@topolo/cli 0.13.9 → 0.13.11

package/agent-packs/src/topolo_agent_pack/live.py

@@ -275,7 +275,7 @@ def request(lib,operation,params=None):
     record=read_json(lib.root/'live-bridge.json',{})
     if not record: raise PackError('This desktop profile has no live bridge. Open it through topolo-agent-pack first.')
     with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as connection:
-        connection.settimeout(3 if operation=='status' else 60 if operation in {'permissions-configure','owned-roster-read','smoke-start'} else 20)
+        connection.settimeout(3 if operation=='status' else 240 if operation.startswith('lane-') else 60 if operation in {'permissions-configure','owned-roster-read','smoke-start'} else 20)
         try: connection.connect(record['socket'])
         except OSError as exc: raise PackError('Managed live bridge is unavailable: '+str(exc)) from exc
         connection.sendall(canonical({'token':record['token'],'operation':operation,**({'params':params} if params is not None else {})})+b'\n')
@@ -315,8 +315,15 @@ class BackendProxy:
         self.permission_batch=None
         self._permission_configuration_inputs=None
         self.smoke_busy=False
+        self.lane_busy=False
+        self.emit_native=True
+        self.lane_connection_binding=None
+        self.managed_transport=None
+        self._lane_configuration_record=None
 
     async def start_child(self):
+        if self.lane_connection_binding:
+            raise PackError('Managed dynamic lanes require the existing native owner; no alternate app-server startup')
         active=self.lib.active()
         if not active.get('runtime'): raise PackError('No selected managed runtime')
         self.runtime=active['runtime'];env=os.environ.copy()
@@ -359,6 +366,7 @@ class BackendProxy:
             method=value.get('method');params=value.get('params') or {}
             if self.approvals:
                 record=self.approvals.capture(value)
+                if record:self.dynamic_permission_event(record)
                 if record and record['sourceThreadId']!=record['intakeThreadId'] and record['notificationState']!='delivered':
                     self.schedule_notification(record)
             if method=='turn/started': self.active_turns.add(params['threadId'])
@@ -370,7 +378,7 @@ class BackendProxy:
                     for row in self.approvals.records():
                         if row['nativeConnectionCurrent'] and row['intakeThreadId']==params['threadId'] and row['notificationState']!='delivered':
                             self.schedule_notification(row)
-            sys.stdout.buffer.write(line);sys.stdout.buffer.flush()
+            if self.emit_native:sys.stdout.buffer.write(line);sys.stdout.buffer.flush()
 
     async def stop_child(self):
         if self.child and self.child.returncode is None:
@@ -406,7 +414,12 @@ class BackendProxy:
         if 'id' in value and 'method' in value:self.pending.add(str(value['id']))
         if self.approvals and 'method' not in value and ('result' in value or 'error' in value):self.approvals.sending(value)
         self.child.stdin.write(canonical(value)+b'\n');await self.child.stdin.drain()
-        if self.approvals and 'method' not in value and ('result' in value or 'error' in value):self.approvals.settled(value)
+        if self.approvals and 'method' not in value and ('result' in value or 'error' in value):
+            entry=self.approvals.pending.get(str(value['id']))
+            self.approvals.settled(value)
+            decision=(value.get('result') or {}).get('decision')
+            if entry and decision in {'accept','decline','cancel'}:
+                self.dynamic_permission_event(entry['record'],'approved' if decision=='accept' else 'denied')
         if self.execution and value.get('method')=='initialized':
             await self.request_catalog()
 
@@ -417,6 +430,8 @@ class BackendProxy:
         await self.child.stdin.drain()
 
     async def call_native(self,method,params,before_dispatch=None):
+        if self.managed_transport:
+            return await self.call_managed_native(method,params,before_dispatch)
         identity='topolo-relay-'+uuid.uuid4().hex
         request={'id':identity,'method':method,'params':params}
         if method in {'thread/resume','turn/start'}:
@@ -441,6 +456,49 @@ class BackendProxy:
             raise PackError('Native intake relay refused; original request remains pending')
         return reply['result']
 
+    async def call_managed_native(self,method,params,before_dispatch=None):
+        identity='topolo-managed-'+uuid.uuid4().hex
+        request={'id':identity,'method':method,'params':params}
+        intake=next((r for r in self.execution.roles.values() if r['key']==self.lane_connection_binding['intakeKey']),None)
+        intake_notification=method=='turn/start' and intake and params.get('threadId')==intake['threadId']
+        if method in {'thread/resume','turn/start'}:
+            await self.qualify_organization(params['threadId'])
+            if not intake_notification:request=self.execution.prepare(request)
+            elif set(params)!={'threadId','input'}:
+                raise PackError('Original intake native settings must remain unchanged')
+        if before_dispatch is not None:before_dispatch()
+        self.pending.add(identity)
+        try:
+            result=await self.managed_transport.evaluate('request',{'method':method,'params':request['params']})
+            reply=self.execution.reply({'id':identity,'result':result})
+            return reply['result']
+        finally:self.pending.discard(identity)
+
+    async def managed_native_events(self):
+        while not self.managed_transport.closed:
+            messages=await self.managed_transport.evaluate('next',{},events=True)
+            if not isinstance(messages,list):
+                raise PackError('Actual managed native event batch differs')
+            for value in messages:
+                if value.get('method')=='topolo/managed-request-unavailable':
+                    raise PackError('Actual managed own-child request is unavailable; preserve custody')
+                record=self.approvals.capture(value)
+                if record:
+                    self.dynamic_permission_event(record)
+                    self.schedule_notification(record)
+                params=value.get('params') or {};method=value.get('method')
+                if method=='turn/started':self.active_turns.add(params['threadId'])
+                elif method=='turn/completed':self.active_turns.discard(params['threadId'])
+                elif method=='thread/status/changed':
+                    if params.get('status',{}).get('type')=='active':self.active_turns.add(params['threadId'])
+                    elif params.get('status',{}).get('type') in {'idle','notLoaded','systemError'}:
+                        self.active_turns.discard(params['threadId'])
+
+    async def send_native_approval(self,entry,reply):
+        if self.managed_transport:
+            return await self.managed_transport.evaluate('approval',{'request':entry['message'],'reply':reply})
+        self.child.stdin.write(canonical(reply)+b'\n');await self.child.stdin.drain()
+
     def smoke_current(self,roles,resuming=None):
         if (not self.execution or self.permission_configuration or self.quiesced or not self.initialized or self.closed or
             not self.child or self.child.returncode is not None or self.active_turns or self.pending or self.notifications or
@@ -548,6 +606,12 @@ class BackendProxy:
 
     async def qualify_organization(self,thread_id):
         role=self.execution.roles.get(thread_id) if self.execution else None
+        record=None
+        if role and role.get('dynamicLaneId'):
+            from . import lanes
+            record=lanes.Registry(self.lib.root,'codex').read(role['dynamicLaneId'])
+            if record['plan'].get('continuityTransport')=='native-cli':
+                lanes.native_cli_admission(record['plan']['continuity'])
         if role and not self.permission_configuration and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
             raise PackError('Unresolved native permission operation requires reconciliation before owned execution or grants')
         if not role or not role.get('installationConsent'):
@@ -557,20 +621,31 @@ class BackendProxy:
         from . import topolo
         consent=role['installationConsent']
         agents=self.lib.load(consent['pack'])[0]['agents']
-        matches=[a for a in agents if '/'.join([a['pack'],a['set'],a['id']])==role['key'] and a['threadId']==role['threadId']]
+        matches=[a for a in agents if '/'.join([a['pack'],a['set'],a['id']])==role.get('sourceRoleKey',role['key']) and a['threadId']==role.get('sourceRoleNativeId',role['threadId'])]
         if len(matches)!=1:
             raise PackError('Current consent has no unique live owned role')
-        if role['settings']!=permission_settings(matches[0],role['settings'],consent):
+        effective_consent=consent
+        if role.get('dynamicVerificationProfile')=='manual':
+            effective_consent={**consent,'profile':'manual','overrides':{}}
+        if role['settings']!=permission_settings(matches[0],role['settings'],effective_consent):
             raise PackError('Effective native permission intent differs from the current consent profile')
         if self.permission_batch and self.permission_batch['consent']==consent:
             if time.monotonic()>=self.permission_batch['deadline']:
                 raise PackError('Qualified native permission batch expired; reconcile without replay')
             role['organizationPolicyProof']=self.permission_batch['proof'];return
-        _,proof=await asyncio.to_thread(topolo.organization_execution_policy,
+        remote,proof=await asyncio.to_thread(topolo.organization_execution_policy,
             topolo.Client(consent['environment'],consent['contextKey']),consent,agents,consent.get('agentWorkspaceId'))
         from .permissions import authorize_native_scope
         authorize_native_scope(proof)
+        if role.get('dynamicVerificationProfile')=='manual' and 'manual' not in remote['allowedProfiles']:
+            raise PackError('Fresh organization policy prohibits the child-only manual verification profile')
         role['organizationPolicyProof']=proof
+        if role.get('dynamicLaneId'):
+            current=await self.dynamic_current(record['plan'])
+            configuring=self._lane_configuration_record
+            if configuring and configuring['nativeId']==thread_id and self.lane_busy:
+                self.execution.prepare_dynamic_configuration(configuring,current)
+            else:self.execution.qualify_dynamic(record,current)
 
     def existing_runtime_intent(self):
         """Full existing composition only; never use a new composition as migration."""
