@topolo/cli 0.13.3 → 0.13.4

package/agent-packs/README.md

@@ -492,7 +492,19 @@ authorization remains separate from local command sandboxing.
 Managed bridge status reports requested policy and which resumes have current
 native readback. It does not claim an inference test or independent app-tool
 approval readback. Existing runtimes without this policy report not-configured
-until explicitly rebuilt. Source fixtures do not establish live desktop or
+until explicit `permissions ... --apply` adoption on the existing idle connection.
+Adoption validates the complete selected composition and current source revision,
+qualifies the installed protocol and native model catalog, and verifies original
+thread identities and workspaces before native permission changes. Legacy model
+and effort values are reviewed source-role intent, qualified only by native
+resume responses. Existing execution-policy selections are preserved. The
+operation compares charter and transcript inventories and retains partial or
+uncertain effects for read-only reconciliation; it never recreates threads.
+
+The private token-authenticated bridge also supports `owned-roster-read` with
+no parameters. It sends only fixed native thread metadata and model-catalog
+reads for the full selected roster. Its result explicitly does not establish
+effective permissions, models or app-tool approval behavior. Source fixtures do not establish live desktop or
 three-environment shared-memory acceptance.
 
 ### Organization consent and intake permission routing

package/agent-packs/src/topolo_agent_pack/cli.py

@@ -335,6 +335,7 @@ def parser():
         if command=='connect':
             q.add_argument('--roles',required=True);q.add_argument('--agent-workspace',required=True);q.add_argument('--bytes-workspace',required=True)
             q.add_argument('--ownership',choices=['user','organization'],required=True);q.add_argument('--bytes-scope',choices=['private','org'],required=True);q.add_argument('--instance')
+            q.add_argument('--reconcile-local-context',action='store_true',help='Explicitly reconcile a recorded partial context attachment; never replays cloud writes')
         if command=='remember':
             q.add_argument('--content',required=True);q.add_argument('--kind',choices=['instruction','knowledge','durable'],required=True)
             q.add_argument('--provenance',required=True);q.add_argument('--visibility',choices=['private','shared'],default='private')
@@ -359,13 +360,18 @@ def main(argv=None):
         harness = argv[at + 1]
         del argv[at:at + 2]
     policy_command = 'policy' in argv or 'permissions' in argv
-    if harness == 'claude' and not policy_command:
+    command_args=list(argv)
+    if command_args and command_args[0]=='--store':command_args=command_args[2:]
+    elif command_args and command_args[0].startswith('--store='):command_args=command_args[1:]
+    cloud_command=bool(command_args and command_args[0] in {'connect','remote-context','remember','artifact','artifact-get','remote-recover'})
+    if harness == 'claude' and not policy_command and not cloud_command:
         from . import claude
         return claude.main(argv)
     if harness not in {'codex', 'claude'}:
         print('topolo-agent-pack: Unsupported harness: ' + harness, file=sys.stderr)
         return 2
     args=parser().parse_args(argv)
+    args.harness=harness
     try:
         lib=Library(args.store)
         if args.command in {'connect','remote-context','remember','artifact','artifact-get','remote-recover'}:

package/agent-packs/src/topolo_agent_pack/execution.py

@@ -17,16 +17,19 @@ from . import policy, permissions
 from .storage import PackError, atomic_json, component_key, read_json
 
 
-def compile_runtime(lib, components, runtime):
+def prepare_runtime(lib, components, runtime):
+    """Validate existing role intent without installing a policy or changing history."""
     runtime = pathlib.Path(runtime)
     with closing(sqlite3.connect('file:' + str(runtime / 'home/state_5.sqlite') + '?mode=ro', uri=True)) as db:
         cwds = dict(db.execute('SELECT id,cwd FROM threads'))
-    rows = []
+    rows = []; keys = set(); identities = set()
     for component in components:
         manifest, revision = lib.load(component['sourcePack'], component['revision'])
         matches = [a for a in manifest['agents'] if component_key(a) == component['key'] and a['threadId'] == component['threadId']]
-        if len(matches) != 1 or component['threadId'] not in cwds:
+        if (len(matches) != 1 or component['threadId'] not in cwds or revision != component['revision'] or
+                component['key'] in keys or component['threadId'] in identities):
             raise PackError('Execution policy has no unique owned role: ' + component['key'])
+        keys.add(component['key']); identities.add(component['threadId'])
         consent = permissions.load(lib, matches[0]['pack'], manifest['agents']) if hasattr(lib, 'root') else None
         rows.append({'key': component['key'], 'threadId': component['threadId'],
                      'sourceRevision': revision, 'cwd': cwds[component['threadId']],
@@ -38,7 +41,12 @@ def compile_runtime(lib, components, runtime):
                 'roles': rows, 'applied': False, 'modelTurnsStarted': False}
     # Construct/validate fully before installing intent in a staged runtime.
     ExecutionGate(document)
-    atomic_json(runtime / 'execution-policy.json', document)
+    return document
+
+
+def compile_runtime(lib, components, runtime):
+    document = prepare_runtime(lib, components, runtime)
+    atomic_json(pathlib.Path(runtime) / 'execution-policy.json', document)
     return document
 
 

package/agent-packs/src/topolo_agent_pack/live.py

@@ -5,6 +5,7 @@ or another Codex profile. The renderer bridge is available only in the managed
 profile explicitly launched with local debugging enabled.
 """
 import asyncio
+from contextlib import closing
 import base64
 import hashlib
 import json
@@ -24,7 +25,7 @@ import urllib.parse
 import uuid
 
 from .storage import Library,PackError,atomic_json,canonical,read_json
-from .execution import ExecutionGate, load_gate, qualify_protocol
+from .execution import ExecutionGate, load_gate, prepare_runtime, qualify_protocol
 from .approvals import ApprovalRouter
 
 def permission_settings(agent, current, consent):
@@ -45,7 +46,7 @@ def request(lib,operation,params=None):
     record=read_json(lib.root/'live-bridge.json',{})
     if not record: raise PackError('This desktop profile has no live bridge. Open it through topolo-agent-pack first.')
     with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as connection:
-        connection.settimeout(3 if operation=='status' else 60 if operation=='permissions-configure' else 20)
+        connection.settimeout(3 if operation=='status' else 60 if operation in {'permissions-configure','owned-roster-read'} else 20)
         try: connection.connect(record['socket'])
         except OSError as exc: raise PackError('Managed live bridge is unavailable: '+str(exc)) from exc
         connection.sendall(canonical({'token':record['token'],'operation':operation,**({'params':params} if params is not None else {})})+b'\n')
@@ -83,6 +84,7 @@ class BackendProxy:
         self.approvals=None;self.native_calls={};self.notifications=set()
         self.permission_configuration=False
         self.permission_batch=None
+        self._permission_configuration_inputs=None
 
