@topolo/cli 0.13.9 → 0.13.11

package/agent-packs/src/topolo_agent_pack/policy.py

@@ -29,6 +29,12 @@ MODELS = {'codex': {'reasoning': 'gpt-6-astra', 'workhorse': 'gpt-6.1-sol'},
           'claude': {'reasoning': 'claude-opus-5-5', 'workhorse': 'claude-sonnet-5-5'}}
 
 
+def dynamic_task_settings(configuration, task, harness, catalog, constraints, *, override_authorized=False):
+    """Dynamic task intent only; preserve every fixed role's settings."""
+    from .task_models import resolve
+    return resolve(configuration, task, harness, catalog, constraints, override_authorized=override_authorized)
+
+
 def role_profile(agent):
     explicit = agent.get('executionProfile')
     if explicit is not None:

package/agent-packs/src/topolo_agent_pack/task_models.py

@@ -0,0 +1,200 @@
+"""Versioned task selection intersected with a current native account catalog.
+
+This module selects intent only. It neither opens a host nor grants permissions.
+An unavailable choice is a refusal, never a provider or parent-model fallback.
+"""
+import copy
+import hashlib
+
+from .storage import PackError, canonical
+
+
+def digest(value):
+    return hashlib.sha256(canonical(value)).hexdigest()
+
+
+def default_configuration():
+    """Explicit template for a new pack configuration; existing roles are unchanged."""
+    return {
+        'format': 'topolo-task-model-configuration', 'schemaVersion': 1, 'revision': '1',
+        'rules': [
+            {'id': 'routine', 'complexity': ['routine'], 'risk': ['low'], 'profile': 'routine'},
+            {'id': 'deep', 'complexity': ['complex'], 'risk': ['low', 'normal', 'security-critical'], 'profile': 'deep'},
+            {'id': 'security', 'complexity': ['routine', 'standard'], 'risk': ['security-critical'], 'profile': 'deep'},
+            {'id': 'standard', 'complexity': ['standard'], 'risk': ['low', 'normal'], 'profile': 'standard'},
+        ],
+        'harnesses': {
+            'codex': {
+                'tiers': {'standard': 'gpt-6.1-sol', 'deep': 'gpt-6-astra'},
+                'profiles': {'routine': {'tier': 'standard', 'efforts': ['low', 'medium']},
+                             'standard': {'tier': 'standard', 'efforts': ['medium']},
+                             'deep': {'tier': 'deep', 'efforts': ['high']}},
+            },
+            'claude': {
+                'tiers': {'economy': 'claude-haiku-5-5', 'standard': 'claude-sonnet-5-5', 'deep': 'claude-opus-5-5'},
+                'profiles': {'routine': {'tier': 'economy', 'efforts': ['low', 'medium']},
+                             'standard': {'tier': 'standard', 'efforts': ['medium']},
+                             'deep': {'tier': 'deep', 'efforts': ['high']}},
+            },
+        },
+    }
+
+
+def _strings(values, label):
+    if (not isinstance(values, list) or not values or len(values) > 64 or
+            any(not isinstance(v, str) or not v or len(v) > 128 for v in values) or
+            len(set(values)) != len(values)):
+        raise PackError('Invalid exact ' + label)
+    return set(values)
+
+
+def role_constraints(configuration, role_key):
+    """Intersect explicit pack, group and role ceilings; none is an implied grant."""
+    if (not isinstance(configuration,dict) or set(configuration)!={'pack','groups','roles'} or
+            not isinstance(role_key,str) or len(role_key.split('/'))!=3 or
+            not isinstance(configuration['groups'],dict) or not isinstance(configuration['roles'],dict)):
+        raise PackError('Explicit pack, group and role model constraints required')
+    group=role_key.split('/')[1]
+    rows=[configuration['pack'],configuration['groups'].get(group),configuration['roles'].get(role_key)]
+    models=None;efforts=None
+    for row in rows:
+        if not isinstance(row,dict) or set(row)!={'allowedModels','allowedEfforts'}:
+            raise PackError('Task model constraint layer is missing or unsupported')
+        m=_strings(row['allowedModels'],'constraint models');e=_strings(row['allowedEfforts'],'constraint efforts')
+        models=m if models is None else models&m;efforts=e if efforts is None else efforts&e
+    if not models or not efforts:
+        raise PackError('Task model constraints have no permitted intersection')
+    return {'allowedModels':sorted(models),'allowedEfforts':sorted(efforts)}
+
+
+def _selection(configuration, task, harness, constraints, *, override_authorized=False):
+    """Resolve one bounded task against supplied, independently qualified host data.
