@team-agent/installer 0.5.114 → 0.5.116

package/crates/team-agent/src/contract_runtime/backend.rs

@@ -21,7 +21,6 @@ use team_agent_contract::host::{
     process::{fingerprint_file, resolve_cwd},
     tmux::HostLimits,
 };
-use team_agent_contract::kiro::{KiroAdapter, McpStdio, KIRO_DESCRIPTOR};
 use team_agent_contract::orchestration::{lifecycle::*, physical::*, store::*, Error};
 use thiserror::Error as ThisError;
 
@@ -29,10 +28,13 @@ use super::{
     config::{MemberRoute, RoleConfig, RuntimeFamily},
     discovery::{self, Discovery, DiscoveryError},
     forward::FrameworkContext,
+    registry::{self, NativeAdapter},
 };
 
 #[derive(Debug, ThisError)]
 pub enum BackendError {
+    #[error("native configuration: {0}")]
+    Configuration(#[from] super::config::ConfigError),
     #[error("native discovery: {0}")]
     Discovery(#[from] DiscoveryError),
     #[error("contract runtime: {0}")]
@@ -203,7 +205,7 @@ impl Backend {
     }
 }
 
-pub(super) fn settings(binding: &Binding) -> PhysicalSettings {
+pub(super) fn settings(binding: &Binding, provider: registry::NativeProvider) -> PhysicalSettings {
     PhysicalSettings {
         tmux: binding.tmux.clone(),
         limits: HostLimits {
@@ -220,7 +222,7 @@ pub(super) fn settings(binding: &Binding) -> PhysicalSettings {
             columns: 120,
             rows: 40,
         },
-        action_budget: Duration::from_secs(30),
+        action_budget: provider.action_budget(),
         freshness: Duration::from_secs(2),
         journal_bytes: 2 * 1024 * 1024,
     }
@@ -228,10 +230,11 @@ pub(super) fn settings(binding: &Binding) -> PhysicalSettings {
 pub(super) fn adapter(
     binding: &Binding,
     identity: &InstanceIdentity,
-) -> Result<KiroAdapter, BackendError> {
-    Ok(KiroAdapter::new(McpStdio {
-        executable: binding.candidate.clone(),
-        arguments: vec![
+    provider: &ProviderId,
+) -> Result<NativeAdapter, BackendError> {
+    Ok(registry::provider(provider.as_str())?.adapter(
+        binding.candidate.clone(),
+        vec![
             "contract-mcp".into(),
             "--workspace".into(),
             binding
@@ -249,8 +252,18 @@ pub(super) fn adapter(
             "--generation".into(),
             identity.generation.0.to_string(),
         ],
-        environment: BTreeMap::new(),
-    })?)
+        BTreeMap::new(),
+    )?.with_launch_context(binding.workspace.path.clone(), None)?)
+}
+fn launch_adapter(
+    binding: &Binding,
+    identity: &InstanceIdentity,
+    provider: &ProviderId,
+    discovered: &Discovery,
+) -> Result<NativeAdapter, BackendError> {
+    Ok(adapter(binding, identity, provider)?.with_launch_context(
+        binding.workspace.path.clone(), discovered.runtime.clone(),
+    )?)
 }
 fn request(
     binding: &Binding,
@@ -258,10 +271,15 @@ fn request(
     identity: InstanceIdentity,
     discovered: &Discovery,
 ) -> Result<LaunchRequest, BackendError> {
-    let profiles = KIRO_DESCRIPTOR
-        .input
-        .profiles
-        .require("Kiro input profiles")?;
+    let descriptor = registry::provider(role.provider.as_str())?.descriptor();
+    if discovered.catalog.provider != role.provider
+        || discovered.catalog.native != discovered.native
+    {
+        return Err(ContractError::Mismatch("role native catalog").into());
+    }
+    // Metadata-only discovery cannot authorize a native-subscription worker.
+    descriptor.auth.subscription.require("native subscription launch")?;
+    let profiles = descriptor.input.profiles.require("native input profiles")?;
     let mut matches = profiles.iter().filter(|profile| {
         profile.matches_native(&discovered.native)
             && profile.channel == Channel::Tmux
@@ -271,6 +289,7 @@ fn request(
     if matches.next().is_some() {
         return Err(ContractError::AmbiguousProfile.into());
     }
+    profile.policy.require("native submit policy")?;
     Ok(LaunchRequest {
         provider: role.provider.as_str().into(),
         operation: Operation::Fresh,
@@ -298,11 +317,31 @@ fn request(
     })
 }
 
+fn preflight_request(
+    binding: &Binding,
+    role: &RoleConfig,
+    identity: InstanceIdentity,
+    discovered: &Discovery,
+) -> Result<LaunchRequest, BackendError> {
+    let mut request = request(binding, role, identity, discovered)?;
+    if registry::provider(role.provider.as_str())? == registry::NativeProvider::GrokBuild {
+        // Pure H2 only: this is a proposed private path, not a filesystem receipt.