     async def start_child(self):
         active=self.lib.active()
@@ -153,6 +155,10 @@ class BackendProxy:
         if self.permission_configuration and value.get('method') in {'thread/resume','turn/start'}:
             sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,'message':'Owned permission configuration in progress'}})+b'\n')
             sys.stdout.buffer.flush();return
+        if value.get('method') in {'thread/resume','turn/start'} and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
+            sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,
+                'message':'Unresolved native permission operation requires reconciliation before execution'}})+b'\n')
+            sys.stdout.buffer.flush();return
         if self.quiesced:
             if 'id' in value:
                 sys.stdout.buffer.write(canonical({'id':value['id'],'error':{'code':-32000,'message':'Pack switch in progress; reconnecting backend'}})+b'\n');sys.stdout.buffer.flush()
@@ -181,8 +187,14 @@ class BackendProxy:
         identity='topolo-relay-'+uuid.uuid4().hex
         request={'id':identity,'method':method,'params':params}
         if method in {'thread/resume','turn/start'}:
+            if not self.permission_configuration and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
+                raise PackError('Unresolved native permission operation requires reconciliation before execution')
             await self.qualify_organization(params['threadId'])
             await asyncio.wait_for(self.catalog_ready.wait(),10)
+            if self.permission_configuration:
+                if self._permission_configuration_inputs is None:
+                    raise PackError('No owned permission configuration snapshot; native settings were not sent')
+                self.configuration_current(*self._permission_configuration_inputs)
             request=self.execution.prepare(request)
         future=asyncio.get_running_loop().create_future();self.native_calls[identity]=future;self.pending.add(identity)
         try:
@@ -221,68 +233,200 @@ class BackendProxy:
         authorize_native_scope(proof)
         role['organizationPolicyProof']=proof
 