+
+    The caller binds catalog/config digests to its current native connection and
+    checks them again before every effect. API-wide availability is insufficient.
+    """
+    if (not isinstance(configuration, dict) or set(configuration) != {'format', 'schemaVersion', 'revision', 'rules', 'harnesses'} or
+            configuration.get('format') != 'topolo-task-model-configuration' or
+            configuration.get('schemaVersion') != 1 or not configuration.get('revision')):
+        raise PackError('Task model configuration is missing or unsupported')
+    if (not isinstance(task, dict) or not {'type', 'complexity', 'risk'} <= set(task) or
+            set(task) - {'type', 'complexity', 'risk', 'override'} or
+            not isinstance(task['type'], str) or not task['type'] or len(task['type']) > 120 or
+            task['complexity'] not in {'routine', 'standard', 'complex'} or
+            task['risk'] not in {'low', 'normal', 'security-critical'}):
+        raise PackError('An intake must supply an exact task type, complexity and risk')
+    rules = configuration.get('rules')
+    if not isinstance(rules, list) or not 0 < len(rules) <= 32:
+        raise PackError('Task model rules are unavailable')
+    matches = []
+    for rule in rules:
+        if (not isinstance(rule, dict) or not {'id', 'complexity', 'risk', 'profile'} <= set(rule) or
+                not isinstance(rule['id'], str) or not rule['id'] or
+                not isinstance(rule['profile'], str) or not rule['profile'] or
+                set(rule) - {'id', 'complexity', 'risk', 'profile', 'types'}):
+            raise PackError('Invalid task model rule')
+        complexities = _strings(rule['complexity'], 'complexity rule')
+        risks = _strings(rule['risk'], 'risk rule')
+        types = _strings(rule['types'], 'task type rule') if 'types' in rule else None
+        if task['complexity'] in complexities and task['risk'] in risks and (types is None or task['type'] in types):
+            matches.append(rule)
+    if len(matches) != 1:
+        raise PackError('Task has no unique configured model profile')
+    rule = matches[0]
+    harnesses = configuration.get('harnesses')
+    host = harnesses.get(harness) if isinstance(harnesses, dict) else None
+    if (not isinstance(host, dict) or set(host) != {'tiers', 'profiles'} or
+            not isinstance(host['tiers'], dict) or not isinstance(host['profiles'], dict)):
+        raise PackError('Task model harness is not configured')
+    profile = host['profiles'].get(rule['profile'])
+    if (not isinstance(profile, dict) or set(profile) != {'tier', 'efforts'} or
+            not isinstance(profile['tier'], str)):
+        raise PackError('Task model profile is unavailable')
+    requested = {'model': host['tiers'].get(profile['tier']), 'efforts': profile['efforts']}
+    if not isinstance(requested['model'], str) or not requested['model'] or requested['model'].endswith('-latest'):
+        raise PackError('Configured model must be an exact versioned native model')
+    _strings(requested['efforts'], 'configured effort preference')
+    if not isinstance(constraints, dict) or set(constraints) != {'allowedModels', 'allowedEfforts'}:
+        raise PackError('Pack, group and role model constraints are required')
+    allowed_models = _strings(constraints['allowedModels'], 'allowed models')
+    allowed_efforts = _strings(constraints['allowedEfforts'], 'allowed efforts')
+    override = task.get('override')
+    if override is not None:
