feat(app-server): add bounded guarded queue-only client

PARITY.md

@@ -1059,3 +1059,46 @@ are refused without automatic key recovery or history migration. This is an
 at-rest journal boundary, not protection against a reader of both private
 files. Duplicate committed operator confirmation returns the original receipt
 without rewriting its wait classification or journal.
+
+## Unreleased bounded app-server foundation — #71
+
+The opt-in internal client is qualified only for queue mechanics on Codex
+0.160.1 and 0.162.1 / macOS arm64, using separate isolated network-denied synthetic homes. One
+native queue/add, original client message ID persistence and no loaded/resumed
+thread were observed. This is not live delivery, general owner-route or receipt
+ACK qualification. Legacy Codex queue remains the default CLI path.
+
+The client bounds frames, RPCs, traffic, owner verification, monotonic deadlines
+and owned process-group cleanup. An authorized caller supplies a durable
+before-effect fence; at most one queue RPC follows it. After a possible write,
+disconnect, timeout, schema error or remote refusal never enables fallback or
+resend. initialize opts out all 83 notifications in the exact qualified native
+schema; queue/add's own input echo is validated but only IDs are returned.
+queue/list, history, full item/turn notifications, resume/start and model turns
+are excluded. The separate synthetic metadata protocol is explicitly fixture
+only. Other platforms/versions and native observation remain unsupported.
+
+Generated schema hashes and the fixed official source commit are recorded in
+`test/fixtures/app-server-schema-evidence.json`; tests use hermetic streams and
+owned Node children. These facts do not re-pin the shipped Python runtime parity
+reference or implement automatic ACK.
+
+
+Storage binding is checked on the owned queue transport before its effect:
+env/CLI pins plus exact opened state/queue paths. Managed-policy redirection or
+missing direct-native PID proof refuses with zero queue RPC. An additional
+network-denied initialization-only fixture verified config/CLI/env precedence
+with zero queued rows and no model/thread effect. Bootstrap policy files are
+not promised unchanged by the native tool; no managed requirement is bypassed.
+
+### Exact 0.162.1 queue profile qualification
+
+The internal queue client also pins Codex 0.162.1/source
+`092d3acd6bec3e3a14bdc7e7a2810ab628ab759d` on macOS arm64. The source/schema
+fixture records the exact notification opt-out set (84 methods, compared with
+83 in 0.160.1). An unloaded, isolated thread received one queue request with its
+exact supplied client ID and native queue receipt; a separate owned-descriptor
+fixture refused the durable effect guard and left zero queue rows. No version
+range, Linux/Windows qualification, live delivery or ACK follows from these
+queue-only fixtures. Initial harness failures are recorded separately and were
+never retried with an already-attempted intent.

docs/api.md

@@ -82,3 +82,47 @@ secret is accepted in argv/URI/environment. Receipt ACK means receipt only, not
 ownership, completed work or permission to act. Operator confirmation is
 explicitly labeled and must match retained original context. No arbitrary
 message/transcript scan manufactures ACK. Ordinary generated Reply-To stays v1.
+
+
+## Unreleased bounded app-server mechanics — 0.4.0 work
+
+`dist/app-server.js` is an internal opt-in module, not a new public package
+export or a change to ordinary CLI submission. `nativeQueueOnce` requires an
+absolute executable, exact home/thread/original generation, bounded owner
+verifier and durable `beforeEffect` callback. Exact Codex 0.160.1 and 0.162.1
+queue mechanics were tested on macOS arm64 in network-denied synthetic homes;
+other platform or version tuples fail before an effect. There is no minor-range
+or latest-version inference. The caller owns proof of original
+writer/home and any resources used by its verifier.
+
+Only initialize, initialized and one thread/queue/add are used. Queue receipt
+returns IDs only. Body-returning observation APIs, transcript reading, resume,
+wake and new model turns are not implemented. The native process is an owned
+queue transport, not an inferred existing session owner. Possible write marks
+outcome uncertain even when the subsequent response is malformed. No automatic
+fallback follows a possible effect. Fixture-only metadata ports are not native
+observation qualification. See [source evidence](../PARITY.md#unreleased-bounded-app-server-foundation--71).
+
+The 0.162.1 qualification uses source `092d3acd6bec3e3a14bdc7e7a2810ab628ab759d`
+and generated schema hashes, with all 84 native notifications opted out before
+the effect (0.160.1 retains its exact 83-method list). A saved synthetic thread
+remained unloaded before and after one queue request; its own echoed input and
+queue/thread/client IDs were checked. A separate native API fixture verified
+owned SQLite descriptor binding and durable-guard refusal with zero queue rows.
+Neither fixture proves a live writer's generation, actual delivery, receipt ACK
+or a body-free native observer. Linux and Windows native mechanics remain
+unqualified. The initial qualification harness had echo-shape and temporary-home
+mapping failures; each subsequent probe used a distinct home/thread/client ID,
+and no attempted submission was replayed. Details are retained in the
+`test/fixtures/app-server-schema-evidence.json` source fixture.
+
+
+The queue-only SDK pins both environment and CLI SQLite home, then verifies
+opened state/queue DB paths on its OWN native app-server PID before authorizing
+the effect. Config precedes the environment and exact managed requirements can
+supersede the CLI in the qualified versions, so initialize's home echo alone is insufficient.
+Missing/mismatched descriptor proof refuses without queue/fallback. Direct
+native binaries are qualified; launcher wrappers without this PID/storage proof
+remain unsupported. Native bootstrap may create state/cache files according to
+managed policy before binding refusal; zero queue is the guarantee, not zero
+bootstrap filesystem activity. Observers still open only read-only warm stores.