+    def existing_runtime_intent(self):
+        """Full existing composition only; never use a new composition as migration."""
+        active=self.lib.active()
+        components=active.get('components',[])
+        if str(active.get('runtime'))!=str(self.runtime) or not components:
+            raise PackError('Selected runtime has no complete owned source roster')
+        document=prepare_runtime(self.lib,components,self.runtime)
+        roster=read_json(pathlib.Path(self.runtime)/'agents.json')['agents']
+        def identities(rows):
+            values=[('/'.join([r['pack'],r['set'],r['id']]),r['threadId']) for r in rows]
+            if len(set(values))!=len(values):
+                raise PackError('Duplicate runtime roster membership')
+            return set(values)
+        declared={(r['key'],r['threadId']) for r in document['roles']}
+        with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+            native_ids=[r[0] for r in db.execute('SELECT id FROM threads')]
+        if len(native_ids)!=len(declared) or set(native_ids)!={tid for _,tid in declared}:
+            raise PackError('Native runtime membership differs from full selected composition')
+        if identities(roster)!=declared:
+            raise PackError('Runtime roster differs from selected source membership')
+        for component in components:
+            current,revision=self.lib.load(component['sourcePack'])
+            if revision!=component['revision'] or (component['key'],component['threadId']) not in identities(current['agents']):
+                raise PackError('Current source revision or role identity differs from selected runtime')
+        return document
+
+    def preservation(self,roles):
+        paths={pathlib.Path(self.runtime)/'agents.json'}
+        for role in roles:
+            cwd=pathlib.Path(role['cwd'])
+            if not (cwd/'AGENTS.md').is_file():
+                raise PackError('Owned role starting context is missing')
+            paths.update(cwd.rglob('*.md'))
+        home=pathlib.Path(self.runtime)/'home'
+        for name in ['sessions','archived_sessions']:
+            paths.update((home/name).rglob('*.jsonl'))
+        for path in paths:
+            if path.is_symlink() or not path.is_file():
+                raise PackError('Context and transcript preservation requires regular owned files')
+        return {str(p):hashlib.sha256(p.read_bytes()).hexdigest() for p in sorted(paths)}
+
+    async def read_catalog(self):
+        rows=[];cursors=set();models=set();cursor=None
+        while True:
+            result=await self.call_native('model/list',{'includeHidden':True,**({'cursor':cursor} if cursor else {})})
+            for row in result['data']:
+                if not isinstance(row.get('model'),str) or not row['model'] or row['model'] in models:
+                    raise PackError('Native model catalog identity is unqualified')
+                models.add(row['model']);rows.append(row)
+            cursor=result.get('nextCursor')
+            if not cursor:return {'data':rows}
+            if not isinstance(cursor,str) or cursor in cursors or len(cursors)>=20:
+                raise PackError('Native model catalog pagination is unqualified')
+            cursors.add(cursor)
+
+    async def owned_roster_read(self,params):
+        """Finite token-authenticated metadata reads, not an arbitrary RPC dispatcher."""
+        if params or self.permission_configuration or self.quiesced or not self.initialized or self.active_turns or self.pending or self.notifications:
+            raise PackError('Owned read requires an idle initialized connection and no caller overrides')
+        self.permission_configuration=True
+        try:
+            document=self.existing_runtime_intent();rows=[]
+            protocol=qualify_protocol(self.real)
+            for role in document['roles']:
+                state=await self.call_native('thread/read',{'threadId':role['threadId'],'includeTurns':False})
+                thread=state.get('thread',{})
+                if thread.get('id')!=role['threadId'] or thread.get('cwd')!=role['cwd']:
+                    raise PackError('Native role identity differs from owned roster')
+                rows.append({'key':role['key'],'threadId':role['threadId'],'cwd':role['cwd'],
+                    'status':thread.get('status',{}).get('type')})
+            catalog=await self.read_catalog()
+            return {'state':'native-owned-roster-read','roles':rows,
+                'models':[{'model':r['model'],'supportedReasoningEfforts':r['supportedReasoningEfforts']} for r in catalog['data']],
+                'protocol':protocol,'classification':'native metadata and account catalog; role settings remain intent',
+                'effectiveSettingsVerified':False,'modelTurnsStarted':False}
+        finally:self.permission_configuration=False
+
+    def qualification_inputs(self,roles):
+        """Cheap current owned inputs; never cache a changed selection or consent."""
+        from . import permissions
+        active=self.lib.active();sources={}
+        for name in sorted({c['sourcePack'] for c in active.get('components',[])}):
+            manifest,revision=self.lib.load(name)
+            sources[name]={'revision':revision,'consent':permissions.load(self.lib,name,manifest['agents'])}
+        with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+            native_cwds=sorted(db.execute('SELECT id,cwd FROM threads'))
+        return json.loads(canonical({'selected':{'runtime':active.get('runtime'),'components':active.get('components')},
+            'childPid':self.child.pid,'ownedRuntime':str(self.runtime),
+            'sources':sources,'runtimeRoster':read_json(pathlib.Path(self.runtime)/'agents.json'),
+            'nativeMembershipAndCwds':native_cwds,'contextTranscriptHashes':self.preservation(roles)}))
+
+    def configuration_current(self,inputs,roles):
+        if (self.quiesced or self.closed or not self.child or getattr(self.child,'returncode',None) is not None or
+                self.active_turns or self.pending or self.notifications or (self.approvals and self.approvals.pending)):
+            raise PackError('Native work or approval arrived during configuration; reconcile pending requests and any recorded effects')
+        if inputs is not None and self.qualification_inputs(roles)!=inputs:
+            raise PackError('Selected runtime, source, consent, context or transcript changed during qualification; reconcile any recorded effects')
+
     async def configure_permissions(self,pack):
-        """Configure the existing owned child, without launching another server."""
+        """Explicit legacy adoption or transition on the SAME existing owned child."""
         from . import permissions
-        if self.permission_configuration or self.quiesced or not self.execution or self.active_turns or self.pending:
+        if self.permission_configuration or self.quiesced or self.active_turns or self.pending or self.notifications or (not self.execution and not self.initialized):
             raise PackError('Owned native connection must be initialized, idle and settled')
         marker=pathlib.Path(self.runtime)/'permissions-operation.json'
         if marker.exists():
             raise PackError('Unresolved native permissions operation requires read-only reconciliation')
         if self.approvals and self.approvals.pending:
             raise PackError('Native approvals remain pending; preserve their owning connection')
-        manifest,_=self.lib.load(pack);consent=permissions.load(self.lib,pack,manifest['agents'])
-        if not consent:
-            raise PackError('Explicit organization-bound installation consent required')
-        roles=list(self.execution.roles.values());wanted=[]
-        by_key={r['key']:r for r in roles}
-        for agent in manifest['agents']:
-            key='/'.join([agent['pack'],agent['set'],agent['id']]);old=by_key.get(key)
-            if not old or old['threadId']!=agent['threadId']:
-                raise PackError('Complete pack must match the live owned roster')
-            row={**old,'settings':permission_settings(agent,old['settings'],consent),
-                'installationConsent':consent,'intakeKey':consent['intakeRoutes'][key],'contextKey':consent['contextKey']}
-            wanted.append(row)
-        changed={r['threadId']:r for r in wanted}
-        candidate=ExecutionGate({'format':'topolo-codex-runtime-execution','schemaVersion':1,
-            'roles':[changed.get(r['threadId'],r) for r in roles]})
-        candidate.catalog=self.execution.catalog.copy()
-        # Complete ownership/idle qualification precedes the first native effect.
         self.permission_configuration=True
+        legacy=self.execution is None;preservation=None;inputs=None
         try:
+            if legacy:
+                if (pathlib.Path(self.runtime)/'execution-policy.json').exists():
+                    raise PackError('Existing policy must be qualified; not a legacy adoption')
+                document=self.existing_runtime_intent()
+                roles=document['roles'];preservation=self.preservation(roles)
+                inputs=self.qualification_inputs(roles)
+                provenance='reviewed source-role adoption intent; qualified only by native resume acknowledgements'
+            else:
+                roles=list(self.execution.roles.values())
+                provenance='preserved owned execution-policy model and effort'
+            manifest,_=self.lib.load(pack);consent=permissions.load(self.lib,pack,manifest['agents'])
+            if not consent:
+                raise PackError('Explicit organization-bound installation consent required')
+            wanted=[];by_key={r['key']:r for r in roles}
+            for agent in manifest['agents']:
+                key='/'.join([agent['pack'],agent['set'],agent['id']]);old=by_key.get(key)
+                if not old or old['threadId']!=agent['threadId']:
+                    raise PackError('Complete pack must match the live owned roster')
+                wanted.append({**old,'settings':permission_settings(agent,old['settings'],consent),
+                    'installationConsent':consent,'intakeKey':consent['intakeRoutes'][key],'contextKey':consent['contextKey']})
+            if legacy and len(wanted)!=len(roles):
+                raise PackError('Legacy adoption requires the full selected composition')
+            changed={r['threadId']:r for r in wanted}
+            candidate=ExecutionGate({'format':'topolo-codex-runtime-execution','schemaVersion':1,
+                'roles':[changed.get(r['threadId'],r) for r in roles]})
+            # Capture original native requests BEFORE the first awaited legacy read.
+            # Existing pending request generation/body custody always stays on this router.
+            routing=ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',list(candidate.roles.values()),uuid.uuid4().hex)
+            if not self.approvals:self.approvals=routing
+            self._permission_configuration_inputs=(inputs,roles)
+            if legacy:
+                self.protocol=qualify_protocol(self.real)
+                candidate_catalog=await self.read_catalog()
+                self.configuration_current(inputs,roles)
+                candidate.set_catalog(candidate_catalog);self.catalog_ready.set()
+            else:candidate.catalog=self.execution.catalog.copy()
             for role in wanted:
                 state=await self.call_native('thread/read',{'threadId':role['threadId'],'includeTurns':False})
+                self.configuration_current(inputs,roles)
                 thread=state.get('thread',{})
                 if thread.get('id')!=role['threadId'] or thread.get('cwd')!=role['cwd'] or thread.get('status',{}).get('type') not in {'idle','notLoaded'}:
                     raise PackError('Native role identity or idle status differs')
                 if role['settings']['model_reasoning_effort'] not in candidate.catalog.get(role['settings']['model'],set()):
                     raise PackError('Native account lacks the preserved model/effort')
-            # Validate the new routing graph before committing any permission intent.
-            ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',list(candidate.roles.values()),uuid.uuid4().hex)
-            atomic_json(marker,{'state':'prepared','pack':pack,'before':roles,'requested':wanted})
+            self.configuration_current(inputs,roles)
+            operation={'pack':pack,'before':roles,'requested':wanted,'modelEffortProvenance':provenance,
+                'beforeSettingsClassification':'source intent only' if legacy else 'owned execution policy intent',
+                'protocol':self.protocol,'contextTranscriptHashes':preservation,'qualificationInputs':inputs}
+            atomic_json(marker,{**operation,'state':'prepared'})
             self.execution=candidate
             await self.qualify_organization(wanted[0]['threadId'])
+            self.configuration_current(inputs,roles)
             self.permission_batch={'consent':consent,'proof':candidate.roles[wanted[0]['threadId']]['organizationPolicyProof'],
                                    'deadline':time.monotonic()+45}
-            atomic_json(marker,{'state':'may-have-effects','pack':pack,'before':roles,'requested':wanted})
+            atomic_json(marker,{**operation,'state':'may-have-effects'})
             for role in wanted:
+                self.configuration_current(inputs,roles)
                 await self.call_native('thread/resume',{'threadId':role['threadId']})
-                atomic_json(marker,{'state':'may-have-effects','pack':pack,'before':roles,'requested':wanted,
+                # First persist ACK progress, then refuse late work/drift. Do not lose a final ACK.
+                atomic_json(marker,{**operation,'state':'may-have-effects',
                     'verifiedThreadIds':sorted(candidate.verified)})
+                self.configuration_current(inputs,roles)
+            self.configuration_current(inputs,roles)
             document={'format':'topolo-codex-runtime-execution','schemaVersion':1,'roles':list(candidate.roles.values()),
                       'applied':False,'modelTurnsStarted':False}
             atomic_json(pathlib.Path(self.runtime)/'execution-policy.json',document)
-            self.approvals=ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',list(candidate.roles.values()),uuid.uuid4().hex)
+            # No await between the final custody fence and committing the routing graph.
+            # Preserve the physical connection's current router and generation.
+            self.approvals.roles=routing.roles;self.approvals.by_key=routing.by_key
             result={'state':'native-permission-resumes-verified','pack':pack,'verifiedAgents':len(wanted),
                 'modelTurnsStarted':False,'historyChanged':False,'appToolApprovalReadbackVerified':False,
-                'intakeRoutes':len(wanted),'nativeApprovalTransport': 'owned-live-connection'}
+                'intakeRoutes':len(wanted),'nativeApprovalTransport': 'owned-live-connection',
+                'modelEffortProvenance':provenance,'legacyRuntimeAdopted':legacy,
+                'contextTranscriptPreservationVerified':preservation is not None}
             atomic_json(marker,{**result,'verifiedThreadIds':sorted(candidate.verified)})
             atomic_json(pathlib.Path(self.runtime)/'permissions-proof.json',result);marker.unlink()
             return result
-        finally:self.permission_configuration=False;self.permission_batch=None
+        finally:
+            self._permission_configuration_inputs=None
+            self.permission_configuration=False;self.permission_batch=None
 
