@team-agent/installer 0.5.114 → 0.5.115

package/crates/team-agent/src/contract_runtime/discovery.rs

@@ -3,9 +3,12 @@ use std::path::{Path, PathBuf};
 
 use team_agent_contract::contract::{hooks::*, plan::CatalogObservation, types::*};
 use team_agent_contract::host::{command::RealCommandRunner, process::resolve_cwd};
-use team_agent_contract::kiro::{native::*, KiroAdapter, McpStdio, KIRO_DESCRIPTOR};
+use team_agent_contract::kiro::native as kiro;
+use team_agent_contract::providers::cursor::native as cursor;
 use thiserror::Error;
 
+use super::registry::{self, NativeProvider};
+
 #[derive(Debug, Error)]
 pub enum DiscoveryError {
     #[error("required executable is unavailable: {0}")]
@@ -13,7 +16,9 @@ pub enum DiscoveryError {
     #[error("native discovery failed: {0}")]
     Host(#[from] team_agent_contract::host::HostError),
     #[error("native engine probe failed: {0}")]
-    Probe(#[from] EngineProbeError),
+    Probe(#[from] kiro::EngineProbeError),
+    #[error("native Cursor launcher probe failed: {0}")]
+    CursorProbe(#[from] cursor::ProbeError),
     #[error("native discovery contract: {0:?}")]
     Contract(ContractError),
     #[error("native model discovery: {0:?}")]
@@ -26,6 +31,7 @@ pub struct Discovery {
     pub engine: PathBuf,
     pub native: NativeIdentity,
     pub catalog: CatalogObservation,
+    pub runtime: Option<cursor::RuntimeInstallation>,
 }
 
 pub fn executable(name: &'static str) -> Result<PathBuf, DiscoveryError> {
@@ -43,44 +49,89 @@ pub fn executable(name: &'static str) -> Result<PathBuf, DiscoveryError> {
     Err(DiscoveryError::Executable(name))
 }
 