+        request.paths.cwd = team_agent_contract::contract::session::CwdIdentity {
+            path: binding.transport_root.join("workspaces").join(role.id.as_str()),
+            identity: digest(b"effect-free-planned-private-cwd"),
+        };
+    }
+    Ok(request)
+}
+
 /// Team-wide native discovery/admission before the shared launcher creates any
 /// seats (including legacy peers). Bounded read-only native commands run; no
 /// runtime store, worker config, private socket, or worker process is created.
 pub fn preflight(team: &super::config::TeamConfig) -> Result<(), BackendError> {
-    let discovered = discovery::discover(&team.workspace.path)?;
+    if team.roles.iter().all(|role| role.paused) {
+        return Ok(());
+    }
+    let mut discoveries = BTreeMap::new();
     let candidate = std::env::current_exe()?.canonicalize()?;
     let candidate_sha256 =
         fingerprint_file(&candidate, 1024 * 1024 * 1024, Duration::from_secs(10))?;
@@ -317,36 +356,46 @@ pub fn preflight(team: &super::config::TeamConfig) -> Result<(), BackendError> {
         tmux: discovery::executable("tmux")?,
         transport_root: "/tmp/preflight-no-write".into(),
     };
-    for role in &team.roles {
+    for role in team.roles.iter().filter(|role| !role.paused) {
+        let selected = registry::provider(role.provider.as_str())?;
+        if !discoveries.contains_key(&role.provider) {
+            discoveries.insert(
+                role.provider.clone(),
+                discovery::discover_runtime(&role.provider, &team.workspace.path)?,
+            );
+        }
+        let discovered = discoveries.get(&role.provider).ok_or(BackendError::Metadata)?;
         let identity = InstanceIdentity {
             scope: team.scope.clone(),
             seat: role.id.clone(),
             instance: InstanceId::new("preflight")?,
             generation: Generation(1),
         };
-        let adapter = adapter(&binding, &identity)?;
+        let adapter = launch_adapter(&binding, &identity, &role.provider, discovered)?;
         let hooks = adapter.hooks();
-        let request = request(&binding, role, identity, &discovered)?;
-        let resolved = resolve_launch(
-            &KIRO_DESCRIPTOR,
+        let request = preflight_request(&binding, role, identity, discovered)?;
+        let resolved = resolve_launch_preflight(
+            selected.descriptor(),
             &hooks,
             &request,
             Some(&discovered.catalog),
         )?;
-        validate_launch_plan(&KIRO_DESCRIPTOR, &resolved, &adapter.plan(&resolved)?)?;
+        validate_launch_plan(selected.descriptor(), &resolved, &adapter.plan(&resolved)?)?;
     }
     Ok(())
 }
 
-/// This first wiring is fresh-only. Resume/fork must use their typed contracts;
-/// missing evidence cannot be bypassed by silently launching another fresh seat.
+/// Fresh startup is distinct from resume. An existing generation is never
+/// silently replaced with a new native session.
 pub fn start(
     workspace: &Path,
     team: &str,
     role: &RoleConfig,
     members: &[MemberRoute],
 ) -> Result<(Binding, OperationRecord), BackendError> {
-    let discovered = discovery::discover(workspace)?;
+    let selected = registry::provider(role.provider.as_str())?;
+    let descriptor = selected.descriptor();
+    let discovered = discovery::discover_runtime(&role.provider, workspace)?;
     let cwd = resolve_cwd(workspace)?;
     let scope = scope_for(&cwd, team)?;
     let candidate = std::env::current_exe()?.canonicalize()?;
@@ -370,16 +419,17 @@ pub fn start(
         instance: InstanceId::new("preflight")?,
         generation: Generation(1),
     };
-    let probe_adapter = adapter(&provisional, &provisional_identity)?;
+    let probe_adapter = launch_adapter(&provisional, &provisional_identity, &role.provider, &discovered)?;
     let probe_hooks = probe_adapter.hooks();
-    let preflight = request(&provisional, role, provisional_identity, &discovered)?;
-    let preflight = resolve_launch(
-        &KIRO_DESCRIPTOR,
+    let preflight = preflight_request(&provisional, role, provisional_identity, &discovered)?;
+    let preflight = resolve_launch_preflight(
+        descriptor,
         &probe_hooks,
         &preflight,
         Some(&discovered.catalog),
     )?;
-    probe_adapter.plan(&preflight)?;
+    let preflight_plan = probe_adapter.plan(&preflight)?;
+    validate_launch_plan(descriptor, &preflight, &preflight_plan)?;
     let mut backend = if root_for(&cwd.path, &scope).exists() {
         Backend::open(&cwd.path, team)?
     } else {
@@ -393,20 +443,6 @@ pub fn start(
     if backend.store.seat(&role.id)?.is_some() {
         return Err(Error::Conflict.into());
     }
-    // A private immutable source snapshot binds model/effort and all four exact
-    // instruction layers to this startup. Never print its prompt body.
