@jc_stack/ez-agents 0.1.0-beta.27 → 0.1.0-beta.29

package/.env.example

@@ -44,3 +44,12 @@ EZ_REPAIR_ENABLED=true
 # monitor-only credentials; do not put them in an agent workspace.
 # EZ_WATCH_ENROLL_TOKEN=
 # EZ_WATCH_TELEGRAM_CHAT_ID=
+
+# Optional native application-only runtime: no Telegram bot or token.
+# Requires EZ_APPLICATION_PORT; administrator bootstrap uses the real operator ID.
+# EZ_TELEGRAM_ENABLED=false
+# Private application-only local container isolation (optional; default workspace-write).
+# EZ_CODEX_SANDBOX=external
+
+# Optional Mini App launcher (public URL, no credentials).
+# EZ_TELEGRAM_WEB_APP={"command":"voice","label":"Voice","url":"https://voice.example.com/"}

package/AGENTS.md

@@ -2,6 +2,9 @@
 
 Ez supports two independent, composable uses: an autonomous Telegram agent and
 workspace-scoped plugins called by your existing local CLI/GUI executor.
+The autonomous agent also supports authenticated application channels without
+Telegram; see docs/application-channel.md. One installation owner can link several
+channels. Channel credentials and reply destinations do not create new owners.
 For CLI-only requests, follow [standalone setup](docs/standalone-cli.md): no Telegram
 pairing, relay or host executor is required. The main-first Telegram onboarding
 rules below apply only when installing the autonomous relay. When both are
@@ -53,6 +56,23 @@ This package will be published as an open-source, lightweight Telegram-to-CLI re
 - `/goal do my daily routine` is literal task-prompt text for the engine. ez does not parse it, construct a native objective or own its workflow.
 - Keep changes focused. State what was removed, why anything added is necessary, and which observed outcome proves the simpler system works. Preserve authority and uncertain-delivery safeguards. Unchanged, non-actionable maintenance stops quietly; queued updates and passing tests alone do not prove an installed fix.
 
+## Fast KISS iterations
+
+Deliver the smallest useful product increment and verify its main user path.
+Once that works within the architecture and authority boundaries, complete the
+authorized delivery instead of spending disproportionate effort on rare,
+low-impact edge cases. Prefer fast feedback and a focused follow-up fix over
+speculative abstractions, fallback layers or exhaustive test matrices.
+
+Scale validation to likelihood, impact and reversibility: test the changed
+behavior and relevant failure boundaries, run required checks, then stop when
+they pass. Broaden testing only for a concrete unresolved risk or new failure.
+Architecture violations, authorization/secret exposure, data loss and uncertain
+external writes remain blockers even when rare; minor recoverable limitations
+can be stated briefly and deferred. Reviewers distinguish those blockers from
+optional follow-ups and do not hold a working increment for hypothetical polish.
+Measure progress by usable outcomes and feedback, not code or test volume.
+
 ## 3. Crash-Safe Atomic Disk State
 - All persistent stores (`ControlStore`, `RunStore`, outbox queue) must be disk-backed JSON files.
 - **Atomic write pattern:** Never write directly to a state file. Always write to a temporary file (`${target}.${process.pid}.tmp`) with mode `0o600`, then atomically `rename` it over the destination.
@@ -100,7 +120,11 @@ Own the complete engineering/release handoff in CONTRIBUTING.md. Once ready,
 proactively request only missing merge/release authority, then ship and verify;
 do not leave the maintainer to discover ready drafts or operate the release.
 
-- In channel-backend mode, the application owns native sessions and actions. Forward normalized inputs with stable run IDs, recover only by idempotent backend submission, and deliver replies through the existing outbox. Never launch a fallback CLI or pass relay credentials into an executor.
+For every core or plugin PR you author, revise or review, apply CONTRIBUTING.md's
+architecture check and the README's engine/application boundary. A symptom fix
+and green tests do not justify a conflicting execution or context owner. Existing
+legacy channel-backend code is a documented limitation, not a pattern for new
+integrations; applications submit agent turns through the native Ez execution path.
 