+        if (not override_authorized or not isinstance(override, dict) or set(override) != {'model', 'effort'}):
+            raise PackError('Task model override has no exact intake authorization')
+        model = override['model']; preferences = [override['effort']]
+        _strings(preferences, 'override effort')
+    else:
+        model = requested['model']; preferences = requested['efforts']
+    if not isinstance(model,str) or model not in allowed_models:
+        raise PackError('Requested model is outside the configured constraints; no fallback')
+    if not any(e in allowed_efforts for e in preferences):
+        raise PackError('Requested effort is outside the configured constraints; no fallback')
+    return {'rule':rule,'requested':requested,'override':override,'model':model,'preferences':preferences,
+            'allowedModels':allowed_models,'allowedEfforts':allowed_efforts}
+
+
+def resolve(configuration, task, harness, catalog, constraints, *, override_authorized=False):
+    selected=_selection(configuration,task,harness,constraints,override_authorized=override_authorized)
+    rule=selected['rule'];requested=selected['requested'];override=selected['override']
+    model=selected['model'];preferences=selected['preferences']
+    allowed_models=selected['allowedModels'];allowed_efforts=selected['allowedEfforts']
+    if (not isinstance(catalog, dict) or catalog.get('harness') != harness or
+            catalog.get('source') != 'native-account' or not catalog.get('connectionGeneration') or
+            not isinstance(catalog.get('models'), list) or not catalog['models']):
+        raise PackError('Current native account model and effort catalog is required')
+    available = {}
+    for row in catalog['models']:
+        if (not isinstance(row, dict) or set(row) != {'model', 'efforts'} or
+                not isinstance(row['model'], str) or not row['model'] or row['model'] in available):
+            raise PackError('Native catalog has duplicate or malformed model identities')
+        available[row['model']] = _strings(row['efforts'], 'native effort capabilities')
+    if not isinstance(model, str) or model not in allowed_models or model not in available:
+        raise PackError('Requested model is outside the configured or native account constraints; no fallback')
+    effort = next((v for v in preferences if v in allowed_efforts and v in available[model]), None)
+    if effort is None:
+        raise PackError('Requested effort is not supported for the exact model; no fallback')
+    return {
+        'format': 'topolo-task-model-resolution', 'schemaVersion': 1,
+        'task': copy.deepcopy(task), 'harness': harness, 'profile': rule['profile'],
+        'rule': rule['id'], 'requested': copy.deepcopy(override or requested),
+        'resolved': {'model': model, 'effort': effort},
+        'reason': 'Exact configured task profile intersected with pack/group/role and native account constraints',
+        'configurationRevision': configuration['revision'], 'configurationDigest': digest(configuration),
+        'catalogDigest': digest(catalog), 'connectionGeneration': catalog['connectionGeneration'],
+        'constraintsDigest': digest(constraints), 'nativeACK': None,
+    }
+
+
+def resolve_intent(configuration, task, harness, models, constraints, *, override_authorized=False):
+    """Explicit Claude intent when native effort metadata is unavailable.
+
+    This does not fabricate effort capability rows. No task may run until the
+    exact fresh child's actual process settings acknowledge the selected tuple.
