@topolo/cli 0.13.10 → 0.13.12

package/README.md

@@ -436,3 +436,25 @@ context start, fixture start, retirement, and positive permission forwarding
 remain closed before native access. A valid private profile reference does not
 lift this boundary. Source fixtures and descriptor reads do not establish
 private MCP adoption or actual task completion.
+
+Dynamic lane plans can explicitly select the `native-cli` continuity transport.
+Its closed `remote-context --continuity-input` operation produces a bounded
+public identity/context receipt with real response request IDs. The native
+thread's own command or Bash result and charter reads must independently match
+that receipt; an external shell result does not establish native context.
+
+Current native startup, credential refresh authority and Bash result producers
+remain unqualified. Native CLI effects therefore refuse with
+`native_cli_startup_unqualified` before client/helper/native access. Private MCP
+startup retains its existing refusal. Version 1 plans stay readable and do not
+silently become version 2 CLI plans.
+
+### Preserving private pack runtime configuration
+
+`topolo agent-packs --store /owned/AgentPacks runtime-adoption plan --manifest /review/adoption.json` produces a nonwriting configuration plan. Review its physical targets and digest, then use `runtime-adoption apply --manifest /review/adoption.json --plan-digest <sha256> --confirm` for one configuration-only attempt.
+
+The closed owner manifest binds the actual consumer set and effective local Topolo transport origins, physical file preimages, shared aliases, private profile metadata, immutable CLI 0.13.11/MCP 0.14.26/SDK 0.23.21 targets and the separately pinned successor Python adapter. It must include every server in each physical config as either a targeted transport or an explicitly untouched server. Empty or incomplete manifests refuse. The command never installs skills, rebinds a home, changes existing instructions/permissions, starts a consumer or probes Auth.
+
+A successful apply means configuration is prepared. It does not mean existing processes reloaded it, the private account is healthy, permissions were granted or either native harness completed a task. Starting or refreshing consumers is a separate owner-authorized step and can contact private Auth and renew the selected private profile. Public credential-store repair is not a blanket prerequisite for independent private profiles. See [the manifest and effect boundaries](agent-packs/README.md#private-runtime-adoption).
+
+The protocol SDK pin addresses [GHSA-6qxp-vccf-f47h](https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h). The CLI doctor's protocol transport is stdio. Separate HTTP OAuth consumers still need appropriate issuer binding for legacy credentials and bundled providers; this source update neither inspects nor migrates credentials.

