@jc_stack/ez-agents 0.1.0-beta.32 → 0.1.0-beta.34

package/.env.example

@@ -48,6 +48,10 @@ EZ_REPAIR_ENABLED=true
 # Optional native application-only runtime: no Telegram bot or token.
 # Requires EZ_APPLICATION_PORT; administrator bootstrap uses the real operator ID.
 # EZ_TELEGRAM_ENABLED=false
+# Isolation class from agent creation (default isolated).
+# EZ_ISOLATION=isolated
+# EZ_EXECUTOR_TRANSPORT=local
+# Host-capable: EZ_ISOLATION=host-capable and EZ_EXECUTOR_TRANSPORT=host
 # Private application-only local container isolation (optional; default workspace-write).
 # EZ_CODEX_SANDBOX=external
 

package/AGENTS.md

@@ -73,6 +73,35 @@ can be stated briefly and deferred. Reviewers distinguish those blockers from
 optional follow-ups and do not hold a working increment for hypothetical polish.
 Measure progress by usable outcomes and feedback, not code or test volume.
 
+## Feasibility frame for non-trivial work
+
+Before implementing a non-trivial coding, architecture or product change, state
+the user-visible objective, no more than five task-relevant binding constraints,
+the component that owns the failed boundary, the subtraction or simplification
+option, the minimum evidence needed to prove the outcome, and the stop condition.
+Do not restate the full prompt or add this ceremony to minor mechanical edits.
+
+A result that violates a binding constraint is invalid even when tests pass or
+the immediate symptom disappears. Check behavioral correctness, architecture and
+ownership, real user-path evidence and authorized side effects separately. Before
+completion, inspect whether the change added a runner, wrapper, state owner, queue,
+retry loop, prompt layer, dependency or configuration format; retain it only when
+the existing owner or contract cannot solve the demonstrated problem. Use one
+bounded constraint review, then stop when sufficient evidence passes unless a
+concrete material risk remains.
+
+Frame that review as answers to these questions, not as an open-ended request to
+find flaws:
+
+1. Did the solution cross an architecture, ownership or authority boundary?
+2. Did it bypass a binding constraint or preserve the symptom through a workaround?
+3. Did it add machinery where deletion or a simpler existing contract would work?
+4. Does the evidence prove the real user-visible outcome rather than only a proxy?
+5. Is there one concrete unresolved risk severe enough to block completion?
+
+If no answer identifies a material blocker, finish. Do not start another review
+round merely to seek more criticism, tests or hypothetical edge cases.
+
 ## 3. Crash-Safe Atomic Disk State
 - All persistent stores (`ControlStore`, `RunStore`, outbox queue) must be disk-backed JSON files.
 - **Atomic write pattern:** Never write directly to a state file. Always write to a temporary file (`${target}.${process.pid}.tmp`) with mode `0o600`, then atomically `rename` it over the destination.
@@ -97,37 +126,23 @@ Measure progress by usable outcomes and feedback, not code or test volume.
 - Unapproved group messages from other senders and unknown DMs fail silently unless an exact-contact or any-conversation owner-approved channel grant admits them. Both grant types use the restricted task runner. Paired-owner group text is discovery routed to the owner's private chat; it grants no group reply authority.
 - Stopping work (`/stop`) must terminate the active worker PID immediately (`SIGTERM`, escalating to `SIGKILL` if unclosed after 3s).
 
-## 8. Mandatory Adversarial & Negative Tests
-Every pull request modifying authority, execution, or routing must include negative tests:
-1. Unapproved Telegram ID $\rightarrow$ no process spawned.
-2. Non-owner group message $\rightarrow$ silent ignore; owner group discovery $\rightarrow$ private destination only.
-3. Executor environment check $\rightarrow$ asserts `TELEGRAM_BOT_TOKEN` is `undefined`.
-4. Corrupt JSON in store $\rightarrow$ handled gracefully without process crash.
-5. Injected path traversal in IDs $\rightarrow$ rejected.
+## 8. Risk-based negative validation
+
+Changes to authority, execution, routing, secret isolation or durable state must
+validate the affected failure boundary, not rerun or recreate an unrelated fixed
+checklist. Examples include proving that an unapproved sender spawns no process,
+executor secrets remain absent, invalid IDs cannot traverse paths, ambiguous
+external writes are not retried, and corrupt state fails safely. Add or change a
+test only when it protects the changed contract or a demonstrated regression.
+Existing relevant checks plus focused real-path evidence may be sufficient.
 