@@ -588,7 +663,12 @@ class BackendProxy:
         declared={(r['key'],r['threadId']) for r in document['roles']}
         with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
             native_ids=[r[0] for r in db.execute('SELECT id FROM threads')]
-        if len(native_ids)!=len(declared) or set(native_ids)!={tid for _,tid in declared}:
+        from .lanes import Registry
+        dynamic=[r for r in Registry(self.lib.root,'codex').records() if r['state']!='retired']
+        dynamic_ids={r['nativeId'] for r in dynamic}
+        if dynamic_ids & {tid for _,tid in declared} or len(dynamic_ids)!=len(dynamic):
+            raise PackError('Dynamic identity overlaps the fixed roster')
+        if len(native_ids)!=len(declared)+len(dynamic_ids) or set(native_ids)!={tid for _,tid in declared}|dynamic_ids:
             raise PackError('Native runtime membership differs from full selected composition')
         if identities(roster)!=declared:
             raise PackError('Runtime roster differs from selected source membership')
@@ -773,7 +853,7 @@ class BackendProxy:
                 state=await self.call_native('thread/read',{'threadId':record['intakeThreadId'],'includeTurns':False})
                 if state.get('thread',{}).get('status',{}).get('type') not in {'idle','notLoaded'}:
                     self.approvals.notified(record['requestId'],False);return
-                if record['intakeThreadId'] not in self.execution.verified:
+                if not self.managed_transport and record['intakeThreadId'] not in self.execution.verified:
                     await self.call_native('thread/resume',{'threadId':record['intakeThreadId']})
                 self.approvals.live(record['key'],record['intakeThreadId'],record['fingerprint'])
                 # A lost turn/start reply cannot be retried on the next idle event.
@@ -789,8 +869,468 @@ class BackendProxy:
             finally:self.notifications.discard(record['key'])
         asyncio.create_task(deliver())
 
+    def dynamic_history(self, identity):
+        with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+            row=db.execute('SELECT rollout_path FROM threads WHERE id=?',(identity,)).fetchone()
+        if not row:
+            raise PackError('Native transcript identity is missing')
+        path=pathlib.Path(row[0]);OwnedSmoke.owned(path)
+        if not path.resolve().is_relative_to(pathlib.Path(self.runtime).resolve()/'home'):
+            raise PackError('Native transcript is outside the owned home')
+        return hashlib.sha256(path.read_bytes()).hexdigest()
+
+    def dynamic_permission_event(self, approval, decision=None):
+        from . import lanes
+        role=self.execution.roles.get(approval['sourceThreadId']) if self.execution else None
+        if not role or not role.get('dynamicLaneId'):
+            return
+        store=lanes.Registry(self.lib.root,'codex');record=store.read(role['dynamicLaneId'])
+        if decision is None:
+            prior=record.get('permissionRequest')
+            if prior and prior['fingerprint']==approval['fingerprint'] and prior['requestId']==str(approval['requestId']):
+                return
+            changed=lanes.request_permission(record,approval['fingerprint'],str(approval['requestId']),approval['generation'])
+            changed['permissionRequest'].update(turnId=approval.get('turnId'),itemId=approval.get('itemId'))
+        else:
+            changed=lanes.record_decision(record,decision,approval['intakeKey'],approval['fingerprint'],approval['generation'])
+        store.write(changed,lanes.digest(record))
+
+    async def dynamic_outcome(self, record):
+        from . import lanes
+        if record['state']=='executed-outcome-verified':
+            return record
+        if record['state']!='permission-decision-forwarded':
+            raise PackError('Lane settlement needs a real native request, intake decision and operation outcome')
+        request=record['permissionRequest']
+        result=await self.call_native('thread/read',{'threadId':record['nativeId'],'includeTurns':True})
+        if result.get('thread',{}).get('id')!=record['nativeId']:
+            raise PackError('Native outcome thread identity differs')
+        turns=[t for t in result.get('thread',{}).get('turns',[]) if t.get('id')==request.get('turnId')]
+        if len(turns)!=1 or turns[0].get('status') not in {'completed','failed','interrupted'}:
+            raise PackError('Exact native permission turn has not reached a terminal outcome')
+        items=[i for i in turns[0].get('items',[]) if i.get('id')==request.get('itemId')]
+        if len(items)!=1 or items[0].get('type') not in {'commandExecution','fileChange'}:
+            raise PackError('Native permission operation outcome cannot be independently attributed')
+        item=items[0];status=item.get('status')
+        if record['permissionDecision']=='denied':
+            if status!='declined':
+                raise PackError('Denied native request has no declined operation ACK')
+            state='denied'
+        elif status=='completed' and (item['type']!='commandExecution' or item.get('exitCode')==0): state='completed'
+        elif status=='failed' or (item['type']=='commandExecution' and status=='completed' and item.get('exitCode')!=0): state='failed'
+        else: raise PackError('Native permission outcome is unresolved')
+        return lanes.record_outcome(record,{'nativeId':record['nativeId'],'requestFingerprint':request['fingerprint'],
+            'state':state,'verificationDigest':lanes.digest({'turn':turns[0],'item':item})})
+
+    def lane_idle(self):
+        if (not self.execution or not self.approvals or not self.initialized or self.quiesced or self.closed or
+                (not self.managed_transport and (not self.child or self.child.returncode is not None)) or
+                (self.managed_transport and not self.managed_transport.ready) or self.permission_configuration or self.smoke_busy):
+            raise PackError('Dynamic lanes require their current qualified native connection')
+
+    def dynamic_role(self, row):
+        """Collect identity refs from the supported connection, never caller JSON."""
+        from . import topolo, lanes
+        consent=row.get('installationConsent')
+        if (not isinstance(consent,dict) or not isinstance(consent.get('contextKey'),str) or
+                not consent['contextKey'].startswith('org:') or consent['contextKey']!=row.get('contextKey') or
+                consent.get('environment') not in {'development','staging','production'}):
+            raise PackError('Dynamic lanes need an organization-bound source installation')
+        pack=row['key'].split('/')[0];logical='/'.join(row['key'].split('/')[1:])
+        cwd=pathlib.Path(row['cwd']);home=pathlib.Path(self.runtime).resolve()
+        if not cwd.resolve().is_relative_to(home):
+            raise PackError('Dynamic source workspace is outside the selected native runtime')
+        files=[cwd/'AGENTS.md',cwd/'topolo-connection.json',cwd/'.mcp.json']
+        for file in files: OwnedSmoke.owned(file)
+        hashes={str(f):hashlib.sha256(f.read_bytes()).hexdigest() for f in files}
+        descriptor=read_json(files[1]);binding=read_json(topolo.binding_path(self.lib,pack,consent['environment'],consent['contextKey']))
+        roles=[r for r in binding['input']['roles'] if r['logicalId']==logical]
+        identity=binding['identity']
+        if (len(roles)!=1 or identity['organizationId']!=consent['contextKey'][4:] or
+                any(descriptor.get(k)!=v for k,v in {'pack':pack,'role':logical,'environment':consent['environment'],
+                    'contextKey':consent['contextKey'],'instanceId':binding['input']['instanceId'],
+                    'agentWorkspaceId':binding['agentWorkspaceId'],'bytesWorkspaceId':binding['input']['bytesWorkspaceId'],
+                    'agentId':roles[0]['agentId'],'agentVersionId':roles[0]['agentVersionId'],
+                    'identity':{key:identity[key] for key in ['userId','organizationId']}}.items())):
+            raise PackError('Hosted role, Bytes and organization descriptors differ')
+        return {'key':row['key'],'harness':'codex','nativeId':row['threadId'],'cwd':row['cwd'],
+            'settings':row['settings'],'contextDigest':lanes.digest(hashes),'packId':pack,'packRevision':row['sourceRevision'],
+            'contextKey':consent['contextKey'],'organizationId':identity['organizationId'],'environment':consent['environment'],
+            'installationId':binding['input']['instanceId'],'AgentLogicalId':roles[0]['agentId'],
+            'AgentVersionId':roles[0]['agentVersionId'],'AgentWorkspaceId':binding['agentWorkspaceId'],
+            'BytesWorkspaceId':binding['input']['bytesWorkspaceId'],'privateMCPDescriptorHash':hashes[str(files[2])]}
+
+    def dynamic_model_inputs(self, source):
+        """Explicit versioned pack/group/role model constraints; no inferred defaults."""