package/agent-packs/README.md

@@ -669,3 +669,56 @@ context start, fixture start, retirement, and positive permission forwarding
 remain closed before native access. A valid private profile reference does not
 lift this boundary. Source fixtures and descriptor reads do not establish
 private MCP adoption or actual task completion.
+
+### Explicit native CLI continuity
+
+Version 2 dynamic plans may name `continuityTransport: native-cli`; version 1
+plans retain their existing behavior. The original intake relation is logical
+routing. It does not invent native parentage for a peer session.
+
+The existing public `remote-context` command accepts `--continuity-input` with
+one owned, closed input file. The operation uses an absolute pinned Node/CLI,
+selected profile metadata and an isolated child environment. Its receipt projects
+public principal, organization, Agent/version, Agent/Bytes scope, source digests,
+nonce and actual successful response request IDs. Raw stderr, response bodies,
+credentials and environment dumps are excluded. Missing or ambiguous response
+metadata is incomplete evidence.
+
+A receipt itself cannot acknowledge native context. Verification requires the
+same owning native query, its actual model/effort acknowledgement, exact command,
+turn/tool identity, successful completion/exit and matching result within the
+original request history boundary, plus genuine reads of the own charter/context.
+Only the exact bootstrap command may receive bootstrap permission through the
+original intake. Other work also requires verified context, current policy,
+actual tool outcome and separate settlement. Approval forwarding alone is not
+operation completion.
+
+Current startup provenance, profile refresh authority and native Bash completion
+contracts are unavailable. Effects stay closed with
+`native_cli_startup_unqualified`; an unsupported result contract stays
+`native_cli_tool_result_unqualified`. Input references, hashes or JSON flags do
+not grant admission. Private MCP is a separate unsupported transport and is never
+a fallback. Source fixtures do not activate either native harness.
+
+## Private runtime adoption
+
+The public CLI forwards `agent-packs runtime-adoption plan|apply` to the bundled successor adapter. `plan` performs no writes. `apply` requires the exact reviewed `--plan-digest` and `--confirm`; it never calls `prepare`, `bind`, `reconnect`, skill installation or a native/Auth client. The selected immutable public CLI/MCP cohort is separate from the successor Python adapter source. Do not edit an installed immutable runtime to add the successor hooks.
+
+The manifest is a local owner-reviewed configuration scope, not native provenance, a permission grant or a health certificate. Its exact top-level fields are:
+
+- `schemaVersion: 1`, a fresh UUID `operationId`, and the absolute physical `library`.
+- `ownerGeneration: {path, sha256}`: the owner's current bounded nonsecret effective-transport/generation record, inside that library. The owner must establish its native currency separately.
+- `consumers`: the complete unique existing native IDs in scope. Target rows must account for every ID; no new native IDs are created.
+- `profile: {path, publicPath, metadata, environment, contextKey, principalId}`: absolute private and public credential-file references, explicit organization context, and metadata only. Files must be physically distinct; the private profile must be owned, single-link, regular and mode 0600. Neither profile's contents are read or hashed. A renewal that changes private file metadata invalidates the descriptor and requires owner reconciliation.
+- `runtime: {node, cli, mcp, cohort, pythonSource, adapterFiles, osEnvironment}`. Each executable/entry and each `cohort` value is `{path, sha256}`. Cohort keys `cli`, `mcp`, `sdk` pin their package JSON; required target versions are 0.13.11, 0.14.26 and 0.23.21. CLI and MCP entries must be their pinned package's `dist/index.js`. `pythonSource` is the physical successor source directory; `adapterFiles` pins its `topolo_agent_pack/{cli,live,topolo}.py`. Verify the complete installed cohort independently before admitting its pins. `osEnvironment` permits only HOME/PATH and optional USER/LOGNAME/LANG/LC_ALL/TMPDIR, with no credential, service-origin, Node or installation overrides.
+- `targets`: one row per unique physical configuration file, with `{path, before, aliases, format, rootKey, consumers, transports, untouchedServers}`. Supported formats are JSON `mcpServers` and simple TOML `mcp_servers` tables. Each transport is `{name, origin, consumers}` and must already exist as a local command; URL, inherited `env_vars`, installation-mode, ambiguous names or unsupported TOML layouts refuse. `origin` is the exact physical file. The complete physical server map must equal the targeted names plus `untouchedServers`. The owner must independently bind all effective native layers; a zero-table query or a guessed server name is insufficient.
+- `launcher: {path, before}`: exactly the owned generated `launchers/topolo-agent-pack-backend`; its interpreter, owner and mode are preserved.
+- `preserve`: nonsecret `{path, sha256}` references to existing roster, model/effort, permission, charter/context, routing and lifecycle records. Include every protected fixed and dynamic record in the approved scope. These may not overlap destinations. No transcript or credential contents belong in a manifest.
+
+A physical `before` snapshot contains `device`, `inode`, `uid`, numeric permission `mode`, `bytes`, `mtimeNs`, `ctimeNs`, `parents` (absolute path/device/inode triples), and `sha256`. Profile `metadata` uses the same shape without `sha256`. Each alias is `{path, linkTarget, metadata}`, where `metadata` is the symlink's device/inode/uid/full mode/size/mtimeNs/ctimeNs tuple. The plan emits actual beforeimages for review; effect admission must independently establish the owner, complete source set, physical sharing and current generation. It cannot silently authorize another consumer sharing a file.
+
+Only existing owned physical destinations inside the library can change. Shared desktop/backend config symlinks remain intact and their common file changes once. The generated private descriptor and isolated Python MCP launcher are operation-specific. The isolated MCP launcher validates successor bytes before import, then current profile/generation/preservation pins before replacing itself with the explicit Node/MCP pair and closed private environment. This retains the native host's PID, stdio and cancellation custody. Existing host agent names are retained as a closed wrapper argument. Managed default helper clients use the exact Node/CLI pair regardless of PATH. Unmanaged clients retain their ordinary behavior. No parent credential/service-origin/installation/Node environment is copied into those Topolo children. An intentional installation credential mode needs its own separately explicit contract.
+
+Apply reserves `launchers/adoption-<UUID>.json` exclusively. The journal starts in `may-have-config-effects`, records each verified replacement, and becomes `configuration-prepared-native-adoption-unverified` only after all readbacks. Every write rechecks generation, source, profile metadata, preservation pins and destination custody. An interrupted or conflicting apply retains the journal and any uncertain temporary file; it never automatically replays or rolls back. Reconcile exact effects with the original owner.
+
+No apply result proves native reload, identity, current RBAC, model/effort, loaded context, original-intake permission routing or a native tool result. Hosts may react to configuration changes; admit the actual affected owner/generation and normal request settlement before applying in a live host. Later ordinary startup can renew the private credential and load identity. A previous 429/403 or scoped recovery hold remains separately applicable and elapsed time grants no retry. Actual Codex and Claude same-query context, permission, nonce result, cancellation/settlement and own retirement require independent native evidence.