 ## Public contribution workflow
 
-Read CONTRIBUTING.md before edits and docs/releasing.md before a release.
-Maintainers and external agents use the same PR, tests and documentation standard.
-Keep internal plans and private evidence outside this repository.
-
-Before edits, follow CONTRIBUTING.md's isolated-work rules: one task per dedicated
-worktree/branch/PR, starting from fetched origin/main. Do not switch or mix work in
-another task's checkout. Stage only this task's changes. Keep its worktree through
-review and QA; independent review and green CI precede an authorized merge.
-Never treat task completion as permission to merge or publish.
-Own the complete engineering/release handoff in CONTRIBUTING.md. Once ready,
-proactively request only missing merge/release authority, then ship and verify;
-do not leave the maintainer to discover ready drafts or operate the release.
-
-For every core or plugin PR you author, revise or review, apply CONTRIBUTING.md's
-architecture check and the README's engine/application boundary. A symptom fix
-and green tests do not justify a conflicting execution or context owner. Existing
-legacy channel-backend code is a documented limitation, not a pattern for new
-integrations; applications submit agent turns through the native Ez execution path.
-
-A coding-task handoff must include the pushed commit and draft PR URL, checks,
-independent-review status and remaining QA. If PR creation is blocked, state the
-blocker and preserved commit. The merging agent owns the post-merge worktree
-cleanup check and reports removal or the specific reason to retain it. Follow
-CONTRIBUTING.md for squash-merge evidence, ignored files and active-use checks.
+Read CONTRIBUTING.md before edits and docs/releasing.md before a release. It owns
+the worktree, PR, review, merge, release and cleanup process; do not duplicate that
+process here or in feature documentation. For every core or plugin change, apply
+its architecture check and the README's engine/application boundary. A symptom
+fix and green tests do not justify a conflicting execution or context owner.
+Existing legacy channel-backend code is a documented limitation, not a pattern
+for new integrations. Keep internal plans and private evidence outside this
+repository.

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.1.0-beta.34
+
+- Correct setup guidance for host-capable custom Codex providers and replace
+  stale pinned-beta installation guidance with current release records.
+
+- Record an isolation class at agent creation. The default is `isolated`: the
+  native CLI runs in the relay (`EZ_EXECUTOR_TRANSPORT=local`). Pass
+  `--isolation host-capable` to reuse the installer UID and host CLI login.
+  Mismatched class and transport fail closed. Isolated Codex sets
+  `EZ_CODEX_SANDBOX=external`. Host transport is not started for isolated
+  agents. Unlabeled existing host transports stay host-capable.
+- Install pinned Codex CLI `0.153.4` in the relay runtime image so isolated
+  agents resolve `codex` on PATH. Isolated jobs keep auth in
+  `control/cli/codex` and do not link the operator `~/.codex`.
+
+- Confine macOS host jobs to their bound workspace and prevent cross-agent
+  plugin registry access.
+- Support agent-scoped OpenRouter models through the native Codex engine and
+  start a new native session when the provider or model changes.
+- Resolve native CLIs from the host PATH, expose captured presets in application
+  run receipts, and seed one purpose-scoped AGENTS.md for new agents.
+
+## 0.1.0-beta.33
+
+- Allow compatible plugin updates to add commands to existing services, registering
+  their aliases atomically while retaining collision checks and rejecting changes
+  to existing command routes or deployment authority.
+- Simplify contribution guidance and bound independent constraint reviews without
+  changing the native engine, transport or plugin responsibility boundaries.
+
 ## 0.1.0-beta.32
 
 - Add shared authenticated inbound attachment staging for application and
@@ -13,6 +43,9 @@
   host CLI configuration needed for restricted read-only plugin commands.
 - Clarify domain-agent positioning while preserving native engine ownership.
 
+- Prevent accidental cross-agent plugin access by rejecting relay-bound registry
+  calls outside the owning workspace, and restrict its host-folder bindings to
+  workspace roots explicitly granted by the host.
 - Answer native app-server requests with their current protocol shapes. Scheduled
   `codex-gui` browser work now surfaces approval requests and grants only its
   active turn session-scoped HTTPS browser-origin and Chrome app elicitations,

package/CONTRIBUTING.md

@@ -16,9 +16,11 @@ repository. Public docs describe shipped behavior and explicit limitations.
    Packaging/runtime changes also need the Docker checks in docs/releasing.md.
 5. Open a PR explaining the problem, resulting behavior, verification and limits.
    Include a short sanitized reproduction. State which tests were not run.
-6. Obtain independent review and required CI, then complete the
-   maintainer-authorized merge. Maintainers use PRs too. No CLA, ticket
-   requirement, custom commit format or additional approval committee.
+6. Obtain one bounded independent final-head review and required CI, resolve
+   material findings, then complete the authorized merge. An owner or maintainer
+   request for a product change or fix authorizes this normal PR/merge loop;
+   unsolicited external contributions still require maintainer merge authority.
+   No CLA, ticket requirement, custom commit format or additional approval committee.
 