 A coding-task handoff must include the pushed commit and draft PR URL, checks,
 independent-review status and remaining QA. If PR creation is blocked, state the

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## Unreleased
+
+## 0.1.0-beta.29
+
+- Republish the beta.28 Voice connection and web-serving contract at a monotonic
+  version so installations already running private beta.28 QA builds can upgrade
+  through the standard verified public-package path. Runtime behavior is unchanged.
+
+## 0.1.0-beta.28
+
+- Hide empty conversation placeholders from history and update the same menu
+  when navigating Back, rather than adding another menu message.
+- Keep the conversation list to names only; show Archive/Restore for the selected
+  conversation. Label older chats from saved owner messages instead of opaque IDs.
+- Add named Telegram conversations with switching, renaming, archiving and
+  restoring. Preserve native engine bindings and queued work across switches.
+- Add the authenticated application channel to the standard runtime, including
+  botless deployments, explicit owner sharing, native conversation continuity,
+  isolated non-root containers and writable-folder grants.
+- Add owner-bound persistent plugin connections with installed-tool discovery,
+  native task access and revocation-safe Telegram delivery receipts.
+- Add explicit loopback-only `tools serve`, live read-only owner discovery and an
+  optional authenticated private-chat Mini App launcher for plugin-owned web UIs.
+- Fix packaged application command availability and private-plugin update checks.
+- Document agent-owned maintenance for separately deployed applications and add
+  owner-bound, on-demand Telegram delivery-history lookup across native sessions.
+- Clarify the native-engine, transport and plugin ownership boundaries and the
+  proportionate KISS contribution/review standard.
+
 ## 0.1.0-beta.27
 
 - Pass literal task input and `/goal` requests to the selected engine; remove

package/CONTRIBUTING.md

@@ -36,6 +36,34 @@ should explain the user problem and a small acceptance example. Security reports
 follow SECURITY.md. Release and new-plugin requirements: docs/releasing.md and
 docs/plugin-contributions.md.
 
+## Proportional scope and validation
+
+Follow AGENTS.md's fast KISS iteration principle. Define the smallest useful
+increment, verify the main user path and relevant failure boundaries, and run
+required checks. Once these pass and the architecture is preserved, finish the
+authorized delivery. Do not expand scope or repeat tests to cover hypothetical,
+low-impact edge cases. No new tests are needed merely to mirror wording or an
+obvious reversible edit. Broaden verification only when evidence warrants it.
+Reviewers must distinguish material blockers from optional follow-ups; briefly
+record real deferred limitations without making them conditions of this PR.
+
+## Architecture check for every PR
+
+Authors and reviewers apply the [engine and application boundaries](README.md#engine-and-application-boundaries)
+to every proposed or revised core/plugin change. State the failing boundary,
+what can be removed or simplified, which component owns each remaining
+responsibility, and the focused evidence for the fix. Evaluate instructions,
+retries and lifecycle owners as implementation complexity too.
+
+The independent reviewer must confirm that the final diff preserves this boundary;
+passing CI or fixing the immediate symptom is insufficient. Reject replacement
+conversation/prompt assembly, competing agent-turn runners or queues, and domain
+workflows in transport. Preserve necessary authorization, persistence and delivery
+safeguards, standard controls, and the intentional engine-decided chat guidance.
+Resolve violations before approval or merge. Report existing out-of-scope problems
+with sanitized evidence and a next action in an existing issue when available;
+do not disguise them as supported architecture or start a duplicate repair.
+
 ## Isolated work and review
 
 - One coherent change, one branch, one dedicated Git worktree, one PR per

package/Dockerfile

@@ -10,6 +10,7 @@ FROM dependencies AS test
 RUN pnpm verify
 FROM dependencies AS runtime
 RUN chmod +x docker/entrypoint.sh bin/ezenciel-agents* && mkdir -p /state/control /state/home /workspace && chown node:node /state/control /state/home /workspace
+RUN node -e 'for (const [name, target] of Object.entries(require("./package.json").bin)) require("node:fs").symlinkSync("/app/" + target, "/usr/local/bin/" + name)'
 ENV HOME=/state/home EZ_AGENT_WORKSPACE=/workspace EZ_CONTROL_DIR=/state/control EZ_EXECUTOR_CLI=grok PATH=/app/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 WORKDIR /workspace
 ENTRYPOINT ["/app/docker/entrypoint.sh"]

package/README.md

@@ -10,27 +10,70 @@ following up on an agreed task. Each assistant has its own working context and
 responsibilities. The tools and permissions you configure determine what it can
 do.
 
