diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c20a7e7..08e5dc9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -52,6 +52,9 @@ jobs:
       - name: Run hermetic extension example
         run: cargo run --example hermetic_extension --locked
 
+      - name: Run hermetic process transport example
+        run: cargo run --example hermetic_process_transport --locked
+
       - name: Verify package contents
         run: cargo package --locked
 
diff --git a/README.md b/README.md
index 43e2335..adf9e53 100644
--- a/README.md
+++ b/README.md
@@ -17,12 +17,12 @@ compose them through stable public library interfaces or versioned CLI
 contracts, without introducing direct dependencies between sibling holons.
 
 The repository remains architecture-led, but it is no longer documentation
-only. The current FLO-Q02 candidate adds a small Rust library that validates the
-federated extension contracts, resolves one capability deterministically, and
-executes one caller-injected in-process extension through a seam proven by a
-hermetic reference port. It does not copy holon source or claim a product
-orchestrator, CLI, external process adapter, durable run state, or resume
-support.
+only. FLO-Q02 provides a small Rust library that validates the federated
+extension contracts, resolves one capability deterministically, executes one
+caller-injected in-process extension, and validates a provider-neutral process
+transcript without launching a child process. It does not copy holon source or
+claim a product orchestrator, CLI, production process adapter, durable run
+state, or resume support.
 
 ## Executable checkpoint
 
@@ -33,7 +33,10 @@ The first executable checkpoint is deliberately library-only:
 - `ExtensionCatalog` inspection and resolution retain deterministic selection
   and rejection evidence;
 - `Orchestrator` invokes a matching `ExtensionPort` and returns an execution
-  only after Flow validates event and terminal-result correlation; and
+  only after Flow validates event and terminal-result correlation;
+- the process seam deterministically encodes one JSON Lines invocation and
+  checks bounded, caller-supplied stdout/stderr plus process completion
+  evidence, then routes decoded stdout through the same event/result gate; and
 - a no-effects, no-artifacts hermetic port and example prove the seam without a
   provider binary, filesystem output, network access, or external service.
 
@@ -41,14 +44,16 @@ Run the reference example with:
 
 ```console
 cargo run --example hermetic_extension --locked
+cargo run --example hermetic_process_transport --locked
 ```
 
-`EventSink` is the observation boundary for this checkpoint. A future logging
-or OpenTelemetry adapter can attach there, but observations do not influence
-provider selection or execution identity. `emit` is fallible and its error is
-visible to the provider; rejection makes `Orchestrator` return
-`ExecutionError`. A sink cannot directly mutate provider evidence or grant
-authority. No logging backend or telemetry exporter ships in this slice.
+`EventSink` is a fallible, authoritative execution observer, not a best-effort
+telemetry exporter. Observations do not influence provider selection or
+execution identity, but `emit` rejection makes `Orchestrator` return
+`ExecutionError` and never triggers fallback. A sink cannot directly mutate
+provider evidence or grant authority. The separate observability roadmap owns
+any future non-authoritative logging or OpenTelemetry seam; no such backend or
+exporter ships here.
 
 `ValidatedExecution` means the provider evidence passed Flow's contract,
 identity-correlation, ordering, diagnostic redaction-flag, and
@@ -62,11 +67,12 @@ this checkpoint does not content-scan diagnostics or sanitize unrestricted
 contract strings.
 
 Only `trusted` candidates are resolution-eligible in this checkpoint;
-`Orchestrator` executes only a caller-injected in-process port. `sandboxed`
-candidates fail closed because no sandbox backend exists. Declared execution
-limits are validated and correlated as metadata, not enforced. The injected
-code has no Flow-owned timeout, cancellation, stdout/stderr bound, panic
-isolation, filesystem or network containment, or other side-effect enforcement.
+`Orchestrator` either executes a caller-injected in-process port or validates a
+caller-supplied process transcript. `sandboxed` candidates fail closed because
+no sandbox backend exists. In-process limits remain correlated metadata only.
+The process-transcript seam checks already captured stdout/stderr byte counts
+and completion evidence, but it does not launch, time out, cancel, signal, reap,
+or isolate a process. Neither seam provides filesystem or network containment.
 
 ## Architecture
 
@@ -76,6 +82,7 @@ isolation, filesystem or network containment, or other side-effect enforcement.
 - [Decision index](docs/architecture/governance/DECISIONS.md)
 - [Suite boundaries](docs/integrations/suite-boundaries.md)
 - [Federated extension contract](docs/integrations/extension-contract.md)
+- [Process transport contract](docs/integrations/process-transport.md)
 - [Versioned contracts](contracts/README.md)
 - [Roadmap](ROADMAP.md)
 
@@ -84,13 +91,15 @@ skills, agents, templates, and validators used to maintain these documents.
 
 ## Status
 
-Flow is in the **executable contract seam** phase. Issue #23 supplies the
-candidate library implementation and CI definition for the remaining FLO-Q02
-evidence; FLO-Q02 stays active until that change is merged and exercised by
-default-branch CI. Current descriptions of Aniflow, Optiflow, and Renderflow are
-grounded in their default branches as inspected on 2026-08-13. The holons
-remain independently released repositories; real provider adapters and the
-restore-and-assess workflow remain follow-up work.
+Flow is in the **executable contract seam** phase. Issue #23 / PR #24 is merged,
+and default-branch CI passed at
+`979e033409c823b38591b59eca820522efabfa12`. Issue #26 adds the first bounded
+external-process contract over injected evidence; it does not yet implement a
+runner, artifact binding, executable verification, or host isolation. Current
+descriptions of Aniflow, Optiflow, and Renderflow are grounded in their default
+branches as inspected on 2026-08-13. The holons remain independently released
+repositories; real provider adapters and the restore-and-assess workflow remain
+follow-up work.
 
 ## License
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 5150542..ee8bd7a 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -3,7 +3,7 @@ schema: aether.architecture-document/v1
 id: flow-roadmap
 title: Flow Roadmap
 kind: architecture-document
-version: 0.4.0
+version: 0.5.0
 status: draft
 owners:
   - egohygiene
@@ -38,9 +38,9 @@ updated: 2026-09-16
 
 **Lifecycle:** executable contract prototype
 
-**Current gate:** Merge Flow #23's library-only execution seam and observe its
-success and adversarial cases on default-branch CI before expanding provider
-adapters.
+**Current gate:** Finish Flow #26's deterministic process framing and transcript
+validation, then observe its success and adversarial cases on default-branch CI
+before implementing a real provider adapter.
 
 **North-star outcome:** Federated orchestration across holons with stable provider seams, resumable work, and explicit evidence.
 
@@ -48,9 +48,10 @@ adapters.
 
 **Mode:** `central`  
 **Route:** `/roadmap/flow/`  
-**Current publication evidence:** Architecture, contract source, and the Flow
-#23 executable-core candidate; no executable release or Pages publication
-observed.
+**Current publication evidence:** Architecture, contract source, merged Flow
+#23 / PR #24, and successful default-branch CI at
+`979e033409c823b38591b59eca820522efabfa12`; no executable release or Pages
+publication observed.
 
 Publish the public-safe projection through egohygiene.io at /roadmap/flow/. This repository owns intent and acceptance evidence; it does not add a second site deployment.
 
@@ -82,7 +83,7 @@ issues: []
 id: FLO-Q02
 status: active
 depends_on: [FLO-Q01]
-issues: [7, 23]
+issues: [7, 23, 26]
 -->
 #### FLO-Q02 — Freeze extension seams and create a tested executable core
 
@@ -90,7 +91,8 @@ issues: [7, 23]
 **Depends on:** `FLO-Q01`
 
 **Outcome:** Versioned extension/trust envelopes constrain provider SDK mappings,
-then a minimal orchestrator executes a fixture through one provider seam in CI.
+a minimal orchestrator executes a fixture through one provider seam, and the
+same acceptance gate validates a deterministic external-process transcript.
 
 **Exit criteria:**
 
@@ -98,21 +100,26 @@ then a minimal orchestrator executes a fixture through one provider seam in CI.
   manifest and lock contracts.
 - [x] Invocation, event, result, and resolution schemas cover both execution
   modes and compatibility failures.
-- [x] A runnable library path and hermetic example exist in the Flow #23
-  candidate revision.
-- [ ] Default-branch CI proves success and failure behavior.
+- [x] A runnable library path and hermetic example exist in merged Flow #23 /
+  PR #24.
+- [x] Default-branch CI proves the in-process success and failure behavior.
+- [ ] A deterministic process request/transcript seam reuses Flow-owned event
+  and result validation without claiming a production runner or sandbox.
 
 **Current evidence:**
 
 - Flow #7 defines the extension/trust schemas, synthetic fixtures, and
   compatibility outcomes.
-- Flow #23 supplies a Rust 1.85 library candidate for deterministic resolution,
-  injected in-process execution, Flow-owned event/result validation, and a
-  no-effects hermetic example. Its CI definition covers Rust 1.85, stable Rust,
-  and every repository validator.
-- FLO-Q02 remains active until #23 is merged and a default-branch CI run proves
-  both success and adversarial behavior. This evidence does not claim a public
-  CLI, process execution, real provider adapters, durable state, or resume.
+- Flow #23 / PR #24 supplies deterministic resolution, injected in-process
+  execution, Flow-owned event/result validation, and a no-effects hermetic
+  example.
+- Default-branch CI run 35094682274 passed on Rust 1.85, stable Rust, and every
+  repository validator at `979e033409c823b38591b59eca820522efabfa12`.
+- Flow #26 is the focused next slice. FLO-Q02 remains active until its
+  host-neutral process framing and transcript conformance are merged and proven
+  on default-branch CI. This evidence does not claim a public CLI, a production
+  child-process runner, artifact acceptance, executable verification, sandbox
+  enforcement, real provider adapters, durable state, or resume.
 