 You are responsible for understanding submitted code, including AI-generated
 code, and having the right to contribute it under this repository's license.
@@ -79,10 +81,10 @@ do not disguise them as supported architecture or start a duplicate repair.
   create one worktree/PR per repository and link dependencies and merge order.
   Branch from an unmerged feature only when the dependency is intentional and
   documented; do not quietly include it in an unrelated PR.
-- Push the task branch and open a draft PR as soon as the first coherent change
-  is reviewable, before reporting implementation complete. Do not leave completed
-  work only in a local branch. Continue through the release handoff below;
-  implementation completion alone does not authorize publication.
+- Push the task branch and open a PR when the coherent change is reviewable. Use
+  draft status only while implementation or a named gate remains incomplete; do
+  not leave completed mergeable work in a draft or only on a local branch.
+  Publication remains a separate authority boundary.
 - Every handoff names the repository, worktree, branch, exact commit, PR URL,
   checks, independent-review status and remaining QA with its next action. If
   pushing or PR creation is blocked, report the blocker and preserved local
@@ -98,9 +100,10 @@ do not disguise them as supported architecture or start a duplicate repair.
 - New substantive commits or conflict resolutions invalidate the affected review
   and test evidence. Refresh against current main, review the resulting diff and
   run the applicable checks. Do not bypass protected-branch requirements.
-- Merge only after review, required CI, applicable QA and maintainer authorization.
-  Publish only under the separate release process; commits and merges are not
-  releases. Record which source commit and artifact hash were tested.
+- Merge only after review, required CI and applicable QA under the authority in
+  the contribution checklist above. Publish only under the separate release
+  process; commits and merges are not releases. Record which source commit and
+  artifact hash were tested.
 - Keep the worktree while its PR or QA is open. After merge or explicit abandonment,
   inspect it for uncommitted/untracked files and local-only commits. Remove only
   the clean task worktree after valuable work is preserved; never force cleanup.
@@ -124,22 +127,22 @@ and prepare the release. Reuse valid final-commit evidence; repeat checks when
 changes or failures invalidate it. Do not leave a ready feature silently in draft
 or ask the maintainer to run commands, coordinate reviewers, or operate CI.
 
-The maintainer's request is authorization for the requested work and its normal
-implementation steps. Do not ask them to approve the same work again. Once the
-applicable gates pass, execute the requested merge/release and report the packages,
-versions, channel, verification and material limits. Batch related packages in
-dependency order. Prepare the reviewed commits, artifacts and checksums before
-shipping. A request to merge does not silently expand to publication or changing
-a private package's visibility; a request to release already authorizes release.
-If shipping was not requested, report readiness and the next step without treating
-every completed feature as permission to publish.
-
-Complete the authorized merge, publication and rollout using
-docs/releasing.md, then verify registry metadata, downloaded artifact and the
-installed runtime. Report the outcome. Escalate only a product decision, missing
-credential/2FA, failed gate that cannot be repaired in scope, or material scope
-change. Human attention belongs on product intent;
-the agent operates the technical workflow.
+The owner or maintainer request authorizes the requested work and its normal
+PR/merge steps; do not ask them to approve the same work again. Release remains
+separate authority: a request to merge does not authorize publication or changing
+a private package's visibility, while a request to release authorizes the merge
+and publication needed for that release. Prepare and verify the reviewed commits,
+artifacts and checksums before shipping. If release was not requested, stop after
+the merged contribution loop and report any distinct deployment or publication
+step without performing it.
+
+When release is authorized, complete publication using docs/releasing.md, then
+verify registry metadata, the downloaded artifact and any explicitly requested
+installed-runtime QA. Deployment is separate and requires a direct rollout
+request or the target's saved update policy. Report the outcome. Escalate only a
+product decision, missing credential/2FA, failed gate that cannot be repaired in
+scope, or material scope change. Human attention belongs on product intent; the
+agent operates the technical workflow.
 
 Example, substituting a unique task name and an absolute external directory:
 

package/Dockerfile

@@ -9,6 +9,10 @@ COPY . .
 FROM dependencies AS test
 RUN pnpm verify
 FROM dependencies AS runtime
+# Keep this pin aligned with TASK_CODEX_VERSION. Isolated agents run this CLI
+# in the relay; do not bind-mount the operator's ~/.codex.
+ARG CODEX_CLI_VERSION=0.153.4
+RUN npm install -g @openai/codex@${CODEX_CLI_VERSION} && command -v codex
 RUN chmod +x docker/entrypoint.sh bin/ezenciel-agents* && mkdir -p /state/control /state/home /workspace && chown node:node /state/control /state/home /workspace
 RUN node -e 'for (const [name, target] of Object.entries(require("./package.json").bin)) require("node:fs").symlinkSync("/app/" + target, "/usr/local/bin/" + name)'
 ENV HOME=/state/home EZ_AGENT_WORKSPACE=/workspace EZ_CONTROL_DIR=/state/control EZ_EXECUTOR_CLI=grok PATH=/app/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

package/README.md

@@ -148,15 +148,19 @@ the user's request and preserve its scope.
 