-An AI harness is the client that lets a model reason, use tools and carry out
-work. Ez uses your chosen host CLI and its existing login. The harness does the
-reasoning; Ez connects it to a persistent workspace, messaging, plugins and
-explicit authority boundaries. Telegram is the current owner interface.
+## Engine and application boundaries
+
+Ez is a thin wrapper and transport layer around the native agent CLI engine.
+The engine owns inference, native sessions, context management, tool execution,
+goals, delegation and continuation. Ez supplies channel delivery, scheduling,
+standard runtime controls, authorization, secret isolation, session binding,
+durable admission, cancellation and delivery receipts.
+
+User text passes through unchanged, with only minimal additional metadata or
+instructions needed for channel-specific elements such as attachments, quoted
+messages and reply delivery. Ez may adapt media through transcription or speech
+synthesis. Its deliberate, narrow workflow opinion is chat responsiveness:
+instructions encourage the engine to move lengthy work into an Ez-scheduled task
+or use native delegation when appropriate. The engine decides whether and how
+to do so; Ez does not enforce a business workflow or manage native goals.
+
+Ez must not reconstruct conversation history for automatic prompt replay,
+assemble a conventional LLM/API conversation prompt or wrap each message in a
+replacement system prompt. The native engine maintains its session and context.
+Native workspace instructions, plugin discovery and explicit agent-requested
+access to delivery receipts or task context complement that context without
+replacing it.
+
+Applications integrate through public or purpose-built private plugins exposing
+documented CLI commands to the agent. Agent-initiated application actions run
+through those commands, which enforce authentication, authorization, validation
+and canonical persistence directly or through authoritative application services.
+Authenticated application interfaces and separate human approval flows may
+access those services directly.
+
+Application interfaces submit agent turns through the same Ez execution path,
+without separate agent runners, application-owned model-routing layers,
+conversation engines or competing execution queues for those turns.
+Deterministic plugin services, provider connections, domain jobs, UI transcripts
+and delivery queues are permitted when they do not take ownership of agent
+execution.
+
+Preserve standard Ez commands and behavior across channels, including scheduling
+and runtime controls; document any current capability gaps explicitly.
+Application-specific behavior belongs in plugin instructions and CLI commands,
+not transport branches or replacement runtime controls.
+
+These are architecture requirements. The current application-only runtime accepts
+foreground application turns; background scheduling with application delivery is
+not implemented. The legacy channel-backend mode delegates execution and changes
+standard controls, so it does not meet this integration boundary. New integrations
+use the [native application channel](docs/application-channel.md).
 
 ## What makes an Ez assistant
 
 | Part | What it contributes |
 |---|---|
 | **Workspace** | Markdown instructions, business context and working files that persist across conversations and changes of AI. |
-| **Harness** | The existing AI client that plans, chooses tools and executes work. See [AI selection](docs/architecture/ai-selection.md). |
+| **Native engine** | Inference, native sessions, context management and tool execution. See [AI selection](docs/architecture/ai-selection.md). |
 | **Authority** | A verified owner and explicit limits on delegated work. Receiving a message or installing a tool does not grant permission to act. |
-| **Plugins** | Separately maintained tools and connections, with instructions the agent can discover and use. Provider authentication and receipts belong to the plugin. |
-| **Messaging and continuity** | A way to reach the assistant, return results and continue work in its own environment. |
+| **Plugins** | Documented CLI commands and agent instructions for application capabilities. Commands enforce authentication, authorization, validation and canonical persistence directly or through authoritative application services. |
+| **Ez transport and runtime** | Channel delivery, scheduling and standard runtime controls around the native engine. |
 
 The design starts with one assistant, one mind and clear responsibilities.
 Business instructions live in the workspace; reusable capabilities live in tools
 and plugins. The agent decides how to do the work using those instructions and
 the capabilities available to it.
 