 <!-- roadmap-step
 id: FLO-Q03
@@ -193,8 +200,9 @@ issues: []
 ## Strategic context
 
 Flow begins with three independently released Rust tools. Its first executable
-checkpoint is a bounded, library-only extension resolution and execution seam;
-it is not yet a product orchestrator or provider integration. Flow will
+checkpoint is a bounded extension resolution and execution seam: merged
+in-process evidence plus host-neutral process transcript validation. It is not
+yet a product orchestrator, process runner, or provider integration. Flow will
 integrate named releases through public libraries or versioned CLI contracts.
 It will not consolidate repositories, copy sibling source, or hide missing
 provider capabilities inside the facade.
@@ -237,16 +245,28 @@ outside selection and result identity so future logging and OpenTelemetry
 adapters cannot rewrite provider evidence. A sink failure rejects the
 checkpoint execution.
 
-**Candidate evidence:** Flow #23 includes a no-effects, no-artifacts hermetic
-port and executable library example, success and adversarial tests, and CI for
-Rust 1.85, stable Rust, and the existing Python validators. Default-branch CI
-after merge remains the final FLO-Q02 gate. Process transport, real provider
-adapters, durable state, cancellation, checkpoints, and resume are deferred.
-Only trusted candidates are resolution-eligible in this checkpoint;
-`Orchestrator` executes only a caller-injected in-process port. Declared limits
-are correlated metadata rather than runtime enforcement. Caller-issued
-configuration and authorization identities are correlated but not
-authenticated.
+**Delivered evidence:** Flow #23 / PR #24 includes a no-effects, no-artifacts
+hermetic port and executable library example, success and adversarial tests,
+and CI for Rust 1.85, stable Rust, and the existing Python validators.
+Default-branch CI passed at
+`979e033409c823b38591b59eca820522efabfa12`. Only trusted candidates are
+resolution-eligible. The in-process seam treats declared limits as correlated
+metadata, and caller-issued configuration and authorization identities are
+correlated but not authenticated.
+
+### Freeze external-process framing
+
+Encode one compact, LF-terminated invocation document and validate a bounded,
+caller-supplied JSON Lines provider transcript containing ordered events and one
+terminal result. Reuse the existing Flow-owned correlation, redaction-flag,
+terminal-consistency, and observer checks. Treat stdout as protocol-only,
+stderr as opaque operational evidence, and exit zero as transport evidence
+rather than semantic success.
+
+**Candidate evidence:** Flow #26 adds the pure framing decoder, hermetic
+transcript example, typed framing/output/completion failures, and adversarial
+tests. It does not launch or isolate a process, bind filesystem artifacts,
+verify executable bytes, deliver cancellation, or authenticate a publisher.
 
 ### Pin the capability matrix
 
diff --git a/contracts/README.md b/contracts/README.md
index 03757b1..647634e 100644
--- a/contracts/README.md
+++ b/contracts/README.md
@@ -26,6 +26,12 @@ The extension contracts are described in
 Provider manifests request behavior; only the operator-controlled lock grants
 authority, precedence, or fallback.
 
+Process framing reuses the existing invocation, event, and result documents
+rather than introducing a wrapper contract. The provisional JSON Lines wire
+rules and host-neutral acceptance boundary are specified in
+[`docs/integrations/process-transport.md`](../docs/integrations/process-transport.md).
+Wire whitespace and caller read chunking are not contract identity.
+
 `compatibility.flow_version_requirement` is parsed with Rust's `semver`
 `VersionReq` grammar and must use comma-separated comparators. For example,
 `>=0.1.0, <0.2.0` is a bounded range; `>=0.1.0 <0.2.0` is invalid. Invalid or
@@ -40,16 +46,18 @@ downgrade.
 
 The current Rust checkpoint maps the six extension-v1 documents into closed
 library models and adds semantic checks that JSON Schema alone does not express.
-Its hermetic reference execution is not a provider adapter and does not prove
-process transport, filesystem artifact handling, sandboxing, checkpoints, or
-resume.
+Its hermetic in-process reference and host-neutral process transcript are not
+provider adapters and do not prove process launch/capture enforcement,
+filesystem artifact handling, executable verification, sandboxing,
+checkpoints, or resume.
 
 For this checkpoint, the caller owns configuration canonicalization and digest
 generation plus authorization issuance, authorization ID, and grants digest.
 Flow shape-checks these values and correlates the identities repeated by the
-provider; `ValidatedExecution` does not authenticate them. Execution-limit
-fields are likewise validated and correlated metadata, not timeout,
-cancellation, output-bound, panic, sandbox, or side-effect enforcement.
+provider; `ValidatedExecution` does not authenticate them. The process
+transcript validator checks already captured stdout/stderr lengths and a caller
+completion observation. That is not runtime timeout, cancellation, capture,
+panic, sandbox, or side-effect enforcement.
 
 Validate the set with:
 
diff --git a/docs/architecture/foundation/ARCHITECTURE.md b/docs/architecture/foundation/ARCHITECTURE.md
index 07fe21d..9ea1296 100644
--- a/docs/architecture/foundation/ARCHITECTURE.md
+++ b/docs/architecture/foundation/ARCHITECTURE.md
@@ -3,7 +3,7 @@ schema: aether.architecture-document/v1
 id: flow-architecture
 title: Flow Architecture
 kind: architecture-document
-version: 0.3.1
+version: 0.4.0
 status: draft
 owners:
   - egohygiene
@@ -70,9 +70,17 @@ are constructed as executable plus argv, never as shell strings.
 
 Pinned in-process adapters and bounded process adapters share the same
 invocation, event, result, validation, and provenance semantics. Process
-adapters additionally enforce declared time, output, cancellation, filesystem,
-environment, subprocess, network, AI, GPU, and side-effect limits outside the
-provider process.
+adapters must additionally enforce every time, output, cancellation,
+filesystem, environment, subprocess, network, AI, GPU, and side-effect
+guarantee they claim outside the provider process. A declaration, grant,
+transcript check, or adapter policy is not by itself sandbox enforcement.
+
+The first process boundary is host-neutral: Flow deterministically encodes one
+versioned invocation and validates a caller-supplied JSON Lines stdout
+transcript, bounded stderr length, and completion observation. That seam reuses
+the same Flow-owned event and result validation as in-process execution. It does
+not spawn, signal, time out, cancel, reap, inspect files from, or isolate a child
+process.
 
 ### Extension lifecycle
 
@@ -154,14 +162,16 @@ structure without overriding suite dependency rules.
 
 ## Current implementation boundary
 
-Flow issue #23 supplies a candidate Rust library with closed extension-v1
-models, deterministic single-capability resolution, one caller-injected
-in-process extension port, Flow-owned event/result validation, and a hermetic
-no-effects reference implementation. It does not yet supply the public CLI,
-process adapters, real holon adapters, artifact locators, durable run state,
-checkpoints, cancellation, or resume described elsewhere in this document.
-Structural units beyond that library seam remain constraints for later adapter
-and orchestration work, not claims about current source layout.
+Flow issue #23 / merged PR #24 supplies closed extension-v1 models,
+deterministic single-capability resolution, one caller-injected in-process
+extension port, Flow-owned event/result validation, and a hermetic no-effects
+reference implementation. Issue #26 adds deterministic process request framing
+and host-neutral transcript validation through that same acceptance gate. It
+does not yet supply the public CLI, a production child-process runner, real
+holon adapters, artifact locators, executable verification, enforceable
+isolation, durable run state, checkpoints, interruption, or resume. Structural
+units beyond these library seams remain constraints for later adapter and
+orchestration work, not claims about current source layout.
 
 ## Open questions
 
@@ -171,8 +181,11 @@ and orchestration work, not claims about current source layout.
 
 ## Validation
 
-The issue #23 candidate CI validates the Rust 1.85 and stable library builds,
-closed contract models, deterministic resolution, the hermetic in-process seam,
-and repository architecture metadata. Default-branch evidence remains pending
-merge. Forbidden dependency-edge checks, CLI-thinness, and subprocess adapter
-contract tests remain later gates for the corresponding runtime surfaces.
+Default-branch CI run 35094682274 validates PR #24's Rust 1.85 and stable
+library builds, closed contract models, deterministic resolution, hermetic
+in-process seam, and repository architecture metadata at
+`979e033409c823b38591b59eca820522efabfa12`. Issue #26 adds deterministic
+request/transcript conformance tests and a hermetic process-transport example
+to the same matrix. Forbidden dependency-edge checks, CLI-thinness, real
+launcher enforcement, artifact acceptance, and sandbox conformance remain
+later gates for their corresponding runtime surfaces.
diff --git a/docs/architecture/governance/DECISIONS.md b/docs/architecture/governance/DECISIONS.md
index 1d483fb..8c3d697 100644
--- a/docs/architecture/governance/DECISIONS.md
+++ b/docs/architecture/governance/DECISIONS.md
@@ -3,12 +3,12 @@ schema: aether.architecture-document/v1
 id: flow-decisions
 title: Flow Decisions
 kind: architecture-document
-version: 0.3.0
+version: 0.4.0
 status: draft
 owners:
   - egohygiene
 created: 2026-08-13
-updated: 2026-09-12
+updated: 2026-09-16
 governed_by:
   - architecture-decisions
 depends_on:
@@ -59,6 +59,7 @@ justifies separate ADRs.
 | [ADR-0003](decisions/ADR-0003-docs-first-initialization.md) | Initialize Flow with architecture before implementation | Accepted | 2026-08-13 | None | Architecture is accepted and adapter planning begins |
 | [ADR-0004](decisions/ADR-0004-federated-suite-contracts.md) | Keep holons federated behind versioned contracts | Accepted | 2026-08-21 | ADR-0001 | A required capability cannot be composed through a released interface |
 | [ADR-0005](decisions/ADR-0005-federated-extension-authority.md) | Separate extension declarations from operator authority | Accepted | 2026-09-12 | None | A required execution mode cannot preserve the same trust and evidence boundary |
+| [ADR-0006](decisions/ADR-0006-bounded-process-transport.md) | Bound process transport with a deterministic JSON Lines transcript | Accepted | 2026-09-16 | None | A released provider or real runner cannot preserve the profile's framing or termination semantics |
 
 ## Active decisions
 
@@ -77,7 +78,8 @@ None beyond the superseded issue constraint.
 