-    use std::os::unix::fs::OpenOptionsExt;
-    let snapshot = serde_json::to_vec(role).map_err(|_| BackendError::Metadata)?;
-    let mut file = std::fs::OpenOptions::new()
-        .write(true)
-        .create_new(true)
-        .mode(0o600)
-        .open(
-            root_for(&backend.binding.workspace.path, &backend.binding.scope)
-                .join(format!("role-{}.json", role.id.as_str())),
-        )?;
-    file.write_all(&snapshot)?;
-    file.sync_all()?;
     let route = backend.binding.framework().route()?;
     let mut peers: Vec<_> = members
         .iter()
@@ -426,11 +462,29 @@ pub fn start(
     });
     backend.store.set_framework_routes(&peers, Some(&route))?;
     let identity = backend.store.propose_identity(&role.id)?;
-    let adapter = adapter(&backend.binding, &identity)?;
+    let server_key = selected.server_key_for(&identity)?;
+    write_role(&backend.binding, &identity, role)?;
+    let adapter = launch_adapter(&backend.binding, &identity, &role.provider, &discovered)?;
     let hooks = adapter.hooks();
-    let request = request(&backend.binding, role, identity, &discovered)?;
+    let mut request = request(&backend.binding, role, identity, &discovered)?;
+    if !descriptor.workspace.shared_cwd {
+        request.paths.cwd = super::workspace::prepare(&backend.binding, &role.id)?;
+    }
+    if selected == registry::NativeProvider::GrokBuild {
+        team_agent_contract::providers::grok_build::native::require_private_primary(&request.paths.cwd)?;
+    }
+    if let Some(registry::NativeRuntime::Cursor(runtime)) = &discovered.runtime {
+        request.preassigned_session = Some(
+            team_agent_contract::providers::cursor::native::allocate_chat(
+                runtime, &request.paths.cwd, &mut RealCommandRunner::default(),
+                team_agent_contract::contract::hooks::ReadBounds {
+                    deadline: Duration::from_secs(90), max_output_bytes: 1024 * 1024,
+                },
+            ).map_err(|error| BackendError::Discovery(DiscoveryError::Catalog(error)))?,
+        );
+    }
     let resolved = resolve_launch(
-        &KIRO_DESCRIPTOR,
+        descriptor,
         &hooks,
         &request,
         Some(&discovered.catalog),
@@ -438,7 +492,7 @@ pub fn start(
     let plan = adapter.plan(&resolved)?;
     let operation = OperationId::new(format!("start-{}", request.identity.instance.as_str()))?;
     let mut io = ScopedMaterializer::new(
-        &KIRO_DESCRIPTOR,
+        descriptor,
         &resolved,
         &plan,
         operation.clone(),
@@ -447,15 +501,17 @@ pub fn start(
     let clock = RealClock::new();
     let mut physical = PhysicalRuntime::new(
         Registration {
-            descriptor: &KIRO_DESCRIPTOR,
+            descriptor,
             hooks: &hooks,
-            controls: team_agent_contract::kiro::interaction::CONTROLS,
+            controls: selected.controls(),
+            startup: selected.startup(),
+            session_panel: selected.session_panel(),
         },
-        settings(&backend.binding),
+        settings(&backend.binding, selected),
         operation.clone(),
         &clock,
     )?;
-    physical.evidence = policy_evidence(&request.native, candidate_sha256);
+    physical.evidence = policy_evidence(&role.provider, &request.native, candidate_sha256)?;
     let record = Lifecycle {
         store: &mut backend.store,
         host: &mut physical,
@@ -463,7 +519,7 @@ pub fn start(
     }
     .startup(
         &Adapter {
-            descriptor: &KIRO_DESCRIPTOR,
+            descriptor,
             hooks: &hooks,
             catalog: Some(&discovered.catalog),
         },
@@ -471,30 +527,201 @@ pub fn start(
         Routing {
             pane: "unpublished".into(),
             binding_key: format!("binding-{}", request.identity.instance.as_str()),
-            server_key: "team".into(),
+            server_key: server_key.into(),
         },
         operation,
     )?;
     Ok((backend.binding, record))
 }
 
-pub(super) fn read_role(binding: &Binding, id: &SeatId) -> Result<RoleConfig, BackendError> {
-    let path = root_for(&binding.workspace.path, &binding.scope)
-        .join(format!("role-{}.json", id.as_str()));
+/// A fully admitted resume proposal. It is still effect-free: no parent stop,
+/// session allocation, snapshot write or config replacement has occurred.
+pub struct PreparedResume {
+    binding: Binding,
+    role: RoleConfig,
+    discovered: Discovery,
+    request: LaunchRequest,
+}
+
+impl PreparedResume {
+    pub(crate) fn seat(&self) -> &SeatId { &self.request.identity.seat }
+    pub(crate) fn session(&self) -> Option<&str> {
+        self.request.resume.as_ref().map(|resume| resume.binding.native_session.as_str())
+    }
+}
+
+pub(crate) fn prepare_restart(
+    workspace: &Path,
+    team: &str,
+    directory: &Path,
+    state: &serde_json::Value,
+) -> Result<Vec<PreparedResume>, BackendError> {
+    let config = super::framework::team_config(workspace, directory, team)?.ok_or(BackendError::Metadata)?;
+    let mut prepared = Vec::new();
+    let agents = state.get("agents").and_then(serde_json::Value::as_object).ok_or(BackendError::Metadata)?;
+    for (id, _) in agents.iter().filter(|(_, row)| {
+        super::framework::is_contract(row)
+            && !crate::state::projection::agent_stopped_for_restart(row)
+    }) {
+        let Some(role) = config.roles.iter().find(|role| role.id.as_str() == id) else {
+            // Removed roles are not silently re-created from an old snapshot.