-Use the harness's native capabilities when they meet the need. Add a standalone
+Use the engine's native capabilities when they meet the need. Add a standalone
 plugin when a missing integration earns the maintenance. Ez keeps the surrounding
 runtime small, so your files, tools and business knowledge remain useful as AI
 clients improve.
@@ -211,6 +254,34 @@ optional. Installed plugin snippets and skill paths come from `ez tools list --d
 Credentials and control state stay outside the mind. File separation is not
 OS isolation against a process running as the same user.
 
+In Telegram, **Conversations** (or `/chats`) lists this agent's saved Ez
+conversations by name. Tap a name to continue its native engine session and
+restore its AI choice. Names start with the first message; `/rename Client launch`
+sets a custom name for the current conversation. **New conversation** keeps the
+old one available. **Archive this conversation**, shown after selecting a name, hides a conversation without deleting its engine
+history; **Archived conversations → select a name → Restore conversation** brings it back. Archiving the current conversation
+leaves the next message to start a fresh one. Running and queued work stays bound
+to its original conversation; archive does not cancel work.
+
+Agents can inspect what was sent to the bound Telegram chat across conversations
+with `ezenciel-agents-message history` (latest 8 deliveries), `--limit N` (1–50),
+or `--message-id ID` for a specific message, including a chunk of a longer report.
+This read-only command requires an active owner Telegram run and returns confirmed
+local receipts with message IDs, delivery times and source run/session references.
+It does not change the selected conversation or inject history into prompts.
+Only retained receipts from the current owner binding are available; Telegram
+edits/deletions and attachment contents are not fetched.
+
+Existing conversations without a title show their first saved message and date when
+available. Empty routing placeholders are omitted from history; + New conversation
+is the create action. Back updates the current menu without creating a conversation. Use /rename for a custom name. Older
+records without a saved model reuse a known choice for their original CLI.
+Antigravity's latest-only resume cannot switch back to an older conversation.
+The list covers sessions already tracked by this Ez agent; it does not import
+unrelated GUI/CLI history. Application-backed channels keep session controls in
+the connected application. Shared workspace files still persist across topics.
+
+
 Telegram intake is owner-gated. The executor sends replies with the messaging
 CLI; stdout is not a reply. A process exit code is not delivery proof.
 Voice/media needs its additional providers and tools; defer optional setup

package/bin/ezenciel-agents-application

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec node "$(dirname "$0")/ezenciel-agents-application.mjs" "$@"

package/bin/ezenciel-agents-application.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process'
+import { createRequire } from 'node:module'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const require = createRequire(import.meta.url)
+const tsx = require.resolve('tsx')
+const entry = join(here, '..', 'src', 'application-cli.ts')
+const forwarded = process.argv.slice(2).filter((arg) => arg !== '--')
+const child = spawn(process.execPath, ['--import', tsx, entry, ...forwarded], { stdio: 'inherit' })
+child.on('exit', (code, signal) => {
+  if (signal) process.kill(process.pid, signal)
+  process.exit(code ?? 1)
+})