-pub fn discover(workspace: &Path) -> Result<Discovery, DiscoveryError> {
-    let home = std::env::var_os("HOME")
-        .map(PathBuf::from)
-        .ok_or(DiscoveryError::Executable(
-            "HOME for native installation lookup",
-        ))?;
-    let engine = resolve_helper(&executable(KIRO_DESCRIPTOR.identity.binary)?, &home)?;
-    let native = probe_engine(
-        &engine,
-        &mut RealCommandRunner::default(),
-        discovery_bounds(),
-    )?;
+pub fn discover(provider: &ProviderId, workspace: &Path) -> Result<Discovery, DiscoveryError> {
+    let selected = registry::provider(provider.as_str()).map_err(DiscoveryError::Contract)?;
+    let descriptor = selected.descriptor();
+    let bounds = ReadBounds {
+        deadline: std::time::Duration::from_secs(30),
+        max_output_bytes: 1024 * 1024,
+    };
+    let launcher = executable(descriptor.identity.binary)?;
+    let (engine, native) = match selected {
+        NativeProvider::Kiro => {
+            let home = std::env::var_os("HOME")
+                .map(PathBuf::from)
+                .ok_or(DiscoveryError::Executable("HOME for native installation lookup"))?;
+            let engine = kiro::resolve_helper(&launcher, &home)?;
+            let native = kiro::probe_engine(&engine, &mut RealCommandRunner::default(), bounds)?;
+            (engine, native)
+        }
+        NativeProvider::Cursor => {
+            let engine = cursor::resolve_launcher(&launcher)?;
+            let native = cursor::probe_launcher(&engine, &mut RealCommandRunner::default(), bounds)?;
+            (engine, native)
+        }
+    };
     let request = CatalogRequest {
-        provider: ProviderId::new(KIRO_DESCRIPTOR.identity.id).map_err(DiscoveryError::Contract)?,
+        provider: ProviderId::new(descriptor.identity.id).map_err(DiscoveryError::Contract)?,
         native: native.clone(),
         executable: engine.clone(),
         cwd: resolve_cwd(workspace)?,
-        source: CHAT_CATALOG_SOURCE,
-        bounds: discovery_bounds(),
+        source: descriptor.model.catalog.require("native catalog source").map_err(DiscoveryError::Contract)?.clone(),
+        bounds,
     };
-    let mut host = CatalogReader::new(request.clone(), RealCommandRunner::default())
-        .map_err(DiscoveryError::Contract)?;
-    // H1 does not use these pointers; keep the actual current executable and do
-    // not manufacture an alternate CLI or execute an MCP server for discovery.
-    let adapter = KiroAdapter::new(McpStdio {
-        executable: std::env::current_exe()?.canonicalize()?,
-        arguments: Vec::new(),
-        environment: Default::default(),
-    })
-    .map_err(DiscoveryError::Contract)?;
-    let catalog = adapter
-        .discover(&request, &mut host)
-        .map_err(DiscoveryError::Catalog)?;
-    Ok(Discovery {
-        engine,
-        native,
-        catalog,
-    })
+    // H1 does not use these pointers or execute an MCP server. Cursor's
+    // launcher fingerprint authorizes only metadata reads, never worker launch.
+    let adapter = selected.adapter(
+        std::env::current_exe()?.canonicalize()?,
+        Vec::new(),
+        Default::default(),
+    ).map_err(DiscoveryError::Contract)?;
+    let hooks = adapter.hooks();
+    let catalog_hook = hooks.catalog.require("H1 catalog").map_err(DiscoveryError::Contract)?;
+    let catalog = match selected {
+        NativeProvider::Kiro => {
+            let mut host = kiro::CatalogReader::new(request.clone(), RealCommandRunner::default())
+                .map_err(DiscoveryError::Contract)?;
+            catalog_hook.discover(&request, &mut host)
+        }
+        NativeProvider::Cursor => {
+            let mut host = cursor::NativeCatalog::new(request.clone(), RealCommandRunner::default())
+                .map_err(DiscoveryError::Contract)?;
+            catalog_hook.discover(&request, &mut host)
+        }
+    }.map_err(DiscoveryError::Catalog)?;
+    let result = Discovery { engine, native, catalog, runtime: None };
+    validate_catalog(provider, &result).map_err(DiscoveryError::Contract)?;
+    Ok(result)
+}
+
+/// Runtime discovery is separate from public catalog metadata. Cursor explicitly
+/// bridges the same installation's catalog to its proven Node/entry identity.
+pub(super) fn discover_runtime(provider: &ProviderId, workspace: &Path) -> Result<Discovery, DiscoveryError> {
+    let mut discovery = discover(provider, workspace)?;
+    if registry::provider(provider.as_str()).map_err(DiscoveryError::Contract)? == NativeProvider::Cursor {
+        let home = std::env::var_os("HOME").map(PathBuf::from)
+            .ok_or(DiscoveryError::Executable("HOME for native subscription"))?;
+        let runtime = cursor::probe_runtime(&discovery.engine, &home, &mut RealCommandRunner::default(),
+            ReadBounds { deadline: std::time::Duration::from_secs(30), max_output_bytes: 1024 * 1024 })?;
+        discovery.catalog = runtime.bind_catalog(&discovery.catalog).map_err(DiscoveryError::Contract)?;
+        discovery.engine = runtime.engine.clone();
+        discovery.native = runtime.native.clone();
+        discovery.runtime = Some(runtime);
+    }
+    Ok(discovery)
+}
+
+fn validate_catalog(provider: &ProviderId, discovery: &Discovery) -> Result<(), ContractError> {
+    let descriptor = registry::provider(provider.as_str())?.descriptor();
+    if discovery.catalog.provider != *provider
+        || discovery.catalog.native != discovery.native
+        || discovery.catalog.schema != descriptor.model.catalog.require("native catalog source")?.schema
+    {
+        return Err(ContractError::Mismatch("native catalog provider/identity/schema"));
+    }
+    Ok(())
 }
 
 pub fn models(
@@ -88,7 +139,10 @@ pub fn models(
 ) -> Result<crate::cli::CmdResult, crate::cli::CliError> {
     let result = std::env::current_dir()
         .map_err(DiscoveryError::Io)
-        .and_then(|cwd| discover(&cwd));
+        .and_then(|cwd| {
+            let provider = ProviderId::new(&args.provider).map_err(DiscoveryError::Contract)?;
+            discover(&provider, &cwd)
+        });
     render_models(args, result)
 }
 