+            continue;
+        };
+        if role.paused { continue; }
+        // The native store is authoritative even if its framework mirror is
+        // stale. Only explicit start-agent may resume a stopped generation.
+        let backend = Backend::open_readonly(workspace, team)?;
+        let seat = backend.store.seat(&role.id)?.ok_or(BackendError::Metadata)?;
+        if seat.status == SeatStatus::Stopped { continue; }
+        prepared.push(prepare_resume(workspace, team, &role.id, Some(role))?);
+    }
+    Ok(prepared)
+}
+
+pub fn prepare_resume(
+    workspace: &Path,
+    team: &str,
+    seat: &SeatId,
+    role: Option<&RoleConfig>,
+) -> Result<PreparedResume, BackendError> {
+    let backend = Backend::open_readonly(workspace, team)?;
+    let parent = backend.store.seat(seat)?.ok_or(BackendError::Metadata)?;
+    if parent.status == SeatStatus::Unknown {
+        return Err(Error::Fence.into());
+    }
+    let role = match role {
+        Some(role) => role.clone(),
+        None => read_role(&backend.binding, &parent.identity)?,
+    };
+    if role.id != parent.identity.seat || role.provider != parent.provider {
+        return Err(ContractError::Mismatch("resume role provider").into());
+    }
+    let source = parent.session.clone().ok_or(ContractError::Invalid("native resume binding required"))?;
+    if resolve_cwd(&source.cwd.path)? != source.cwd {
+        return Err(ContractError::Mismatch("resume cwd incarnation").into());
+    }
+    let candidate = std::env::current_exe()?.canonicalize()?;
+    let candidate_sha256 = fingerprint_file(&candidate, 1024 * 1024 * 1024, Duration::from_secs(10))?;
+    if backend.binding.candidate != candidate || backend.binding.candidate_sha256 != candidate_sha256 {
+        return Err(Error::Fence.into());
+    }
+    let discovered = discovery::discover_runtime(&role.provider, workspace)?;
+    let identity = backend.store.propose_identity(seat)?;
+    let adapter = launch_adapter(&backend.binding, &identity, &role.provider, &discovered)?;
+    let hooks = adapter.hooks();
+    let mut request = request(&backend.binding, &role, identity, &discovered)?;
+    request.operation = Operation::Resume;
+    request.paths.cwd = source.cwd.clone();
+    request.resume = Some(ResumeRequest {
+        binding: source, expected_source: parent.identity,
+    });
+    let selected = registry::provider(role.provider.as_str())?;
+    if selected == registry::NativeProvider::GrokBuild {
+        team_agent_contract::providers::grok_build::native::require_private_primary(&request.paths.cwd)?;
+    }
+    let resolved = resolve_launch(selected.descriptor(), &hooks, &request, Some(&discovered.catalog))?;
+    validate_launch_plan(selected.descriptor(), &resolved, &adapter.plan(&resolved)?)?;
+    Ok(PreparedResume { binding: backend.binding, role, discovered, request })
+}
+
+pub fn resume(prepared: PreparedResume) -> Result<OperationRecord, BackendError> {
+    let mut backend = Backend::open(&prepared.binding.workspace.path, &prepared.binding.team)?;
+    if serde_json::to_vec(&backend.binding).map_err(|_| BackendError::Metadata)?
+        != serde_json::to_vec(&prepared.binding).map_err(|_| BackendError::Metadata)?
+    {
+        return Err(Error::Fence.into());
+    }
+    let source = prepared.request.resume.as_ref().ok_or(BackendError::Metadata)?;
+    let parent = backend.store.assert_current(&source.expected_source)?;
+    if parent.session.as_ref() != Some(&source.binding) {
+        return Err(Error::Fence.into());
+    }
+    let selected = registry::provider(prepared.role.provider.as_str())?;
+    let descriptor = selected.descriptor();
+    let adapter = launch_adapter(&backend.binding, &prepared.request.identity, &prepared.role.provider, &prepared.discovered)?;
+    let hooks = adapter.hooks();
+    // Revalidate the exact plan before publishing the generation snapshot.