package/compose.yaml

@@ -12,13 +12,21 @@ services:
     # still removes every capability from the relay and its executor children.
     cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, SETPCAP, KILL]
     environment:
+      EZ_RUNTIME_UID: ${EZ_RUNTIME_UID:-1000}
+      EZ_RUNTIME_GID: ${EZ_RUNTIME_GID:-1000}
+      EZ_RELAY_UID: ${EZ_RELAY_UID:-1001}
       EZ_REPAIR_ENABLED: ${EZ_REPAIR_ENABLED:-true}
       EZ_AGENT_PURPOSE_FILE: /run/agent-purpose.md
       EZ_EXECUTOR_TRANSPORT: ${EZ_EXECUTOR_TRANSPORT:-host}
       EZ_CHANNEL_BACKEND_URL: ${EZ_CHANNEL_BACKEND_URL:-}
+      EZ_TELEGRAM_WEB_APP: ${EZ_TELEGRAM_WEB_APP:-}
+      EZ_TELEGRAM_ENABLED: ${EZ_TELEGRAM_ENABLED:-true}
+      EZ_APPLICATION_PORT: ${EZ_APPLICATION_PORT:-}
+      EZ_APPLICATION_HOST: ${EZ_APPLICATION_HOST:-127.0.0.1}
       EZ_AGENT_WORKSPACE: ${EZ_AGENT_WORKSPACE:?Set this agent workspace}
       EZ_CONTROL_DIR: ${EZ_CONTROL_DIR:?Set this agent control directory}
       EZ_EXECUTOR_CLI: ${EZ_EXECUTOR_CLI:?Set the host installation CLI}
+      EZ_CODEX_SANDBOX: ${EZ_CODEX_SANDBOX:-}
       EZ_CODEX_AUTO_COMPACT_TOKENS: ${EZ_CODEX_AUTO_COMPACT_TOKENS:-64000}
       EZ_EXECUTOR_TIMEOUT_SECONDS: ${EZ_EXECUTOR_TIMEOUT_SECONDS:-300}
       EZ_PAGERDUTY_STOCKS_HEALTH_URL: ${EZ_PAGERDUTY_STOCKS_HEALTH_URL:-}

package/docker/entrypoint.sh

@@ -1,13 +1,31 @@
 #!/bin/sh -p
 set -eu
 umask 077
+runtime_uid=${EZ_RUNTIME_UID:-1000}
+runtime_gid=${EZ_RUNTIME_GID:-1000}
+relay_uid=${EZ_RELAY_UID:-1001}
+for runtime_id in "$runtime_uid" "$runtime_gid" "$relay_uid"; do
+  case "$runtime_id" in
+    ''|*[!0-9]*|0*) echo 'Runtime UID/GID values must be positive decimal IDs' >&2; exit 64 ;;
+  esac
+  if [ "${#runtime_id}" -gt 10 ] || [ "$runtime_id" -gt 2147483647 ]; then
+    echo 'Runtime UID/GID values must not exceed 2147483647' >&2; exit 64
+  fi
+done
+if [ "$runtime_uid" = "$relay_uid" ]; then
+  echo 'EZ_RELAY_UID must differ from EZ_RUNTIME_UID to isolate relay secrets' >&2
+  exit 64
+fi
 if [ "$(id -u)" = 0 ]; then
   mkdir -p /state/control /state/home /workspace /run/secrets
   chmod 700 /run/secrets
-  chown 1000:1000 /state/control /state/home /workspace
+  chown "$runtime_uid:$runtime_gid" /state/control /state/home /workspace
   if [ -f /run/secrets/relay_env ]; then exec 3</run/secrets/relay_env; else exec 3</dev/null; fi
-  exec setpriv --ruid=1001 --euid=1000 --regid=1000 --clear-groups --bounding-set=-all --no-new-privs /app/docker/entrypoint.sh "$@"
+  exec setpriv --ruid="$relay_uid" --euid="$runtime_uid" --regid="$runtime_gid" --clear-groups --bounding-set=-all --no-new-privs /app/docker/entrypoint.sh "$@"
 fi
+# Reserve the private environment descriptor before Node can use it for libuv.
+# Root startup already opened it; preserve that inherited secret descriptor.
+( : <&3 ) 2>/dev/null || exec 3</dev/null
 case "${1:-start}" in
   start|smoke|exec|setup)
     exec flock --no-fork -n -E 73 /state/control/relay.lock node --import /app/node_modules/tsx/dist/loader.mjs /app/docker/run.ts "$@" ;;

package/docker/healthcheck.mjs

@@ -4,7 +4,7 @@ const fail = code => { process.stderr.write(`EZ_HEALTH_${code}\n`); process.exit
 let value;
 try { value = JSON.parse(readFileSync(relayControl + '/heartbeat.json', 'utf8')); }
 catch { fail('RELAY_UNREADABLE'); }
-if (!value.polling) fail('RELAY_NOT_POLLING');
+if (!value.polling && !(process.env.EZ_TELEGRAM_ENABLED === 'false' && value.applicationOnly === true)) fail('RELAY_NOT_POLLING');
 if (!Number.isFinite(value.at) || Date.now() - value.at > 20000) fail('RELAY_STALE');
 