     def schedule_notification(self,record):
-        if (record['key'] in self.notifications or record['notificationState'] not in
+        if (self.permission_configuration or record['key'] in self.notifications or record['notificationState'] not in
                 {'not-delivered','awaiting-idle-intake'}):return
         self.notifications.add(record['key'])
         async def deliver():
@@ -319,18 +463,24 @@ class BackendProxy:
             if not secrets.compare_digest(message.get('token',''),self.token): raise PackError('Live bridge authentication failed')
             op=message.get('operation')
             if op=='quiesce':
+                if self.permission_configuration:
+                    raise PackError('Permission configuration in progress; preserve the owning native connection')
                 if self.active_turns: raise PackError('Outgoing agents have active turns. Wait for their current turns; Codex can stay open.')
                 if self.pending: raise PackError('Backend requests are in flight. Retry the switch; Codex can stay open.')
                 self.quiesced=True
                 await self.stop_child()
             elif op=='resume':
                 if self.quiesced: raise PackError('Use the desktop reconnect action to resume a quiesced bridge')
+            elif op=='owned-roster-read':
+                result=await self.owned_roster_read(message.get('params') or {})
             elif op=='permissions-configure':
                 result=await self.configure_permissions((message.get('params') or {})['pack'])
             elif op in {'approval-list','approval-details','approval-respond'}:
                 if not self.approvals:
                     raise PackError('This connection has no qualified intake routing')
                 params=message.get('params') or {}
+                if op=='approval-respond' and self.permission_configuration:
+                    raise PackError('Permission configuration in progress; original native request remains pending')
                 if op=='approval-list':result={'requests':self.approvals.records()}
                 else:
                     entry=self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
@@ -340,13 +490,15 @@ class BackendProxy:
                             raise PackError('Recorded human decision required; never auto-approve')
                         reply=self.approvals.response(params['key'],params['intakeThreadId'],params['fingerprint'],params['result'])
                         if reply['result'].get('decision')=='accept':
+                            if not self.execution:
+                                raise PackError('Native approval requires qualified owned execution policy; original request remains pending')
                             await self.qualify_organization(entry['record']['sourceThreadId'])
                             self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
                         self.approvals.sending(reply)
                         self.child.stdin.write(canonical(reply)+b'\n');await self.child.stdin.drain();self.approvals.settled(reply)
                         result={'state':'native-response-forwarded','operationEffectVerified':False}
             elif op!='status': raise PackError('Unknown live bridge operation')
-            if op not in {'approval-list','approval-details','approval-respond','permissions-configure'}:result=self.status()
+            if op not in {'approval-list','approval-details','approval-respond','permissions-configure','owned-roster-read'}:result=self.status()
         except Exception as exc: result={'error':str(exc)}
         writer.write(canonical(result)+b'\n');await writer.drain();writer.close();await writer.wait_closed()
 

package/agent-packs/src/topolo_agent_pack/topolo.py

@@ -2,6 +2,9 @@
 import re,contextlib,fcntl,base64,hashlib,json,os,pathlib,shutil,subprocess,tempfile,uuid
 from .storage import PackError,atomic_json,canonical,read_json,safe_id
 