+        path=self.lib.root/'dynamic-models'/(source['packId']+'.json');OwnedSmoke.owned(path)
+        document=read_json(path)
+        if (set(document)!={'format','schemaVersion','sourceRevision','configuration','constraints','authorizedOverrides'} or
+                document['format']!='topolo-pack-dynamic-models' or document['schemaVersion']!=1 or
+                document['sourceRevision']!=source['packRevision']):
+            raise PackError('Versioned dynamic model configuration is missing for this exact source role')
+        from .task_models import role_constraints
+        document={**document,'effectiveConstraints':role_constraints(document['constraints'],source['key'])}
+        catalog={'harness':'codex','source':'native-account','connectionGeneration':self.approvals.generation,
+            'models':[{'model':m,'efforts':sorted(e)} for m,e in sorted(self.execution.catalog.items())]}
+        return document,catalog
+
+    async def dynamic_current(self, plan):
+        self.lane_idle()
+        source=self.execution.roles.get(plan['role']['nativeId']);intake=self.execution.roles.get(plan['intake']['nativeId'])
+        if not source or not intake or source.get('dynamicLaneId') or intake.get('dynamicLaneId'):
+            raise PackError('Dynamic source role or original intake is not currently owned')
+        await self.qualify_organization(source['threadId'])
+        self.lane_idle()
+        role=self.dynamic_role(source);route=self.dynamic_role(intake);proof=source['organizationPolicyProof']
+        consent=source['installationConsent']
+        ceiling={'policyRevision':proof['revision'],'policyDigest':proof['policyDigest'],
+            'profile':consent.get('overrides',{}).get(source['key'],consent['profile']),'intakeKey':source['intakeKey']}
+        document,catalog=self.dynamic_model_inputs(role)
+        from . import task_models,lanes
+        task=plan['resolution']['task']
+        resolution=task_models.resolve(document['configuration'],task,'codex',catalog,document['effectiveConstraints'],
+            override_authorized=lanes.digest(task) in document['authorizedOverrides'])
+        if resolution!=plan['resolution']:
+            raise PackError('Task profile, native catalog, intake override or configuration changed; no fallback')
+        return {'role':role,'intake':route,'ceiling':ceiling}
+
+    async def dynamic_native(self, identity, cwd):
+        result=await self.call_native('thread/read',{'threadId':identity,'includeTurns':False})
+        thread=result.get('thread',{})
+        with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+            rows=db.execute('SELECT id,cwd,archived FROM threads WHERE id=?',(identity,)).fetchall()
+        if rows!=[(identity,cwd,0)] or thread.get('id')!=identity or thread.get('cwd')!=cwd:
+            raise PackError('Dynamic native descriptor is not the exact active owned runtime identity')
+        return {'nativeId':identity,'cwd':cwd,'nativeParentId':None,'archived':False,'backend':'local',
+            'foreignWorkspace':False,'busy':thread.get('status',{}).get('type') not in {'idle','notLoaded'},
+            'pendingApprovals':sum(e['record']['sourceThreadId']==identity for e in self.approvals.pending.values())}
+
+    async def dynamic_context(self,operation,params):
+        from . import lanes
+        import shlex
+        expected_fields={'laneId','operationId'} if operation=='lane-context-start' else {'laneId'}
+        if set(params)!=expected_fields:
+            raise PackError('Closed own-child context operation required')
+        self.lane_idle();store=lanes.Registry(self.lib.root,'codex');record=store.read(params['laneId'])
+        if not record or record['state']!='loaded-context-ACK':
+            raise PackError('Actual native settings and instruction-source ACK required before bootstrap')
+        if record['plan'].get('continuityTransport')=='native-cli':
+            lanes.native_cli_admission(record['plan']['continuity'])
+        current=await self.dynamic_current(record['plan'])
+        if current!={k:record['plan'][k] for k in ['role','intake','ceiling']}:
+            raise PackError('Current bootstrap source or policy differs')
+        native=await self.dynamic_native(record['nativeId'],record['creationReceipt']['cwd'])
+        if native['busy'] or native['pendingApprovals']:
+            return {'state':'awaiting-own-native-idle','native':native}
+        if operation=='lane-context-read':
+            probe=record.get('contextProbe')
+            if not probe or probe['state']!='native-delivered':
+                raise PackError('Exact own bootstrap delivery is unresolved; no replay')
+            result=await self.call_native('thread/read',{'threadId':record['nativeId'],'includeTurns':True})
+            thread=result.get('thread',{});turns=[t for t in thread.get('turns',[]) if t.get('id')==probe['turnId']]
+            if thread.get('id')!=record['nativeId'] or len(turns)!=1 or turns[0].get('status')!='completed' or turns[0].get('error'):
+                raise PackError('Exact same-child bootstrap turn is not completed')
+            reads=[]
+            for item in turns[0].get('items',[]):
+                if item.get('type')!='commandExecution' or item.get('status')!='completed' or item.get('exitCode')!=0:
+                    continue
+                command=item.get('command','');args=shlex.split(command) if isinstance(command,str) else []
+                exact=command==probe['command'] or (len(args)==3 and pathlib.Path(args[0]).name in {'sh','zsh','bash'} and args[1] in {'-c','-lc'} and args[2]==probe['command'])
+                if not exact:
+                    continue
+                try:value=json.loads(item.get('aggregatedOutput',''))
+                except (ValueError,TypeError):continue
+                if value==probe['expected'] and item.get('id'):
+                    reads.append(item['id'])
+            if len(reads)!=1:
+                raise PackError('Actual same-child native file-read command and exact metadata result are unproven')
+            if any(hashlib.sha256(pathlib.Path(path).read_bytes()).hexdigest()!=sha for path,sha in probe['fileHashes'].items()):
+                raise PackError('Own role context changed during native bootstrap')
+            updated={**record,'contextProbe':{k:v for k,v in probe.items() if k not in {'text','command'}}|
+                {'state':'native-file-read-ACK','nativeItemId':reads[0],'proofDigest':lanes.digest({'turnId':probe['turnId'],'itemId':reads[0],'expected':probe['expected']})}}
+            return store.write(updated,lanes.digest(record))
+        if record.get('contextProbe'):
+            raise PackError('Owned native bootstrap is already reserved; no second turn')
+        nonce=OwnedSmoke.operation_id(params['operationId']);cwd=pathlib.Path(record['creationReceipt']['cwd'])
+        guide=cwd/'AGENTS.md';connection=cwd/'topolo-connection.json'
+        for path in [guide,connection]:OwnedSmoke.owned(path)
+        descriptor=read_json(connection);role=record['plan']['role'];principal=descriptor.get('identity',{}).get('userId')
+        if not isinstance(principal,str) or not principal:
+            raise PackError('Current connected role principal is unknown')
+        expected={'operationId':nonce,'nativeId':record['nativeId'],'AgentLogicalId':role['AgentLogicalId'],'AgentVersionId':role['AgentVersionId'],
+            'AgentWorkspaceId':role['AgentWorkspaceId'],'BytesWorkspaceId':role['BytesWorkspaceId'],'principalId':principal,
+            'organizationId':role['organizationId'],'environment':role['environment'],'charterSHA256':hashlib.sha256(guide.read_bytes()).hexdigest()}
+        script=("import pathlib,json,hashlib;d=json.loads(pathlib.Path("+repr(str(connection))+").read_text());"
+            "v={'operationId':"+repr(nonce)+",'nativeId':"+repr(record['nativeId'])+",'AgentLogicalId':d['agentId'],'AgentVersionId':d['agentVersionId'],"
+            "'AgentWorkspaceId':d['agentWorkspaceId'],'BytesWorkspaceId':d['bytesWorkspaceId'],'principalId':d['identity']['userId'],"
+            "'organizationId':d['identity']['organizationId'],'environment':d['environment'],'charterSHA256':hashlib.sha256(pathlib.Path("+repr(str(guide))+").read_bytes()).hexdigest()};print(json.dumps(v))")
+        command='python3 -c '+shlex.quote(script)
+        text=('Bounded own-child context bootstrap '+nonce+'. Before role work, read only your own AGENTS.md and topolo-connection.json. '
+            'Use the native exec_command tool to run exactly this read-only metadata command: '+command+'. '
+            'It outputs only public role identities and a charter hash. Do not write files, access credentials, use the network, or perform other work. '
+            'Return the same JSON object. This file-read proof does not verify private MCP connectivity.')
+        probe={'operationId':nonce,'expected':expected,'command':command,'text':text,'state':'start-may-have-effects',
+            'fileHashes':{str(p):hashlib.sha256(p.read_bytes()).hexdigest() for p in [guide,connection]},
+            'generation':record['nativeConnectionGeneration'],'privateMCPVerified':False}
+        held={**record,'contextProbe':probe};store.write(held,lanes.digest(record))
+        try:
+            self.execution.qualify_dynamic(record,current)
+            result=await self.call_native('turn/start',{'threadId':record['nativeId'],'input':[{'type':'text','text':text,'text_elements':[]}]})
+            turn_id=result.get('turn',{}).get('id')
+            if not isinstance(turn_id,str) or not turn_id:
+                raise PackError('Actual bootstrap turn acknowledgement is missing')
+            updated={**held,'contextProbe':{**probe,'state':'native-delivered','turnId':turn_id}}
+            store.write(updated,lanes.digest(held));return {'state':'own-context-bootstrap-delivered','turnId':turn_id,'operationId':nonce}
+        except BaseException:
+            store.write({**held,'contextProbe':{**probe,'state':'uncertain-effect-hold'}},lanes.digest(held));raise
+
+    async def dynamic_fixture(self,operation,params):
+        from . import lanes
+        expected={'laneId','operationId'} if operation=='lane-fixture-start' else {'laneId'}
+        if set(params)!=expected:
+            raise PackError('Closed own-lane fixture operation required')
+        self.lane_idle();store=lanes.Registry(self.lib.root,'codex');record=store.read(params['laneId'])
+        if not record or record['plan'].get('verificationProfile')!='manual':
+            raise PackError('Actual routing proof requires the bound two-child manual verification plan')
+        if record['plan'].get('continuityTransport')=='native-cli':
+            lanes.native_cli_admission(record['plan']['continuity'])
+        current=await self.dynamic_current(record['plan'])
+        if current!={k:record['plan'][k] for k in ['role','intake','ceiling']}:
+            raise PackError('Current source/intake/policy changed before own fixture verification')
+        if record.get('contextProbe',{}).get('state')!='native-file-read-ACK':
+            raise PackError('Actual own-child native file-read bootstrap is required before fixture work')
+        if operation=='lane-fixture-read':
+            fixture=record.get('fixtureVerification')
+            if not fixture or fixture['state']!='native-delivered':
+                raise PackError('Own native fixture delivery is unresolved; no replay')
+            native=await self.dynamic_native(record['nativeId'],record['creationReceipt']['cwd'])
+            if native['busy'] or native['pendingApprovals']:
+                return {'state':record['state'],'nativeBusy':native['busy'],'pendingApprovals':native['pendingApprovals']}
+            verified=await self.dynamic_outcome(record)
+            if verified['outcome']['state']=='completed':
+                path=pathlib.Path(fixture['path']);OwnedSmoke.owned(path)
+                if read_json(path)!=fixture['expected']:
+                    raise PackError('Real native item result is not the exact own nonce-file bytes')
+                verified['fixtureVerification']={k:v for k,v in fixture.items() if k!='text'}|{'state':'outcome-verified','fileSHA256':hashlib.sha256(path.read_bytes()).hexdigest()}
+            elif verified['outcome']['state']=='denied':
+                if pathlib.Path(fixture['path']).exists():
+                    raise PackError('Denied request has an unexpected fixture file; retain unresolved effects')
+            settled=lanes.settle(verified,native);return store.write(settled,lanes.digest(record))
+        nonce=OwnedSmoke.operation_id(params['operationId'])
+        if record['state']!='loaded-context-ACK' or record.get('fixtureVerification'):
+            raise PackError('Own fixture requires current loaded context and one fresh bounded operation')
+        native=await self.dynamic_native(record['nativeId'],record['creationReceipt']['cwd'])
+        if native['busy'] or native['pendingApprovals']:
+            raise PackError('Own fixture child is not idle')
+        role=record['plan']['role'];path=pathlib.Path(record['creationReceipt']['cwd'])/('.topolo-dynamic-'+record['laneId']+'-'+nonce+'.json')
+        if path.exists() or path.is_symlink():
+            raise PackError('Own fixture path already exists; never overwrite')
+        body={'operationId':nonce,'laneId':record['laneId'],'nativeId':record['nativeId'],'AgentVersionId':role['AgentVersionId'],
+            'AgentWorkspaceId':role['AgentWorkspaceId'],'BytesWorkspaceId':role['BytesWorkspaceId']}
+        text=('Topolo bounded own-worker verification '+nonce+'. Read the already loaded role charter and connected Agent/Bytes identity. '
+            'Use the native apply_patch/file-change tool to create only '+str(path)+' with exactly this JSON: '+json.dumps(body,separators=(',',':'))+'. '
+            'Request native permission through the original intake; do not bypass policy or auto-approve. Read back only your fixture and report its nonce and status. '
+            'Do not edit source, business content, other workspaces, credentials, global settings, provider resources or external messages.')