+    let resolved = resolve_launch(descriptor, &hooks, &prepared.request, Some(&prepared.discovered.catalog))?;
+    let plan = adapter.plan(&resolved)?;
+    validate_launch_plan(descriptor, &resolved, &plan)?;
+    write_role(&backend.binding, &prepared.request.identity, &prepared.role)?;
+    let operation = OperationId::new(format!("resume-{}", prepared.request.identity.instance.as_str()))?;
+    let mut io = ScopedMaterializer::new(descriptor, &resolved, &plan, operation.clone(), RealCommandRunner::default())?;
+    let clock = RealClock::new();
+    let mut physical = PhysicalRuntime::new(
+        Registration {
+            descriptor, hooks: &hooks, controls: selected.controls(),
+            startup: selected.startup(), session_panel: selected.session_panel(),
+        },
+        settings(&backend.binding, selected), operation.clone(), &clock,
+    )?;
+    physical.evidence = policy_evidence(&prepared.role.provider, &prepared.request.native, backend.binding.candidate_sha256)?;
+    let record = Lifecycle { store: &mut backend.store, host: &mut physical, io: &mut io }.startup(
+        &Adapter { descriptor, hooks: &hooks, catalog: Some(&prepared.discovered.catalog) },
+        &prepared.request,
+        Routing {
+            pane: "unpublished".into(),
+            binding_key: format!("binding-{}", prepared.request.identity.instance.as_str()),
+            server_key: selected.server_key_for(&prepared.request.identity)?,
+        },
+        operation,
+    )?;
+    Ok(record)
+}
+
+fn role_path(binding: &Binding, identity: &InstanceIdentity) -> PathBuf {
+    root_for(&binding.workspace.path, &binding.scope).join(format!(
+        "role-{}-{}.json", identity.seat.as_str(), identity.instance.as_str(),
+    ))
+}
+fn write_role(binding: &Binding, identity: &InstanceIdentity, role: &RoleConfig) -> Result<(), BackendError> {
+    use std::os::unix::fs::OpenOptionsExt;
+    if identity.scope != binding.scope || identity.seat != role.id {
+        return Err(BackendError::Metadata);
+    }
+    // Each generation has an immutable source; an old stopped generation's
+    // model/instructions never change when a new role is admitted.
+    let snapshot = serde_json::to_vec(role).map_err(|_| BackendError::Metadata)?;
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true)
+        .mode(0o600).custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(role_path(binding, identity))?;
+    file.write_all(&snapshot)?;
+    file.sync_all()?;
+    Ok(())
+}
+pub(super) fn read_role(binding: &Binding, identity: &InstanceIdentity) -> Result<RoleConfig, BackendError> {
+    let mut path = role_path(binding, identity);
+    // Existing generation-one deployments retain their immutable source.
+    if identity.generation == Generation(1) {
+        match std::fs::symlink_metadata(&path) {
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                path = root_for(&binding.workspace.path, &binding.scope)
+                    .join(format!("role-{}.json", identity.seat.as_str()));
+            }
+            Err(error) => return Err(error.into()),
+            Ok(_) => {},
+        }
+    }
     let metadata = std::fs::symlink_metadata(&path)?;
     if metadata.file_type().is_symlink() || !metadata.is_file() {
         return Err(BackendError::Metadata);
     }
     let mut bytes = Vec::new();
-    std::fs::File::open(path)?
-        .take(4 * 1024 * 1024 + 1)
-        .read_to_end(&mut bytes)?;
+    use std::os::unix::fs::{MetadataExt, OpenOptionsExt};
+    let file = std::fs::OpenOptions::new().read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC).open(path)?;
+    let opened = file.metadata()?;
+    if metadata.dev() != opened.dev() || metadata.ino() != opened.ino() {
+        return Err(BackendError::Metadata);
+    }
+    file.take(4 * 1024 * 1024 + 1).read_to_end(&mut bytes)?;
     if bytes.len() > 4 * 1024 * 1024 {
         return Err(BackendError::Metadata);
     }
     let role: RoleConfig = serde_json::from_slice(&bytes).map_err(|_| BackendError::Metadata)?;
-    if &role.id != id
-        || role.provider.as_str() != "kiro"
+    if role.id != identity.seat || identity.scope != binding.scope
+        || registry::descriptor(role.provider.as_str())
+            .is_none_or(|descriptor| descriptor.identity.id != role.provider.as_str())
         || digest(role.prompt.text.as_bytes()) != role.prompt.sha256
     {
         return Err(BackendError::Metadata);
@@ -503,38 +730,36 @@ pub(super) fn read_role(binding: &Binding, id: &SeatId) -> Result<RoleConfig, Ba
 }
 
 pub(super) fn policy_evidence(
+    provider: &ProviderId,
     native: &NativeIdentity,
     candidate_sha256: Digest,
-) -> Vec<CapabilityEvidence> {
-    team_agent_contract::kiro::interaction::PROFILES
-        .iter()
-        .filter(|profile| profile.matches_native(native))
-        .flat_map(|profile| {
-            // Bind this observed executable and candidate to the stable recipe.
-            // This is not the historical R0 receipt, nor a business/MCP PASS.