 ## Evidence gaps and open questions
 
-Flow crate layout and capability-specific library-versus-process adapter
-selection remain implementation decisions. Provider compatibility ranges and
-shared extension envelope granularity are governed by ADR-0005 and may evolve
-through additive contract-set revisions.
+Capability-specific library-versus-process adapter selection remains an
+implementation decision. Provider compatibility ranges and shared extension
+envelope granularity are governed by ADR-0005 and may evolve through additive
+contract-set revisions. Artifact binding, executable integrity, and enforced
+process isolation remain open after ADR-0006's host-neutral transcript profile.
diff --git a/docs/architecture/governance/decisions/ADR-0006-bounded-process-transport.md b/docs/architecture/governance/decisions/ADR-0006-bounded-process-transport.md
new file mode 100644
index 0000000..2674af7
--- /dev/null
+++ b/docs/architecture/governance/decisions/ADR-0006-bounded-process-transport.md
@@ -0,0 +1,226 @@
+---
+schema: aether.architecture-decision/v1
+id: adr-0006
+title: Bound process transport with a deterministic JSON Lines transcript
+kind: architecture-decision
+status: accepted
+accepted: 2026-09-16
+owners:
+  - egohygiene
+scope:
+  - flow
+  - aniflow
+  - optiflow
+  - renderflow
+governed_by:
+  - architecture-decisions
+supersedes: []
+superseded_by: []
+related:
+  - flow-architecture
+  - flow-roadmap
+  - adr-0004
+  - adr-0005
+---
+
+# ADR-0006 — Bound process transport with a deterministic JSON Lines transcript
+
+## Context
+
+ADR-0004 keeps Aniflow, Optiflow, and Renderflow independently released behind
+versioned library or process contracts. ADR-0005 separates provider declarations
+from operator authority and requires process evidence to remain subject to the
+same Flow-owned semantic validation as in-process evidence.
+
+Flow issue #23 proved only a caller-injected in-process port. Before Flow can add
+real provider adapters, it needs one provider-neutral process wire boundary that
+does not parse human console output or let a process exit impersonate validated
+completion.
+
+A complete process runtime also requires executable discovery, direct argv
+launch, independent pipe capture, executable integrity verification, artifact
+binding, timeout and cancellation enforcement, and possibly operating-system
+isolation. Combining those concerns before the wire contract is stable would
+make platform behavior part of the protocol decision and turn the next
+checkpoint into an unreviewable runtime implementation.
+
+Flow issue #26 therefore accepts a smaller dependency-unlocking boundary:
+deterministic standard-input encoding and host-neutral validation of supplied
+standard-output, standard-error, and termination evidence.
+
+## Decision
+
+Flow process providers use a JSON Lines stdio profile built from the existing
+closed v1 extension contracts:
+
+1. Standard input contains exactly one compact UTF-8
+   `flow.extension-invocation/v1` object, one terminating line feed, and EOF.
+2. Standard output contains zero or more complete
+   `flow.extension-event/v1` records followed by exactly one
+   `flow.extension-result/v1` record and EOF.
+3. Each standard-output record is terminated by LF or CRLF. The result must be
+   terminated and final; blank lines, partial lines, unknown schemas, human
+   presentation, duplicate results, and trailing records are invalid.
+4. Standard output is protocol-only. Standard error is a separate opaque byte
+   stream and is never parsed as protocol or merged with standard output.
+5. Raw standard-output and standard-error bytes are checked against the
+   invocation's declared limits before accepted execution can be constructed.
+6. Only a supplied normal exit observation with code `0` is eligible for
+   acceptance. A nonzero exit, an exit without a portable code, timeout, or
+   host cancellation rejects the transcript regardless of provider-authored
+   success evidence.
+7. Exit `0` remains necessary but insufficient. Flow applies its existing event
+   and result schema, identity, ordering, diagnostic, validation, artifact-ID,
+   and terminal-consistency checks before constructing `ValidatedExecution`.
+8. Events retain the existing fallible `EventSink` behavior. The sink is an
+   authoritative acceptance observer, not a best-effort telemetry exporter;
+   its rejection prevents `ValidatedExecution`.
+9. No failure after invocation begins authorizes implicit retry or fallback.
+
+The initial implementation accepts already-captured bytes and an explicit,
+host-neutral termination observation. It neither starts nor controls a process.
+The observation is correlated evidence supplied by a caller, not proof of an
+actual operating-system event or executable identity.
+
+## Rationale
+
+JSON Lines preserves ordered event streaming while reusing the versioned JSON
+contracts already validated by Flow. One record per line makes truncation,
+trailing data, result multiplicity, and human-output contamination explicit.
+Keeping standard error opaque prevents provider-native diagnostics from being
+mistaken for authoritative events or results.
+
+Separating host-neutral transcript validation from a launcher keeps the first
+process checkpoint deterministic and redistribution-safe. The same fixtures can
+run on every host without requiring signal semantics, executable permissions,
+filesystem topology, timers, or a provider installation. Later runners can map
+platform-specific behavior into this stable evidence boundary.
+
+Requiring both a valid transcript and exit `0` preserves layered validation. A
+provider-reported failure can complete the wire protocol normally, while a
+provider-reported success cannot hide an abnormal process termination.
+
+## Evidence and assumptions
+
+- The repository already has closed Rust models and semantic validation for
+  `flow.extension-invocation/v1`, `flow.extension-event/v1`, and
+  `flow.extension-result/v1`.
+- The current execution seam constructs `ValidatedExecution` only after
+  Flow-owned preflight, event, observer, and terminal-result checks.
+- `EventSink::emit` is intentionally fallible and its rejection already fails
+  execution. This decision preserves that authoritative behavior and does not
+  recast it as telemetry.
+- Synthetic host-neutral transcripts can prove framing and correlation without
+  claiming that a real provider process, timeout, cancellation, or output
+  capture has been observed.
+- Future provider adapters are assumed to be able to emit the versioned
+  invocation/event/result semantics directly or through a Flow-owned adapter.
+  That assumption remains unproven for real holon releases until adapter work
+  reinspects them.
+
+## Alternatives considered
+
+- **One terminal JSON document:** rejected because it removes ordered event
+  streaming and requires buffering all provider evidence before any observation.
+- **Length-prefixed or binary frames:** deferred because they add codec and
+  interoperability complexity without evidence that JSON Lines is insufficient
+  for the first local provider adapters.
+- **Parse human console output:** rejected because presentation text is not a
+  stable, versioned machine contract and can interleave unpredictably.
+- **Allow mixed logs and protocol records on stdout:** rejected because a
+  heuristic separator would make framing ambiguous and diagnostics capable of
+  corrupting authoritative evidence.
+- **Treat a result or exit `0` alone as success:** rejected because either can
+  disagree with events, validation evidence, identity, or the other termination
+  signal.
+- **Implement the launcher, artifact binding, integrity, and sandbox in the
+  same checkpoint:** rejected for issue #26 because those are independent trust
+  and platform boundaries that need their own evidence.
+
+## Trade-offs
+
+The strict final line ending and protocol-only stdout require providers or
+adapters to route all human presentation to stderr or another explicit surface.
+This is less permissive than many CLI conventions but makes truncation and EOF
+semantics deterministic.
+
+JSON Lines is human-inspectable and broadly interoperable, but it does not
+provide binary framing or make the JSON bytes canonical. Compact request bytes
+are reproducible for the same typed value but are not used as an authenticity or
+artifact-identity proof.
+
+The host-neutral seam can reject captured evidence that exceeds declared bounds
+but cannot prevent a real child from producing unbounded output. It can classify
+a timeout or cancellation observation but cannot cause either event. Those
+enforcement guarantees remain unavailable until a runner implements and tests
+them.
+
+## Expected consequences
+
+- Every future process adapter has one exact structured stdout grammar and does
+  not invent provider-specific console parsing.
+- The process and in-process seams reuse the same authoritative event/result
+  validation and `ValidatedExecution` boundary.
+- Synthetic fixtures can cover success, malformed framing, ordering,
+  correlation, output bounds, observer rejection, and termination contradictions
+  without a child process.
+- A future launcher must capture stdout and stderr independently and translate
+  host termination into this profile without weakening it.
+- Real provider, artifact, package-integrity, sandbox, cancellation, and resume
+  work remains visible rather than being implied by transcript validation.
+
+## Observed outcomes
+
+The issue #26 checkpoint adds a host-neutral encoder and transcript-validation
+candidate plus hermetic conformance coverage. It does not supply a supported
+process launcher or real holon adapter. Default-branch CI after merge remains the
+acceptance evidence for the implementation.
+
+## Security, privacy, and authority
+
+All provider output is untrusted. Standard-output records must pass closed
+contract and correlation checks. Opaque stderr and rejected raw records may
+contain secrets or private paths; they are bounded sensitive evidence and must
+not be exported or rendered as portable diagnostics without explicit
+caller-controlled inspection and redaction.
+
+This decision grants no filesystem, environment, subprocess, network, AI, GPU,
+source-mutation, destructive, signing, or publication authority. It does not
+verify package bytes, publisher identity, signatures, or executable provenance.
+It does not provide an operating-system sandbox. In particular, validating a
+transcript cannot make a `sandboxed` provider executable when no enforcing
+backend exists.
+
+The fallible `EventSink` remains part of authoritative acceptance. No logging,
+metrics, tracing, OpenTelemetry, or hosted exporter is introduced, and
+telemetry-only state does not enter invocation, result, or artifact identity.
+
+## Review triggers
+
+Review this decision if:
+
+- a released provider cannot emit or be adapted to this JSON Lines profile;
+- required payload volume or binary data makes line-oriented JSON unsuitable;
+- streaming launch evidence requires a framing guarantee not expressible here;
+- a new contract major changes invocation, event, or result discrimination;
+- a real runner exposes incompatible cross-platform EOF or termination
+  behavior; or
+- an accepted telemetry contract changes the role of authoritative versus
+  non-authoritative observers.
+
+## Related artifacts
+
+ADR-0004, ADR-0005, `flow-architecture`, `flow-roadmap`,
+`docs/integrations/extension-contract.md`,
+`docs/integrations/process-transport.md`, Flow issue #26, Flow issue #3, and
+Flow issue #11.
+
+## Validation
+
+Conformance tests must prove the single-request encoding, LF and CRLF record
+handling, event-then-result order, required terminal line ending and EOF,
+protocol-only stdout, opaque stderr bounds, shared semantic validation,
+fallible observer behavior, exit `0` requirement, and rejection of timeout,
+cancellation, nonzero exit, malformed, duplicate, partial, contradictory, and
+trailing evidence. Every invalid fixture must return an error and never a
+`ValidatedExecution`.
diff --git a/docs/integrations/README.md b/docs/integrations/README.md
index 7fb655f..f193736 100644
--- a/docs/integrations/README.md
+++ b/docs/integrations/README.md
@@ -11,36 +11,48 @@ implementations.
   orchestration outcome.
 - [Federated extension contract](extension-contract.md) defines extension
   identity, trust, discovery, execution envelopes, hooks, and resolution.
+- [Process transport](process-transport.md) defines deterministic JSON Lines
+  request framing and host-neutral transcript acceptance without claiming a
+  production process runner.
 - [Versioned contracts](../../contracts/README.md) define the provisional suite
   interchange vocabulary.
 