+        fixture={'operationId':nonce,'state':'start-may-have-effects','path':str(path),'expected':body,'text':text,
+            'generation':self.approvals.generation}
+        prepared={**record,'fixtureVerification':fixture};store.write(prepared,lanes.digest(record))
+        try:
+            await self.call_native('thread/resume',{'threadId':record['nativeId']})
+            result=await self.call_native('turn/start',{'threadId':record['nativeId'],'input':[{'type':'text','text':text,'text_elements':[]}]})
+            turn=result.get('turn',{}).get('id')
+            if not isinstance(turn,str) or not turn:
+                raise PackError('Native fixture turn has no actual identity')
+            latest=store.read(record['laneId']);updated={**latest,'fixtureVerification':{**fixture,'state':'native-delivered','turnId':turn}}
+            return store.write(updated,lanes.digest(latest))
+        except BaseException:
+            latest=store.read(record['laneId']);store.write({**latest,'fixtureVerification':{**fixture,'state':'uncertain'}},lanes.digest(latest));raise
+
+    async def dynamic_create(self,params):
+        """Root-invoked supported ThreadStart on this exact owned native home.
+
+        No requested task or turn is started. A possible-effect creation is
+        durably reserved before dispatch and never automatically replayed.
+        """
+        from . import lanes
+        if not self.lane_connection_binding or set(params)!={'laneId'} or params['laneId']!=self.lane_connection_binding['laneId']:
+            raise PackError('Supported native creation requires the exact explicit owned Root lane connection')
+        self.lane_idle();store=lanes.Registry(self.lib.root,'codex');planned=store.read_plan(params['laneId'])
+        if store.read(params['laneId']) is not None:
+            raise PackError('This lane already has an actual native identity')
+        if planned.get('continuityTransport')=='native-cli':
+            lanes.native_cli_admission(planned['continuity'])
+        current=await self.dynamic_current(planned)
+        if current!={k:planned[k] for k in ['role','intake','ceiling']}:
+            raise PackError('Source, intake or policy changed before native creation')
+        await asyncio.to_thread(managed_lane_frontend,self.lib,self.runtime,planned)
+        # Independent fixed-ID reads before the single fresh worker is spent.
+        for role in [current['role'],current['intake']]:await self.dynamic_native(role['nativeId'],role['cwd'])
+        directory=store.directory/'creation';directory.mkdir(mode=0o700,exist_ok=True);store._owned(directory,True)
+        marker=directory/(planned['laneId']+'.json')
+        if marker.exists() or marker.is_symlink():
+            raise PackError('Native creation already reserved; reconcile without replay')
+        fd=os.open(marker,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
+        phase={'format':'topolo-owned-native-creation','schemaVersion':1,'laneId':planned['laneId'],
+            'planDigest':lanes.digest(planned),'state':'may-have-effects','nativeId':None,'generation':self.approvals.generation}
+        with os.fdopen(fd,'wb') as stream:stream.write(canonical(phase)+b'\n');stream.flush();os.fsync(stream.fileno())
+        spec=dict(planned['role']['settings'])
+        if planned.get('verificationProfile')=='manual':
+            from .permissions import apply_settings
+            source=planned['role'];spec=apply_settings({'pack':source['packId'],'set':source['key'].split('/')[1],'id':source['key'].split('/')[2]},
+                'codex',spec,{'profile':'manual','overrides':{},'intakeRoutes':{source['key']:planned['intake']['key']}})
+        choice=planned['resolution']['resolved'];spec.update(model=choice['model'],model_reasoning_effort=choice['effort'])
+        guide=pathlib.Path(planned['role']['cwd'])/'AGENTS.md';charter=guide.read_text()
+        if len(charter.encode())>131072:
+            raise PackError('Reviewed role charter exceeds bounded native creation context')
+        try:
+            result=await self.call_native('thread/start',{'cwd':planned['role']['cwd'],'model':choice['model'],
+                'allowProviderModelFallback':False,
+                'approvalPolicy':spec['approval_policy'],'sandbox':spec['sandbox_mode'],
+                'config':{'model_reasoning_effort':choice['effort'],'sandbox_workspace_write':spec['sandbox_workspace_write'],'apps':spec['apps']},
+                'developerInstructions':charter})
+            thread=result.get('thread',{});identity=thread.get('id')
+            if not isinstance(identity,str) or not identity or identity in planned['nativeIdsBeforeCreation']:
+                raise PackError('Native ThreadStart has no proven fresh created identity')
+            phase={**phase,'nativeId':identity};atomic_json(marker,phase)
+            native=await self.dynamic_native(identity,planned['role']['cwd'])
+            if native['busy'] or native['pendingApprovals'] or await self.dynamic_current(planned)!=current:
+                raise PackError('Actual created child placement, idle state or current context differs')
+            frontend=await asyncio.to_thread(managed_lane_frontend,self.lib,self.runtime,planned,identity)
+            receipt={'format':'topolo-native-lane-created','schemaVersion':1,'state':'ready','planDigest':lanes.digest(planned),
+                'harness':'codex','nativeId':identity,'logicalOriginThreadId':planned['logicalOriginThreadId'],'cwd':native['cwd'],
+                'model':result.get('model'),'effort':result.get('reasoningEffort'),'nativeParentId':None,
+                'fresh':True,'creationSource':'supported-native-host-tool'}
+            if receipt['model']!=choice['model'] or receipt['effort']!=choice['effort']:
+                raise PackError('Native creation model/effort tuple differs; no fallback or task dispatch')
+            record=lanes.adopt(planned,receipt,native,current)
+            record.update(frontendVisibility=frontend['state'],frontendProof=frontend)
+            record=store.write(record,None)
+            atomic_json(marker,{**phase,'state':'ready','receipt':receipt,'modelTurnsStarted':False,'nativeParentAvailability':'UNAVAILABLE'})
+            return {'state':'created-adopted-unconfigured','receipt':receipt,'modelTurnsStarted':False,'nativeParentAvailability':'UNAVAILABLE'}
+        except BaseException:
+            atomic_json(marker,{**phase,'state':'uncertain-effect-hold','replayAuthorized':False});raise
+
+    async def dynamic_lane(self, operation, params):
+        from . import lanes,task_models,policy
+        requested=params.get('request',params.get('plan',{})) if isinstance(params,dict) else {}
+        if isinstance(requested,dict) and (requested.get('continuityTransport')=='native-cli' or requested.get('schemaVersion')==2 or 'continuity' in requested):
+            lanes.native_cli_admission(requested.get('continuity'))
+        self.lane_idle()
+        if self.lane_busy:
+            raise PackError('An owned dynamic lane operation is already active')
+        self.lane_busy=True;store=lanes.Registry(self.lib.root,'codex');changed=False;record=None
+        try:
+            if operation=='lane-plan':
+                if set(params)!={'request'}:
+                    raise PackError('Lane plan accepts only its exact intake request')
+                request=params['request'];source=next((r for r in self.execution.roles.values() if r['key']==request['sourceRoleKey']),None)
+                if not source or source.get('dynamicLaneId'):
+                    raise PackError('Exact fixed source role required')
+                intake=next((r for r in self.execution.roles.values() if r['key']==source['intakeKey']),None)
+                if not intake:
+                    raise PackError('Original native intake is missing')
+                await self.qualify_organization(source['threadId'])
+                self.execution.set_catalog(await self.read_catalog())
+                role=self.dynamic_role(source);route=self.dynamic_role(intake);document,catalog=self.dynamic_model_inputs(role)
+                choice=policy.dynamic_task_settings(document['configuration'],request['task'],'codex',catalog,
+                    document['effectiveConstraints'],override_authorized=lanes.digest(request['task']) in document['authorizedOverrides'])
+                proof=source['organizationPolicyProof'];consent=source['installationConsent']
+                if request.get('verificationProfile')=='manual':
+                    from . import topolo
+                    remote,_=await asyncio.to_thread(topolo.organization_execution_policy,topolo.Client(consent['environment'],consent['contextKey']),
+                        consent,self.lib.load(role['packId'])[0]['agents'],consent.get('agentWorkspaceId'))
+                    if 'manual' not in remote['allowedProfiles']:
+                        raise PackError('Fresh organization policy does not allow the narrower test profile')
+                plan=lanes.plan(request,role,route,choice,{'policyRevision':proof['revision'],'policyDigest':proof['policyDigest'],
+                    'profile':consent.get('overrides',{}).get(source['key'],consent['profile']),'intakeKey':source['intakeKey']})
+                with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+                    plan['nativeIdsBeforeCreation']=sorted(r[0] for r in db.execute('SELECT id FROM threads'))
+                return store.save_plan(plan)
+            if operation=='lane-adopt':
+                if set(params)!={'plan','receipt'}:
+                    raise PackError('Lane adoption requires exact plan and native creation receipt')
+                plan=params['plan'];receipt=params['receipt']
+                if store.read_plan(plan['laneId'])!=plan:
+                    raise PackError('Creation plan differs from the owned immutable native snapshot')
+                if receipt['nativeId'] in plan.get('nativeIdsBeforeCreation',[]):
+                    raise PackError('Native lane was already present at planning; fresh creation not proven')
+                if receipt['cwd']!=plan['role']['cwd']:
+                    raise PackError('Dynamic lane must use the reviewed source role context workspace')
+                current=await self.dynamic_current(plan)
+                native=await self.dynamic_native(receipt['nativeId'],receipt['cwd'])
+                if native['busy'] or native['pendingApprovals']:
+                    raise PackError('Created native lane must be idle before adoption')
+                record=lanes.adopt(plan,receipt,native,current)
+                return store.write(record,None)
+            if set(params)!={'laneId'}:
+                raise PackError('Lane operation accepts only its exact registered identity')
+            record=store.read(params['laneId'])
+            if not record:
+                raise PackError('No owned dynamic lane registration')
+            if record['plan'].get('continuityTransport')=='native-cli':
+                lanes.native_cli_admission(record['plan']['continuity'])
+            current=await self.dynamic_current(record['plan'])
+            if current!={k:record['plan'][k] for k in ['role','intake','ceiling']}:
+                raise PackError('Dynamic source, intake or policy drift; no native mutation')
+            native=await self.dynamic_native(record['nativeId'],record['creationReceipt']['cwd'])
+            if operation=='lane-read':
+                return {'record':record,'native':native,'proof':'current-own-native-read'}
+            if native['busy'] or native['pendingApprovals']:
+                raise PackError('Dynamic lane is busy or has a pending original approval')
+            if operation=='lane-configure':
+                self.execution.prepare_dynamic_configuration(record,current)
+                self.approvals.register_dynamic(self.execution.roles[record['nativeId']])
+                # Persist uncertainty before the first actual settings effect.