@@ -98,6 +152,11 @@ fn render_models(
 ) -> Result<crate::cli::CmdResult, crate::cli::CliError> {
     use crate::cli::{CmdOutput, CmdResult, ExitCode};
     use serde_json::json;
+    let result = result.and_then(|discovery| {
+        let provider = ProviderId::new(&args.provider).map_err(DiscoveryError::Contract)?;
+        validate_catalog(&provider, &discovery).map_err(DiscoveryError::Contract)?;
+        Ok(discovery)
+    });
     let (value, human, exit) = match result {
         Ok(discovery) => {
             let query = args.search.as_deref().map(str::to_lowercase);
@@ -114,7 +173,8 @@ fn render_models(
             let value = json!({"schema_version":"models.v1","ok":true,"provider":args.provider,
                 "models":rows,"auth":"unknown","auth_basis":"native_catalog_visibility_is_not_authorization",
                 "source":{"schema":discovery.catalog.schema,"executable":discovery.engine,
-                    "version":discovery.native.version,"executable_sha256":team_agent_contract::host::digest_hex(discovery.native.executable_sha256)},
+                    "version":discovery.native.version,"executable_sha256":team_agent_contract::host::digest_hex(discovery.native.executable_sha256),
+                    "identity_scope":"catalog_only"},
                 "current_role_model":null,"search":args.search});
             let mut lines = vec![format!("models.v1 | {} native model IDs:", args.provider)];
             lines.extend(
@@ -163,12 +223,13 @@ mod tests {
             executable_sha256: Digest([1; 32]),
         };
         let discovery = Discovery {
+            runtime: None,
             engine: "/controlled/kiro-cli-chat".into(),
             native: native.clone(),
             catalog: CatalogObservation {
                 provider: ProviderId::new("kiro").unwrap(),
                 native,
-                schema: "controlled-json".into(),
+                schema: kiro::CHAT_CATALOG_SOURCE.schema.into(),
                 models: vec![ModelRecord {
                     id: "Exact-Case-ID".into(),
                     efforts: Support::Unverified(Reason {
@@ -192,7 +253,7 @@ mod tests {
         assert_eq!(json["auth"], "unknown");
         assert_eq!(json["models"][0]["model_id"], "Exact-Case-ID");
         assert_eq!(json["models"][0]["efforts"]["state"], "unverified");
-        assert_eq!(json["source"]["schema"], "controlled-json");
+        assert_eq!(json["source"]["schema"], kiro::CHAT_CATALOG_SOURCE.schema);
         assert!(json["current_role_model"].is_null());
     }
 
@@ -203,7 +264,7 @@ mod tests {
             search: None,
             json: true,
         };
-        let error = parse_version(b"kiro-cli-chat 2.29.invalid\n").unwrap_err();
+        let error = kiro::parse_version(b"kiro-cli-chat 2.29.invalid\n").unwrap_err();
         let result = render_models(&args, Err(DiscoveryError::Probe(error))).unwrap();
         assert_eq!(result.exit, ExitCode::Error);
         let CmdOutput::Human(text) = result.output else {
@@ -217,6 +278,91 @@ mod tests {
         assert_eq!(json["models"], serde_json::json!([]));
     }
 