 These documents are governed by
-[ADR-0004](../architecture/governance/decisions/ADR-0004-federated-suite-contracts.md).
+[ADR-0004](../architecture/governance/decisions/ADR-0004-federated-suite-contracts.md),
+[ADR-0005](../architecture/governance/decisions/ADR-0005-federated-extension-authority.md),
+and
+[ADR-0006](../architecture/governance/decisions/ADR-0006-bounded-process-transport.md).
 
 ## Implementation status
 
-The FLO-Q02 candidate implements only the in-process library seam described by
-the extension contract. It validates closed extension-v1 models, resolves one
-capability from explicit caller input, invokes a caller-supplied
-`ExtensionPort`, and validates correlated events and the terminal result. The
-included reference port is hermetic and produces no effects or artifacts.
-
-Only lock entries with `trusted` trust are resolution-eligible, and
-`Orchestrator` executes only a caller-injected in-process port. `sandboxed`
+Merged PR #24 implements the in-process library seam described by the extension
+contract. It validates closed extension-v1 models, resolves one capability from
+explicit caller input, invokes a caller-supplied `ExtensionPort`, and validates
+correlated events and the terminal result. Issue #26 adds deterministic process
+request encoding and validation of caller-supplied completion, stdout, and
+stderr evidence through the same Flow-owned acceptance gate. Both reference
+paths are hermetic and produce no effects or artifacts.
+
+Only lock entries with `trusted` trust are resolution-eligible.
+`Orchestrator` either invokes a caller-injected in-process port or validates a
+caller-supplied process transcript; it does not launch a process. `sandboxed`
 entries fail closed because this checkpoint has no enforceable sandbox backend.
 A `ValidatedExecution` proves closed-contract and correlation checks, not the
 authenticity of a caller-issued configuration digest, authorization ID, or
 grants digest. The caller owns configuration canonicalization and authorization
 issuance.
 
-Declared limits are validated and identity-correlated metadata only: the
-injected in-process code has no Flow-owned timeout, cancellation, output-bound,
-panic-isolation, filesystem/network, or other side-effect enforcement.
+Declared limits remain identity-correlated metadata for injected in-process
+code. The process-transcript seam checks captured stdout/stderr lengths and a
+completion observation, but no Flow runner yet enforces those limits while a
+process executes. Neither path provides timeout delivery, cancellation, panic
+isolation, filesystem/network containment, or other side-effect enforcement.
 
 The following remain deferred: provider discovery from the filesystem, dynamic
-loading, process transport and sandboxing, real Aniflow/Optiflow/Renderflow
-adapters, artifact locator and domain-output validation, a public CLI, durable
-plans and run state, cancellation, checkpoints, and resume. `EventSink` is an
-observation attachment point for future logging and OpenTelemetry adapters; it
-is not a shipped telemetry backend and cannot affect resolution or execution
-identity. Its fallible `emit` can reject the checkpoint execution.
+loading, a production child-process runner, sandboxing, real
+Aniflow/Optiflow/Renderflow adapters, artifact locator and domain-output
+validation, a public CLI, durable plans and run state, interruption,
+checkpoints, and resume. `EventSink` is a fallible execution observer, not a
+logging or OpenTelemetry adapter. It cannot affect resolution or execution
+identity, but its rejection intentionally rejects the execution without
+fallback.
diff --git a/docs/integrations/extension-contract.md b/docs/integrations/extension-contract.md
index 16a23e5..2425290 100644
--- a/docs/integrations/extension-contract.md
+++ b/docs/integrations/extension-contract.md
@@ -6,9 +6,11 @@ This contract defines how Flow discovers, resolves, authorizes, invokes, and
 records independently released extensions. It is the reusable substrate for
 Flow issue #7. Flow issue #23 implements a bounded subset as a Rust library:
 deterministic resolution plus one injected, trusted in-process execution seam
-proven with a hermetic reference port. Product orchestration, real provider
-adapters, a two-holon vertical slice, and runtime CLI commands remain work for
-Flow issue #3 and its later children.
+proven with a hermetic reference port. Flow issue #26 adds deterministic
+process request encoding and host-neutral validation of caller-supplied
+completion, stdout, and stderr evidence; it does not launch a process. Product
+orchestration, real provider adapters, a two-holon vertical slice, and runtime
+CLI commands remain work for Flow issue #3 and its later children.
 
 An extension is an independently versioned provider package. It can expose one
 or more Aniflow, Optiflow, Renderflow, Flow, or third-party domain capabilities
@@ -85,46 +87,52 @@ Any content-changing operation produces a new artifact identity and lineage.
 
 - **In-process:** a version-pinned public library entry point. Flow still binds
   it to the invocation, event, result, authorization, and provenance contracts.
-- **Process (future target):** a version-pinned executable invoked directly
-  with argv. A future process adapter must independently capture stdout/stderr,
-  enforce timeout, output bounds, cancellation grace, permissions, and declared
-  outputs, and never parse human console text as a contract.
+- **Process:** a version-pinned executable invoked directly with argv. The v1
+  host-neutral transport encodes one invocation and validates a caller-supplied
+  JSON Lines event/result transcript, captured-output lengths, and completion
+  observation. A production process adapter must still independently launch
+  the pinned executable, capture stdout/stderr concurrently, enforce timeout,
+  output bounds, cancellation grace, permissions, and declared outputs, and
+  never parse human console text as a contract.
 
 Both modes must produce the same structured semantic result. Flow may choose
 process isolation when toolchains, licensing, trust, or failure containment make
 an in-process edge unsuitable.
 
-The current executable checkpoint resolves only `trusted` candidates and proves
-only a caller-injected in-process library port. It performs no filesystem
-discovery, dynamic loading, external process invocation, executable integrity
-verification, or sandbox enforcement. `sandboxed` candidates fail closed.
-Declared limits are validated and correlated with the resolved mode as policy
-metadata only; Flow does not enforce a timeout, cancellation, stdout/stderr
-bound, panic isolation, filesystem/network containment, or any other side
-effect on the injected code. The process behavior above remains a future
-contract target, not a claim about the implemented runtime.
+The current executable checkpoint resolves only `trusted` candidates. It proves
+a caller-injected in-process library port plus host-neutral process request and
+transcript validation. It performs no filesystem discovery, dynamic loading,
+external process launch/capture, executable integrity verification, or sandbox
+enforcement. `sandboxed` candidates fail closed. In-process limits remain
+policy metadata only. The process seam checks already captured stdout/stderr
+byte counts and completion evidence, but it does not enforce timeout,
+cancellation, output capture, panic isolation, filesystem/network containment,
+or any other side effect while a provider runs.
 