+                before=lanes.digest(record);hold={**record,'state':'uncertain-effect-hold'}
+                store.write(hold,before);changed=True
+                self._lane_configuration_record=record
+                result=await self.call_native('thread/resume',{'threadId':record['nativeId']})
+                actual={'model':result.get('model'),'effort':result.get('reasoningEffort')}
+                source=record['plan']['role'];document,catalog=self.dynamic_model_inputs(source)
+                choice=task_models.acknowledge(record['plan']['resolution'],actual,configuration=document['configuration'],
+                    catalog=catalog,constraints=document['effectiveConstraints'])
+                configured=lanes.acknowledge_settings(record,actual,choice,self.approvals.generation)
+                guide=str(pathlib.Path(source['cwd'])/'AGENTS.md')
+                if guide not in result.get('instructionSources',[]):
+                    raise PackError('Actual native loaded instruction sources omit the owned role charter')
+                if await self.dynamic_current(record['plan'])!=current:
+                    raise PackError('Context or policy changed during native settings application')
+                configured=lanes.acknowledge_context(configured,source['contextDigest'])
+                self.execution.qualify_dynamic(configured,current)
+                return store.write(configured,lanes.digest(hold))
+            if operation=='lane-settle':
+                verified=await self.dynamic_outcome(record)
+                return store.write(lanes.settle(verified,native),lanes.digest(record))
+            if operation=='lane-retire':
+                if record['state']!='settled':
+                    raise PackError('Only a settled verified child can archive')
+                # Archive through native API; preserve the durable possible-effect state.
+                history=self.dynamic_history(record['nativeId'])
+                hold={**record,'state':'uncertain-effect-hold'};store.write(hold,lanes.digest(record));changed=True
+                await self.call_native('thread/archive',{'threadId':record['nativeId']})
+                with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+                    archived=db.execute('SELECT archived FROM threads WHERE id=?',(record['nativeId'],)).fetchone()
+                if archived!=(1,):
+                    raise PackError('Native archive readback is unavailable; preserve uncertainty')
+                if self.dynamic_history(record['nativeId'])!=history:
+                    raise PackError('Native archived transcript bytes differ; history preservation is unproven')
+                retired=lanes.retire(record,{**native,'archived':True,'historyPreserved':True})
+                self.approvals.retire_dynamic(record['nativeId']);self.execution.retire_dynamic(record['nativeId'])
+                return store.write(retired,lanes.digest(hold))
+            raise PackError('Unsupported closed lane operation')
+        except BaseException:
+            if changed and record and record['nativeId'] in self.execution.roles:
+                self.execution.roles[record['nativeId']]['dynamicCurrentQualified']=False
+                self.execution.verified.discard(record['nativeId'])
+            raise
+        finally:
+            self._lane_configuration_record=None
+            self.lane_busy=False
+
     def status(self):
-        return {'pid':os.getpid(),'childPid':self.child.pid if self.child else None,'desktopPid':os.getppid(),'runtime':self.runtime,
+        return {'pid':os.getpid(),'childPid':self.child.pid if self.child else None,'desktopPid':None if self.managed_transport else os.getppid(),'runtime':self.runtime,
+                'nativeTransport':'existing-managed-window' if self.managed_transport else 'owned-stdio',
+                'managedTargetId':self.managed_transport.target_id if self.managed_transport else None,
                 'quiesced':self.quiesced,'initialized':self.initialized,
                 'activeTurns':sorted(self.active_turns),'pendingRequests':len(self.pending),
                 'executionPolicy':self.execution.status() if self.execution else {'state':'not-configured'},
@@ -799,17 +1339,53 @@ class BackendProxy:
     async def control(self,reader,writer):
         try:
             message=json.loads(await asyncio.wait_for(reader.readline(),5))
-            if not secrets.compare_digest(message.get('token',''),self.token): raise PackError('Live bridge authentication failed')
+            if not secrets.compare_digest(message.get('token',''),self.token):
+                raise PackError('Live bridge authentication failed')
             op=message.get('operation')
+            if self.lane_connection_binding:
+                scoped=self.lane_connection_binding;params=message.get('params') or {}
+                if op.startswith('lane-'):
+                    lane=params.get('request',params.get('plan',params)).get('laneId')
+                    if lane!=scoped['laneId']:
+                        raise PackError('Operation is outside the exact owned lane connection')
+                    if op=='lane-plan' and params['request']['sourceRoleKey']!=scoped['sourceRoleKey']:
+                        raise PackError('Source role differs from the connection binding')
+                elif op in {'approval-details','approval-respond'}:
+                    entry=self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
+                    role=self.execution.roles.get(entry['record']['sourceThreadId'],{})
+                    if role.get('dynamicLaneId')!=scoped['laneId']:
+                        raise PackError('Approval is outside the exact owned lane')
+                elif op not in {'status','approval-list'}:
+                    raise PackError('Operation is outside the foreground lane connection')
             if op=='quiesce':
                 if self.permission_configuration:
                     raise PackError('Permission configuration in progress; preserve the owning native connection')
-                if self.active_turns: raise PackError('Outgoing agents have active turns. Wait for their current turns; Codex can stay open.')
-                if self.pending: raise PackError('Backend requests are in flight. Retry the switch; Codex can stay open.')
+                if self.active_turns:
+                    raise PackError('Outgoing agents have active turns. Wait for their current turns; Codex can stay open.')
+                if self.pending:
+                    raise PackError('Backend requests are in flight. Retry the switch; Codex can stay open.')
                 self.quiesced=True
                 await self.stop_child()
             elif op=='resume':
-                if self.quiesced: raise PackError('Use the desktop reconnect action to resume a quiesced bridge')
+                if self.quiesced:
+                    raise PackError('Use the desktop reconnect action to resume a quiesced bridge')
+            elif op in {'lane-context-start','lane-context-read'}:
+                result=await self.dynamic_context(op,message.get('params') or {})
+            elif op in {'lane-fixture-start','lane-fixture-read'}:
+                result=await self.dynamic_fixture(op,message.get('params') or {})
+            elif op=='lane-create':
+                result=await self.dynamic_create(message.get('params') or {})
+            elif op=='lane-close':
+                from .lanes import Registry
+                params=message.get('params') or {}
+                if set(params)!={'laneId'} or not self.lane_connection_binding:
+                    raise PackError('Explicit foreground own-lane close required')
+                record=Registry(self.lib.root,'codex').read(params['laneId'])
+                if not record or record['state']!='retired' or self.active_turns or self.pending or self.notifications or self.approvals.pending:
+                    raise PackError('Own lane must be retired with no pending native work before normal connection closure')
+                self.lane_close_event.set();result={'state':'normal-own-connection-close-requested'}
+            elif op in {'lane-plan','lane-adopt','lane-configure','lane-read','lane-settle','lane-retire'}:
+                result=await self.dynamic_lane(op,message.get('params') or {})
             elif op=='owned-roster-read':
                 result=await self.owned_roster_read(message.get('params') or {})
             elif op in {'smoke-start','smoke-read'}:
@@ -836,10 +1412,15 @@ class BackendProxy:
                             await self.qualify_organization(entry['record']['sourceThreadId'])
                             self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
                         self.approvals.sending(reply)
-                        self.child.stdin.write(canonical(reply)+b'\n');await self.child.stdin.drain();self.approvals.settled(reply)
+                        await self.send_native_approval(entry,reply);self.approvals.settled(reply)
+                        decision=reply['result'].get('decision')
+                        if decision in {'accept','decline','cancel'}:
+                            self.dynamic_permission_event(entry['record'],'approved' if decision=='accept' else 'denied')
                         result={'state':'native-response-forwarded','operationEffectVerified':False}
-            elif op!='status': raise PackError('Unknown live bridge operation')
-            if op not in {'approval-list','approval-details','approval-respond','permissions-configure','owned-roster-read','smoke-start','smoke-read'}:result=self.status()
+            elif op!='status':
+                raise PackError('Unknown live bridge operation')
+            if op not in {'lane-context-start','lane-context-read','lane-fixture-start','lane-fixture-read','lane-create','lane-close','lane-plan','lane-adopt','lane-configure','lane-read','lane-settle','lane-retire','approval-list','approval-details','approval-respond','permissions-configure','owned-roster-read','smoke-start','smoke-read'}:
+                result=self.status()
         except Exception as exc: result={'error':str(exc)}
         writer.write(canonical(result)+b'\n');await writer.drain();writer.close();await writer.wait_closed()
 
@@ -869,6 +1450,250 @@ class BackendProxy:
             if record.get('pid')==os.getpid():
                 (self.lib.root/'live-bridge.json').unlink(missing_ok=True);self.path.unlink(missing_ok=True)
 
+class ManagedNativeTransport:
+    """One captured, current desktop manager owns every native lane effect."""