+    fn cursor_catalog() -> Discovery {
+        let native = NativeIdentity {
+            version: "2026.09.29-a1b2c3".into(),
+            harness: cursor::METADATA_HARNESS.into(),
+            ui: cursor::METADATA_UI.into(),
+            platform: Platform::MacOs,
+            executable_sha256: Digest([2; 32]),
+        };
+        Discovery {
+            runtime: None,
+            engine: "/controlled/cursor-agent".into(),
+            native: native.clone(),
+            catalog: CatalogObservation {
+                provider: ProviderId::new("cursor").unwrap(),
+                native,
+                schema: cursor::CATALOG_SOURCE.schema.into(),
+                models: ["gpt-5.6-luna-xhigh", "gpt-5.6-luna-xhigh-fast", "Other-Exact-ID"]
+                    .into_iter().map(|id| ModelRecord {
+                        id: id.into(),
+                        efforts: Support::Unverified(Reason {
+                            code: "not-observed", message: "Native IDs are not separate effort flags",
+                        }),
+                    }).collect(),
+            },
+        }
+    }
+
+    #[test]
+    fn cursor_catalog_filters_exact_native_family_without_runtime_claims() {
+        let args = ModelsArgs {
+            provider: "cursor".into(), search: Some("GPT-5.6-LUNA-XHIGH".into()), json: true,
+        };
+        let result = render_models(&args, Ok(cursor_catalog())).unwrap();
+        assert_eq!(result.exit, ExitCode::Ok);
+        let CmdOutput::Human(text) = result.output else { panic!("JSON text projection"); };
+        let json: serde_json::Value = serde_json::from_str(&text).unwrap();
+        let ids: Vec<_> = json["models"].as_array().unwrap().iter()
+            .map(|row| row["model_id"].as_str().unwrap()).collect();
+        assert_eq!(ids, ["gpt-5.6-luna-xhigh", "gpt-5.6-luna-xhigh-fast"]);
+        assert_eq!(json["provider"], "cursor");
+        assert_eq!(json["auth"], "unknown");
+        assert_eq!(json["source"]["identity_scope"], "catalog_only");
+        assert_eq!(json["source"]["version"], "2026.09.29-a1b2c3");
+        assert!(json["models"].as_array().unwrap().iter().all(|row|
+            row["efforts"]["state"] == "unverified" && row["aliases"] == serde_json::json!([])));
+        assert!(json["current_role_model"].is_null());
+    }
+
+    #[test]
+    fn mismatched_catalog_provider_native_or_schema_is_not_projected() {
+        let args = ModelsArgs { provider: "cursor".into(), search: None, json: true };
+        for field in ["provider", "native", "schema"] {
+            let mut discovery = cursor_catalog();
+            match field {
+                "provider" => discovery.catalog.provider = ProviderId::new("kiro").unwrap(),
+                "native" => discovery.catalog.native.executable_sha256 = Digest([9; 32]),
+                "schema" => discovery.catalog.schema = kiro::CHAT_CATALOG_SOURCE.schema.into(),
+                _ => unreachable!(),
+            }
+            let result = render_models(&args, Ok(discovery)).unwrap();
+            assert_eq!(result.exit, ExitCode::Error, "{field}");
+            let CmdOutput::Human(text) = result.output else { panic!("JSON text projection"); };
+            let json: serde_json::Value = serde_json::from_str(&text).unwrap();
+            assert_eq!(json["ok"], false);
+            assert_eq!(json["models"], serde_json::json!([]));
+        }
+    }
+
+    #[test]
+    fn cursor_probe_failure_has_no_legacy_or_fixed_model_fallback() {
+        let args = ModelsArgs { provider: "cursor".into(), search: None, json: true };
+        for error in [
+            DiscoveryError::Executable("cursor-agent"),
+            DiscoveryError::CursorProbe(cursor::parse_version(b"Cursor release unknown").unwrap_err()),
+        ] {
+            let result = render_models(&args, Err(error)).unwrap();
+            assert_eq!(result.exit, ExitCode::Error);
+            let CmdOutput::Human(text) = result.output else { panic!("JSON text projection"); };
+            let json: serde_json::Value = serde_json::from_str(&text).unwrap();
+            assert_eq!(json["provider"], "cursor");
+            assert_eq!(json["models"], serde_json::json!([]));
+            assert_eq!(json["ok"], false);
+        }
+    }
+
     #[test]
     fn native_discovery_failure_has_no_catalog_or_fallback() {
         let args = ModelsArgs {