-            let binding_sha256 = digest(
-                format!(
-                    "kiro-runtime-policy-v1\n{native:?}\n{}\n{:?}\n{candidate_sha256:?}",
-                    profile.id, profile.policy_sha256,
-                )
-                .as_bytes(),
-            );
-            profile
-                .operations
-                .iter()
-                .map(move |operation| CapabilityEvidence {
-                    provider: ProviderId::new("kiro").expect("static provider"),
-                    native: native.clone(),
-                    profile_id: profile.id.into(),
-                    policy_sha256: profile.policy_sha256,
-                    channel: profile.channel,
-                    operation: *operation,
-                    kind: EvidenceKind::Native,
-                    candidate_sha256,
-                    evidence_sha256: binding_sha256,
-                })
-        })
-        .collect()
+) -> Result<Vec<CapabilityEvidence>, ContractError> {
+    let descriptor = registry::provider(provider.as_str())?.descriptor();
+    let profiles = descriptor.input.profiles.require("native input profiles")?;
+    let mut evidence = Vec::new();
+    for profile in profiles.iter().filter(|profile| profile.matches_native(native)) {
+        // Unknown submit recipes never produce Native evidence, even when the
+        // provider has a readable catalog or a recognizable TUI surface.
+        profile.policy.require("native submit policy")?;
+        let binding_sha256 = digest(
+            format!(
+                "{}-runtime-policy-v1\n{native:?}\n{}\n{:?}\n{candidate_sha256:?}",
+                descriptor.identity.id, profile.id, profile.policy_sha256,
+            ).as_bytes(),
+        );
+        evidence.extend(profile.operations.iter().map(|operation| CapabilityEvidence {
+            provider: provider.clone(),
+            native: native.clone(),
+            profile_id: profile.id.into(),
+            policy_sha256: profile.policy_sha256,
+            channel: profile.channel,
+            operation: *operation,
+            kind: EvidenceKind::Native,
+            candidate_sha256,
+            evidence_sha256: binding_sha256,
+        }));
+    }
+    Ok(evidence)
 }
 
 struct NoNewIo;
@@ -577,19 +802,23 @@ pub fn stop(workspace: &Path, team: &str, seat: &SeatId) -> Result<OperationReco
         .ok_or(Error::Invalid("unknown native seat"))?;
     let nonce = backend.store.propose_identity(seat)?.instance;
     let operation = OperationId::new(format!("stop-{}", nonce.as_str()))?;
-    let adapter = adapter(&backend.binding, &target.identity)?;
+    let selected = registry::provider(target.provider.as_str())?;
+    let adapter = adapter(&backend.binding, &target.identity, &target.provider)?;
     let hooks = adapter.hooks();
     let clock = RealClock::new();
     let mut physical = PhysicalRuntime::new(
         Registration {
-            descriptor: &KIRO_DESCRIPTOR,
+            descriptor: selected.descriptor(),
             hooks: &hooks,
-            controls: &[],
+            controls: selected.controls(),
+            startup: selected.startup(),
+            session_panel: selected.session_panel(),
         },
-        settings(&backend.binding),
+        settings(&backend.binding, selected),
         operation.clone(),
         &clock,
     )?;
+    physical.evidence = policy_evidence(&target.provider, &target.native, backend.binding.candidate_sha256)?;
     Ok(Lifecycle {
         store: &mut backend.store,
         host: &mut physical,
@@ -602,6 +831,110 @@ pub fn stop(workspace: &Path, team: &str, seat: &SeatId) -> Result<OperationReco
 mod tests {
     use super::*;
 
+    struct RoleFixture { root: PathBuf, binding: Binding, role: RoleConfig, identity: InstanceIdentity }
+    impl RoleFixture {
+        fn new() -> Self {
+            use std::os::unix::fs::DirBuilderExt;
+            let root = std::env::temp_dir().join(format!("contract-role-{}-{}", std::process::id(),
+                std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos()));
+            std::fs::DirBuilder::new().mode(0o700).create(&root).unwrap();
+            let cwd = resolve_cwd(&root).unwrap();
+            let scope = scope_for(&cwd, "test").unwrap();
+            std::fs::create_dir_all(root_for(&cwd.path, &scope)).unwrap();
+            let seat = SeatId::new("worker").unwrap();
+            let identity = InstanceIdentity { scope: scope.clone(), seat: seat.clone(), instance: InstanceId::new("first").unwrap(), generation: Generation(1) };
+            let binding = Binding { version: 1, workspace: cwd, team: "test".into(), scope,
+                endpoint: "controlled".into(), candidate: "/controlled/candidate".into(), candidate_sha256: digest(b"candidate"),
+                tmux: "/controlled/tmux".into(), transport_root: "/controlled/transport".into() };
+            let role = RoleConfig { id: seat, provider: ProviderId::new("cursor").unwrap(), source: root.join("role.md"),
+                role: "worker".into(), model: "first-model".into(), effort: None, bypass: false, paused: false,
+                body: "bounded fixture".into(), prompt: super::super::prompt::Prompt {
+                    text: "bounded fixture".into(), sha256: digest(b"bounded fixture"), sources: vec![],
+                } };
+            Self { root, binding, role, identity }
+        }
+    }
+    impl Drop for RoleFixture { fn drop(&mut self) { let _ = std::fs::remove_dir_all(&self.root); } }
+
+    #[test]
+    fn restart_skips_stopped_mirror_and_stopped_native_store_before_resume_discovery() {
+        for provider in ["cursor", "grok_build"] {
+            let mut fixture = RoleFixture::new();
+            let directory = fixture.root.join("roles");
+            std::fs::create_dir_all(directory.join("agents")).unwrap();
+            std::fs::write(directory.join("TEAM.md"), "---\nname: test\n---\nFixture\n").unwrap();
+            std::fs::write(directory.join("agents/worker.md"),
+                format!("---\nprovider: {provider}\nmodel: unavailable-fixture-model\n---\nFixture\n")).unwrap();
+            let stopped = serde_json::json!({"agents":{"worker":{"provider":provider,"status":"stopped","session_id":"preserved","generation":1}}});
+            // No framework binding/store/native installation exists yet. A
+            // stopped mirror must not even attempt to open the native store.