+    def __init__(self,lib,runtime,lane_id):
+        self.lib=lib;self.runtime=runtime;self.lane_id=lane_id;self.token=secrets.token_hex(32)
+        self.ws=None;self.events_ws=None;self.ready=False;self.closed=False;self.subscriptions_closed=False;self.lock=asyncio.Lock()
+        self.scope=None;self.target_id=None
+
+    async def open(self,planned):
+        self.scope=await asyncio.to_thread(managed_lane_frontend,self.lib,self.runtime,planned)
+        self.ws,target=await asyncio.to_thread(renderer,self.lib)
+        self.events_ws,event_target=await asyncio.to_thread(renderer,self.lib)
+        if target!=self.scope['targetId'] or event_target!=target:
+            raise PackError('Existing managed renderer identity changed before connection')
+        self.target_id=target
+        await self.evaluate('open',{'homes':[self.scope['home']],'source':planned['role'],'intake':planned['intake'],
+            'adapter':self.scope['capability']})
+        self.ready=True
+
+    def expression(self,action,value):
+        params={'action':action,'value':value,'laneId':self.lane_id,'token':self.token}
+        return """(async()=>{
+          const p=PARAMS,key=Symbol.for('topolo.agent-pack.managed-native.v1');
+          let registry=window[key];
+          if(p.action==='open'){
+            window[key]??=new Map();registry=window[key];
+            if(registry.has(p.laneId))throw new Error('Owned managed connection exists; no replay or takeover');
+            const v=p.value,services=(await import(v.adapter.module))[v.adapter.export];
+            const opened=await services?.appServerManagers?.open('local');
+            if(opened?.status!=='ready')throw new Error('Existing managed native backend unavailable');
+            const manager=opened.manager,home=await manager.getCodexHome();
+            if(!v.homes.includes(home))throw new Error('Managed native home differs');
+            const state={manager,home,source:v.source,intake:v.intake,token:p.token,childId:null,creationReserved:false,
+              queue:[],waiters:[],subscriptions:[],closed:false};
+            registry.set(p.laneId,state);
+            const push=value=>{if(state.closed)return;if(state.queue.length>=1024){state.closed=true;return;}
+              state.queue.push(value);state.waiters.splice(0).forEach(f=>f());};
+            state.subscriptions.push(await manager.subscribe({type:'event',key:{hostId:'local'},event:'approval-request',listener:async event=>{
+              if(event.conversationId!==state.childId)return;
+              const conversation=await manager.getConversation(state.childId);
+              const request=conversation?.requests?.find(r=>r.id===event.requestId);
+              if(request&&request.params?.threadId===state.childId&&['item/fileChange/requestApproval','item/commandExecution/requestApproval'].includes(request.method))
+                push(request);
+              else push({method:'topolo/managed-request-unavailable',params:{threadId:state.childId}});
+            }}));
+            state.subscriptions.push(await manager.subscribe({type:'notification',key:{hostId:'local'},
+              methods:['turn/started','turn/completed','thread/status/changed'],listener:notification=>{
+                if([state.childId,state.intake.nativeId].includes(notification.params?.threadId))push(notification);
+              }}));
+            return {state:'managed-owning-connection-ready',home};
+          }
+          const s=registry?.get(p.laneId);
+          if(p.action==='close'){
+            if(s&&s.token!==p.token)throw new Error('Foreign managed native connection must be preserved');
+            if(s){s.closed=true;s.waiters.splice(0).forEach(f=>f());
+              for(const subscription of s.subscriptions)await subscription.unsubscribe();registry.delete(p.laneId);}
+            return {state:'normal-own-managed-subscriptions-closed',nativeOwnerStopped:false};
+          }
+          if(!s||s.token!==p.token||s.closed)throw new Error('Original managed native connection unavailable; no fallback');
+          if(await s.manager.getCodexHome()!==s.home)throw new Error('Captured managed native instance/home changed');
+          if(p.action==='request'){
+            const {method,params}=p.value;
+            const allowed=['model/list','thread/read','thread/start','thread/resume','thread/archive','turn/start'];
+            if(!allowed.includes(method))throw new Error('Unsupported closed managed native method');
+            const id=params.threadId;
+            if(method==='thread/start'){
+              if(s.creationReserved||params.cwd!==s.source.cwd)throw new Error('Managed native creation is reserved or placement differs');
+              s.creationReserved=true;
+            }else if(method!=='model/list'){
+              if(id!==s.childId&&!(method==='thread/read'&&[s.source.nativeId,s.intake.nativeId].includes(id))&&
+                !(method==='turn/start'&&id===s.intake.nativeId))throw new Error('Managed native request is outside the own child/intake');
+              if(method==='turn/start'&&id===s.intake.nativeId&&Object.keys(params).some(k=>!['threadId','input'].includes(k)))
+                throw new Error('Original intake settings must remain unchanged');
+            }
+            const result=await s.manager.sendRequest(method,params);
+            if(method==='thread/start'){
+              const id=result?.thread?.id;
+              if(typeof id!=='string'||[s.source.nativeId,s.intake.nativeId].includes(id))throw new Error('Fresh managed native identity unavailable');
+              s.childId=id;
+            }
+            return result;
+          }
+          if(p.action==='approval'){
+            const {request,reply}=p.value;
+            if(request.params?.threadId!==s.childId||request.id!==reply.id||!['accept','decline','cancel'].includes(reply.result?.decision))
+              throw new Error('Exact original own-child native approval required');
+            const current=await s.manager.getConversation(s.childId);
+            const actual=current?.requests?.find(r=>r.id===request.id);
+            const canonical=v=>JSON.stringify(v,(_k,x)=>x&&typeof x==='object'&&!Array.isArray(x)?Object.fromEntries(Object.keys(x).sort().map(k=>[k,x[k]])):x);
+            if(!actual||canonical(actual)!==canonical(request))throw new Error('Actual native pending request body changed');
+            if(request.method==='item/fileChange/requestApproval')await s.manager.replyWithFileChangeApprovalDecision(s.childId,request.id,reply.result.decision);
+            else if(request.method==='item/commandExecution/requestApproval')await s.manager.replyWithCommandExecutionApprovalDecision(s.childId,request.id,reply.result.decision);
+            else throw new Error('Unsupported own-child native permission decision');
+            const after=await s.manager.getConversation(s.childId);
+            if(after?.requests?.some(r=>r.id===request.id))throw new Error('Native decision forwarding is not acknowledged; preserve uncertainty');
+            return {state:'native-response-forwarded',operationEffectVerified:false};
+          }
+          if(p.action==='next'){
+            if(!s.queue.length)await new Promise(resolve=>{const wake=()=>{clearTimeout(timer);resolve();};
+              const timer=setTimeout(()=>{s.waiters=s.waiters.filter(f=>f!==wake);resolve();},10000);s.waiters.push(wake);});
+            if(s.closed)throw new Error('Managed own native event custody was lost');
+            return s.queue.splice(0);
+          }
+          throw new Error('Unsupported closed managed transport operation');
+        })()""".replace('PARAMS',json.dumps(params),1)
+
+    async def evaluate(self,action,value,events=False):
+        ws=self.events_ws if events else self.ws
+        if not ws or self.closed:
+            raise PackError('Owned managed transport is unavailable')
+        if action!='close' and managed_backend_generation(self.lib,self.runtime)!=self.scope['proxyGeneration']:
+            raise PackError('Original selected native execution owner changed; no retargeting')
+        if events:
+            return await asyncio.to_thread(ws.evaluate,self.expression(action,value))
+        async with self.lock:return await asyncio.to_thread(ws.evaluate,self.expression(action,value))
+
+    async def close(self):
+        try:
+            if self.ws and not self.closed:
+                result=await self.evaluate('close',{})
+                self.subscriptions_closed=result.get('state')=='normal-own-managed-subscriptions-closed'
+        finally:
+            self.closed=True;self.ready=False
+            for ws in [self.ws,self.events_ws]:
+                if ws:
+                    ws.close()
+
+
+class OwnedLaneConnection:
+    """Explicit, foreground native stdio connection for one reviewed new lane.
+
+    The existing window manager owns creation, settings, turns and native approval
+    responses. No replacement app-server or unrelated profile is started.
