[Meta-Develop]

Normal intake now retains the selected managed account, frozen routing policy and genuine task assessment through role selection, launch and collection. Unknown access and usage remain explicit. Candidate ranking includes loaded review/retry tradeoffs and retained accepted-result evidence; score proxies remain separate from billed usage.

Native launch authority stays bound to the actual managed worktree, held claims, selected executable/account and launch purpose. Managed control parents retain read-only access; ordinary terminal Workers use their validated execution contract. Optional Git info directories are created through the authenticated held common-directory root. Linux isolation retains UID-map, procfs, Nix-directory masking, deadline, cancellation and cleanup checks. The Nix package exports the main binary, account authority and setup helper against one source manifest.

Grok headless, ACP, catalog and managed-login paths disable automatic updates. ACP requires its exact protocol, approval, model and effort contract and disables memory and subagents. Cursor managed sign-in relays validated public owner actions through the native/account-authority/GUI adapters with expiry, incarnation, cancellation and redaction controls.

Executable review lenses retain authored model/effort and information scope. Each launch is selected against the frozen assessment/policy, current account/catalog, priors, history and quota; scoped authorization is restored afterward. Invalid contracts, account drift, lost access and policy-floor violations still refuse. Historical routing-score V1 remains readable while current V2 schemas retain the added review/rework evidence.

Incomplete goal/spec proposals keep their conservative planning/execution graph, real coverage gaps and frozen policy. Both task assessment and grain classification now require a complete, nondegraded proposal; normal intake still refuses an unassessed document before provider observation. Complete proposals retain normal classification and error propagation.

Writable Direct confinement is first sealed after final parent timeout, assignment messaging, checkpoint and live-budget binding, before launch validation or invocation. Preparation still authenticates and persists the underlying managed-worktree admission. The full command snapshot remains strict; the separately sealed process grant retains its own validation. Tests cover finalized messaging/timeout and independent post-seal mutations.

Fixture repairs carry current selected-account registry/adapter custody into scoped threads, retain real assessment and role/lens contracts, preserve canonical nested Worker metadata and synchronize published schemas. Original isolation, grant, journal, primary-integrity, usage and pricing assertions remain.

Feedback replanning now derives routing from a cloned view of the remaining validated fragments. The canonical session retains completed assignments and fragment history; unassigned remaining fragments still prevent assessment. Heuristic lowering and provider assessment use that same view. A regression checks assessment, history, scope and round-trip preservation.

Grok catalog observation now distinguishes the exact native owner-authentication refusal from a malformed catalog. An implicit optional observation retains existing omission behavior; an explicit executable override still fails closed. Hermetic regressions use the actual unauthenticated public payload and preserve the authenticated-header requirement.

Current fixtures use owned Core registry and lifecycle custody for Cursor, seal each IPC phase after its final messaging and artifact paths, and assert the canonical ACP approval sequence. Role-selection tests assert the four reachable roles and preserve the authored fail-closed effort. Coordinated policy/script planning retains its parent and two terminal Worker scopes, fragments and original task text. The CLI unassessed-intake regression now enters normal automatic intake.

The compiled 76ae489 package was qualified by its source manifest and ELF hashes, delivered to the isolated normal-user VM and imported successfully. Its actual native MACO attempt stopped before Worker dispatch because the selected Grok profile required owner authentication. The final-command confinement change was not reached by that attempt. Productive execution, successful import and operational acceptance remain separate; no stable launcher or running account-authority service has been replaced.

Since d7d8dc4 the branch adds 26 commits that harden the Linux/WSL operator path. Grok's inner bubblewrap is admitted in the ExternalGrok systemd profile. Bare instructions default to the Codex runtime, Codex priors use gpt-6.1-sol as the baseline and refuse GPT-6 Astra, and budgets halt per assignment. Literal single-file create/append goals are accepted, an absent implicit CAM endpoint is treated as not configured, a local-auth Codex primary stays eligible, and direct Codex Workers run with native delegation disabled. Path resolution falls back to a component walk when openat2 is unavailable. Review lens scope keeps earlier selector seals and binds the parent process record, the admitted CAM endpoint is rechecked before release, and worker changes are attributed by wrapper observation. The endpoint socket uses the short-path helper, bounded-status cleanup is budgeted, and journal-append wrapper commands are canonicalised. Codex moderation notices are accepted and missing worker reports are reported as missing. Stale supervise, plan-runtime, quota-refresh, gate-classifier, release-error and operator-prior fixtures are repaired, and shared supervise test helpers use distinct run ids. docs/OPERATOR_QUICKSTART.md, linked from the README, documents the Linux operator path.

Status at f57624f: all 23 checks pass, including the Required Rust CI gate (run 38981323406). On WSL Ubuntu, a release build of maco completed two Codex E2E supervise runs (README append and new-file creation); both ended with accepted=true, decision=accept, status=succeeded. A Grok E2E run has not been performed yet because it requires the owner's interactive Grok device login.