package/crates/team-agent/src/contract_runtime/framework.rs

@@ -19,6 +19,14 @@ pub fn is_contract(agent: &Value) -> bool {
         .and_then(Value::as_str)
         .is_some_and(|provider| super::registry::descriptor(provider).is_some())
 }
+/// Published paused roles without an instance never crossed native startup.
+/// A bound instance is never skipped, even if a stale row says paused.
+pub(crate) fn is_paused_unstarted(agent: &Value) -> bool {
+    is_contract(agent)
+        && agent.get("status").and_then(Value::as_str) == Some("paused")
+        && agent.get("contract_instance").is_none_or(Value::is_null)
+}
+
 pub fn has_contract(state: &Value) -> bool {
     state
         .get("agents")
@@ -72,7 +80,7 @@ pub fn require_legacy_lifecycle(
             None => !config.roles.is_empty(),
         });
     if selected_native || configured_native {
-        return Err(crate::cli::CliError::Runtime(format!("contract_capability_unverified: {operation} is not admitted for Kiro; no legacy fallback or fresh replacement was performed")));
+        return Err(crate::cli::CliError::Runtime(format!("contract_capability_unverified: {operation} is not admitted for contract-native seats; no legacy fallback or fresh replacement was performed")));
     }
     Ok(())
 }
@@ -93,7 +101,7 @@ pub fn require_legacy_role(
         .or(declared.as_deref())
         .is_some_and(super::registry::recognizes)
     {
-        return Err(crate::cli::CliError::Runtime("contract_capability_unverified: mutable Kiro role lifecycle is not admitted; use initial quick-start; no role file was changed".into()));
+        return Err(crate::cli::CliError::Runtime("contract_capability_unverified: mutable contract-native role lifecycle is not admitted; use initial quick-start; no role file was changed".into()));
     }
     Ok(())
 }
@@ -141,16 +149,36 @@ pub fn start_role(
 }
 
 pub fn project_seat(workspace: &Path, team: &str, id: &str) -> Result<Value, BackendError> {
-    let backend = Backend::open_readonly(workspace, team)?;
+    let mut backend = Backend::open_readonly(workspace, team)?;
     let seat = backend
         .store
         .seat(&SeatId::new(id)?)?
         .ok_or(BackendError::Metadata)?;
-    let role = backend::read_role(&backend.binding, &seat.identity.seat)?;
+    let role = backend::read_role(&backend.binding, &seat.identity)?;
+    if role.provider != seat.provider {
+        return Err(BackendError::Metadata);
+    }
     let alive = seat
         .physical
         .as_ref()
         .is_some_and(|target| sample_process(&target.process) == ProcessState::Alive);
+    // Present only individually proven tools. A successful report_result
+    // never turns send_message/get_team_status into invented discoveries.
+    let mut observed = Vec::new();
+    let mut binding_source = None;
+    if super::registry::provider(seat.provider.as_str())?.uses_tool_roundtrips() {
+        let protocol = super::pump::protocol(&mut backend, &seat, &team_agent_contract::host::clock::RealClock::new())?;
+        if let team_agent_contract::contract::probe::ProbeOutcome::Observed(binding) = protocol.binding.outcome {
+            binding_source = Some(format!("{:?}", binding.source));
+            observed = binding.tools;
+        }
+    }
+    let tools: serde_json::Map<String, Value> = [
+        (team_agent_contract::contract::types::LogicalTool::SendMessage, "send_message"),
+        (team_agent_contract::contract::types::LogicalTool::ReportResult, "report_result"),
+        (team_agent_contract::contract::types::LogicalTool::GetTeamStatus, "get_team_status"),
+    ].into_iter().map(|(tool, name)| (name.into(), json!(if observed.contains(&tool) { "observed" } else { "unknown" }))).collect();
+    let binding_status = if observed.len() == 3 { "observed" } else if observed.is_empty() { "unverified" } else { "partial" };
     let status = if seat.status == SeatStatus::Stopped {
         "stopped"
     } else if seat.status != SeatStatus::Unknown && alive {
@@ -166,7 +194,8 @@ pub fn project_seat(workspace: &Path, team: &str, id: &str) -> Result<Value, Bac
         "session_id":seat.session.map(|session| session.native_session),
         "native_endpoint":seat.endpoint,"native_pane":seat.pane,
         "pane_id":null,"window":null,"session_name":null,
-        "mcp_binding":"unverified","bootstrap_used":seat.bootstrap_used}),
+        "mcp_binding":binding_status,"mcp_binding_source":binding_source,"mcp_tools":tools,
+        "bootstrap_used":seat.bootstrap_used}),
     )
 }
 