 if (process.env.EZ_EXECUTOR_TRANSPORT === 'host') {

package/docker/run.ts

@@ -32,7 +32,7 @@ if (command === 'start') {
   const heartbeat = '/state/control/heartbeat.json'
   await rm(heartbeat, { force: true })
   const timer = setInterval(() => {
-    if (relay.bot.isRunning()) void writeFile(heartbeat, JSON.stringify({ at: Date.now(), polling: true, version: packageVersion }), { mode: 0o600 })
+    if (relay.isRunning()) void writeFile(heartbeat, JSON.stringify({ at: Date.now(), polling: Boolean(relay.bot?.isRunning()), applicationOnly: process.env.EZ_TELEGRAM_ENABLED === 'false', version: packageVersion }), { mode: 0o600 })
   }, 5000)
   for (const signal of ['SIGINT', 'SIGTERM'] as const) process.once(signal, () => { clearInterval(timer); void relay.stop() })
   try { await relay.start() } finally { clearInterval(timer); await rm(heartbeat, { force: true }) }
@@ -47,6 +47,6 @@ if (command === 'start') {
   child.on('exit', (code) => { process.exitCode = code ?? 1 })
 } else if (command === 'setup') {
   await (await import('../src/setup.js')).runCli()
-} else if (['owner', 'source', 'message', 'react'].includes(command)) {
-  await import(`../src/${command === 'source' ? 'source-cli' : command}.js`)
+} else if (['owner', 'source', 'application', 'message', 'react'].includes(command)) {
+  await import(`../src/${command === 'source' ? 'source-cli' : command === 'application' ? 'application-cli' : command}.js`)
 } else throw new Error('Use start, smoke, exec, setup, owner, source, message or react')