+    """
+    def __init__(self,lib,connection_id,binding):
+        from .storage import safe_id
+        self.lib=lib;self.connection_id=safe_id(connection_id);self.binding=binding
+        fields={'format','schemaVersion','laneId','runtime','binary','binaryDigest','protocolDigest','sourceRoleKey','intakeKey','transport'}
+        if (not isinstance(binding,dict) or set(binding)!=fields or binding['format']!='topolo-owned-lane-connection' or
+                binding['schemaVersion']!=1 or binding['transport']!='codex-managed-window' or binding['laneId']!=self.connection_id or
+                str(lib.active().get('runtime'))!=binding['runtime'] or not pathlib.Path(binding['binary']).is_absolute() or
+                '/intakes/' not in binding['intakeKey']):
+            raise PackError('Explicit exact owned lane connection binding required')
+        binary=pathlib.Path(binding['binary']);info=binary.lstat()
+        if binary.is_symlink() or not binary.is_file() or info.st_uid not in {0,os.getuid()} or info.st_mode&0o022:
+            raise PackError('Native binary must be a regular qualified installed executable')
+        if hashlib.sha256(binary.read_bytes()).hexdigest()!=binding['binaryDigest']:
+            raise PackError('Native binary differs from the reviewed connection binding')
+        self.protocol=qualify_protocol(str(binary),lane_creation=True)
+        from .lanes import digest
+        if digest(self.protocol)!=binding['protocolDigest']:
+            raise PackError('Native protocol differs from the reviewed connection binding')
+        self.directory=lib.root/'dynamic-connections'/self.connection_id
+        self.proxy=BackendProxy(lib,str(binary),['app-server']);self.proxy.emit_native=False
+        self.proxy.lane_connection_binding=binding
+        self.proxy.lane_close_event=asyncio.Event()
+
+    async def run(self):
+        directory=self.directory
+        active=self.lib.active();self.proxy.runtime=self.binding['runtime']
+        self.proxy.execution=load_gate(self.proxy.runtime) or ExecutionGate(prepare_runtime(self.lib,active['components'],self.proxy.runtime))
+        self.proxy.approvals=ApprovalRouter(pathlib.Path(self.proxy.runtime)/'approval-inbox',list(self.proxy.execution.roles.values()),uuid.uuid4().hex)
+        source=[r for r in self.proxy.execution.roles.values() if r['key']==self.binding['sourceRoleKey']]
+        intake=[r for r in self.proxy.execution.roles.values() if r['key']==self.binding['intakeKey']]
+        if len(source)!=1 or len(intake)!=1 or source[0]['intakeKey']!=intake[0]['key']:
+            raise PackError('Owned managed connection has no exact original source and intake route')
+        planned={name:{'nativeId':row['threadId'],'cwd':row['cwd']} for name,row in [('role',source[0]),('intake',intake[0])]}
+        transport=ManagedNativeTransport(self.lib,self.proxy.runtime,self.connection_id)
+        self.proxy.managed_transport=transport;self.proxy.protocol=self.protocol
+        server=None;stop=asyncio.Event();loop=asyncio.get_running_loop();event_task=None;created=False
+        for sig in [signal.SIGINT,signal.SIGTERM]:loop.add_signal_handler(sig,stop.set)
+        try:
+            # A read-only preflight precedes durable custody for native subscriptions.
+            preflight=await asyncio.to_thread(managed_lane_frontend,self.lib,self.proxy.runtime,planned)
+            directory.parent.mkdir(mode=0o700,exist_ok=True);OwnedSmoke.owned(directory.parent,directory=True)
+            directory.mkdir(mode=0o700);created=True;OwnedSmoke.owned(directory,directory=True)
+            atomic_json(directory/'managed-custody.json',{'state':'native-subscriptions-may-follow','laneId':self.connection_id,
+                'token':transport.token,'targetId':preflight['targetId'],'runtime':self.proxy.runtime,'binding':self.binding})
+            await transport.open(planned)
+            self.proxy.path=lane_socket_path(self.lib,self.connection_id)
+            if self.proxy.path.exists() or self.proxy.path.is_symlink():
+                raise PackError('Own managed control path is occupied; no takeover')
+            self.proxy.initialized=True
+            self.proxy.execution.set_catalog(await self.proxy.read_catalog());self.proxy.catalog_ready.set()
+            server=await asyncio.start_unix_server(self.proxy.control,path=str(self.proxy.path),limit=1024*1024)
+            self.proxy.path.chmod(0o600)
+            atomic_json(directory/'connection.json',{'pid':os.getpid(),'socket':str(self.proxy.path),'token':self.proxy.token,
+                'connectionId':self.connection_id,'generation':self.proxy.approvals.generation,'binding':self.binding,
+                'nativeTransport':'existing-managed-window','managedTargetId':transport.target_id})
+            print(json.dumps({'state':'owned-managed-native-lane-connection-ready','connectionId':self.connection_id,'pid':os.getpid(),
+                'managedTargetId':transport.target_id,'modelTurnsStarted':False,'generation':self.proxy.approvals.generation}),flush=True)
+            event_task=asyncio.create_task(self.proxy.managed_native_events())
+            stopped=asyncio.create_task(stop.wait());normal=asyncio.create_task(self.proxy.lane_close_event.wait())
+            done,pending=await asyncio.wait({stopped,normal,event_task},return_when=asyncio.FIRST_COMPLETED)
+            for task in pending:task.cancel()
+            if event_task in done:
+                await event_task
+        finally:
+            await self.close_owned_controls(transport,server,event_task,created)
+
+    async def close_owned_controls(self,transport,server,event_task,created):
+        directory=self.directory
+        try:await transport.close()
+        finally:
+            if event_task:
+                event_task.cancel()
+            if server:
+                server.close();await server.wait_closed()
+            if created:
+                pending=self.proxy.approvals.records()
+                normal=self.proxy.lane_close_event.is_set() and transport.subscriptions_closed and not self.proxy.active_turns and not any(r.get('state')=='pending' for r in pending)
+                atomic_json(directory/'closure.json',{'state':'closed' if normal else 'closed-with-unresolved-work',
+                    'normalLifecycleClosureVerified':normal,'nativeTransport':'existing-managed-window',
+                    'nativeOwnerStopped':False,'ownSubscriptionsClosed':transport.subscriptions_closed,
+                    'pendingNativeApprovals':sum(r.get('state')=='pending' for r in pending),'replayAuthorized':False})
+                (directory/'connection.json').unlink(missing_ok=True)
+                if server:
+                    self.proxy.path.unlink(missing_ok=True)
+
+
+def lane_socket_path(lib,connection_id):
+    # A fixed short path fits macOS AF_UNIX even with a long library/lane name.
+    # The authenticated socket is mode0600; an existing path is never taken over.
+    identity=hashlib.sha256(canonical([str(lib.root),connection_id])).hexdigest()[:24]
+    return pathlib.Path('/tmp')/('topolo-lane-'+str(os.getuid())+'-'+identity+'.sock')
+
+
+def request_lane(lib,connection_id,operation,params):
+    from .storage import safe_id
+    directory=lib.root/'dynamic-connections'/safe_id(connection_id)
+    OwnedSmoke.owned(directory,directory=True);OwnedSmoke.owned(directory/'connection.json')
+    record=read_json(directory/'connection.json')
+    if record.get('connectionId')!=connection_id or record.get('socket')!=str(lane_socket_path(lib,connection_id)):
+        raise PackError('Owned lane connection receipt differs')
+    with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as connection:
+        connection.settimeout(240);connection.connect(record['socket'])
+        connection.sendall(canonical({'token':record['token'],'operation':operation,'params':params})+b'\n')
+        with connection.makefile('rb') as stream:line=stream.readline(1024*1024)
+    if not line:
+        raise PackError('Owned lane connection closed without ACK; reconcile without replay')
+    result=json.loads(line)
+    if 'error' in result:
+        raise PackError(result['error'])
+    return result
+
 def proxy_main():
     lib=Library(os.environ['CODEX_PACK_HOME']);real=os.environ['CODEX_PACK_REAL_CLI']
     args=sys.argv[1:]
@@ -976,6 +1801,94 @@ def thread_ids(runtime):
 def rendered_threads(ws):
     return ws.evaluate('Array.from(document.querySelectorAll("[data-app-action-sidebar-thread-row][data-app-action-sidebar-thread-host-id=local]")).map(e=>({id:e.getAttribute("data-app-action-sidebar-thread-id").replace(/^local:/,""),title:e.getAttribute("data-app-action-sidebar-thread-title")}))')
 
+
+def managed_backend_generation(lib,runtime):
+    """Authenticate the existing proxy; a manifest or symlink is not liveness."""
+    active=lib.active()
+    if active.get('runtime')!=str(runtime):
+        raise PackError('Selected native runtime changed')
+    status=request(lib,'status')
+    if (not isinstance(status,dict) or status.get('runtime')!=str(runtime) or status.get('initialized') is not True or
+            status.get('quiesced') is not False or any(type(status.get(k)) is not int or status[k]<1 for k in ['pid','childPid'])):
+        raise PackError('Current authenticated selected backend is unavailable')
+    return {k:status[k] for k in ['pid','childPid','runtime']}
+
+
+def managed_lane_frontend(lib,runtime,planned,native_id=None,app='/Applications/ChatGPT.app'):
+    """Use only the current managed window's exported native manager/catalog.
+
+    A separate selected-home app-server cannot assert managed visibility. The
+    existing manager must already own the selected storage before any refresh.
+    This function never reconnects, changes home, restarts or creates a worker.