 ## Package and runtime
 
-**Beta 0.1.0-beta.12 — for testing on a trusted machine.** Offline and Docker
-fixtures are verified. Live account onboarding and reboot acceptance for this
-release are deferred; this is not a production-readiness claim. The source branch
-may contain changes newer than the published beta; inspect the supplied artifact's
-documentation when installing a pinned release.
-
-The npm package is `@jc_stack/ez-agents` (channel `beta`). Download a pinned
-release with `npm pack @jc_stack/ez-agents@0.1.0-beta.12`, or get the tarball and SHA256SUMS from
-[GitHub prereleases](https://github.com/jdorado/ez-agents/releases/tag/v0.1.0-beta.12).
+**Published beta releases are for testing on a trusted machine.** Offline and
+Docker fixtures are verified for the selected release. Live account onboarding
+and reboot acceptance remain beta gates; this is not a production-readiness
+claim. The source branch may contain changes newer than the published beta, so
+inspect the supplied artifact's documentation when installing a pinned release.
+
+The npm package is `@jc_stack/ez-agents`. Approved beta publications use npm's
+`latest` distribution tag while their versions and GitHub releases remain
+prereleases. For a reproducible download, choose an exact version from
+[GitHub prereleases](https://github.com/jdorado/ez-agents/releases) and substitute
+it for `VERSION` in `npm pack @jc_stack/ez-agents@VERSION`.
+You can also download the release's candidate tarball and verify its SHA-256
+against the attached release receipt or release notes.
 GitHub remains under `jdorado`; npm uses `jc_stack`. Do not install the unrelated
 unscoped `ez-whatsapp` package.
 
@@ -242,28 +246,32 @@ credentials, startup, and verified pairing; never present this as human homework
 | `ezenciel-agents-install build` | Build once per artifact, with a private log and duplicate-build detection |
 | `ezenciel-agents-install status --deployment <path>` | Distinguish runtime/configuration, pairing and Telegram reply evidence |
 | `ezenciel-agents-create --register-cli <current-cli>` | Record the CLI that installs the initial package |
-| `ezenciel-agents-create --name <name> --purpose <purpose>` | Create an agent inheriting the installation CLI; token via stdin |
+| `ezenciel-agents-create --name <name> --purpose <agent-brief>` | Create an agent from the installing LLM's compact brief; packaged Codex defaults isolated, other CLIs stay host-capable; token via stdin |
+| `ezenciel-agents-create --name <name> --purpose <agent-brief> --isolation host-capable` | Explicitly reuse the host CLI and installer UID |
 | `ezenciel-agents-host` | Invoke the existing shared host CLI for this deployment |
-| `ezenciel-agents-setup configure <executor>` | Private configuration and missing starter files; preserves personal files |
-| `ezenciel-agents-setup configure <executor> --token-stdin` | Same, with the BotFather token supplied privately through stdin |
+| `ezenciel-agents-setup configure <executor> --purpose-file <path>` | Private configuration and missing starter files; fresh workspaces require installer-scoped purpose; preserves personal files |
+| `ezenciel-agents-setup configure <executor> --purpose-file <path> --token-stdin` | Same, with the BotFather token supplied privately through stdin |
 | `ezenciel-agents-setup service` | Start only the Docker relay bound by `docker.env` in the current directory; register the [host service](docs/host-service.md) separately |
 | `ezenciel-agents-owner status` | Inspect the owner and pending pairing requests |
 | `ezenciel-agents-owner approve <telegram-user-id>` | Approve the verified owner; never an arbitrary first sender |
 | `ezenciel-agents-setup status` | Inspect installed executor choices |
-| `ezenciel-agents-setup init` | Seed only missing workspace guidance |
+| `ezenciel-agents-setup init --purpose-file <path>` | Seed missing workspace guidance; purpose is optional only when AGENTS.md already exists |
 
 Run runtime tools through `ezenciel-agents-docker run --rm relay <command>`
 as shown in the Docker guide. Keep the Docker engine available; Compose owns
-restart and shutdown. The installing agent registers the small host CLI transport with the native service manager.
+restart and shutdown. Host-capable agents register the small host CLI transport with the native service manager. Isolated agents do not.
 