package/docker/smoke.mjs

@@ -7,10 +7,37 @@ const image = process.env.EZ_RELAY_IMAGE || 'ezenciel-agents:local';
 const dir = mkdtempSync(join(tmpdir(), 'ez-docker-qa-'));
 const holder = `ez-main-lock-qa-${process.pid}`;
 const volume = `${holder}-control`;
+const application = `${holder}-application`;
 const marker = 'qa-private-secret-never-in-executor';
 writeFileSync(join(dir, 'relay.env'), `TELEGRAM_BOT_TOKEN=${marker}\n`, { mode: 0o600 });
+writeFileSync(join(dir, 'node'), `#!/bin/sh\nIFS= read -r value <&3\n[ "$value" = "TELEGRAM_BOT_TOKEN=${marker}" ] || exit 91\nexec /usr/local/bin/node "$@"\n`, { mode: 0o555 });
 const run = (args) => spawnSync('docker', args, { encoding: 'utf8', timeout: 60000 });
 try {
+  const inherited = run(['run','--rm','--mount',`type=bind,src=${join(dir,'relay.env')},dst=/run/secrets/relay_env,readonly`,
+    '--mount',`type=bind,src=${join(dir,'node')},dst=/qa/node,readonly`,'-e','PATH=/qa:/usr/local/bin:/usr/bin:/bin',image,'application','--help']);
+  assert.equal(inherited.status,0,inherited.stderr);
+  const nonroot = ['--user','20000:20000','--read-only','--cap-drop','ALL','--security-opt','no-new-privileges',
+    '--tmpfs','/tmp:mode=1777','--tmpfs','/state/control:uid=20000,gid=20000,mode=700',
+    '--tmpfs','/state/home:uid=20000,gid=20000,mode=700','--tmpfs','/workspace:uid=20000,gid=20000,mode=700',
+    '-e','EZ_TELEGRAM_ENABLED=false','-e','EZ_APPLICATION_PORT=8110','-e','EZ_EXECUTOR_TRANSPORT=local','-e','EZ_EXECUTOR_CLI=codex'];
+  const help = run(['run','--rm',...nonroot,image,'application','--help']);
+  assert.equal(help.status,0,help.stderr);
+  assert.match(help.stdout,/ezenciel-agents-application/);
+  const login = run(['run','--rm',...nonroot,'--entrypoint','/bin/bash',image,'-lc',
+    'command -v ezenciel-agents-application && command -v ezenciel-agents-message && ezenciel-agents-message --help']);
+  assert.equal(login.status,0,login.stderr);
+  assert.match(login.stdout,/\/usr\/local\/bin\/ezenciel-agents-application/);
+  assert.match(login.stdout,/\/usr\/local\/bin\/ezenciel-agents-message/);
+  const started = run(['run','-d','--name',application,...nonroot,image,'start']);
+  assert.equal(started.status,0,started.stderr);
+  let ready = false;
+  for (let n=0;n<60;n++) {
+    if (run(['exec',application,'node','/app/docker/healthcheck.mjs']).status===0) { ready=true; break; }
+    await new Promise(resolve=>setTimeout(resolve,200));
+  }
+  assert.ok(ready,run(['logs',application]).stderr);
+  assert.equal(run(['stop','--time','10',application]).status,0);
+  assert.equal(run(['inspect','--format','{{.State.ExitCode}}',application]).stdout.trim(),'0');
   const probe = `
     const fs = require('fs'), assert = require('assert/strict');
     assert.equal(process.getuid(), 1000);
@@ -28,6 +55,18 @@ try {
   const result = run(['run', '--rm', '--mount', `type=bind,src=${join(dir,'relay.env')},dst=/run/secrets/relay_env,readonly`, image, 'exec', 'node', '-e', probe, literal]);
   assert.equal(result.status, 0, result.stderr);
   assert.deepEqual(JSON.parse(result.stdout).argv, [literal]);
+  const customProbe = probe.replace('process.getuid(), 1000', 'process.getuid(), 20001') + `
+    assert.equal(process.geteuid(),20001);
+    assert.equal(process.getgid(),20002);
+    assert.equal(process.getegid(),20002);
+    for (const directory of ['/state/control','/state/home','/workspace']) {
+      const info=fs.statSync(directory); assert.equal(info.uid,20001); assert.equal(info.gid,20002);
+    }
+  `;
+  const custom = run(['run','--rm','-e','EZ_RUNTIME_UID=20001','-e','EZ_RUNTIME_GID=20002','-e','EZ_RELAY_UID=20003',
+    '--mount',`type=bind,src=${join(dir,'relay.env')},dst=/run/secrets/relay_env,readonly`,image,'exec','node','-e',customProbe]);
+  assert.equal(custom.status,0,custom.stderr);
+  assert.equal(JSON.parse(custom.stdout).uid,20001);
   const failed = run(['run','--rm',image,'exec','node','-e','process.exit(23)']);
   assert.equal(failed.status, 23, failed.stderr);
   const held = run(['run','-d','--name',holder,'-v',`${volume}:/state/control`,image,'exec','node','-e',"require('fs').writeFileSync('/state/control/ready','yes');setInterval(()=>{},1000)"]);
@@ -43,5 +82,5 @@ try {
   assert.equal(run(['kill',holder]).status,0);
   const recovered=run(['run','--rm','-v',`${volume}:/state/control`,image,'exec','node','-e','process.exit(0)']);
   assert.equal(recovered.status,0,recovered.stderr);
-  console.log('Docker smoke passed: non-root executor, private secret mount/environment, literal argv, exit code, no Docker socket, duplicate writer rejection and crash lock release.');
-} finally { run(['rm','-f',holder]); run(['volume','rm',volume]); rmSync(dir, {recursive:true, force:true}); }
+  console.log('Docker smoke passed: direct non-root application help/start/health/stop, inherited private descriptor, non-root executor, private secret isolation, literal argv, exit code, no Docker socket, duplicate writer rejection and crash lock release.');
+} finally { run(['rm','-f',holder,application]); run(['volume','rm',volume]); rmSync(dir, {recursive:true, force:true}); }