+class ConnectionSourceRefused(PackError):
+    pass
+
 class Client:
     def __init__(self,environment,context,binary=None):
         if environment not in {'development','staging','production'}:
@@ -35,6 +38,8 @@ class Client:
                 plan=self.run(['actions','plan',*common,'--confirm'])
                 if not plan.get('executable'):
                     raise PackError('Topolo plan is not executable')
+            if action=='app_topolo_agent.agent_packs.connect' and getattr(self,'_pack_connect_scope',None) is not None:
+                qualify_connection_scope(self._pack_connect_scope)
             if upload:
                 result=self.run(['actions','upload',*common,'--file',str(upload),'--content-type',input.get('type','application/octet-stream'),'--confirm'])
             else:result=self.run(['actions','call',*common,'--detail',*(['--confirm'] if write else [])])
@@ -123,9 +128,194 @@ def attach_runtime(lib,runtime):
         with os.fdopen(fd,'w') as f:f.write(text);f.flush();os.fsync(f.fileno())
         os.chmod(temp,0o600);os.replace(temp,guide)
 
+def context_file(path,root,optional=False):
+    """Only regular owned files within a qualified local context root."""
+    path=pathlib.Path(path);root=pathlib.Path(root).resolve()
+    if not path.is_absolute() or not path.is_relative_to(root):
+        raise PackError('Context file is outside its owned root')
+    parent=path.parent
+    while parent.is_relative_to(root):
+        if parent.is_symlink() or not parent.is_dir() or parent.stat().st_uid!=os.getuid():
+            raise PackError('Context parent is not an owned regular directory')
+        if parent==root:break
+        parent=parent.parent
+    if path.is_symlink():
+        raise PackError('Context file must not be a symlink')
+    if not path.exists() and optional:return None
+    if not path.is_file() or path.stat().st_uid!=os.getuid() or path.stat().st_nlink!=1:
+        raise PackError('Context file must be an owned regular file')
+    return path.read_bytes()
+
+def claude_context_plan(lib,name,manifest,revision):
+    from .claude import project_directory
+    safe_id(name);root=lib.root/'claude';state_path=root/'state.json'
+    state_bytes=context_file(state_path,lib.root);state=json.loads(state_bytes)
+    if state.get('schemaVersion')!=1 or state.get('harness')!='claude' or not isinstance(state.get('agents'),list):
+        raise PackError('Existing Claude roster required')
+    expected={name+'/'+a['set']+'/'+a['id']:a for a in manifest['agents']}
+    records=[r for r in state['agents'] if r.get('pack')==name]
+    if len(records)!=len(expected) or {r.get('key') for r in records}!=set(expected):
+        raise PackError('Complete existing Claude pack must match the captured roster')
+    ids=set();workspaces=set();rows=[];preserved={str(state_path):hashlib.sha256(state_bytes).hexdigest()}
+    config=pathlib.Path(os.environ.get('CLAUDE_CONFIG_DIR',str(pathlib.Path.home()/'.claude'))).expanduser().resolve()
+    for record in records:
+        key=record['key'];agent=expected[key];safe_id(agent['set']);safe_id(agent['id'])
+        workspace=root/'workspaces'/name/agent['set']/agent['id']
+        session=record.get('cliSessionId','')
+        try:session_ok=str(uuid.UUID(session))==session
+        except (ValueError,AttributeError,TypeError):session_ok=False
+        fields={'key':key,'pack':name,'set':agent['set'],'agent':agent['id'],'sourceRevision':revision,
+            'sourceCodexThreadId':agent['threadId'],'workspace':str(workspace),'cliSessionId':session,'desktopSessionId':'local_'+session,
+            'transcript':str(project_directory(config,workspace)/(session+'.jsonl'))}
+        if not session_ok or any(record.get(k)!=v for k,v in fields.items()) or session in ids or str(workspace) in workspaces:
+            raise PackError('Claude native identity, revision or workspace differs')
+        ids.add(session);workspaces.add(str(workspace))
+        identity_path=root/'identities'/(hashlib.sha256(key.encode()).hexdigest()+'.json')
+        identity_bytes=context_file(identity_path,lib.root);identity_record=json.loads(identity_bytes)
+        if any(identity_record.get(k)!=v for k,v in fields.items()):
+            raise PackError('Claude durable identity differs from its roster')
+        preserved[str(identity_path)]=hashlib.sha256(identity_bytes).hexdigest()
+        guide=workspace/'CLAUDE.md';body=context_file(guide,lib.root)
+        descriptor=workspace/'topolo-connection.json';old_descriptor=context_file(descriptor,lib.root,optional=True)
+        for file in workspace.rglob('*.md'):
+            if file!=guide:preserved[str(file)]=hashlib.sha256(context_file(file,lib.root)).hexdigest()
+        transcript=pathlib.Path(fields['transcript'])
+        preserved[str(transcript)]=hashlib.sha256(context_file(transcript,config/'projects')).hexdigest()
+        rows.append({'key':key,'logicalId':agent['set']+'/'+agent['id'],'nativeThreadId':record['desktopSessionId'],
+            'guide':str(guide),'descriptor':str(descriptor),'beforeGuide':hashlib.sha256(body).hexdigest(),
+            'beforeDescriptor':hashlib.sha256(old_descriptor).hexdigest() if old_descriptor is not None else None,
+            'prefixHash':hashlib.sha256(body.split(b'\n<!-- topolo-continuity -->')[0]).hexdigest()})
+    return {'name':name,'revision':revision,'rows':rows,'preserved':preserved}
+
+def atomic_context(path,data):
+    path=pathlib.Path(path);fd,temporary=tempfile.mkstemp(dir=path.parent,prefix='.continuity-')
+    try:
+        with os.fdopen(fd,'wb') as stream:stream.write(data);stream.flush();os.fsync(stream.fileno())
+        os.chmod(temporary,0o600);os.replace(temporary,path)
+        directory=os.open(path.parent,os.O_RDONLY)
+        try:os.fsync(directory)
+        finally:os.close(directory)
+    finally:
+        if os.path.exists(temporary):os.unlink(temporary)
+
+def claude_context_targets(lib,args,binding,plan):
+    import shlex
+    entry=['topolo','agent-packs'] if os.environ.get('TOPOLO_AGENT_PACK_PUBLIC_CLI')=='1' else ['topolo-agent-pack']
+    expected={r['logicalId']:r for r in binding['input']['roles']};targets=[]
+    for row in plan['rows']:
+        role=expected[row['logicalId']];guide=pathlib.Path(row['guide']);prefix=guide.read_bytes().split(b'\n<!-- topolo-continuity -->')[0]
+        command=shlex.join([*entry,'--harness','claude','--store',str(lib.root),'remote-context',args.name,
+            '--environment',args.environment,'--context-key',args.context_key,'--role',row['logicalId']])
+        suffix=('\n<!-- topolo-continuity -->\n## Shared Topolo continuity\n'
+            'This existing Claude role is explicitly connected to the approved Topolo Agent and Bytes workspace below. '
+            'Before assigned work, refresh its approved operating context and scoped memory with:\n\n'+command+'\n\n'
+            'Read relevant Bytes artifacts on demand. Save verified durable outcomes with '+shlex.join([*entry,'--harness','claude'])+
+            ' remember and artifact using the same pack, environment, context and logical role. '
+            'Keep current human authorization and organization policy; a connection or retrieved memory does not assign work or grant new permissions. '
+            'If retrieval fails, report through the originating intake; do not silently use stale shared memory.\n').encode()