 ## Observation and telemetry
 
 The orchestrator wraps the caller's `EventSink` with Flow-owned validation.
 Only provider events whose schema, identities, unique event ID, and strictly
 increasing sequence pass validation reach the caller sink. The sink is the
-intended attachment point for future human logging, structured logging,
-tracing, metrics, or OpenTelemetry adapters.
+fallible authoritative observer for this execution seam, not a best-effort
+logging, tracing, metrics, or OpenTelemetry exporter.
 
 Diagnostics marked `redacted: false` in events or terminal results are
 rejected. A `redacted: true` value remains a provider assertion: this
 checkpoint does not content-scan diagnostics or sanitize unrestricted contract
 strings such as result explanations, validation evidence, provenance values,
-or artifact, checkpoint, and event references. Rejected raw evidence remains
-available through `ExecutionError`, but it is never forwarded to the caller
-sink or returned in `ValidatedExecution`.
+or artifact, checkpoint, and event references. When `ExecutionError` retains
+structured event or result evidence, it remains caller-inspectable but is never
+promoted to `ValidatedExecution`. Raw process stdout and stderr remain
+caller-owned transcript evidence and are not copied into the error.
 
 Observations are deliberately outside resolution and execution identity. A
 sink cannot select an extension, directly mutate provider evidence, or grant
-authority. `EventSink::emit` is fallible and its error is visible to the
-provider; rejection makes `Orchestrator` return `ExecutionError`. This
-checkpoint includes neither a logging backend nor an OpenTelemetry exporter.
+authority. `EventSink::emit` is fallible and its error is visible to an
+in-process provider; rejection makes either execution seam return
+`ExecutionError` without fallback. A separate best-effort observability seam
+belongs to issue #15. This checkpoint includes neither a logging backend nor an
+OpenTelemetry exporter.
 
 ## Permissions and trust
 
@@ -134,18 +142,19 @@ signing, and publication. The lock grants a subset and selects `trusted`,
 `sandboxed`, or `disabled` operation. No grant is implied by capability
 selection.
 
-Issue #23 makes only `trusted` candidates resolution-eligible, while
-`Orchestrator` accepts only a caller-injected in-process port. It marks
-`sandboxed` candidates unauthorized and unavailable because it has no
-enforceable sandbox backend; `disabled` candidates also fail closed.
+The executable seams make only `trusted` candidates resolution-eligible.
+`Orchestrator` either invokes a caller-injected in-process port or validates a
+caller-supplied process transcript; it does not launch a process. `sandboxed`
+candidates remain unauthorized and unavailable because there is no enforceable
+sandbox backend; `disabled` candidates also fail closed.
 
 Secrets are referenced through runtime handles. Providers and callers are
 responsible for keeping credentials, tokens, private prompt content, and other
 sensitive values out of portable evidence. `discovery.location` is arbitrary
 and may be absolute, so manifests, locks, and resolution inputs must be handled
-according to their actual sensitivity. Issue #23 checks the diagnostic
-`redacted` flag only; it does not verify the provider's `true` assertion,
-inspect diagnostic content, or sanitize other contract strings. Raw
+according to their actual sensitivity. The executable seams check the
+diagnostic `redacted` flag only; they do not verify the provider's `true`
+assertion, inspect diagnostic content, or sanitize other contract strings. Raw
 `ExecutionError` events and results are sensitive, nonportable evidence and
 must not be exported without caller-controlled inspection and redaction.
 
@@ -221,16 +230,20 @@ outcomes. They contain no Ego Hygiene publication content.
 
 ## Current proof and deferred runtime
 
-Issue #23 adds a library-only proof: closed extension-v1 models, semantic
-validation, deterministic single-capability resolution, one injected
-`ExtensionPort`, correlated event/result validation, and a no-effects,
-no-artifacts hermetic reference port. The proof does not promote an extension's
-terminal success report to a validated execution until Flow-owned checks pass.
+Issue #23 / merged PR #24 adds closed extension-v1 models, semantic validation,
+deterministic single-capability resolution, one injected `ExtensionPort`,
+correlated event/result validation, and a no-effects, no-artifacts hermetic
+reference port. Issue #26 reuses that validation for deterministic request
+framing and caller-supplied process transcripts. Neither proof promotes an
+extension's terminal success report to a validated execution until Flow-owned
+checks pass.
 
 Those checks prove contract validity and correlation only. They do not prove
 the authenticity of the caller-issued configuration digest, authorization ID,
-or grants digest, nor do they enforce the declared execution limits or contain
-side effects from the trusted injected code.
+or grants digest. The in-process seam does not enforce declared execution
+limits; the process seam checks only supplied captured byte counts and
+completion evidence. Neither seam contains side effects while provider code
+executes.
 
 For terminal evidence, `produced` and `reused` require every reported
 validation to be `passed`; `skipped` permits `passed` or `not-run` but rejects
@@ -244,8 +257,9 @@ references on `artifact-produced` events must appear in terminal
 not bind identifiers to locators, recompute or verify artifact digests or
 bytes, establish artifact existence, or perform domain-output validation.
 