@@ -235,6 +264,10 @@ pub fn stop_selected(workspace: &Path, state: &Value) -> Result<Vec<Value>, Back
     let mut receipts = Vec::new();
     if let Some(agents) = state.get("agents").and_then(Value::as_object) {
         for (id, agent) in agents.iter().filter(|(_, agent)| is_contract(agent)) {
+            if is_paused_unstarted(agent) {
+                receipts.push(json!({"agent_id":id,"status":"paused","stopped":false}));
+                continue;
+            }
             let backend = Backend::open(workspace, &team)?;
             let seat = backend
                 .store

package/crates/team-agent/src/contract_runtime/mod.rs

@@ -4,6 +4,7 @@
 //! Selection/preflight is read-only. Physical operations require a validated
 //! contract role and its real framework/native binding, not a provider guess.
 pub mod backend;
+pub mod commands;
 pub mod config;
 pub mod discovery;
 pub mod forward;
@@ -12,3 +13,4 @@ pub mod mcp;
 pub mod prompt;
 pub mod pump;
 pub mod registry;
+mod workspace;

package/crates/team-agent/src/contract_runtime/pump.rs

@@ -2,7 +2,7 @@
 //! implicit business retry, queue flush, or replay of uncertain messages.
 use super::{
     backend::{self, Backend, BackendError},
-    forward, framework,
+    forward, framework, registry,
 };
 use serde_json::Value;
 use std::path::Path;
@@ -12,11 +12,10 @@ use team_agent_contract::host::{
     clock::{Clock, RealClock},
     process::verify_native_ancestry,
 };
-use team_agent_contract::kiro::{interaction, KIRO_DESCRIPTOR};
 use team_agent_contract::orchestration::{physical::*, store::*, supervisor::*};
 use team_agent_contract::runtime::probes::*;
 