+    """
+    if (harness!='claude' or not isinstance(models,dict) or
+            set(models)!={'harness','source','connectionGeneration','models'} or models['harness']!=harness or
+            models['source']!='native-account-model-ids' or not models['connectionGeneration']):
+        raise PackError('Current native account model-ID observation required for staged Claude intent')
+    actual=_strings(models['models'],'native model IDs')
+    selected=_selection(configuration,task,harness,constraints,override_authorized=override_authorized)
+    if selected['model'] not in actual:
+        raise PackError('Exact task model is absent from the actual native account; no fallback')
+    effort=next(e for e in selected['preferences'] if e in selected['allowedEfforts'])
+    return {'format':'topolo-task-model-resolution','schemaVersion':1,'task':copy.deepcopy(task),'harness':harness,
+            'profile':selected['rule']['profile'],'rule':selected['rule']['id'],
+            'requested':copy.deepcopy(selected['override'] or selected['requested']),
+            'resolved':{'model':selected['model'],'effort':effort},
+            'reason':'Versioned task intent intersected with pack/group/role constraints and current native model IDs; effort support awaits actual process ACK',
+            'configurationRevision':configuration['revision'],'configurationDigest':digest(configuration),
+            'catalogDigest':digest(models),'connectionGeneration':models['connectionGeneration'],
+            'constraintsDigest':digest(constraints),'nativeEffortSupport':'awaiting-native-process-settings-ACK','nativeACK':None}
+
+
+def acknowledge(resolution, native, *, configuration, catalog, constraints):
+    if (resolution['configurationDigest'] != digest(configuration) or
+            resolution['catalogDigest'] != digest(catalog) or
+            resolution['constraintsDigest'] != digest(constraints) or
+            native != resolution['resolved']):
+        raise PackError('Task model inputs or actual native model/effort changed; execution remains blocked')
+    return {**copy.deepcopy(resolution), 'nativeACK': copy.deepcopy(native)}

package/agent-packs/src/topolo_agent_pack/topolo.py

@@ -1,26 +1,28 @@
 """Optional public Topolo continuity adapter. No credentials or transcript uploads."""
-import re,contextlib,fcntl,base64,hashlib,json,os,pathlib,shutil,subprocess,tempfile,uuid
+import re,contextlib,fcntl,base64,hashlib,json,os,pathlib,shutil,stat,subprocess,tempfile,uuid
 from .storage import PackError,atomic_json,canonical,read_json,safe_id
 
 class ConnectionSourceRefused(PackError):
     pass
 
 class Client:
-    def __init__(self,environment,context,binary=None):
+    def __init__(self,environment,context,binary=None,env=None,node=None):
         if environment not in {'development','staging','production'}:
             raise PackError('Explicit Topolo environment required')
         if not context or any(c in context for c in '\n\r'):
             raise PackError('Explicit Topolo context required')
-        if any(os.environ.get(k) for k in ['TOPOLO_API_KEY','TOPOLO_ACCESS_TOKEN','TOPOLO_'+environment.upper()+'_API_KEY','TOPOLO_'+environment.upper()+'_ACCESS_TOKEN']):
+        selected=os.environ if env is None else env
+        if any(selected.get(k) for k in ['TOPOLO_API_KEY','TOPOLO_ACCESS_TOKEN','TOPOLO_'+environment.upper()+'_API_KEY','TOPOLO_'+environment.upper()+'_ACCESS_TOKEN']):
             raise PackError('Pinned connections require the CLI protected account context, not injected credentials')
         self.environment=environment;self.context=context
         self.binary=binary or shutil.which('topolo')
         if not self.binary:
             raise PackError('Install the public @topolo/cli and authenticate before connecting')
-        self.env={**os.environ,'TOPOLO_CONTEXT':context}
-        self.env['PATH']=str(pathlib.Path(self.binary).parent)+os.pathsep+self.env.get('PATH','')
+        self.env={**selected,'TOPOLO_CONTEXT':context}
+        self.command=[node,self.binary] if node else [self.binary]
+        self.env['PATH']=(str(pathlib.Path(node).parent)+os.pathsep+'/usr/bin:/bin') if node else str(pathlib.Path(self.binary).parent)+os.pathsep+self.env.get('PATH','')
     def run(self,args):
-        p=subprocess.run([self.binary,'--env',self.environment,*args,'--json'],env=self.env,capture_output=True,text=True,timeout=90)
+        p=subprocess.run([*self.command,'--env',self.environment,*args,'--json'],env=self.env,capture_output=True,text=True,timeout=90)
         if p.returncode:
             raise PackError('Topolo command failed (exit '+str(p.returncode)+'); inspect the published action, account permissions and environment. No fallback was used.')
