.close();
         signal.removeEventListener('abort', stop);
     }
     return {
@@ -7035,6 +8114,20 @@ async function relayWorkspaceLoop(flags, signal, serialized) {
 export async function run(argv) {
     const { positional, flags, repeated } = parseCliOptions(argv);
     const [command, subcommand] = positional;
+    const setupScope = currentBootstrapHostScope();
+    if (setupScope) {
+        // An admitted native callback keeps its original authority through the
+        // official dispatcher. Closed descendants never use the legacy route.
+        const prepared = await inspectCodexBootstrapHostPreparation(setupScope);
+        if (command !== 'bootstrap' || positional.length !== 1 || flags.size !== prepared.flags.size
+            || [...repeated.values()].some(values => values.length !== 1)
+            || [...prepared.flags].some(([key, value]) => flags.get(key) !== value)) {
+            throw new Error('codex_setup_host_command_mismatch');
+        }
+        if (!prepared.flags.has('dry-run'))
+            await originalCodexSetupSessionSender(setupScope);
+        return setupScope.step(() => bootstrap(flags, setupScope));
+    }
     if (command === 'relay' && subcommand === 'container-entrypoint') {
         if (positional.length === 2 && flags.size === 1 && flags.get('dry-run') === true) {
             return { ok: true, stage: 'container_entrypoint_plan', started: false,