package/agent-packs/src/topolo_agent_pack/cli.py

@@ -290,6 +290,9 @@ def parser():
     p.add_argument('--version',action='version',version=__version__)
     p.add_argument('--store',default=os.environ.get('CODEX_PACK_HOME',str(pathlib.Path.home()/'AgentPacks')))
     sub=p.add_subparsers(dest='command',required=True)
+    q=sub.add_parser('runtime-adoption',help='Configuration-only private runtime plan/apply; no consumer startup or authentication')
+    q.add_argument('operation',choices=['plan','apply']);q.add_argument('--manifest',required=True)
+    q.add_argument('--plan-digest');q.add_argument('--confirm',action='store_true')
     def selection(q):
         q.add_argument('--set',dest='sets',action='append');q.add_argument('--agent',dest='agents',action='append')
     def activation(q):
@@ -344,6 +347,7 @@ def parser():
             q.add_argument('--ownership',choices=['user','organization'],required=True);q.add_argument('--bytes-scope',choices=['private','org'],required=True);q.add_argument('--instance')
             q.add_argument('--reconcile-local-context',action='store_true',help='Explicitly reconcile a recorded partial context attachment; never replays cloud writes')
             q.add_argument('--private-profile',action='store_true',help='Bind the explicitly selected protected profile metadata for native child helpers')
+        if command=='remote-context':q.add_argument('--continuity-input',help='Closed native-cli continuity input; runtime authority must independently qualify before any client')
         if command=='remember':
             q.add_argument('--content',required=True);q.add_argument('--kind',choices=['instruction','knowledge','durable'],required=True)
             q.add_argument('--provenance',required=True);q.add_argument('--visibility',choices=['private','shared'],default='private')
@@ -373,7 +377,7 @@ def main(argv=None):
     elif command_args and command_args[0].startswith('--store='):command_args=command_args[1:]
     lane_command=bool(command_args and command_args[0]=='lane')
     cloud_command=bool(command_args and command_args[0] in {'connect','remote-context','remember','artifact','artifact-get','remote-recover'})
-    if harness == 'claude' and not policy_command and not cloud_command and not lane_command:
+    if harness == 'claude' and not policy_command and not cloud_command and not lane_command and not (command_args and command_args[0]=='runtime-adoption'):
         from . import claude
         return claude.main(argv)
     if harness not in {'codex', 'claude'}:
@@ -382,10 +386,18 @@ def main(argv=None):
     args=parser().parse_args(argv)
     args.harness=harness
     try:
+        if args.command=='runtime-adoption':
+            if harness!='codex':
+                raise PackError('Runtime adoption is one explicit cross-host owner manifest, not a harness override')
+            emit(live.private_runtime_adoption(args.store,args.manifest,args.operation,args.plan_digest,args.confirm))
+            return 0
         lib=Library(args.store)
         if args.command in {'connect','remote-context','remember','artifact','artifact-get','remote-recover'}:
             from . import topolo
-            with topolo.connection_lock(lib,args):result=topolo.dispatch(lib,args)
+            if args.command=='remote-context' and args.continuity_input:
+                result=topolo.native_cli_continuity_read(lib,args)
+            else:
+                with topolo.connection_lock(lib,args):result=topolo.dispatch(lib,args)
             emit(result)
             return 0
         if args.command=='lane' and args.operation=='serve':