         try:value=json.loads(p.stdout)
@@ -100,7 +102,11 @@ def attach_runtime(lib,runtime):
         if not pointer.exists():continue
         selected=read_json(pointer);binding=read_json(binding_path(lib,pack,selected['environment'],selected['contextKey']))
         role=agent['set']+'/'+agent['id']
-        if not any(r['logicalId']==role for r in binding['input']['roles']):continue
+        matches=[r for r in binding['input']['roles'] if r['logicalId']==role]
+        if not matches:continue
+        if len(matches)!=1:
+            raise PackError('Connected role binding is not unique')
+        reference=matches[0]
         import sqlite3,shlex
         con=sqlite3.connect(runtime/'home/state_5.sqlite')
         try:row=con.execute('SELECT cwd FROM threads WHERE id=?',(agent['threadId'],)).fetchone()
@@ -117,7 +123,9 @@ def attach_runtime(lib,runtime):
         # The descriptor contains identity references, never tokens or cached memory.
         atomic_json(directory/'topolo-connection.json',{'environment':selected['environment'],'contextKey':selected['contextKey'],
           'pack':pack,'role':role,'instanceId':binding['input']['instanceId'],'agentWorkspaceId':binding['agentWorkspaceId'],
-          'bytesWorkspaceId':binding['input']['bytesWorkspaceId']})
+          'bytesWorkspaceId':binding['input']['bytesWorkspaceId'],
+          'agentId':reference['agentId'],'agentVersionId':reference['agentVersionId'],
+          'identity':{key:binding['identity'][key] for key in ['userId','organizationId']}})
         text=old+'\n<!-- topolo-continuity -->\n## Shared Topolo continuity\n'+\
           'Before starting assigned work, refresh your approved operating instructions and scoped memory using:\n\n'+command+'\n\n'+\
           'If retrieval fails, report the exact blocker and do not silently use stale shared memory. Read only relevant Bytes artifact references on demand. '+\
@@ -312,6 +320,28 @@ def qualify_connection_scope(scope):
     except (PackError,OSError,ValueError,TypeError) as error:
         raise ConnectionSourceRefused('Pack source or native context changed before cloud dispatch; no mutating call') from error
 
+def private_profile_reference(client,args):
+    """Explicit selected-profile metadata only; never open credential contents."""
+    if not getattr(args,'private_profile',False):
+        return None
+    env=getattr(client,'env',None)
+    selected=env.get('TOPOLO_CONFIG_PATH') if isinstance(env,dict) else None
+    if (not isinstance(selected,str) or not selected or
+            getattr(client,'environment',None)!=args.environment or getattr(client,'context',None)!=args.context_key):
+        raise PackError('Explicit private profile and exact selected client environment/context required')
+    path=pathlib.Path(selected)
+    try:
+        leaf=path.lstat();parent=path.parent.lstat()
+        if (not path.is_absolute() or path.resolve()!=path or not stat.S_ISREG(leaf.st_mode) or
+                leaf.st_uid!=os.getuid() or leaf.st_nlink!=1 or stat.S_IMODE(leaf.st_mode)!=0o600 or
+                not stat.S_ISDIR(parent.st_mode) or parent.st_uid!=os.getuid() or stat.S_IMODE(parent.st_mode)!=0o700):
+            raise PackError('Private profile requires an owned single-link0600 leaf in an owned0700 directory')
+    except OSError as error:
+        raise PackError('Explicit private profile metadata is unavailable; no default profile fallback') from error
+    return {'format':'topolo-private-credential-profile','schemaVersion':1,'configPath':str(path),
+        'environment':args.environment,'contextKey':args.context_key}
+
+
 def connect(lib,args,client):
     manifest,revision=lib.load(args.name)