+    """
+    from . import lanes
+    root=pathlib.Path(runtime);home=root/'home'
+    if not home.is_dir():
+        raise PackError('Selected owned native home is unavailable')
+    generation=managed_backend_generation(lib,str(root))
+    expected=[str(home)]
+    layout=lib.root/'desktop-layout.json';stable=lib.root/'desktop-home';layout_hash=None
+    if layout.exists():
+        OwnedSmoke.owned(layout)
+        if read_json(layout).get('owner') not in {'topolo-agent-pack','codex-pack'}:
+            raise PackError('Stable app-host layout is not owned by this pack')
+        OwnedSmoke.owned(stable,directory=True)
+        expected.append(str(stable));layout_hash=hashlib.sha256(layout.read_bytes()).hexdigest()
+    ws,target=renderer(lib)
+    try:
+        capability=adapter(app)
+        params={'adapter':capability,'homes':expected,'configFile':str(home/'config.toml'),
+                'roles':[planned['role'],planned['intake']],'nativeId':native_id}
+        expression="""(async()=>{
+          const p=PARAMS,services=(await import(p.adapter.module))[p.adapter.export];
+          if(!services?.appServerManagers||!services.localThreadCatalog)throw new Error('Managed native manager/catalog unavailable; no fallback');
+          const opened=await services.appServerManagers.open('local');
+          if(opened?.status!=='ready'||!opened.manager)throw new Error('Existing managed local backend is unavailable');
+          const manager=opened.manager,home=await manager.getCodexHome();
+          if(typeof home!=='string'||!p.homes.includes(home))throw new Error('Existing managed backend is outside the selected owned home');
+          const provenance=await manager.sendRequest('config/read',{cwd:p.roles[0].cwd,includeLayers:true});
+          const users=provenance?.layers?.filter(layer=>layer.name?.type==='user'&&!layer.disabledReason);
+          if(!Array.isArray(users)||!users.length||users.some(layer=>layer.name.file!==p.configFile||typeof layer.version!=='string'||!layer.version))
+            throw new Error('Actual native execution-home config provenance differs');
+          const configOrigins=users.map(layer=>({name:layer.name,version:layer.version}));
+          for(const role of p.roles){const value=await manager.readThread(role.nativeId,{includeTurns:false}),thread=value?.thread;
+            if(thread?.id!==role.nativeId||thread.cwd!==role.cwd||thread.archived===true)throw new Error('Managed backend cannot read exact fixed source/intake');}
+          if(p.nativeId===null)return {home,configOrigins,sourceIds:p.roles.map(r=>r.nativeId),nativeId:null,state:'managed-preflight-read-verified'};
+          if(p.roles.some(r=>r.nativeId===p.nativeId))throw new Error('Cannot register a fixed source/intake as a new lane');
+          const value=await manager.readThread(p.nativeId,{includeTurns:false}),thread=value?.thread;
+          if(thread?.id!==p.nativeId||thread.cwd!==p.roles[0].cwd||thread.archived===true)throw new Error('Managed native own-child read differs');
+          let cursor=null,listed=false;
+          for(let page=0;page<20;page++){
+            const result=await manager.sendRequest('thread/list',{cursor,limit:100,archived:false,modelProviders:[],useStateDbOnly:true});
+            if(!Array.isArray(result?.data))throw new Error('Managed native thread-list response unavailable');
+            if(result.data.some(t=>t.id===p.nativeId)){listed=true;break;}
+            cursor=result.nextCursor;if(cursor===null||cursor===undefined)break;
+          }
+          if(!listed)throw new Error('Exact own child is absent from the managed native list');
+          const catalog=services.localThreadCatalog;
+          await catalog.notifyThread({hostId:'local',threadId:p.nativeId},'upsert');
+          await catalog.requestSync(['local'],'immediate');
+          const entries=await catalog.readEntries([{hostId:'local',threadId:p.nativeId}]);
+          if(!Array.isArray(entries)||entries.length!==1||entries[0].threadId!==p.nativeId||entries[0].hostId!=='local')
+            throw new Error('Managed own-child catalog registration was not acknowledged');
+          if(await manager.getCodexHome()!==home)throw new Error('Managed backend home changed during native registration');
+          return {state:'managed-native-read-list-catalog-verified',home,configOrigins,nativeId:p.nativeId,sourceIds:p.roles.map(r=>r.nativeId),
+            nativeRead:true,nativeList:true,catalogRead:true,rendered:!!document.querySelector('[data-app-action-sidebar-thread-row][data-app-action-sidebar-thread-id="local:'+CSS.escape(p.nativeId)+'"]')};
+        })()""".replace('PARAMS',json.dumps(params),1)
+        result=ws.evaluate(expression)
+        if (not isinstance(result,dict) or result.get('home') not in expected or result.get('nativeId')!=native_id or
+                result.get('sourceIds')!=[r['nativeId'] for r in params['roles']]):
+            raise PackError('Exact existing managed backend acknowledgement differs')
+        if native_id is not None and (result.get('state')!='managed-native-read-list-catalog-verified' or
+                any(result.get(k) is not True for k in ['nativeRead','nativeList','catalogRead'])):
+            raise PackError('Managed native child read/list/catalog proof is incomplete')
+        if managed_backend_generation(lib,str(root))!=generation:
+            raise PackError('Selected native backend generation changed during managed proof')
+        if layout_hash is not None and hashlib.sha256(layout.read_bytes()).hexdigest()!=layout_hash:
+            raise PackError('Stable owned app-host layout changed during managed proof')
+        return {**result,'targetId':target,'selectedRuntime':str(root),'capability':capability,'proxyGeneration':generation}
+    finally:ws.close()
+
 def checkpoint_ui(lib,runtime):
     ws,_=renderer(lib)
     try:
@@ -1075,3 +1988,56 @@ def bind(lib,runtime):
             if backup.exists():raise PackError('Cannot preserve existing desktop-home file: '+name)
             dest.rename(backup)
         dest.symlink_to(expected)
+
+
+def compile_native_cli_command(value,store,pack,input_path,environment):
+    """Compile a fixed native tool command; no shell/model text is accepted."""
+    import shlex
+    from . import lanes
+    value=lanes.native_cli_input(value)
+    allowed={'HOME','USER','LOGNAME','PATH','LANG','LC_ALL','TMPDIR','TOPOLO_CONFIG_PATH','TOPOLO_ENV','TOPOLO_CONTEXT'}
+    if (not isinstance(environment,dict) or not set(environment)<=allowed or
+            any(not isinstance(v,str) or len(v)>4096 or any(ord(c)<32 for c in v) for v in environment.values()) or
+            not environment.get('TOPOLO_CONFIG_PATH') or not pathlib.Path(environment['TOPOLO_CONFIG_PATH']).is_absolute() or
+            environment.get('TOPOLO_ENV')!=value['context']['environment'] or environment.get('TOPOLO_CONTEXT')!=value['context']['contextKey']):
+        raise PackError('Exact child-only native-cli environment required; inherited credentials are forbidden')
+    if any(not pathlib.Path(p).is_absolute() for p in [store,input_path]) or pack!=value['sourceRoleKey'].split('/')[0]:
+        raise PackError('Exact owned store, pack and input references required')
+    argv=['/usr/bin/env','-i',*[k+'='+environment[k] for k in sorted(environment)],value['cli']['nodeExecutable'],value['cli']['entry'],
+        'agent-packs','--store',str(store),'remote-context',pack,'--environment',value['context']['environment'],
+        '--context-key',value['context']['contextKey'],'--role',value['context']['logicalId'],'--continuity-input',str(input_path)]
+    return shlex.join(argv)
+
+
+def native_cli_codex_tool_proof(value,command,result,turn_id,cwd,guide_command,guide_digest):
+    """Verify actual owned Codex tool DTOs; printed/foreign receipts do not ACK."""
+    import shlex
+    from . import lanes
+    value=lanes.native_cli_input(value);lanes.native_cli_hash(guide_digest)
+    if guide_digest!=value['source']['charterDigest']:
+        raise PackError('Native-cli actual charter read differs from the pinned receipt source')
+    thread=result.get('thread',{});turns=[t for t in thread.get('turns',[]) if t.get('id')==turn_id]
+    if (thread.get('id')!=value['nativeId'] or thread.get('cwd')!=str(cwd) or len(turns)!=1 or
+            turns[0].get('status')!='completed' or turns[0].get('error')):
+        raise PackError('Exact same-child native-cli turn/cwd completion required')
+    receipts=[];reads=[]
+    for item in turns[0].get('items',[]):
+        if item.get('type')!='commandExecution' or item.get('status')!='completed' or type(item.get('exitCode'))is not int or item['exitCode']!=0 or not item.get('id'):
+            continue
+        actual=item.get('command');args=shlex.split(actual) if isinstance(actual,str) else []
+        unwrapped=args[2] if len(args)==3 and args[0] in {'/bin/sh','/bin/bash','/bin/zsh'} and args[1]=='-c' else actual
+        if unwrapped==guide_command and hashlib.sha256(item.get('aggregatedOutput','').encode()).hexdigest()==guide_digest:
+            reads.append(item['id'])
+        if unwrapped!=command:
+            continue
+        try:
+            receipt=json.loads(item.get('aggregatedOutput',''))
+        except (ValueError,TypeError):
+            continue
+        receipt=lanes.native_cli_receipt(value,receipt);receipts.append((item['id'],receipt))
+    if len(receipts)!=1 or len(reads)!=1 or receipts[0][0]==reads[0]:
+        raise PackError('Actual native-cli command/receipt and own charter read require unique successful tool results')
+    identity,receipt=receipts[0]
+    proof={'harness':'codex','nativeId':value['nativeId'],'generation':value['nativeConnectionGeneration'],'turnId':turn_id,
+        'itemId':identity,'commandDigest':lanes.digest(command),'exitCode':0,'receiptDigest':lanes.digest(receipt)}
+    return {'receipt':receipt,'proof':proof,'nativeCharterReadItemId':reads[0]}