+            assert!(prepare_restart(&fixture.root, "test", &directory, &stopped).unwrap().is_empty());
+
+            fixture.binding.transport_root = fixture.binding.workspace.path.join("native-store");
+            fixture.binding.endpoint = endpoint(&fixture.binding.scope);
+            let store = ContractStore::create(&fixture.binding.transport_root, fixture.binding.scope.clone(), &fixture.binding.endpoint).unwrap();
+            let native = NativeIdentity { version: "fixture".into(), harness: "unavailable".into(), ui: "tui".into(),
+                platform: Platform::MacOs, executable_sha256: digest(b"fixture") };
+            let seat = SeatRecord {
+                identity: fixture.identity.clone(), provider: ProviderId::new(provider).unwrap(), native,
+                cwd: fixture.binding.workspace.clone(), endpoint: fixture.binding.endpoint.clone(),
+                pane: "unpublished".into(), binding_key: "fixture".into(), profile: "unavailable".into(), server_key: "fixture".into(),
+                evidence_kind: EvidenceKind::Native, status: SeatStatus::Stopped, process: None, physical: None,
+                session: None, resources: vec![], workspace_resources: vec![], bootstrap_used: false,
+            };
+            // Test-only canonical fixture, never a live-store recovery shortcut.
+            let db = rusqlite::Connection::open(fixture.binding.transport_root.join("contract.db")).unwrap();
+            db.execute("INSERT INTO contract_seats(seat,record) VALUES(?1,?2)",
+                rusqlite::params![fixture.identity.seat.as_str(), serde_json::to_string(&seat).unwrap()]).unwrap();
+            db.execute("INSERT INTO contract_generations(seat,generation) VALUES(?1,1)", [fixture.identity.seat.as_str()]).unwrap();
+            drop(db);
+            std::fs::write(root_for(&fixture.binding.workspace.path, &fixture.binding.scope).join("framework-binding.json"),
+                serde_json::to_vec(&fixture.binding).unwrap()).unwrap();
+            let stale_running = serde_json::json!({"agents":{"worker":{"provider":provider,"status":"running"}}});
+            assert!(prepare_restart(&fixture.root, "test", &directory, &stale_running).unwrap().is_empty());
+            assert_eq!(store.seat(&fixture.identity.seat).unwrap(), Some(seat));
+            assert_eq!(store.propose_identity(&fixture.identity.seat).unwrap().generation, Generation(2));
+        }
+    }
+
+    #[test]
+    fn role_snapshots_are_instance_scoped_and_exclusive() {
+        let fixture = RoleFixture::new();
+        write_role(&fixture.binding, &fixture.identity, &fixture.role).unwrap();
+        let mut second = fixture.identity.clone();
+        second.instance = InstanceId::new("second").unwrap();
+        second.generation = Generation(2);
+        let mut role = fixture.role.clone();
+        role.model = "second-model".into();
+        write_role(&fixture.binding, &second, &role).unwrap();
+        assert_eq!(read_role(&fixture.binding, &fixture.identity).unwrap().model, "first-model");
+        assert_eq!(read_role(&fixture.binding, &second).unwrap().model, "second-model");
+        assert!(write_role(&fixture.binding, &fixture.identity, &role).is_err());
+        assert_eq!(read_role(&fixture.binding, &fixture.identity).unwrap().model, "first-model");
+    }
+
+    #[test]
+    fn legacy_role_fallback_is_only_for_missing_generation_one_not_symlinks() {
+        let fixture = RoleFixture::new();
+        let old = root_for(&fixture.binding.workspace.path, &fixture.binding.scope).join("role-worker.json");
+        std::fs::write(&old, serde_json::to_vec(&fixture.role).unwrap()).unwrap();
+        assert_eq!(read_role(&fixture.binding, &fixture.identity).unwrap().model, "first-model");
+        let mut later = fixture.identity.clone();
+        later.generation = Generation(2);
+        assert!(read_role(&fixture.binding, &later).is_err());
+        std::os::unix::fs::symlink(fixture.root.join("missing"), role_path(&fixture.binding, &fixture.identity)).unwrap();
+        assert!(matches!(read_role(&fixture.binding, &fixture.identity), Err(BackendError::Metadata)));
+    }
+
+    #[test]
+    fn mismatched_role_owner_cannot_write_a_snapshot() {
+        let fixture = RoleFixture::new();
+        let mut identity = fixture.identity.clone();
+        identity.seat = SeatId::new("other").unwrap();
+        assert!(matches!(write_role(&fixture.binding, &identity, &fixture.role), Err(BackendError::Metadata)));
+        assert!(!role_path(&fixture.binding, &identity).exists());
+    }
+
     #[test]
     fn shutdown_error_exposes_the_durable_operation_failure_not_metadata() {
         let failure = "native instance not alive or replaced: Unknown; stage=check-bound; expected_pid=44123; process_state=Some(Replaced)";
@@ -618,6 +951,65 @@ mod tests {
         assert!(!shown.contains("metadata is invalid"));
     }
 
+    #[test]
+    fn cursor_metadata_never_mints_runtime_policy_evidence() {
+        let provider = ProviderId::new("cursor").unwrap();
+        let mut native = NativeIdentity {
+            version: "2026.09.29-a1b2c3".into(),
+            harness: "cursor-launcher".into(),
+            ui: "metadata".into(),
+            platform: Platform::MacOs,
+            executable_sha256: digest(b"launcher only"),
+        };
+        let candidate = digest(b"candidate");
+        assert!(policy_evidence(&provider, &native, candidate).unwrap().is_empty());
+        native.harness = "cursor-agent".into();
+        native.ui = "tui".into();
+        // Admission supplies a separately image-fenced runtime identity. The
+        // recipe still cannot be borrowed from metadata or another provider.