 ## Runtime and development reference
 
 The selected host CLI runs in this agent's persistent workspace and owns its
 Markdown/work files. New conversations and AI changes preserve those files.
-`AGENTS.md`, `SOUL.md`, and `USER.md` are seeded; `MEMORY.md` is
-optional. Installed plugin snippets and skill paths come from `ez tools list --details`; no tool inventory file needs maintenance. Received files go in `inbox/`, tasks and deliverables in `work/`.
-Credentials and control state stay outside the mind. File separation is not
-OS isolation against a process running as the same user.
+One compact, purpose-scoped `AGENTS.md` is seeded; `MEMORY.md` is optional.
+The installing LLM authors the initial brief from the owner's request and known
+application context; Ez stores it without trying to infer the product itself.
+Installed plugin snippets and skill paths come from `ez tools list --details`; no tool inventory file needs maintenance. Received files go in `inbox/`, tasks and deliverables in `work/`.
+Credentials and control state stay outside the mind. Isolated agents use relay
+mounts as the filesystem boundary. Host-capable file separation is not OS
+isolation against a process running as the same user.
 
 In Telegram, **Conversations** (or `/chats`) lists this agent's saved Ez
 conversations by name. Tap a name to continue its native engine session and

package/THIRD_PARTY_NOTICES.md

@@ -8,7 +8,7 @@ The container is built locally; no bundled third-party binary image is promised.
 
 Direct runtime dependencies: grammy (MIT), tsx (MIT). Development dependencies
 include TypeScript (Apache-2.0) and Node type definitions (MIT). The runtime
-image installs ffmpeg and Debian packages: redistributing that image requires
-review of its exact package build, notices and corresponding-source obligations.
-Docker and the selected host AI CLI are separately installed products, not covered
-by this repository's MIT license.
+image installs ffmpeg, Debian packages, and pinned `@openai/codex` (Apache-2.0):
+redistributing that image requires review of its exact package build, notices and
+corresponding-source obligations. Docker and a host-capable AI CLI remain
+separately installed products, not covered by this repository's MIT license.

package/compose.yaml

@@ -17,6 +17,7 @@ services:
       EZ_RELAY_UID: ${EZ_RELAY_UID:-1001}
       EZ_REPAIR_ENABLED: ${EZ_REPAIR_ENABLED:-true}
       EZ_AGENT_PURPOSE_FILE: /run/agent-purpose.md
+      EZ_ISOLATION: ${EZ_ISOLATION:-}
       EZ_EXECUTOR_TRANSPORT: ${EZ_EXECUTOR_TRANSPORT:-host}
       EZ_CHANNEL_BACKEND_URL: ${EZ_CHANNEL_BACKEND_URL:-}
       EZ_TELEGRAM_WEB_APP: ${EZ_TELEGRAM_WEB_APP:-}
@@ -50,7 +51,7 @@ services:
       retries: 3
 configs:
   agent_purpose:
-    file: ${EZ_AGENT_PURPOSE_FILE:-./templates/agent/SOUL.md}
+    file: ${EZ_AGENT_PURPOSE_FILE:-./templates/agent-purpose.md}
 secrets:
   relay_env:
     file: ${EZ_RELAY_ENV_FILE:?Set EZ_RELAY_ENV_FILE to the private relay env file}