-`extensions list`, `extensions inspect`, `doctor`, process transport, sandbox
-enforcement, real provider adapters, interruption/cancellation, durable run
-state, checkpoints/resume, and the cross-holon vertical slice remain deferred
-work for Flow #3 after the required holon contracts are available as releases
-or versioned process envelopes.
+`extensions list`, `extensions inspect`, `doctor`, real process launching and
+capture, artifact binding, executable verification, sandbox enforcement, real
+provider adapters, interruption delivery, durable run state,
+checkpoints/resume, and the cross-holon vertical slice remain deferred work for
+Flow #3 after the required holon contracts are available as releases or
+versioned process envelopes.
diff --git a/docs/integrations/process-transport.md b/docs/integrations/process-transport.md
new file mode 100644
index 0000000..73a5ef9
--- /dev/null
+++ b/docs/integrations/process-transport.md
@@ -0,0 +1,260 @@
+# Bounded process transcript profile
+
+## Purpose and scope
+
+This document defines the provider-neutral standard-input, standard-output,
+standard-error, and termination transcript that a future Flow process adapter
+must use. It composes the existing `flow.extension-invocation/v1`,
+`flow.extension-event/v1`, and `flow.extension-result/v1` contracts without
+changing their semantic ownership.
+
+The implemented checkpoint is deliberately host-neutral. It can encode one
+invocation request and validate already-captured transcript bytes plus an
+explicit termination observation. It does not locate, start, supervise, signal,
+or reap an operating-system process. A transcript proves only that supplied
+evidence is internally valid under this profile; it does not prove how the
+evidence was captured or which executable produced it.
+
+This profile is governed by
+[ADR-0006](../architecture/governance/decisions/ADR-0006-bounded-process-transport.md)
+and refines the process mode described by the
+[federated extension contract](extension-contract.md).
+
+## Boundary ownership
+
+| Channel or observation | Owner | Meaning |
+| --- | --- | --- |
+| Standard input | Flow | Exactly one validated invocation request |
+| Standard output | Provider contribution, Flow validation | Protocol records only: zero or more events followed by exactly one result |
+| Standard error | Provider contribution, caller-controlled handling | Opaque, bounded diagnostic bytes; never protocol |
+| Termination | Future process runner contribution, Flow validation | Host-neutral exit, timeout, or cancellation observation |
+| Event observation | Flow and caller | A fallible, authoritative acceptance boundary through `EventSink` |
+
+The provider cannot promote its result to accepted completion. Flow returns a
+`ValidatedExecution` only after framing, contract, correlation, ordering,
+observer, terminal-consistency, and termination checks all pass.
+
+## Standard-input request
+
+The encoded request frame has this grammar:
+
+```text
+stdin = compact-invocation-json LF EOF
+```
+
+The request requirements are:
+
+- the value is one valid `flow.extension-invocation/v1` object;
+- the invocation passes Flow's semantic validation before encoding;
+- the JSON is UTF-8 and compact rather than pretty-printed;
+- exactly one line-feed byte terminates the object;
+- no byte-order mark, blank prefix, second request, or trailing data is
+  permitted; and
+- a future runner must write only that frame and close standard input after the
+  terminating line feed.
+
+Compact encoding makes requests reproducible for the same typed value, but it
+is not an RFC 8785 canonicalization claim. Request bytes are not an extension,
+configuration, authorization, artifact, or result identity.
+
+## Standard-output records
+
+The provider writes JSON Lines using this grammar:
+
+```text
+stdout     = *event-record result-record EOF
+event-record = extension-event-json record-end
+result-record = extension-result-json record-end
+record-end = LF / CRLF
+```
+
+Each record is one complete UTF-8 JSON object on one physical line. Flow uses
+the closed `schema_version` field to distinguish
+`flow.extension-event/v1` from `flow.extension-result/v1`; there is no
+unversioned wrapper or console-text heuristic.
+
+The record rules are:
+
+- zero or more event records may precede the result record;
+- exactly one result record is required;
+- the result must be the final record;
+- both line-feed and carriage-return-plus-line-feed endings are accepted;
+- every record, including the result, requires a line ending;
+- EOF must follow the result's line ending immediately;
+- blank lines, byte-order marks, invalid UTF-8, malformed JSON, unknown schema
+  versions, duplicate results, records after the result, and unterminated final
+  records are rejected; and
+- human logs, progress bars, banners, prompts, and any other non-protocol text
+  are forbidden on standard output.
+
+The framing grammar permits an empty event prefix, but accepted execution still
+uses the shared event/result validator. That validator requires the existing
+identity, ordering, diagnostic, artifact-reference, and terminal-event/result
+invariants. A result without the matching terminal event therefore cannot
+produce `ValidatedExecution`.
+
+The raw standard-output byte count includes JSON, carriage returns, line feeds,
+and any invalid or trailing bytes. It must not exceed the invocation's
+`limits.max_stdout_bytes`. The host-neutral validator rejects an oversized
+captured transcript; preventing an operating-system child from producing or
+buffering excess output is deferred to a future runner.
+
+## Standard error
+
+Standard error is an independent opaque byte stream. Flow does not require it
+to be UTF-8, parse it as JSON, merge it with standard output, convert it into an
+extension diagnostic, or use it to decide provider success.
+
+The raw byte count must not exceed `limits.max_stderr_bytes`. An oversized
+captured stream rejects the transcript. Raw standard error may contain secrets,
+private paths, or provider-native text, so it is sensitive operational evidence
+and is not portable result, provenance, event, or telemetry data. Callers must
+apply an explicit inspection and redaction policy before exporting it.
+
+This checkpoint validates the supplied byte bound. Independent concurrent
+capture, backpressure, truncation, and forced child termination remain future
+runner responsibilities.
+
+## Termination observations
+
+Termination is represented without assuming Unix signals, Windows status
+objects, or a particular async runtime. Only a normal exit with code `0` is
+eligible for accepted execution.
+
+| Observation | Validation meaning |
+| --- | --- |
+| Normal exit `0` | Necessary but not sufficient; the complete transcript must also validate |
+| Normal nonzero exit | Transport failure, even if stdout claims success |
+| Exit without a portable code | Transport failure, including signal termination reported without a code |
+| Timeout | Transport failure; no validated execution |
+| Host cancellation | Transport failure; no validated execution |
+
+A coherent provider result whose semantic outcome is `failed`, `blocked`,
+`unavailable`, or `cancelled` may still be valid evidence when the provider
+completed the protocol and exited `0`. The result outcome describes the domain
+operation; the process exit describes whether the transport completed normally.
+
+Conversely, exit `0` never converts missing, malformed, contradictory, or
+observer-rejected evidence into completion. A timeout, host cancellation, or
+nonzero exit cannot be repaired by a provider-authored result.
+
+The current library validates a caller-supplied termination observation. It
+does not measure a timeout, issue cancellation, deliver a signal, wait through
+`cancellation_grace_ms`, or prove that a process was reaped.
+
+## Validation and acceptance order
+
+The boundary applies these gates before constructing accepted execution:
+
+1. Validate the invocation and require that it matches the resolved process
+   interface. Request encoding is a separate operation with the same
+   invocation and process-preflight gates for use by a future runner.
+2. Enforce the captured standard-output and standard-error byte limits.
+3. Require the supplied termination observation to be normal exit `0`.
+4. Decode the JSON Lines framing and require the event-then-result grammar.
+5. Apply the shared Flow-owned event validation, correlation, uniqueness,
+   strictly increasing sequence, and diagnostic checks. Forward each
+   individually valid event to the caller's `EventSink` in transcript order.
+6. Validate the result contract, correlation, diagnostics, artifact references,
+   outcome, and consistency with the terminal event.
+7. Construct `ValidatedExecution` only after every preceding gate succeeds.
+
+This ordering gives byte-limit and termination failures precedence over parsing
+or observing provider-authored records. In particular, events from an
+abnormally terminated process never reach the authoritative sink. A valid
+event can reach the sink before a later event or terminal result rejects the
+execution; observation is authoritative but not transactional rollback.
+
+Invalid provider bytes remain untrusted evidence. The process boundary must not
+deserialize bytes directly into `ValidatedExecution` or offer a public
+unchecked constructor from raw events and a result.
+
+## Event observation is authoritative
+
+`EventSink` remains fallible and authoritative. It receives an immutable event
+only after that event passes its individual contract and invocation-correlation
+checks. If the sink rejects an event, Flow rejects the execution and returns no
+`ValidatedExecution`.
+
+This behavior is intentionally not a best-effort telemetry contract. The sink
+may implement a caller-required audit, policy, or durable observation boundary,
+so its failure is allowed to affect acceptance. It cannot select a provider,
+rewrite an event, alter extension integrity, grant authority, or change result
+identity. A separate non-authoritative logging, metrics, tracing, or
+OpenTelemetry contract remains work for Flow's observability roadmap; this
+checkpoint ships no telemetry backend or exporter.
+
+## Failure classes
+
+The transcript boundary distinguishes at least these failure concerns:
+
+| Concern | Representative evidence |
+| --- | --- |
+| Invalid invocation | Wrong schema, malformed identity, or non-process interface |
+| Output limit | Raw stdout or stderr exceeds its declared byte limit |
+| Encoding or framing | Invalid UTF-8, malformed JSON line, blank line, unknown record, or missing terminator |
+| Protocol order | Missing result, duplicate result, or record after result |
+| Invalid event | Invalid schema, identity, event ID, sequence, phase, diagnostic, or post-terminal event |
+| Observer rejection | The authoritative `EventSink` rejects a valid event |
+| Invalid result | Invalid schema, identity, outcome, validation, artifact reference, or terminal consistency |
+| Abnormal termination | Nonzero exit, timeout, or host cancellation |
+
+The caller retains its borrowed raw transcript for explicit inspection; Flow's
+process errors do not copy stdout or stderr or reproduce opaque provider bytes
+in display text. Structured event or result evidence may be retained by later
+semantic errors. No failure after invocation begins authorizes implicit retry
+or fallback.
+
+## Determinism and conformance
+
+Conformance fixtures are synthetic, redistribution-safe, and independent of
+filesystem enumeration, locale, wall-clock time, network access, and a real
+provider executable. The required proof covers:
+
+- a compact invocation request with exactly one terminating line feed;
+- successful LF and CRLF event/result transcripts;
+- stable validation regardless of host read-chunk boundaries;
+- zero-event framing followed by semantic rejection for the missing terminal
+  event;
+- invalid UTF-8, malformed JSON, blank lines, unknown schemas, partial final
+  records, missing and duplicate results, and trailing records;
+- duplicate event identifiers, non-increasing sequences, mismatched identities,
+  unredacted diagnostics, contradictory outcomes, and failed success-like
+  validation evidence;
+- stdout and stderr at and above their declared byte boundaries;
+- exit `0`, nonzero exit, timeout, and host-cancellation observations;
+- authoritative sink rejection; and
+- proof that every invalid case returns an error rather than
+  `ValidatedExecution`.
+
+The validation result depends only on the resolved extension, invocation,
+transcript bytes, termination observation, and authoritative sink outcome. It
+does not inspect the host filesystem, environment, process table, clock, or
+network.
+
+## Implemented guarantees and deferred work
+
+Issue #26 implements only the host-neutral request encoder and transcript
+validation seam described above. It reuses the existing closed invocation,
+event, and result models plus Flow-owned semantic validation.
+
+It does not implement or prove:
+
+- executable discovery, direct argv construction, or process launch;
+- standard-input writing or concurrent stdout/stderr capture against a child;
+- runtime output backpressure, timeout measurement, cancellation delivery,
+  grace periods, kill, or reap behavior;
+- executable, package, publisher, signature, or transparency-log verification;
+- artifact locators, root confinement, path-escape prevention, immutable input
+  verification, declared-output discovery, or content digest recomputation;
+- filesystem, environment, subprocess, network, AI, GPU, signing, publication,
+  or other side-effect isolation;
+- an operating-system sandbox or an enforceable `sandboxed` trust profile;
+- real Aniflow, Optiflow, or Renderflow process adapters;
+- durable plans, run state, checkpoints, retry, or resume;
+- a public Flow CLI; or
+- logging, metrics, tracing, OpenTelemetry, or a hosted observability backend.
+
+Later work may place a platform-specific runner in front of this validator. The
+runner must supply evidence without weakening the transcript grammar or
+promoting launch, exit, or file existence alone to accepted completion.
diff --git a/examples/hermetic_process_transport.rs b/examples/hermetic_process_transport.rs
new file mode 100644
index 0000000..c029c14
--- /dev/null
+++ b/examples/hermetic_process_transport.rs
@@ -0,0 +1,110 @@
+use std::collections::BTreeMap;
+
+use flow::{
+    Authorization, Configuration, Domain, EXTENSION_INVOCATION_V1, ExecutionModeKind,
+    ExtensionCatalog, ExtensionInvocation, ExtensionLock, ExtensionManifest, ExtensionObservation,
+    ExtensionPort, HermeticExtension, InvocationExtension, InvocationInterface, InvocationPhase,
+    Orchestrator, PortIdentity, ProcessCompletion, ProcessTranscript, ResolutionRequest, Trust,
+};
+
+const CONFIG_DIGEST: &str = "2222222222222222222222222222222222222222222222222222222222222222";
+const GRANTS_DIGEST: &str = "3333333333333333333333333333333333333333333333333333333333333333";
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let manifest: ExtensionManifest = serde_json::from_str(include_str!(
+        "../contracts/examples/extension-manifest.v1.example.json"
+    ))?;
+    let mut lock: ExtensionLock = serde_json::from_str(include_str!(
+        "../contracts/examples/extension-lock.v1.example.json"
+    ))?;
+    lock.extensions[0].trust = Trust::Trusted;
+
+    let observation = ExtensionObservation::new(
+        manifest.extension_id.clone(),
+        manifest.version.clone(),
+        manifest.publisher.id.clone(),
+        manifest.integrity.clone(),
+        true,
+    );
+    let catalog = ExtensionCatalog::inspect([manifest], lock, [observation])?;
+    let resolution = catalog.resolve(&ResolutionRequest::new(
+        "hermetic-process-example",
+        "optiflow/inspect-collection",
+        Domain::Optiflow,
+        "synthetic-process",
+        ExecutionModeKind::Process,
+    ));
+    let resolved = resolution
+        .resolved()
+        .ok_or("the hermetic process interface did not resolve")?;
+    let invocation = ExtensionInvocation {
+        schema_version: EXTENSION_INVOCATION_V1.to_owned(),
+        invocation_id: "invocation:hermetic-process-example".to_owned(),
+        run_id: "run:hermetic-process-example".to_owned(),
+        phase: InvocationPhase::Execute,
+        extension: InvocationExtension {
+            extension_id: resolved.extension_id().to_owned(),
+            version: resolved.version().to_owned(),
+            publisher_id: resolved.publisher_id().to_owned(),
+            integrity: resolved.integrity().value.clone(),
+        },
+        capability_id: resolved.capability().capability_id.clone(),
+        interface: InvocationInterface {
+            kind: resolved.execution_mode().kind,
+            name: resolved.execution_mode().name.clone(),
+            protocol: resolved.execution_mode().protocol.clone(),
+        },
+        input_artifacts: Vec::new(),
+        expected_output_types: resolved.capability().produces.clone(),
+        configuration: Configuration {
+            schema_id: resolved.capability().configuration_schema.clone(),
+            digest: CONFIG_DIGEST.to_owned(),
+            values: BTreeMap::new(),
+        },
+        authorization: Authorization {
+            authorization_id: "authorization:hermetic-process-example".to_owned(),
+            lock_id: resolved.lock_id().to_owned(),
+            grants_digest: GRANTS_DIGEST.to_owned(),
+        },
+        limits: resolved.execution_mode().limits.clone(),
+        checkpoint_refs: Vec::new(),
+        secret_handles: Vec::new(),
+        cancellation_id: "cancel:hermetic-process-example".to_owned(),
+    };
+
+    let request = Orchestrator::encode_process_request(resolved, &invocation)?;
+
+    // The hermetic port only manufactures deterministic fixture evidence. No
+    // operating-system child is launched by this example or the Flow library.
+    let fixture = HermeticExtension::new(PortIdentity::from_resolved(resolved));
+    let mut provider_events = Vec::new();
+    let provider_result = fixture.invoke(&invocation, &mut provider_events)?;
+    let mut provider_stdout = Vec::new();
+    for event in &provider_events {
+        serde_json::to_writer(&mut provider_stdout, event)?;
+        provider_stdout.push(b'\n');
+    }
+    serde_json::to_writer(&mut provider_stdout, &provider_result)?;
+    provider_stdout.push(b'\n');
+
+    let mut observed = Vec::new();
+    let execution = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            &[],
+        ),
+        &mut observed,
+    )?;
+
+    println!(
+        "{} encoded {} request bytes and validated {} process events with outcome {:?}",
+        resolution.evidence().case_id,
+        request.len(),
+        execution.events().len(),
+        execution.result().outcome
+    );
+    Ok(())
+}
diff --git a/src/contracts.rs b/src/contracts.rs
index fc8cd75..89c5118 100644
--- a/src/contracts.rs
+++ b/src/contracts.rs
@@ -196,7 +196,8 @@ pub enum ExecutionModeKind {
 ///
 /// The current injected in-process seam correlates these values with the
 /// resolved declaration but does not enforce time, cancellation, or output
-/// bounds.
+/// bounds. The host-neutral process seam checks captured stdout/stderr lengths;
+/// it does not enforce limits against a running child.
 pub struct ExecutionLimits {
     pub timeout_ms: u64,
     pub max_stdout_bytes: u64,
diff --git a/src/execution.rs b/src/execution.rs
index db34d40..9ee257e 100644
--- a/src/execution.rs
+++ b/src/execution.rs
@@ -9,6 +9,9 @@ use crate::contracts::{
     EventKind, ExecutionModeKind, ExtensionEvent, ExtensionInvocation, ExtensionResult,
     InvocationPhase, Outcome, ValidationError,
 };
+use crate::process::{
+    DecodedProcessTranscript, ProcessProtocolError, decode_provider_stdout, encode_invocation_frame,
+};
 