     claude_plan=claude_context_plan(lib,args.name,manifest,revision) if getattr(args,'harness','codex')=='claude' else None
@@ -337,6 +367,9 @@ def connect(lib,args,client):
             if not getattr(args,'reconcile_local_context',False):
                 raise PackError('Partial Claude context attachment requires explicit --reconcile-local-context; no replay')
     old=read_json(path,{})
+    if old.get('privateCredentialProfile') and not getattr(args,'private_profile',False):
+        raise PackError('Explicit private-profile selection required to requalify this existing private connection')
+    private_profile=private_profile_reference(client,args)
     journal=path.with_suffix('.pending.json')
     pending=read_json(journal,{})
     instance=args.instance or old.get('input',{}).get('instanceId') or pending.get('input',{}).get('instanceId') or 'pack_'+uuid.uuid4().hex
@@ -345,6 +378,8 @@ def connect(lib,args,client):
       'ownershipScope':args.ownership,'bytesWorkspaceId':args.bytes_workspace,'bytesScope':args.bytes_scope,'roles':roles}
     scope=(lib,args,dict(vars(args)),canonical(manifest),revision,roles_bytes,roles,claude_plan)
     owner=identity(client)
+    if private_profile is not None and args.context_key!='org:'+owner['organizationId']:
+        raise PackError('Private profile identity differs from the exact selected organization context')
     qualify_connection_scope(scope)
     journal=path.with_suffix('.pending.json')
     if journal.exists():
@@ -358,6 +393,8 @@ def connect(lib,args,client):
     reuse=bool(old and old.get('input')==payload and old.get('agentWorkspaceId')==args.agent_workspace and old.get('packRevision')==revision)
     proposed={'schemaVersion':1,'environment':args.environment,'contextKey':args.context_key,'identity':owner,
       'agentWorkspaceId':args.agent_workspace,'input':payload,'packRevision':revision}
+    if private_profile is not None:
+        proposed['privateCredentialProfile']={**private_profile,'identity':owner}
     if claude_plan is not None:
         claude_context_targets(lib,args,proposed,claude_plan)
         if local_pending:
@@ -384,6 +421,10 @@ def connect(lib,args,client):
         raise PackError('Pack connection read-back mismatch; preserve pending receipt')
     binding={'schemaVersion':1,'environment':args.environment,'contextKey':args.context_key,'identity':owner,
       'agentWorkspaceId':args.agent_workspace,'input':payload,'connection':readback,'packRevision':revision}
+    if private_profile is not None:
+        if private_profile_reference(client,args)!=private_profile:
+            raise PackError('Private profile selection changed during connection; preserve existing receipts')
+        binding['privateCredentialProfile']={**private_profile,'identity':owner}
     if local_pending:
         if binding!=old:
             raise PackError('Claude attachment verified remote binding changed; no local replay')
@@ -560,6 +601,8 @@ def connection_lock(lib,args):
         yield
 
 def dispatch(lib,args):
+    if args.command=='remote-context' and getattr(args,'continuity_input',None):
+        return native_cli_continuity_read(lib,args)
     client=Client(args.environment,args.context_key)
     if args.command=='connect':return connect(lib,args,client)
     if args.command=='remote-context':return remote_context(lib,args,client)[1]
@@ -571,3 +614,124 @@ def dispatch(lib,args):
         reference=read_json(args.reference)
         return read_artifact(client,binding,reference['key'],reference,args.destination)
     raise PackError('Unsupported Topolo command')
+
+
+
+def native_cli_response(stdout,stderr,service):
+    """Preserve only canonical public response metadata; never echo raw stderr."""