package/docker/smoke.mjs

@@ -10,6 +10,7 @@ const volume = `${holder}-control`;
 const application = `${holder}-application`;
 const marker = 'qa-private-secret-never-in-executor';
 writeFileSync(join(dir, 'relay.env'), `TELEGRAM_BOT_TOKEN=${marker}\n`, { mode: 0o600 });
+writeFileSync(join(dir, 'purpose.md'), 'Verify the packaged Ez runtime.\n', { mode: 0o644 });
 writeFileSync(join(dir, 'node'), `#!/bin/sh\nIFS= read -r value <&3\n[ "$value" = "TELEGRAM_BOT_TOKEN=${marker}" ] || exit 91\nexec /usr/local/bin/node "$@"\n`, { mode: 0o555 });
 const run = (args) => spawnSync('docker', args, { encoding: 'utf8', timeout: 60000 });
 try {
@@ -17,17 +18,19 @@ try {
     '--mount',`type=bind,src=${join(dir,'node')},dst=/qa/node,readonly`,'-e','PATH=/qa:/usr/local/bin:/usr/bin:/bin',image,'application','--help']);
   assert.equal(inherited.status,0,inherited.stderr);
   const nonroot = ['--user','20000:20000','--read-only','--cap-drop','ALL','--security-opt','no-new-privileges',
+    '--mount',`type=bind,src=${join(dir,'purpose.md')},dst=/run/agent-purpose.md,readonly`,'-e','EZ_AGENT_PURPOSE_FILE=/run/agent-purpose.md',
     '--tmpfs','/tmp:mode=1777','--tmpfs','/state/control:uid=20000,gid=20000,mode=700',
     '--tmpfs','/state/home:uid=20000,gid=20000,mode=700','--tmpfs','/workspace:uid=20000,gid=20000,mode=700',
-    '-e','EZ_TELEGRAM_ENABLED=false','-e','EZ_APPLICATION_PORT=8110','-e','EZ_EXECUTOR_TRANSPORT=local','-e','EZ_EXECUTOR_CLI=codex'];
+    '-e','EZ_TELEGRAM_ENABLED=false','-e','EZ_APPLICATION_PORT=8110','-e','EZ_ISOLATION=isolated','-e','EZ_EXECUTOR_TRANSPORT=local','-e','EZ_EXECUTOR_CLI=codex'];
   const help = run(['run','--rm',...nonroot,image,'application','--help']);
   assert.equal(help.status,0,help.stderr);
   assert.match(help.stdout,/ezenciel-agents-application/);
   const login = run(['run','--rm',...nonroot,'--entrypoint','/bin/bash',image,'-lc',
-    'command -v ezenciel-agents-application && command -v ezenciel-agents-message && ezenciel-agents-message --help']);
+    'command -v ezenciel-agents-application && command -v ezenciel-agents-message && command -v codex && ezenciel-agents-message --help && codex --version']);
   assert.equal(login.status,0,login.stderr);
   assert.match(login.stdout,/\/usr\/local\/bin\/ezenciel-agents-application/);
   assert.match(login.stdout,/\/usr\/local\/bin\/ezenciel-agents-message/);
+  assert.match(login.stdout,/codex-cli 0\.153\.4/);
   const started = run(['run','-d','--name',application,...nonroot,image,'start']);
   assert.equal(started.status,0,started.stderr);
   let ready = false;
@@ -82,5 +85,5 @@ try {
   assert.equal(run(['kill',holder]).status,0);
   const recovered=run(['run','--rm','-v',`${volume}:/state/control`,image,'exec','node','-e','process.exit(0)']);
   assert.equal(recovered.status,0,recovered.stderr);
-  console.log('Docker smoke passed: direct non-root application help/start/health/stop, inherited private descriptor, non-root executor, private secret isolation, literal argv, exit code, no Docker socket, duplicate writer rejection and crash lock release.');
+  console.log('Docker smoke passed: direct non-root application help/start/health/stop, inherited private descriptor, non-root executor, isolated Codex on PATH, private secret isolation, literal argv, exit code, no Docker socket, duplicate writer rejection and crash lock release.');
 } finally { run(['rm','-f',holder,application]); run(['volume','rm',volume]); rmSync(dir, {recursive:true, force:true}); }

package/docs/application-channel.md

@@ -6,6 +6,10 @@ outbox. The application supplies domain tools and keeps its UI/content API; it
 can remove its own model runner, continuation loop and engine authentication.
 This is separate from the older outbound channel-backend integration.
 
+Run admission, status and inbox receipts include the immutable `preset` captured
+for that run so an application can label delivered messages with the engine choice
+that actually produced them.
+
 ## Shared runtime controls
 
 Register with `--share-owner` (the existing `--share-telegram` spelling is an
@@ -267,6 +271,8 @@ separate CLI histories. A retry cannot change an admitted turn's AI choice.
 
 Register owner-chat channels with `--share-owner` and submit `followOwner:true`.
 Web, phone and Telegram then use the same selected native conversation and AI.
+A later same-client provider or model change starts a new native conversation for the next
+admitted turn; already-queued work keeps its original engine.
 This works without Telegram and requires no transcript replay or new runner.
 Scoped application conversations remain separate when the flag is omitted.
 Owner identity does not automatically merge histories or grant learner access.

package/docs/architecture/ai-selection.md

@@ -8,7 +8,9 @@ At intake each journal entry receives an immutable preset and conversation ID.
 Batches cannot cross that boundary. The run copies that choice and invokes the
 native adapter with its exact model/effort. A later menu change cannot reroute it.
 Old conversation metadata is retained only so accepted work can finish; selecting
-a different CLI never restores that CLI's old history.
+a different CLI never restores that CLI's old history. Selecting a different provider
+or model on the same client does not resume the previous selection's native thread; the next
+admitted turn starts a new native conversation.
 