package/agent-packs/src/topolo_agent_pack/lanes.py

@@ -9,6 +9,9 @@ import hashlib
 import os
 import pathlib
 import stat
+import re
+import uuid
+import time
 from contextlib import contextmanager
 
 from .storage import PackError, atomic_json, canonical, read_json, safe_id
@@ -51,7 +54,7 @@ def _role(value, harness):
 
 def plan(request, role, intake, resolution, ceiling):
     if (not isinstance(request, dict) or not {'laneId','logicalOriginThreadId','sourceRoleKey','task'}<=set(request) or
-            set(request)-{'laneId','logicalOriginThreadId','sourceRoleKey','task','verificationProfile'}):
+            set(request)-{'laneId','logicalOriginThreadId','sourceRoleKey','task','verificationProfile','continuityTransport','continuity'}):
         raise PackError('Dynamic lane request has unsupported fields')
     if request.get('verificationProfile') not in {None,'manual'}:
         raise PackError('Only a separately bound narrower manual verification profile is supported')
@@ -68,7 +71,12 @@ def plan(request, role, intake, resolution, ceiling):
         raise PackError('Dynamic lane has no exact current policy ceiling and intake route')
     for key in ['policyRevision', 'policyDigest', 'profile']:
         _identity(ceiling[key], key)
-    return {'format': 'topolo-dynamic-lane-plan', 'schemaVersion': 1,
+    explicit_cli='continuityTransport' in request or 'continuity' in request
+    if explicit_cli:
+        if request.get('continuityTransport')!='native-cli' or set(request.get('continuity',{}))!={'cli','admissionReferences'}:
+            raise PackError('Explicit closed native-cli continuity transport required; no fallback')
+        native_cli_configuration(request['continuity'])
+    result={'format': 'topolo-dynamic-lane-plan', 'schemaVersion': 2 if explicit_cli else 1,
             'laneId': request['laneId'], 'harness': harness,
             'logicalOriginThreadId': request['logicalOriginThreadId'],
             'role': copy.deepcopy(role), 'intake': copy.deepcopy(intake),
@@ -78,6 +86,10 @@ def plan(request, role, intake, resolution, ceiling):
             'nativeParentId': intake['nativeId'] if harness == 'claude' else None,
             'nativeParentAvailability': 'actual-harness-intake' if harness == 'claude' else 'UNAVAILABLE',
             'state': 'planned', 'executionAuthorized': False}
+    if explicit_cli:
+        result.update(continuityTransport='native-cli',continuity=copy.deepcopy(request['continuity']),
+            nativeParentId=None,nativeParentAvailability='actual-native-peer')
+    return result
 
 
 def adopt(planned, receipt, native, current):
@@ -110,7 +122,7 @@ def adopt(planned, receipt, native, current):
         _identity(native.get('title'),'actual child title')
     if not pathlib.Path(receipt['cwd']).is_absolute():
         raise PackError('Created lane requires its exact absolute owned workspace')
-    return {'format': 'topolo-dynamic-lane', 'schemaVersion': 1,
+    return {'format': 'topolo-dynamic-lane', 'schemaVersion': planned['schemaVersion'],
             'laneId': planned['laneId'], 'harness': planned['harness'], 'nativeId': receipt['nativeId'],
             'plan': copy.deepcopy(planned), 'planDigest': digest(planned),
             'creationReceipt': copy.deepcopy(receipt), 'creationReceiptDigest': digest(receipt),
@@ -139,6 +151,8 @@ def acknowledge_context(record, context_digest):
 