 /// Exact identity advertised by an injected in-process port.
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -112,6 +115,66 @@ impl PortError {
     }
 }
 
+/// Host-reported completion for one already-captured provider process.
+///
+/// This is an observation supplied by a future runner. It does not launch,
+/// signal, wait for, or otherwise control a process.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ProcessCompletion {
+    /// The process exited. `None` means no portable exit code was available,
+    /// for example after signal termination.
+    Exited { code: Option<i32> },
+    /// The runner reports that the execution deadline elapsed.
+    TimedOut,
+    /// The runner reports that forced cancellation terminated the process.
+    Cancelled,
+}
+
+/// Captured process stream whose configured byte bound was exceeded.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ProcessStream {
+    Stdout,
+    Stderr,
+}
+
+/// Borrowed, host-captured process evidence awaiting Flow validation.
+///
+/// Raw stdout and stderr remain caller-owned sensitive evidence. Flow never
+/// places their bytes in `ValidatedExecution`, portable provenance, or error
+/// display output.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ProcessTranscript<'a> {
+    completion: ProcessCompletion,
+    stdout: &'a [u8],
+    stderr: &'a [u8],
+}
+
+impl<'a> ProcessTranscript<'a> {
+    #[must_use]
+    pub const fn new(completion: ProcessCompletion, stdout: &'a [u8], stderr: &'a [u8]) -> Self {
+        Self {
+            completion,
+            stdout,
+            stderr,
+        }
+    }
+
+    #[must_use]
+    pub const fn completion(self) -> ProcessCompletion {
+        self.completion
+    }
+
+    #[must_use]
+    pub const fn stdout(self) -> &'a [u8] {
+        self.stdout
+    }
+
+    #[must_use]
+    pub const fn stderr(self) -> &'a [u8] {
+        self.stderr
+    }
+}
+
 /// Execution failed before or after invocation. Provider evidence is retained
 /// for inspection but is never converted into `ValidatedExecution` on error.
 #[derive(Debug, Error)]
@@ -148,6 +211,25 @@ pub enum ExecutionError {
         events: Vec<ExtensionEvent>,
         result: Box<ExtensionResult>,
     },
+    #[error("external process protocol failed: {source}")]
+    ProcessProtocol {
+        #[source]
+        source: ProcessProtocolError,
+    },
+    #[error(
+        "captured process {stream:?} exceeded its byte limit: observed {observed}, limit {limit}"
+    )]
+    ProcessOutputLimit {
+        stream: ProcessStream,
+        limit: u64,
+        observed: u64,
+    },
+    #[error("external process did not exit successfully (portable exit code: {code:?})")]
+    ProcessExit { code: Option<i32> },
+    #[error("external process timed out")]
+    ProcessTimeout,
+    #[error("external process was forcibly cancelled")]
+    ProcessCancelled,
 }
 
 impl ExecutionError {
@@ -155,7 +237,13 @@ impl ExecutionError {
     #[must_use]
     pub fn events(&self) -> &[ExtensionEvent] {
         match self {
-            Self::InvalidInvocation { .. } | Self::Preflight { .. } => &[],
+            Self::InvalidInvocation { .. }
+            | Self::Preflight { .. }
+            | Self::ProcessProtocol { .. }
+            | Self::ProcessOutputLimit { .. }
+            | Self::ProcessExit { .. }
+            | Self::ProcessTimeout
+            | Self::ProcessCancelled => &[],
             Self::Provider { events, .. }
             | Self::InvalidEvent { events, .. }
             | Self::EventSink { events, .. }
@@ -169,7 +257,14 @@ impl ExecutionError {
         match self {
             Self::InvalidEvent { result, .. } | Self::EventSink { result, .. } => result.as_deref(),
             Self::InvalidResult { result, .. } => Some(result.as_ref()),
-            Self::InvalidInvocation { .. } | Self::Preflight { .. } | Self::Provider { .. } => None,
+            Self::InvalidInvocation { .. }
+            | Self::Preflight { .. }
+            | Self::Provider { .. }
+            | Self::ProcessProtocol { .. }
+            | Self::ProcessOutputLimit { .. }
+            | Self::ProcessExit { .. }
+            | Self::ProcessTimeout
+            | Self::ProcessCancelled => None,
         }
     }
 }
@@ -181,6 +276,15 @@ impl ExecutionError {
 /// this checkpoint. Artifact checks correlate provider-reported identifiers
 /// only; they do not resolve locators, verify bytes, or perform domain-output
 /// validation.
+///
+/// The fields remain private so unvalidated provider evidence cannot be
+/// promoted with a struct literal:
+///
+/// ```compile_fail
+/// use flow::ValidatedExecution;
+///
+/// let _unvalidated = ValidatedExecution {};
+/// ```
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct ValidatedExecution {
     events: Vec<ExtensionEvent>,
@@ -204,7 +308,7 @@ impl ValidatedExecution {
     }
 }
 
-/// Stateless coordinator for one already-resolved in-process invocation.
+/// Stateless coordinator for one already-resolved invocation.
 #[derive(Clone, Copy, Debug, Default)]
 pub struct Orchestrator;
 