+    from . import lanes
+    if len(stdout.encode())>262144 or len(stderr.encode())>65536:
+        raise PackError('native_cli_request_metadata_unavailable: bounded public response required')
+    try:
+        body=json.loads(stdout)
+    except ValueError as error:
+        raise PackError('native_cli_request_metadata_unavailable: invalid public JSON') from error
+    if not isinstance(body,dict) or body.get('error'):
+        raise PackError('native_cli_request_metadata_unavailable: unsuccessful public response')
+    events=[];seen=set()
+    pattern=r'^\[topolo\] ← (\d{3}) (GET|POST) (auth|agent) (/[^\s?#\\]+) \([0-9.]+ms, req=([A-Za-z0-9][A-Za-z0-9._:-]{0,127})\)$'
+    for line in stderr.splitlines():
+        match=re.fullmatch(pattern,line)
+        if not match:
+            continue
+        status,method,target,path,request_id=match.groups()
+        if request_id=='unavailable' or request_id in seen or not 200<=int(status)<300:
+            raise PackError('native_cli_request_metadata_unavailable: ambiguous or unsuccessful response request IDs')
+        seen.add(request_id);events.append({'requestId':request_id,'method':method,'service':target,'path':path,'status':int(status)})
+    if not 1<=len(events)<=8 or service not in {event['service'] for event in events}:
+        raise PackError('native_cli_request_metadata_unavailable: actual canonical server response IDs required')
+    return body.get('data',body),events
+
+
+def native_cli_command_response(client,args,service):
+    env={**client.env,'TOPOLO_DEBUG':'1'}
+    result=subprocess.run([*client.command,'--env',client.environment,*args,'--json'],env=env,
+        capture_output=True,text=True,timeout=90)
+    if result.returncode:
+        raise PackError('native_cli_request_metadata_unavailable: public command refused; no fallback or retry')
+    return native_cli_response(result.stdout,result.stderr,service)
+
+
+def native_cli_selected_environment(value,binding,host_env):
+    from . import lanes
+    from types import SimpleNamespace
+    context=value['context'];profile=binding.get('privateCredentialProfile')
+    lanes.native_cli_closed(profile,{'format','schemaVersion','configPath','environment','contextKey','identity'},'private profile reference')
+    if (profile['format']!='topolo-private-credential-profile' or profile['schemaVersion']!=1 or
+            profile['environment']!=context['environment'] or profile['contextKey']!=context['contextKey'] or
+            profile['identity']!={'userId':context['principalId'],'organizationId':context['organizationId']}):
+        raise PackError('Exact native-cli approved profile/principal/context reference required')
+    selected=SimpleNamespace(env={'TOPOLO_CONFIG_PATH':profile['configPath']},environment=context['environment'],context=context['contextKey'])
+    args=SimpleNamespace(private_profile=True,environment=context['environment'],context_key=context['contextKey'])
+    private_profile_reference(selected,args)
+    for path,sha in [(value['cli']['nodeExecutable'],value['cli']['nodeDigest']),(value['cli']['entry'],value['cli']['entryDigest'])]:
+        p=pathlib.Path(path);info=p.lstat()
+        if (p.resolve()!=p or not stat.S_ISREG(info.st_mode) or info.st_uid not in {0,os.getuid()} or info.st_mode&0o022 or
+                not info.st_mode&0o111 or hashlib.sha256(p.read_bytes()).hexdigest()!=sha):
+            raise PackError('Native-cli executable source/provenance changed')
+    allowed={'HOME','USER','LOGNAME','PATH','LANG','LC_ALL','TMPDIR'}
+    env={k:v for k,v in host_env.items() if k in allowed and isinstance(v,str)}
+    env['PATH']=str(pathlib.Path(value['cli']['nodeExecutable']).parent)+os.pathsep+'/usr/bin:/bin'
+    env.update(TOPOLO_CONFIG_PATH=profile['configPath'],TOPOLO_ENV=context['environment'],TOPOLO_CONTEXT=context['contextKey'])
+    return env
+
+
+def native_cli_continuity_read(lib,args,*,_admit=None,_client_factory=None,_response=None):
+    """Native command producer. No current runtime authority producer exists.
+
+    Injected callbacks are internal hermetic seams, never CLI/JSON options.
+    Receipt output is public response evidence, not native-query attribution.