-fn protocol(
+pub(super) fn protocol(
     backend: &mut Backend,
     seat: &SeatRecord,
     clock: &RealClock,
@@ -28,6 +27,9 @@ fn protocol(
         .into_iter()
         .filter(|record| {
             !record.closed
+                && record.identity == seat.identity
+                && record.server_key == seat.server_key
+                && record.binding_key == seat.binding_key
                 && record.native_process == target.process
                 && verify_native_ancestry(&record.process, &record.native_process).is_ok()
         })
@@ -75,6 +77,35 @@ fn protocol(
             });
         }
     }
+    if registry::provider(seat.provider.as_str())?.uses_tool_roundtrips() {
+        let session = seat.session.as_ref().ok_or(BackendError::Metadata)?;
+        if target.identity() != &seat.identity || target.binding != seat.binding_key
+            || target.provider != seat.provider || target.native != seat.native
+            || target.native_session.as_ref() != Some(&session.native_session)
+            || session.source != seat.identity || session.provider != seat.provider
+            || session.native != seat.native || session.cwd != target.cwd
+            || target.candidate_sha256 != backend.binding.candidate_sha256
+        {
+            return Err(ContractError::Mismatch("native roundtrip current binding").into());
+        }
+        // The core returns only per-tool invocation + actual successful
+        // write/flush pairs for THIS captured connection and generation.
+        // Server list writes or another connection's facts cannot qualify.
+        let tools = backend.store.completed_connection_tools(&seat.identity, &connection.connection)?;
+        if !tools.is_empty() {
+            events.push(ProtocolEvent {
+                scope: target.scope(events.len() as u64, clock.now(), Duration::from_secs(2),
+                    "live-native-tool-roundtrip-ledger"),
+                fact: ProtocolFact::ClientBound {
+                    server_instance: connection.connection.clone(),
+                    evidence: ClientBindingEvidence {
+                        server_key: seat.server_key.clone(), tools,
+                        source: ClientBindingSource::NativeToolRoundtrip,
+                    },
+                },
+            });
+        }
+    }
     Ok(collect_protocol(
         target,
         &connection.connection,
@@ -91,8 +122,18 @@ fn deliver_one(backend: &mut Backend, seat: &SeatRecord) -> Result<(), BackendEr
     {
         return Ok(());
     }
+    let selected = registry::provider(seat.provider.as_str())?;
+    let bootstrap_allowed = selected.first_business_bootstrap() && !seat.bootstrap_used;
+    let profiles = selected.descriptor().input.profiles.require("native input profiles")?;
+    let profile = profiles.iter().find(|profile| profile.id == seat.profile && profile.matches_native(&seat.native))
+        .ok_or(ContractError::ProfileUnavailable)?;
+    profile.policy.require("native submit policy")?;
+    let role = backend::read_role(&backend.binding, &seat.identity)?;
+    if role.provider != seat.provider {
+        return Err(BackendError::Metadata);
+    }
     let clock = RealClock::new();
-    let adapter = backend::adapter(&backend.binding, &seat.identity)?;
+    let adapter = backend::adapter(&backend.binding, &seat.identity, &seat.provider)?;
     let hooks = adapter.hooks();
     let operation = OperationId::new(format!(
         "deliver-{}",
@@ -104,15 +145,17 @@ fn deliver_one(backend: &mut Backend, seat: &SeatRecord) -> Result<(), BackendEr
     ))?;
     let mut physical = PhysicalRuntime::new(
         Registration {
-            descriptor: &KIRO_DESCRIPTOR,
+            descriptor: selected.descriptor(),
             hooks: &hooks,
-            controls: interaction::CONTROLS,
+            controls: selected.controls(),
         },
-        backend::settings(&backend.binding),
+        backend::settings(&backend.binding, selected),
         operation.clone(),
         &clock,
     )?;
-    physical.evidence = backend::policy_evidence(&seat.native, backend.binding.candidate_sha256);
+    physical.evidence = backend::policy_evidence(
+        &seat.provider, &seat.native, backend.binding.candidate_sha256,
+    )?;
     physical.protocol = Some(protocol(backend, seat, &clock)?);
     let sample = physical.readiness(seat)?;
     if !matches!(sample.pane.outcome, ProbeOutcome::Observed(ref pane) if pane.surface == InputSurface::ComposerReady)
@@ -120,28 +163,39 @@ fn deliver_one(backend: &mut Backend, seat: &SeatRecord) -> Result<(), BackendEr
     {
         return Ok(());
     }
-    backend
-        .store
-        .begin_observation(&seat.identity, &operation)?;
-    // A completed-but-uncertain inspector quarantines the seat, without an