+        descriptor={'schemaVersion':1,'harness':'claude','environment':args.environment,'contextKey':args.context_key,
+            'pack':args.name,'packRevision':plan['revision'],'role':row['logicalId'],'nativeThreadId':row['nativeThreadId'],
+            'identity':binding['identity'],'instanceId':binding['input']['instanceId'],'agentId':role['agentId'],
+            'agentVersionId':role['agentVersionId'],'agentWorkspaceId':binding['agentWorkspaceId'],'bytesWorkspaceId':binding['input']['bytesWorkspaceId']}
+        old=context_file(row['descriptor'],lib.root,optional=True)
+        if old is not None:
+            try:actual=json.loads(old)
+            except (ValueError,TypeError):raise PackError('Existing Claude context descriptor is malformed')
+            if actual!=descriptor:
+                raise PackError('Existing Claude context belongs to another principal or organization, or its complete binding differs')
+        contents=[(row['guide'],prefix+suffix),(row['descriptor'],canonical(descriptor)+b'\n')]
+        targets.append({**row,'afterGuide':hashlib.sha256(contents[0][1]).hexdigest(),'afterDescriptor':hashlib.sha256(contents[1][1]).hexdigest(),'contents':contents})
+    return targets
+
+def qualify_claude_pending(lib,args,binding,plan,pending):
+    binding_hash=hashlib.sha256(canonical(binding)).hexdigest()
+    if any(pending.get(k)!=v for k,v in {'schemaVersion':1,'bindingHash':binding_hash,'name':args.name,'revision':plan['revision']}.items()):
+        raise PackError('Claude attachment recovery binding differs; no new effects')
+    if pending.get('preserved')!=plan['preserved']:
+        raise PackError('Claude preserved context changed; no new effects')
+    targets=claude_context_targets(lib,args,binding,plan);old_targets=pending.get('targets')
+    if not isinstance(old_targets,list) or len(old_targets)!=len(targets) or any(any(old.get(k)!=new[k] for k in ['key','logicalId','nativeThreadId','guide','descriptor','prefixHash','afterGuide','afterDescriptor']) for old,new in zip(old_targets,targets)):
+        raise PackError('Claude attachment target identity differs; no new effects')
+    verified=pending.get('verifiedKeys');keys=[row['key'] for row in targets]
+    if not isinstance(verified,list) or verified!=keys[:len(verified)]:
+        raise PackError('Claude partial verification progress differs')
+    for old,current in zip(old_targets,targets):
+        if current['beforeGuide'] not in [old.get('beforeGuide'),old['afterGuide']] or current['beforeDescriptor'] not in [old.get('beforeDescriptor'),old['afterDescriptor']] or (current['key'] in verified and (current['beforeGuide']!=old['afterGuide'] or current['beforeDescriptor']!=old['afterDescriptor'])):
+            raise PackError('Claude partial target progress differs; no new effects')
+    return targets
+
+def attach_claude(lib,args,binding,plan):
+    import shlex
+    path=binding_path(lib,args.name,args.environment,args.context_key)
+    journal=path.with_suffix('.claude-context.pending.json');receipt=path.with_suffix('.claude-context.verified.json')
+    binding_hash=hashlib.sha256(canonical(binding)).hexdigest()
+    pending=read_json(journal,{})
+    if pending and not getattr(args,'reconcile_local_context',False):
+        raise PackError('Partial Claude context attachment requires explicit --reconcile-local-context; no replay')
+    current_manifest,current_revision=lib.load(args.name)
+    current=claude_context_plan(lib,args.name,current_manifest,current_revision)
+    if current!=plan:
+        raise PackError('Claude context changed during connection qualification')
+    targets=claude_context_targets(lib,args,binding,plan)
+    stable={'schemaVersion':1,'bindingHash':binding_hash,'name':args.name,'revision':plan['revision'],'preserved':plan['preserved'],
+        'targets':[{k:v for k,v in row.items() if k!='contents'} for row in targets]}
+    result={'state':'local-context-verified','harness':'claude','verifiedAgents':len(targets),'historyChanged':False,
+        'nativeSettingsVerified':False,'nativeIdleVerified':False,'modelTurnsStarted':False,'bindingHash':binding_hash}
+    if not pending and all(row['beforeGuide']==row['afterGuide'] and row['beforeDescriptor']==row['afterDescriptor'] for row in targets):
+        if claude_context_plan(lib,args.name,*lib.load(args.name))!=plan:
+            raise PackError('Claude context changed before unchanged attachment receipt')
+        atomic_json(receipt,{**stable,**result,'verifiedKeys':[row['key'] for row in targets]})
+        return result
+    if pending:
+        if any(pending.get(k)!=stable[k] for k in ['schemaVersion','bindingHash','name','revision','preserved']):
+            raise PackError('Claude attachment recovery binding or preserved context differs')
+        old_targets=pending['targets']
+        if len(old_targets)!=len(targets) or any(any(old.get(k)!=new[k] for k in ['key','logicalId','nativeThreadId','guide','descriptor','prefixHash','afterGuide','afterDescriptor']) for old,new in zip(old_targets,targets)):
+            raise PackError('Claude attachment target identity differs')
+        stable['targets']=old_targets
+    else:atomic_json(journal,{**stable,'state':'prepared','verifiedKeys':[]})
+    verified=[]
+    for row,baseline in zip(targets,stable['targets']):
+        manifest,revision=lib.load(args.name);fresh=claude_context_plan(lib,args.name,manifest,revision)
+        if revision!=stable['revision'] or fresh['preserved']!=stable['preserved'] or [r['key'] for r in fresh['rows']]!=[r['key'] for r in plan['rows']]:
+            raise PackError('Claude source, identities, context or transcript changed during attachment')
+        for file,data in row['contents']:
+            old=context_file(file,lib.root,optional=file==row['descriptor']);digest=hashlib.sha256(old).hexdigest() if old is not None else None
+            before=baseline['beforeGuide'] if file==row['guide'] else baseline['beforeDescriptor']
+            after=baseline['afterGuide'] if file==row['guide'] else baseline['afterDescriptor']
+            if digest not in [before,after]:
+                raise PackError('Claude target changed; partial attachment retained for explicit reconciliation')
+            if digest!=after:atomic_context(file,data)
+            if hashlib.sha256(context_file(file,lib.root)).hexdigest()!=after:
+                raise PackError('Claude attachment read-back differs; retain partial journal')
+        verified.append(row['key']);atomic_json(journal,{**stable,'state':'partial','verifiedKeys':verified})
+    final=claude_context_plan(lib,args.name,*lib.load(args.name))
+    if final['preserved']!=stable['preserved']:
+        raise PackError('Claude preserved context or history changed before final receipt')
+    for row in stable['targets']:
+        if any(hashlib.sha256(context_file(row[file],lib.root)).hexdigest()!=row[after] for file,after in [('guide','afterGuide'),('descriptor','afterDescriptor')]):
+            raise PackError('Claude final attachment differs; retain partial journal')
+    atomic_json(receipt,{**stable,**result,'verifiedKeys':verified});journal.unlink()
+    return result
+
+def qualify_connection_scope(scope):
+    lib,args,options,manifest_bytes,revision,roles_bytes,roles,claude_plan=scope
+    try:
+        current_manifest,current_revision=lib.load(args.name)