+        assert!(!policy_evidence(&provider, &native, candidate).unwrap().is_empty());
+        // Even a Kiro-looking image cannot reuse its evidence under Cursor.
+        native.harness = "v2".into();
+        native.version = "2.29.0".into();
+        assert!(policy_evidence(&provider, &native, candidate).unwrap().is_empty());
+    }
+
+    #[test]
+    fn cursor_request_refuses_metadata_launch_and_wrong_provider_catalog() {
+        let provider = ProviderId::new("cursor").unwrap();
+        let scope = ScopeId::new("controlled").unwrap();
+        let seat = SeatId::new("worker").unwrap();
+        let binding = Binding {
+            version: 1,
+            workspace: CwdIdentity { path: "/controlled".into(), identity: digest(b"cwd") },
+            team: "demo".into(), scope: scope.clone(), endpoint: "/controlled/socket".into(),
+            candidate: "/controlled/candidate".into(), candidate_sha256: digest(b"candidate"),
+            tmux: "/controlled/tmux".into(), transport_root: "/controlled/runtime".into(),
+        };
+        let role = RoleConfig {
+            id: seat.clone(), provider: provider.clone(), source: "/controlled/role.md".into(),
+            role: "worker".into(), model: "gpt-5.6-luna-xhigh".into(), effort: None,
+            bypass: true, paused: false, body: "role".into(),
+            prompt: super::super::prompt::Prompt { text: "prompt".into(), sha256: digest(b"prompt"), sources: vec![] },
+        };
+        let identity = InstanceIdentity { scope, seat, instance: InstanceId::new("preflight").unwrap(), generation: Generation(1) };
+        let native = NativeIdentity {
+            version: "2026.09.29-a1b2c3".into(), harness: "cursor-launcher".into(),
+            ui: "metadata".into(), platform: Platform::MacOs, executable_sha256: digest(b"launcher"),
+        };
+        let mut discovery = Discovery {
+            runtime: None,
+            engine: "/controlled/cursor-agent".into(), native: native.clone(),
+            catalog: CatalogObservation { provider, native,
+                schema: team_agent_contract::providers::cursor::native::CATALOG_SOURCE.schema.into(), models: vec![] },
+        };
+        assert!(matches!(request(&binding, &role, identity.clone(), &discovery),
+            Err(BackendError::Contract(ContractError::ProfileUnavailable))));
+        discovery.catalog.provider = ProviderId::new("kiro").unwrap();
+        assert!(matches!(request(&binding, &role, identity, &discovery),
+            Err(BackendError::Contract(ContractError::Mismatch("role native catalog")))));
+    }
+
     #[test]
     fn policy_bindings_track_runtime_native_identity_not_a_release_receipt() {
         let mut native = NativeIdentity {
@@ -628,11 +1020,12 @@ mod tests {
             executable_sha256: digest(b"old image"),
         };
         let candidate = digest(b"candidate");
-        let old = policy_evidence(&native, candidate);
+        let provider = ProviderId::new("kiro").unwrap();
+        let old = policy_evidence(&provider, &native, candidate).unwrap();
         assert!(!old.is_empty());
         native.version = "2.29.0".into();
         native.executable_sha256 = digest(b"updated image");
-        let new = policy_evidence(&native, candidate);
+        let new = policy_evidence(&provider, &native, candidate).unwrap();
         assert_eq!(new.len(), old.len());
         for (old, new) in old.iter().zip(&new) {
             assert_eq!(new.native, native);
@@ -641,6 +1034,6 @@ mod tests {
             assert_ne!(new.evidence_sha256, old.evidence_sha256);
         }
         native.harness = "v3".into();
-        assert!(policy_evidence(&native, candidate).is_empty());
+        assert!(policy_evidence(&provider, &native, candidate).unwrap().is_empty());
     }
 }