 Grok/Claude accept caller-selected native UUIDs. Codex/OpenCode generate IDs, so
 the adapter reads only their typed JSONL session metadata; stdout never becomes a

package/docs/docker-runtime.md

@@ -1,9 +1,9 @@
 # Docker runtime and shared host CLI
 
-Docker Compose owns each relay and executable plugin. The CLI the user installs
-Ez from stays on the host, with its existing authentication. All agents in that
-installation use that CLI; there is no second CLI installation or agent-specific
-CLI login. The relay image contains Node, relay dependencies and ffmpeg.
+Docker Compose owns each relay and executable plugin. Isolated agents run the
+native CLI from the relay image (pinned Codex). Host-capable agents reuse the
+CLI the user installed Ez from, with its existing authentication. The relay
+image contains Node, relay dependencies, ffmpeg and that pinned Codex CLI.
 The runtime image exposes Ez commands through the wrappers in `/app/bin`, including
 `ezenciel-agents-application`; application images do not need to link Ez themselves.
 The image also installs package-manifest commands in `/usr/local/bin`, so native
@@ -13,26 +13,33 @@ belongs to Ez packaging, not an application image or an engine-specific prompt.
 ## Agent binding
 
 Use [agent-led setup](setup.md). `ezenciel-agents-create` accepts a name, purpose,
+optional `--isolation isolated|host-capable` (default `isolated`),
 a bot token through stdin; the CLI defaults to the one recorded at package
 installation by `--register-cli <current-cli>`. It creates a private deployment
 with a unique Compose project, mind, control directory and secret file. Names
 cannot overwrite existing agents. `installation.json` keeps subsequent agents
 on the same CLI. Each agent gets its own purpose and native conversation IDs.
+`isolated` sets `EZ_EXECUTOR_TRANSPORT=local` and runs the native CLI in the
+relay. `host-capable` sets `host` and reuses the installer UID; unlabeled
+existing host transports stay host-capable so they are not flipped.
 
 `docker.env` contains explicit absolute paths, never token values:
 
 ```dotenv
 COMPOSE_PROJECT_NAME=ez-agent-family
 EZ_EXECUTOR_CLI=grok
+EZ_ISOLATION=isolated
+EZ_EXECUTOR_TRANSPORT=local
 EZ_AGENT_WORKSPACE=/absolute/private/agents/family/mind
 EZ_CONTROL_DIR=/absolute/private/agents/family/control
 EZ_RELAY_ENV_FILE=/absolute/private/agents/family/relay.env
 EZ_AGENT_PURPOSE_FILE=/absolute/private/agents/family/purpose.md
 ```
 
-The installing agent runs `ezenciel-agents-host` under the host's service manager
+Host-capable agents run `ezenciel-agents-host` under the host's service manager
 with `EZ_DEPLOYMENT_DIR` bound to that deployment. This small transport invokes
-the existing CLI; it is not a second relay or model loop. It reads requests from
+the existing CLI; it is not a second relay or model loop. Isolated agents do not
+start it. It reads requests from
 the agent's control directory, fixes cwd/control/tool paths from its installation
 binding, strips environment secrets, forwards native output and exit status, and
 propagates cancellation. Requests cannot select another executable. No network
@@ -41,9 +48,10 @@ is required. Host Node 22+ and the package dependencies run this transport.
 
 Mount mind and control at identical absolute paths in Docker and on the host,
 so incoming files, message attachments and CLI outputs need no path translation.
-Only that agent's directories are mounted into its relay. The host CLI reuses the existing login. Codex receives a private per-agent
+Only that agent's directories are mounted into its relay. Host-capable CLI reuses the existing login. Codex receives a private per-agent
 state home with linked authentication; global memory/configuration is excluded.
-This is not an OS security boundary between agents running as the same user.
+Host-capable is not an OS security boundary between agents running as the same user.
+Isolated agents use the relay mounts; sibling host paths are not present.
 Plugin setup also binds `toolsHome` in the host configuration. Codex receives
 write access to that registry and network access for the Docker client; the host
 rejects registries belonging to a different workspace. Restart the host worker
@@ -146,13 +154,22 @@ default. Existing queued jobs retain their captured execution choice.
 
 ## Codex context isolation
 
-The host Codex binary and existing login are reused, but each agent has its own
-`control/cli/codex` state directory. Only authentication is linked to the host
+Isolated agents run the image Codex with `EZ_CODEX_SANDBOX=external`. Auth is a
+real file at that agent's `control/cli/codex/auth.json`. Do not bind-mount the
+operator `~/.codex` or `$HOME` into an isolated relay. Host-capable agents reuse
+the host Codex binary and login, with a
+`control/cli/codex` state directory. The native CLI is resolved from the host
+PATH, not the package `binDir`, so a shared runtime or one agent's wrapper cannot
+retarget another agent's `CODEX_HOME`. Only authentication is linked to the host
 login; global configuration, sessions and memories are not imported. Global
 memory and host skill discovery are disabled for relay jobs. A conversation
 that already received unrelated global context must be replaced with a fresh
 native conversation; disabling injection does not remove prior turn content.
 This prevents automatic context sharing, not adversarial access by the host user.
+On macOS host jobs, Seatbelt also denies sibling directories of the bound
+workspace (a tenant farm), while allowing explicitly shared and additional
+workspace grants and leaving `$HOME` readable for the host CLI.
+Codex then uses `danger-full-access` so it does not apply a nested Seatbelt.
 