-    // orphan lease that would prevent explicit scoped shutdown. No replay or
-    // blind Escape to clear an unrelated approval/composer is permitted.
-    let binding = match physical.client_binding(seat, &interaction::TOOL_PANEL) {
-        Ok(binding) => binding,
-        Err(error) => {
-            backend.store.fail_observation(&seat.identity, &operation)?;
-            return Err(error.into());
+    // A roundtrip provider consumes only its captured protocol evidence. An
+    // Unknown/partial binding is left to the typed readiness gate; it never
+    // triggers a guessed TUI /tools command or a Kiro inspector fallback.
+    if !bootstrap_allowed && !selected.uses_tool_roundtrips() {
+        let panel = selected.tool_panel()?;
+        if panel.profile_id != seat.profile || panel.server_key != seat.server_key
+            || panel.policy_sha256 != profile.policy_sha256
+        {
+            return Err(ContractError::Mismatch("native inspector seat binding").into());
         }
-    };
-    backend
-        .store
-        .finish_observation(&seat.identity, &operation)?;
-    if !matches!(binding.outcome, ProbeOutcome::Observed(_)) {
-        return Ok(());
+        backend.store.begin_observation(&seat.identity, &operation)?;
+        // Uncertain inspection quarantines the seat without an orphan lease.
+        // No replay or blind Escape clears an unrelated composer/approval.
+        let binding = match physical.client_binding(seat, panel) {
+            Ok(binding) => binding,
+            Err(error) => {
+                backend.store.fail_observation(&seat.identity, &operation)?;
+                return Err(error.into());
+            }
+        };
+        backend.store.finish_observation(&seat.identity, &operation)?;
+        if !matches!(binding.outcome, ProbeOutcome::Observed(_)) {
+            return Ok(());
+        }
+        let mut current_protocol = protocol(backend, seat, &clock)?;
+        current_protocol.binding = binding;
+        physical.protocol = Some(current_protocol);
+    }
+    // H3's owned prompt receipt is independently checked by PhysicalRuntime;
+    // only the one durable first-business claim can carry this instruction.
+    if bootstrap_allowed {
+        physical.initial_prompt = Some(role.prompt.text.clone());
     }
-    let mut current_protocol = protocol(backend, seat, &clock)?;
-    current_protocol.binding = binding;
-    physical.protocol = Some(current_protocol);
     let mut bootstrap = OutboxBootstrap::new(ContractStore::open(
         &backend.binding.transport_root,
         backend.binding.scope.clone(),
@@ -150,10 +204,10 @@ fn deliver_one(backend: &mut Backend, seat: &SeatRecord) -> Result<(), BackendEr
     physical.bootstrap = Some(&mut bootstrap);
     let sample = physical.readiness(seat)?;
     let authorization = DeliveryAuthorization {
-        allow_first_business_bootstrap: false,
+        allow_first_business_bootstrap: bootstrap_allowed,
         require_server_handshake: true,
         channel: Channel::Tmux,
-        policy_sha256: interaction::POLICY,
+        policy_sha256: profile.policy_sha256,
     };
     let _ = team_agent_contract::orchestration::supervisor::tick(
         &mut backend.store,
@@ -170,15 +224,18 @@ pub fn tick(workspace: &Path, state: &mut Value) -> Result<(), BackendError> {
         return Ok(());
     }
     let team = crate::state::projection::team_state_key(state);
-    let mut backend = Backend::open(workspace, &team)?;
     let ids: Vec<_> = state
         .get("agents")
         .and_then(Value::as_object)
         .into_iter()
         .flat_map(|agents| agents.iter())
-        .filter(|(_, agent)| framework::is_contract(agent))
+        .filter(|(_, agent)| framework::is_contract(agent) && !framework::is_paused_unstarted(agent))
         .map(|(id, _)| id.clone())
         .collect();
+    if ids.is_empty() {
+        return Ok(());
+    }
+    let mut backend = Backend::open(workspace, &team)?;
     let mut failure = None;
     for id in ids {
         let Some(seat) = backend.store.seat(&SeatId::new(&id)?)? else {
@@ -192,7 +249,12 @@ pub fn tick(workspace: &Path, state: &mut Value) -> Result<(), BackendError> {
             .and_then(|agents| agents.get_mut(&id))
         {
             match framework::project_seat(workspace, &team, &id) {
-                Ok(projected) => *agent = projected,
+                Ok(projected) => {
+                    let row = agent.as_object_mut().ok_or(BackendError::Metadata)?;
+                    for (key, value) in projected.as_object().ok_or(BackendError::Metadata)? {
+                        row.insert(key.clone(), value.clone());
+                    }
+                },
                 Err(error) => failure = Some(error),
             }
         }