 
 def request_permission(record, request_fingerprint, request_id, generation):
+    if record['plan'].get('continuityTransport')=='native-cli' and record.get('nativeCliContext',{}).get('state')!='native-cli-context-ACK':
+        raise PackError('Native-cli work requires verified same-query public context receipt; bootstrap is separately scoped')
     if record['state'] != 'loaded-context-ACK' or generation != record['nativeConnectionGeneration']:
         raise PackError('Dynamic permission request has no current configured connection')
     _identity(request_fingerprint, 'native request fingerprint'); _identity(request_id, 'native request identity')
@@ -263,7 +277,7 @@ class Registry:
         if path.stat().st_size > 131072:
             raise PackError('Dynamic lane record exceeds its bounded schema')
         record = read_json(path)
-        if (record.get('format') != 'topolo-dynamic-lane' or record.get('schemaVersion') != 1 or
+        if (record.get('format') != 'topolo-dynamic-lane' or record.get('schemaVersion') not in {1,2} or not native_cli_record_version(record) or
                 record.get('laneId') != lane_id or record.get('harness') != self.harness or
                 record.get('state') not in STATES or
                 digest(record.get('plan')) != record.get('planDigest') or
@@ -297,7 +311,7 @@ class Registry:
 
     def write(self, record, before_digest):
         lane_id = record['laneId']
-        if (record.get('format') != 'topolo-dynamic-lane' or record.get('schemaVersion') != 1 or
+        if (record.get('format') != 'topolo-dynamic-lane' or record.get('schemaVersion') not in {1,2} or not native_cli_record_version(record) or
                 record['harness'] != self.harness or record['state'] not in STATES or
                 digest(record['plan']) != record['planDigest'] or
                 digest(record['creationReceipt']) != record['creationReceiptDigest']):
@@ -647,6 +661,14 @@ class ClaudeLifecycle:
     def dispatch(self,action,payload):
         if not isinstance(payload,dict):
             raise PackError('Closed native helper object required')
+        candidates=[payload.get('request'),payload.get('plan'),payload.get('operation',{}).get('record',{}).get('plan') if isinstance(payload.get('operation'),dict) and isinstance(payload.get('operation',{}).get('record',{}),dict) else None]
+        for candidate in candidates:
+            if isinstance(candidate,dict) and (candidate.get('continuityTransport')=='native-cli' or candidate.get('schemaVersion')==2 or 'continuity' in candidate):
+                native_cli_admission(candidate.get('continuity'))
+        if isinstance(payload.get('laneId'),str):
+            existing=self.store.read(payload['laneId'])
+            if existing and existing['plan'].get('continuityTransport')=='native-cli':
+                native_cli_admission(existing['plan']['continuity'])
         base={'models'}
         shapes={
             'peek':{'sourceRoleKey'},'plan':{'request','nativeIds'},'adopt':{'plan','receipt','native'},
@@ -747,3 +769,134 @@ def install_model_configuration(lib,pack,document,before_digest):
         raise PackError('Dynamic configuration readback differs')
     return {'state':'dynamic-task-model-intent-installed','pack':pack,'configurationDigest':digest(document),
         'nativeAvailabilityVerified':False,'existingRoleSettingsChanged':False,'modelTurnsStarted':False}
+
+
+# Explicit native-query CLI continuity. These validators do not grant authority.
+NATIVE_CLI_CONTEXT_FIELDS={'principalId','organizationId','contextKey','installationId','logicalId','agentId',
+    'agentVersionId','agentWorkspaceId','bytesWorkspaceId','environment','bytesScope'}
+NATIVE_CLI_SOURCE_FIELDS={'packRevision','planDigest','bindingDigest','policyDigest','charterDigest','contextDigest'}
+NATIVE_CLI_CLI_FIELDS={'nodeExecutable','nodeDigest','entry','entryDigest','version'}
+NATIVE_CLI_AUTHORITY_FIELDS={'startupEvidencePath','startupEvidenceDigest','profileAuthorityPath','profileAuthorityDigest','expiresAt'}
+NATIVE_CLI_INPUT_FIELDS={'format','schemaVersion','operationId','nonce','transport','harness','laneId','nativeId',
+    'sourceRoleKey','intakeKey','intakeNativeId','nativeConnectionGeneration','context','source','cli','admissionReferences','deadline'}