+        if vars(args)!=options or current_revision!=revision or canonical(current_manifest)!=manifest_bytes or pathlib.Path(args.roles).read_bytes()!=roles_bytes:
+            raise PackError('Pack source or request inputs changed')
+        # Manifest equality and Library.object's content hash bind instructions.
+        # Re-read each actual immutable object; missing/corrupt content refuses.
+        for agent in current_manifest['agents']:role_guide(lib,current_manifest,agent)
+        if claude_plan is not None and claude_context_plan(lib,args.name,current_manifest,current_revision)!=claude_plan:
+            raise PackError('Claude source, identities, context or history changed')
+    except (PackError,OSError,ValueError,TypeError) as error:
+        raise ConnectionSourceRefused('Pack source or native context changed before cloud dispatch; no mutating call') from error
+
 def connect(lib,args,client):
     manifest,revision=lib.load(args.name)
-    selected=read_json(args.roles)
+    claude_plan=claude_context_plan(lib,args.name,manifest,revision) if getattr(args,'harness','codex')=='claude' else None
+    roles_bytes=pathlib.Path(args.roles).read_bytes();selected=json.loads(roles_bytes)
     expected={a['set']+'/'+a['id']:a for a in manifest['agents']}
     if not isinstance(selected,dict) or set(selected)!=set(expected):
         raise PackError('Roles file must map every logical set/agent exactly once')
@@ -136,6 +326,16 @@ def connect(lib,args,client):
             raise PackError('Each role requires only agentId and agentVersionId')
         roles.append({'logicalId':key,**remote,'instructions':role_guide(lib,manifest,a)})
     path=binding_path(lib,args.name,args.environment,args.context_key)
+    local_pending={}
+    if claude_plan is not None:
+        local_journals=list((lib.root/'connections'/args.name).rglob('*.claude-context.pending.json'))
+        expected_journal=path.with_suffix('.claude-context.pending.json')
+        if local_journals:
+            if len(local_journals)!=1 or local_journals[0]!=expected_journal:
+                raise PackError('Unresolved Claude attachment belongs to another environment or context; no new effects')
+            local_pending=json.loads(context_file(expected_journal,lib.root))
+            if not getattr(args,'reconcile_local_context',False):
+                raise PackError('Partial Claude context attachment requires explicit --reconcile-local-context; no replay')
     old=read_json(path,{})
     journal=path.with_suffix('.pending.json')
     pending=read_json(journal,{})
@@ -143,24 +343,60 @@ def connect(lib,args,client):
     payload={'instanceId':instance,'packId':manifest.get('startingContext',{}).get('templateId',manifest['packId']),
       'packVersion':manifest.get('startingContext',{}).get('templateVersion','1.0.0'),
       'ownershipScope':args.ownership,'bytesWorkspaceId':args.bytes_workspace,'bytesScope':args.bytes_scope,'roles':roles}
+    scope=(lib,args,dict(vars(args)),canonical(manifest),revision,roles_bytes,roles,claude_plan)
     owner=identity(client)
+    qualify_connection_scope(scope)
     journal=path.with_suffix('.pending.json')
     if journal.exists():
         pending=read_json(journal)
         if pending['input']!=payload or pending['identity']!=owner or pending.get('agentWorkspaceId')!=args.agent_workspace:
             raise PackError('Unresolved connection receipt; reconcile before changing the request')
-    atomic_json(journal,{'input':payload,'identity':owner,'revision':revision,'agentWorkspaceId':args.agent_workspace})
-    result=client.action('app_topolo_agent.agent_packs.connect',payload,args.agent_workspace,write=True)
-    remote=result['connection'];readback=client.action('app_topolo_agent.agent_packs.get',{'instanceId':instance},args.agent_workspace)['connection']
+    if claude_plan is not None and pending:
+        raise PackError('Unresolved cloud connection requires remote-recover before Claude attachment; no cloud replay')
+    if old and old.get('identity')!=owner:
+        raise PackError('Existing connection principal differs')
+    reuse=bool(old and old.get('input')==payload and old.get('agentWorkspaceId')==args.agent_workspace and old.get('packRevision')==revision)
+    proposed={'schemaVersion':1,'environment':args.environment,'contextKey':args.context_key,'identity':owner,
+      'agentWorkspaceId':args.agent_workspace,'input':payload,'packRevision':revision}
+    if claude_plan is not None:
+        claude_context_targets(lib,args,proposed,claude_plan)
+        if local_pending:
+            if not reuse or any(old.get(k)!=v for k,v in proposed.items()):
+                raise PackError('Claude attachment recovery binding differs; no new connection or binding replacement')
+            qualify_claude_pending(lib,args,old,claude_plan,local_pending)
+    if reuse:
+        remote=client.action('app_topolo_agent.agent_packs.get',{'instanceId':instance},args.agent_workspace)['connection'];readback=remote
+    else:
+        prepared={'input':payload,'identity':owner,'revision':revision,'agentWorkspaceId':args.agent_workspace}
+        if getattr(client,'_pack_connect_scope',None) is not None:
+            raise PackError('A trusted connection dispatch scope is already active')
+        atomic_json(journal,prepared)
+        client._pack_connect_scope=scope
+        try:
+            qualify_connection_scope(scope)
+            result=client.action('app_topolo_agent.agent_packs.connect',payload,args.agent_workspace,write=True)
+        except ConnectionSourceRefused:
+            if not pending and read_json(journal)==prepared:journal.unlink()
+            raise
+        finally:client._pack_connect_scope=None
+        remote=result['connection'];readback=client.action('app_topolo_agent.agent_packs.get',{'instanceId':instance},args.agent_workspace)['connection']
     if remote!=readback or any(readback.get(k)!=v for k,v in payload.items()) or readback.get('organizationId')!=owner['organizationId'] or readback.get('workspaceId')!=args.agent_workspace:
         raise PackError('Pack connection read-back mismatch; preserve pending receipt')
     binding={'schemaVersion':1,'environment':args.environment,'contextKey':args.context_key,'identity':owner,
       'agentWorkspaceId':args.agent_workspace,'input':payload,'connection':readback,'packRevision':revision}
-    atomic_json(path,binding);journal.unlink()
-    atomic_json(path.parent.parent/'active.json',{'environment':args.environment,'contextKey':args.context_key})
+    if local_pending:
+        if binding!=old:
+            raise PackError('Claude attachment verified remote binding changed; no local replay')
+    else:
+        atomic_json(path,binding)
+        if journal.exists():journal.unlink()
+        atomic_json(path.parent.parent/'active.json',{'environment':args.environment,'contextKey':args.context_key})
     active=lib.active()
-    if active.get('runtime'):attach_runtime(lib,active['runtime'])
-    return {'state':'connected','binding':str(path),'instanceId':instance,'roles':len(roles),'environment':args.environment}
+    if claude_plan is not None:attachment=attach_claude(lib,args,binding,claude_plan)
+    else:
+        if active.get('runtime'):attach_runtime(lib,active['runtime'])
+        attachment=None
+    return {'state':'connected','binding':str(path),'instanceId':instance,'roles':len(roles),'environment':args.environment,'localAttachment':attachment}
 