+    """
+    from . import lanes
+    path=pathlib.Path(args.continuity_input);info=path.lstat()
+    if (path.is_symlink() or not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1 or
+            info.st_mode&0o077 or info.st_size>65536):
+        raise PackError('Exact owned bounded native-cli input required')
+    value=lanes.native_cli_input(read_json(path))
+    (lanes.native_cli_admission if _admit is None else _admit)(value)
+    context=value['context']
+    if (args.environment!=context['environment'] or args.context_key!=context['contextKey'] or args.role!=context['logicalId'] or
+            value['sourceRoleKey']!=args.name+'/'+args.role):
+        raise PackError('Native-cli command differs from the exact source/operation')
+    file=binding_path(lib,args.name,args.environment,args.context_key);info=file.lstat()
+    if (file.is_symlink() or not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1 or
+            hashlib.sha256(file.read_bytes()).hexdigest()!=value['source']['bindingDigest']):
+        raise PackError('Native-cli current owned binding source differs')
+    binding=read_json(file);roles=[r for r in binding['input']['roles'] if r['logicalId']==args.role]
+    if (len(roles)!=1 or binding['identity']!={'userId':context['principalId'],'organizationId':context['organizationId']} or
+            binding['packRevision']!=value['source']['packRevision'] or binding['input']['instanceId']!=context['installationId'] or
+            binding['agentWorkspaceId']!=context['agentWorkspaceId'] or binding['input']['bytesWorkspaceId']!=context['bytesWorkspaceId'] or
+            binding['input']['bytesScope']!=context['bytesScope'] or roles[0]['agentId']!=context['agentId'] or roles[0]['agentVersionId']!=context['agentVersionId']):
+        raise PackError('Native-cli source principal/Agent/Bytes binding differs')
+    env=native_cli_selected_environment(value,binding,os.environ)
+    client=(Client if _client_factory is None else _client_factory)(args.environment,args.context_key,
+        binary=value['cli']['entry'],env=env,node=value['cli']['nodeExecutable'])
+    call=native_cli_command_response if _response is None else _response
+    identity,identity_events=call(client,['whoami'],'auth')
+    if (identity.get('user',{}).get('id')!=context['principalId'] or (identity.get('organization')or{}).get('id')!=context['organizationId']):
+        raise PackError('Actual native-cli public identity differs')
+    with tempfile.TemporaryDirectory(prefix='topolo-native-cli-context-') as directory:
+        input_file=pathlib.Path(directory)/'input.json';atomic_json(input_file,{'instanceId':context['installationId'],'logicalId':context['logicalId']})
+        envelope,context_events=call(client,['actions','call','app_topolo_agent.agent_packs.context','--detail','--data','@'+str(input_file),
+            '--resource-type','workspace','--resource-id',context['agentWorkspaceId']],'agent')
+    result=envelope.get('data',envelope)
+    actual=result.get('context',{})
+    expected={'organizationId':context['organizationId'],'workspaceId':context['agentWorkspaceId'],'instanceId':context['installationId'],
+        'logicalId':context['logicalId'],'agentId':context['agentId'],'agentVersionId':context['agentVersionId'],
+        'artifacts':{'appId':'app_topolo_bytes','resourceType':'workspace','resourceId':context['bytesWorkspaceId'],'scope':context['bytesScope']}}
+    if envelope.get('success') is False or any(actual.get(k)!=v for k,v in expected.items()):
+        raise PackError('Actual native-cli public Agent/Bytes context differs')
+    # Recheck mutable public binding, binary and stat-only profile after awaited reads.
+    if hashlib.sha256(file.read_bytes()).hexdigest()!=value['source']['bindingDigest']:
+        raise PackError('Native-cli binding changed during response; no receipt ACK')
+    native_cli_selected_environment(value,binding,os.environ)
+    (lanes.native_cli_admission if _admit is None else _admit)(value)
+    responses={}
+    for kind,body,events in [('identity',{'userId':context['principalId'],'organizationId':context['organizationId']},identity_events),
+                             ('context',expected,context_events)]:
+        responses[kind]={'requestEvents':events,'bodyProjectionDigest':lanes.digest(body),'actionId':None if kind=='identity' else 'app_topolo_agent.agent_packs.context',
+            'resourceType':None if kind=='identity' else 'workspace','resourceId':None if kind=='identity' else context['agentWorkspaceId']}
+    receipt={k:value[k] for k in lanes.NATIVE_CLI_RECEIPT_FIELDS-{'format','schemaVersion','responses','claim'}}
+    receipt.update(format='topolo-native-cli-continuity-receipt',schemaVersion=1,responses=responses,
+        claim='PUBLIC_IDENTITY_CONTEXT_RESPONSE_ONLY_NATIVE_ATTRIBUTION_REQUIRED')
+    return lanes.native_cli_receipt(value,receipt)