+NATIVE_CLI_RECEIPT_FIELDS={'format','schemaVersion','operationId','nonce','transport','harness','laneId','nativeId',
+    'nativeConnectionGeneration','context','source','cli','responses','claim'}
+
+
+def native_cli_closed(value,fields,label):
+    if not isinstance(value,dict) or set(value)!=fields:
+        raise PackError('Closed native-cli '+label+' required')
+
+
+def native_cli_hash(value):
+    if not isinstance(value,str) or not re.fullmatch('[a-f0-9]{64}',value):
+        raise PackError('Exact native-cli source digest required')
+
+
+def native_cli_configuration(value):
+    native_cli_closed(value,{'cli','admissionReferences'},'configuration')
+    cli=value['cli'];refs=value['admissionReferences']
+    native_cli_closed(cli,NATIVE_CLI_CLI_FIELDS,'CLI identity')
+    native_cli_closed(refs,NATIVE_CLI_AUTHORITY_FIELDS,'authority references')
+    for path in [cli['nodeExecutable'],cli['entry'],refs['startupEvidencePath'],refs['profileAuthorityPath']]:
+        if not isinstance(path,str) or len(path)>4096 or not pathlib.Path(path).is_absolute() or any(ord(c)<32 for c in path):
+            raise PackError('Exact absolute native-cli path reference required')
+    for value in [cli['nodeDigest'],cli['entryDigest'],refs['startupEvidenceDigest'],refs['profileAuthorityDigest']]:
+        native_cli_hash(value)
+    if not isinstance(cli['version'],str) or not re.fullmatch(r'0\.13\.\d+',cli['version']):
+        raise PackError('Immutable native-cli version required')
+    if type(refs['expiresAt']) is not int or refs['expiresAt']<=time.time():
+        raise PackError('Current native-cli authority reference required; reference alone is not authority')
+
+
+def native_cli_input(value):
+    native_cli_closed(value,NATIVE_CLI_INPUT_FIELDS,'input')
+    if (value['format']!='topolo-native-cli-continuity-input' or type(value['schemaVersion']) is not int or value['schemaVersion']!=1 or
+            value['transport']!='native-cli' or value['harness'] not in {'codex','claude'}):
+        raise PackError('Explicit versioned native-cli input required')
+    try:
+        if str(uuid.UUID(value['operationId']))!=value['operationId']:
+            raise ValueError()
+    except (ValueError,TypeError,AttributeError) as error:
+        raise PackError('Exact native-cli operation UUID required') from error
+    native_cli_hash(value['nonce']);safe_id(value['laneId'])
+    for key in ['nativeId','sourceRoleKey','intakeKey','intakeNativeId','nativeConnectionGeneration']:
+        _identity(value[key],key)
+    if '/intakes/' not in value['intakeKey'] or value['nativeId']==value['intakeNativeId']:
+        raise PackError('Exact independent child and original intake required')
+    context=value['context'];source=value['source']
+    native_cli_closed(context,NATIVE_CLI_CONTEXT_FIELDS,'public context');native_cli_closed(source,NATIVE_CLI_SOURCE_FIELDS,'source')
+    for entry in context.values():
+        _identity(entry,'public context')
+    if (context['environment'] not in {'production','staging','development'} or context['bytesScope'] not in {'private','org'} or
+            context['contextKey']!='org:'+context['organizationId']):
+        raise PackError('Exact native-cli environment, organization and Bytes scope required')
+    _identity(source['packRevision'],'pack revision')
+    for key in NATIVE_CLI_SOURCE_FIELDS-{'packRevision'}:
+        native_cli_hash(source[key])
+    native_cli_configuration({'cli':value['cli'],'admissionReferences':value['admissionReferences']})
+    if type(value['deadline']) is not int or value['deadline']<=time.time() or value['deadline']>value['admissionReferences']['expiresAt']:
+        raise PackError('Current bounded native-cli operation deadline required')
+    return copy.deepcopy(value)
+
+
+def native_cli_admission(_value):
+    # No supported current startup/refresh authority producer is installed.
+    # Never turn hashes, a caller boolean or JSON evidence references into one.
+    raise PackError('native_cli_startup_unqualified: current startup, profile refresh authority and native result contracts are unavailable')
+
+
+def native_cli_receipt(expected,receipt):