 def remote_context(lib,args,client):
     _,binding=open_binding(lib,args,client)
@@ -266,10 +502,13 @@ def recover_connection(lib,args,client):
     """Read/reconcile receipts. Never replay a memory create with an unknown outcome."""
     path=binding_path(lib,args.name,args.environment,args.context_key)
     pending_path=path.with_suffix('.pending.json')
-    if not path.exists() and pending_path.exists():
+    if pending_path.exists():
         pending=read_json(pending_path)
         if identity(client)!=pending['identity']:
             raise PackError('Pending connection principal/context mismatch')
+        older=read_json(path,{})
+        if older and (older.get('schemaVersion')!=1 or older.get('environment')!=args.environment or older.get('contextKey')!=args.context_key or older.get('identity')!=pending['identity'] or older.get('agentWorkspaceId')!=pending['agentWorkspaceId'] or older.get('input',{}).get('instanceId')!=pending['input']['instanceId']):
+            raise PackError('Existing connection custody differs from the pending original request')
         remote=client.action('app_topolo_agent.agent_packs.get',{'instanceId':pending['input']['instanceId']},pending['agentWorkspaceId'])['connection']
         if any(remote.get(k)!=v for k,v in pending['input'].items()) or remote.get('organizationId')!=pending['identity']['organizationId'] or remote.get('workspaceId')!=pending['agentWorkspaceId']:
             raise PackError('Pending connection read-back mismatch; retain receipt')
@@ -278,7 +517,7 @@ def recover_connection(lib,args,client):
         pending_path.unlink()
         atomic_json(path.parent.parent/'active.json',{'environment':args.environment,'contextKey':args.context_key})
         active=lib.active()
-        if active.get('runtime'):attach_runtime(lib,active['runtime'])
+        if active.get('runtime') and getattr(args,'harness','codex')!='claude':attach_runtime(lib,active['runtime'])
     path,binding=open_binding(lib,args,client);reports=[]
     memory=path.with_suffix('.memory-pending.json')
     journals=([memory] if memory.exists() else [])+list(path.with_suffix('').glob('artifact-*.json'))
@@ -305,8 +544,9 @@ def recover_connection(lib,args,client):
                     state='artifact-and-memory-verified';atomic_json(journal,{'state':state,'artifact':receipt['artifact'],'memoryId':matches[0]['id'],'recovered':True})
             else:state='unresolved-memory-outcome'
         reports.append({'receipt':str(journal),'state':state})
-    return {'state':'reconciled' if not path.with_suffix('.pending.json').exists() and all(r['state'] in ['memory-verified','artifact-and-memory-verified'] for r in reports) else 'recovery-required',
-      'receipts':reports,'connectionPending':path.with_suffix('.pending.json').exists()}
+    return {'state':'reconciled' if not path.with_suffix('.pending.json').exists() and not path.with_suffix('.claude-context.pending.json').exists() and all(r['state'] in ['memory-verified','artifact-and-memory-verified'] for r in reports) else 'recovery-required',
+      'receipts':reports,'connectionPending':path.with_suffix('.pending.json').exists(),
+      'localContextRecoveryRequired':path.with_suffix('.claude-context.pending.json').exists(),'localContextReplayed':False}
 
 @contextlib.contextmanager
 def connection_lock(lib,args):

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.13.3",
-  "topoloPublishedVersion": "0.13.3",
+  "version": "0.13.4",
+  "topoloPublishedVersion": "0.13.4",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",