 ## Chat latency
 

package/docs/host-service.md

@@ -1,7 +1,8 @@
 # Host transport startup
 
-Register one service per deployment after initializing its tools. Substitute the
-exact absolute paths below. Use the existing authenticated host user and include
+Register one service per **host-capable** deployment after initializing its tools.
+Isolated agents run the native CLI in the relay and must not start this service.
+Substitute the exact absolute paths below. Use the existing authenticated host user and include
 its Node 22+, pnpm (or Corepack), Docker and CLI directories in PATH. Resolve the
 actual installed launchers first; shell aliases and interactive shell startup
 files are not available to services. No bot token goes in these service files.
@@ -21,6 +22,7 @@ Description=Ez family host CLI transport
 Type=simple
 Environment=EZ_DEPLOYMENT_DIR=/absolute/private/agents/family
 Environment=PATH=/absolute/node/bin:/absolute/package-manager/bin:/absolute/cli/bin:/usr/local/bin:/usr/bin:/bin
+EnvironmentFile=-%h/.config/ez/family-provider.env
 ExecStart=/absolute/ez-package/package/bin/ezenciel-agents-host
 Restart=on-failure
 RestartSec=5
@@ -29,6 +31,13 @@ RestartSec=5
 WantedBy=default.target
 ```
 
+When the installation declares a custom Codex provider, create that private
+environment file with mode `0600` and only the referenced key, for example
+`OPENROUTER_API_KEY=...`. Provider and model selection do not belong in the
+environment; they remain agent runtime state. The supervisor forwards only keys
+explicitly named by the agent's provider binding, and the Codex subprocess still
+receives none of the relay or plugin secrets.
+
 ```sh
 systemctl --user daemon-reload
 systemctl --user enable --now ez-family.service
@@ -81,10 +90,12 @@ main/plugin replacement. See [upgrade setup, tools and recovery](upgrades.md). E
 
 ## Shared application workspace
 
-Codex tasks inherit the agent's `control/cli/codex/auth.json` binding. Its default
-is a link to the host user's existing login. An operator may provision a private
-agent credential there during migration; new task homes link to that binding,
-preserving it rather than reverting to a different or expired host login.
+Codex tasks inherit the agent's `control/cli/codex/auth.json` binding. Host-capable
+default is a link to the host user's existing login. Isolated agents use a real
+file in that directory and the image Codex; they do not link `~/.codex`. An
+operator may provision a private agent credential there during migration; new
+task homes link to that binding, preserving it rather than reverting to a
+different or expired host login.
 
 An agent binding may set `sharedWorkspace` to an absolute canonical application
 repository. The host resolves its canonical path, adds that directory to Codex

package/docs/plugin-contributions.md

@@ -28,7 +28,10 @@ Before the first PR, provide:
 
 Copy CONTRIBUTING.md, SECURITY.md structure, PR template and docs/releasing.md
 from a released Ez repository; adapt commands and security facts to your plugin.
-Do not copy private QA, company policy, proposed features or unsupported claims.
+Add a short AGENTS.md that states the plugin's ownership boundary and applies the
+same compact feasibility frame and risk-based validation policy; do not copy
+core-only Telegram, state or dependency invariants. Do not copy private QA,
+company policy, proposed features or unsupported claims.
 Public instructions must work without the maintainer's parent workspace. Use
 reviewed local source and its inspected content hash; registry installation is
 inert. Installation is complete only after account onboarding and verified use.

package/docs/plugins.md

@@ -291,6 +291,21 @@ already exist on the host. Keep indexes and writable metadata in the plugin's
 normal volume. This uses Docker bind mounts; it copies no source bytes and
 starts no provider sync. Read-only is the default.
 
+For a relay-bound agent, the source must be inside its workspace/shared workspace
+or under a plugin-specific root granted in the agent's external host configuration:
+
+```json
+{
+  "pluginFolderRoots": {
+    "library": ["/absolute/existing/notes"]
+  }
+}
+```
+
+The agent cannot add this grant through its registry. A missing grant fails before
+Compose or registry state changes. Standalone registries remain operator-owned and
+do not use a relay host allowlist.
+
 Stop the plugin before changing a binding:
 
 ```sh

package/docs/repair.md

@@ -30,7 +30,7 @@ True makes the capability available; it does not itself grant a repair mandate.
 The setting does not change filesystem/GitHub permissions and does
 not cancel an already running task. Explicitly stop active repair work when needed.
 An owner can also disable repairs globally or for a repository in the agent's
-saved USER.md preferences; carry those restrictions into background task context.
+saved AGENTS.md preferences; carry those restrictions into background task context.
 
 ## Setup boundary