+    expected=native_cli_input(expected);native_cli_closed(receipt,NATIVE_CLI_RECEIPT_FIELDS,'receipt')
+    if (receipt['format']!='topolo-native-cli-continuity-receipt' or type(receipt['schemaVersion']) is not int or receipt['schemaVersion']!=1 or
+            receipt['claim']!='PUBLIC_IDENTITY_CONTEXT_RESPONSE_ONLY_NATIVE_ATTRIBUTION_REQUIRED'):
+        raise PackError('Native-cli public receipt format differs')
+    for key in NATIVE_CLI_RECEIPT_FIELDS-{'format','schemaVersion','responses','claim'}:
+        if receipt[key]!=expected[key]:
+            raise PackError('Native-cli receipt identity/source/operation differs')
+    native_cli_closed(receipt['responses'],{'identity','context'},'responses');seen=set()
+    for kind,response in receipt['responses'].items():
+        native_cli_closed(response,{'requestEvents','bodyProjectionDigest','actionId','resourceType','resourceId'},'response evidence')
+        native_cli_hash(response['bodyProjectionDigest']);events=response['requestEvents']
+        if not isinstance(events,list) or not 1<=len(events)<=8:
+            raise PackError('Actual bounded native-cli response request IDs required')
+        services=set()
+        for event in events:
+            native_cli_closed(event,{'requestId','method','service','path','status'},'request event')
+            identity=event['requestId'];path=event['path']
+            if (not isinstance(identity,str) or identity=='unavailable' or not re.fullmatch('[A-Za-z0-9][A-Za-z0-9._:-]{0,127}',identity) or
+                    identity in seen or event['method'] not in {'GET','POST'} or event['service'] not in {'auth','agent'} or
+                    type(event['status']) is not int or not 200<=event['status']<300 or not isinstance(path,str) or
+                    not path.startswith('/') or len(path)>1024 or any(c in path for c in ['?','#','\\','\n','\r'])):
+                raise PackError('Actual canonical successful native-cli response evidence required')
+            seen.add(identity);services.add(event['service'])
+        wanted=(None,None,None) if kind=='identity' else ('app_topolo_agent.agent_packs.context','workspace',expected['context']['agentWorkspaceId'])
+        if (response['actionId'],response['resourceType'],response['resourceId'])!=wanted or ('auth' if kind=='identity' else 'agent') not in services:
+            raise PackError('Native-cli response action/resource attribution differs')
+    return copy.deepcopy(receipt)
+
+
+def native_cli_context_ack(record,input,receipt,proof):
+    receipt=native_cli_receipt(input,receipt)
+    if (record.get('schemaVersion')!=2 or record['plan'].get('continuityTransport')!='native-cli' or
+            record['nativeId']!=input['nativeId'] or record['nativeConnectionGeneration']!=input['nativeConnectionGeneration'] or
+            record['state']!='loaded-context-ACK' or record['planDigest']!=input['source']['planDigest']):
+        raise PackError('Exact configured native-cli lane required before context ACK')
+    native_cli_closed(proof,{'harness','nativeId','generation','turnId','itemId','commandDigest','exitCode','receiptDigest'},'native tool attribution')
+    if (proof['harness']!=input['harness'] or proof['nativeId']!=input['nativeId'] or proof['generation']!=input['nativeConnectionGeneration'] or
+            proof['exitCode']!=0 or type(proof['exitCode'])is not int or proof['receiptDigest']!=digest(receipt)):
+        raise PackError('Actual same-query successful native tool attribution differs')
+    for key in ['turnId','itemId']:
+        _identity(proof[key],key)
+    native_cli_hash(proof['commandDigest'])
+    return {**record,'nativeCliContext':{'state':'native-cli-context-ACK','operationId':input['operationId'],
+        'nonce':input['nonce'],'receiptDigest':digest(receipt),'proof':copy.deepcopy(proof)}}
+
+
+def native_cli_record_version(record):
+    planned=record.get('plan',{})
+    if record.get('schemaVersion')==1:
+        return planned.get('schemaVersion')==1 and 'continuityTransport' not in planned
+    return (planned.get('schemaVersion')==2 and planned.get('continuityTransport')=='native-cli' and
+        planned.get('nativeParentId') is None and isinstance(planned.get('continuity'),dict) and
+        set(planned['continuity'])=={'cli','admissionReferences'})