package.json

@@ -41,7 +41,7 @@
     "build": "tsc -p tsconfig.json",
     "test": "npm run build && npm run test:types && node --import ./test/fixtures/isolate-env.mjs --experimental-strip-types --test test/*.test.ts",
     "test:types": "tsc -p tsconfig.test.json",
-    "test:windows": "npm run build && npm run test:types && node --import ./test/fixtures/isolate-env.mjs --import ./test/fixtures/windows-inspection-diagnostic.mjs --experimental-strip-types --test --test-concurrency=1 test/writer-uid.test.ts test/claude-records.test.ts test/reply-agent-binding.test.ts test/windows.test.ts test/windows-contract.test.ts test/windows-inspection.test.ts test/input-boundaries.test.ts test/discovery.test.ts test/codex-homes.test.ts test/diagnostics.test.ts test/cli-usability.test.ts test/skill-guidance.test.ts test/skill-metadata.test.ts test/ssh-hosts.test.ts test/ssh-response.test.ts test/replies.test.ts test/updates.test.ts",
+    "test:windows": "npm run build && npm run test:types && node --import ./test/fixtures/isolate-env.mjs --import ./test/fixtures/windows-inspection-diagnostic.mjs --experimental-strip-types --test --test-concurrency=1 test/app-server.test.ts test/writer-uid.test.ts test/claude-records.test.ts test/reply-agent-binding.test.ts test/windows.test.ts test/windows-contract.test.ts test/windows-inspection.test.ts test/input-boundaries.test.ts test/discovery.test.ts test/codex-homes.test.ts test/diagnostics.test.ts test/cli-usability.test.ts test/skill-guidance.test.ts test/skill-metadata.test.ts test/ssh-hosts.test.ts test/ssh-response.test.ts test/replies.test.ts test/updates.test.ts",
     "test:package": "npm run build && node --experimental-strip-types test/package-smoke.ts"
   },
   "devDependencies": {

scripts/release.mjs

@@ -19,7 +19,7 @@ export const packageFiles = ['UNICODE-LICENSE.txt', 'dist/casefold.js', 'dist/ca
   'dist/cli.js', 'dist/discovery.js', 'dist/diagnostics.js', 'dist/skill-metadata.js', 'dist/process.js', 'dist/protocol.js', 'dist/replies.js', 'dist/send.js', 'dist/ssh.js', 'dist/ssh-response.js',
   'dist/windows.js', 'dist/writer.js', 'dist/index.js', 'dist/index.d.ts', 'dist/cli.d.ts',
   'dist/discovery.d.ts', 'dist/diagnostics.d.ts', 'dist/skill-metadata.d.ts', 'dist/process.d.ts', 'dist/protocol.d.ts',
-  'dist/replies.d.ts', 'dist/send.d.ts', 'dist/ssh.d.ts', 'dist/ssh-response.d.ts', 'dist/windows.d.ts', 'dist/writer.d.ts', 'dist/updates.js', 'dist/updates.d.ts', 'dist/handoff.js', 'dist/handoff.d.ts', 'dist/handoff-ledger.js', 'dist/handoff-ledger.d.ts', 'dist/handoff-operations.js', 'dist/handoff-operations.d.ts', 'package.json'].sort();
+  'dist/replies.d.ts', 'dist/send.d.ts', 'dist/ssh.d.ts', 'dist/ssh-response.d.ts', 'dist/windows.d.ts', 'dist/writer.d.ts', 'dist/updates.js', 'dist/updates.d.ts', 'dist/handoff.js', 'dist/handoff.d.ts', 'dist/handoff-ledger.js', 'dist/handoff-ledger.d.ts', 'dist/handoff-operations.js', 'dist/handoff-operations.d.ts', 'dist/app-server.js', 'dist/app-server.d.ts', 'package.json'].sort();
 const json = path => JSON.parse(readFileSync(path, 'utf8'));
 const digest = (bytes, algorithm, encoding = 'hex') => createHash(algorithm).update(bytes).digest(encoding);
 const npm = args => execFileSync('npm', args, { encoding: 'utf8', timeout: 120000 });