@@ -229,7 +333,7 @@ impl Orchestrator {
         invocation
             .validate()
             .map_err(|source| ExecutionError::InvalidInvocation { source })?;
-        validate_preflight(resolved, invocation, port.identity())?;
+        validate_in_process_preflight(resolved, invocation, port.identity())?;
 
         let mut validating_sink = ValidatingEventSink::new(invocation, event_sink);
         let provider_result = port.invoke(invocation, &mut validating_sink);
@@ -265,15 +369,107 @@ impl Orchestrator {
         })?;
         Ok(ValidatedExecution { events, result })
     }
+
+    /// Encode one validated process-mode invocation for provider stdin.
+    ///
+    /// The returned compact JSON document ends with exactly one LF. Its bytes
+    /// are a deterministic transport projection, not execution identity or a
+    /// general canonical-JSON representation.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for an invalid invocation, a process-mode preflight
+    /// mismatch, or serialization failure.
+    pub fn encode_process_request(
+        resolved: &ResolvedExtension,
+        invocation: &ExtensionInvocation,
+    ) -> Result<Vec<u8>, ExecutionError> {
+        invocation
+            .validate()
+            .map_err(|source| ExecutionError::InvalidInvocation { source })?;
+        validate_common_preflight(resolved, invocation, ExecutionModeKind::Process)?;
+        encode_invocation_frame(invocation)
+            .map_err(|source| ExecutionError::ProcessProtocol { source })
+    }
+
+    /// Validate one already-captured provider process transcript.
+    ///
+    /// This method is deliberately host-neutral: it does not launch, capture,
+    /// time out, cancel, signal, or reap a process. The caller owns those
+    /// operations and supplies bounded completion/stdout/stderr observations.
+    /// Flow checks the declared byte limits and completion state, parses the
+    /// protocol-only stdout stream, and routes the decoded evidence through the
+    /// same event/result acceptance gate as in-process execution.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed error for invalid invocation or preflight evidence,
+    /// output limits, abnormal completion, protocol framing, observer
+    /// rejection, or invalid provider events/results.
+    pub fn validate_process_transcript(
+        resolved: &ResolvedExtension,
+        invocation: &ExtensionInvocation,
+        transcript: ProcessTranscript<'_>,
+        event_sink: &mut dyn EventSink,
+    ) -> Result<ValidatedExecution, ExecutionError> {
+        invocation
+            .validate()
+            .map_err(|source| ExecutionError::InvalidInvocation { source })?;
+        validate_common_preflight(resolved, invocation, ExecutionModeKind::Process)?;
+
+        validate_captured_length(
+            ProcessStream::Stdout,
+            invocation.limits.max_stdout_bytes,
+            transcript.stdout().len(),
+        )?;
+        validate_captured_length(
+            ProcessStream::Stderr,
+            invocation.limits.max_stderr_bytes,
+            transcript.stderr().len(),
+        )?;
+
+        match transcript.completion() {
+            ProcessCompletion::Exited { code: Some(0) } => {}
+            ProcessCompletion::Exited { code } => {
+                return Err(ExecutionError::ProcessExit { code });
+            }
+            ProcessCompletion::TimedOut => return Err(ExecutionError::ProcessTimeout),
+            ProcessCompletion::Cancelled => return Err(ExecutionError::ProcessCancelled),
+        }
+
+        let decoded = decode_provider_stdout(transcript.stdout())
+            .map_err(|source| ExecutionError::ProcessProtocol { source })?;
+        validate_decoded_process_transcript(invocation, decoded, event_sink)
+    }
 }
 
-fn validate_preflight(
+fn validate_in_process_preflight(
     resolved: &ResolvedExtension,
     invocation: &ExtensionInvocation,
     port: &PortIdentity,
 ) -> Result<(), ExecutionError> {
-    if resolved.execution_mode().kind != ExecutionModeKind::InProcess {
-        return preflight("the resolved execution mode is not in-process");
+    validate_common_preflight(resolved, invocation, ExecutionModeKind::InProcess)?;
+    if port.extension_id != resolved.extension_id()
+        || port.version != resolved.version()
+        || port.publisher_id != resolved.publisher_id()
+        || port.integrity != resolved.integrity().value
+        || port.execution_mode_name != resolved.execution_mode().name
+        || port.execution_mode_kind != resolved.execution_mode().kind
+    {
+        return preflight("the injected port identity or execution mode does not match resolution");
+    }
+    Ok(())
+}
+
+fn validate_common_preflight(
+    resolved: &ResolvedExtension,
+    invocation: &ExtensionInvocation,
+    expected_mode: ExecutionModeKind,
+) -> Result<(), ExecutionError> {
+    if resolved.execution_mode().kind != expected_mode {
+        return preflight(format!(
+            "the resolved execution mode is not {expected_mode:?}"
+        ));
     }
     if invocation.phase != InvocationPhase::Execute {
         return preflight("the execution seam requires invocation phase execute");
@@ -290,6 +486,7 @@ fn validate_preflight(
     }
     if invocation.interface.name != resolved.execution_mode().name
         || invocation.interface.kind != resolved.execution_mode().kind
+        || invocation.interface.protocol != resolved.execution_mode().protocol
     {
         return preflight("the invocation interface does not match resolution");
     }
@@ -305,18 +502,64 @@ fn validate_preflight(
     if invocation.limits != resolved.execution_mode().limits {
         return preflight("the invocation limits do not match the resolved execution mode");
     }
-    if port.extension_id != resolved.extension_id()
-        || port.version != resolved.version()
-        || port.publisher_id != resolved.publisher_id()
-        || port.integrity != resolved.integrity().value
-        || port.execution_mode_name != resolved.execution_mode().name
-        || port.execution_mode_kind != resolved.execution_mode().kind
-    {
-        return preflight("the injected port identity or execution mode does not match resolution");
+    Ok(())
+}
+
+fn validate_captured_length(
+    stream: ProcessStream,
+    limit: u64,
+    observed: usize,
+) -> Result<(), ExecutionError> {
+    let observed = u64::try_from(observed).unwrap_or(u64::MAX);
+    if observed > limit {
+        return Err(ExecutionError::ProcessOutputLimit {
+            stream,
+            limit,
+            observed,
+        });
     }
     Ok(())
 }
 
+fn validate_decoded_process_transcript(
+    invocation: &ExtensionInvocation,
+    decoded: DecodedProcessTranscript,
+    event_sink: &mut dyn EventSink,
+) -> Result<ValidatedExecution, ExecutionError> {
+    let (raw_events, result) = decoded.into_parts();
+    let mut validating_sink = ValidatingEventSink::new(invocation, event_sink);
+    for event in &raw_events {
+        let _emission_result = validating_sink.emit(event);
+    }
+    let (events, issue) = validating_sink.finish();
+    match issue {
+        Some(EventIssue::Invalid(message)) => {
+            return Err(ExecutionError::InvalidEvent {
+                message,
+                events,
+                result: Some(Box::new(result)),
+            });
+        }
+        Some(EventIssue::Downstream(source)) => {
+            return Err(ExecutionError::EventSink {
+                source,
+                events,
+                result: Some(Box::new(result)),
+            });
+        }
+        None => {}
+    }
+
+    validate_result(invocation, &events, &result).map_err(|message| {
+        ExecutionError::InvalidResult {
+            message,
+            events: events.clone(),
+            result: Box::new(result.clone()),
+        }
+    })?;
+    Ok(ValidatedExecution { events, result })
+}
+
 fn validate_result(
     invocation: &ExtensionInvocation,
     events: &[ExtensionEvent],
diff --git a/src/lib.rs b/src/lib.rs
index cde5925..b60e189 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,13 +1,15 @@
-//! Deterministic extension resolution and an injected in-process execution seam.
+//! Deterministic extension resolution and bounded execution-evidence seams.
 //!
 //! Flow treats extension manifests as declarations, operator locks as authority,
 //! and provider events and results as untrusted evidence until validation has
-//! completed.
+//! completed. It can invoke a caller-supplied in-process port or validate an
+//! already-captured external-process transcript; it does not launch processes.
 
 pub mod catalog;
 pub mod contracts;
 pub mod execution;
 pub mod hermetic;
+pub mod process;
 
 pub use catalog::{
     CatalogError, ExtensionCatalog, ExtensionObservation, ResolutionOutcome, ResolutionRequest,
@@ -16,6 +18,9 @@ pub use catalog::{
 pub use contracts::*;
 pub use execution::{
     EventSink, EventSinkError, ExecutionError, ExtensionPort, Orchestrator, PortError,
-    PortIdentity, ValidatedExecution,
+    PortIdentity, ProcessCompletion, ProcessStream, ProcessTranscript, ValidatedExecution,
 };
 pub use hermetic::{HermeticBehavior, HermeticExtension};
+pub use process::{
+    DecodedProcessTranscript, ProcessProtocolError, decode_provider_stdout, encode_invocation_frame,
+};
diff --git a/src/process.rs b/src/process.rs
new file mode 100644
index 0000000..d0e7b1d
--- /dev/null
+++ b/src/process.rs
@@ -0,0 +1,226 @@
+//! Host-neutral framing for the external-provider standard streams.
+//!
+//! Flow writes one compact [`ExtensionInvocation`] JSON object followed by a
+//! line feed. A provider writes zero or more [`ExtensionEvent`] JSON objects,
+//! followed by exactly one [`ExtensionResult`] JSON object. Every provider
+//! frame must be terminated by LF; CRLF is also accepted when decoding.
+//!
+//! This module owns only byte framing. It does not launch processes, inspect
+//! stderr, enforce resource limits, or perform semantic event/result
+//! validation.
+
+use std::str;
+
+use serde_json::Value;
+use thiserror::Error;
+
+use crate::contracts::{
+    EXTENSION_EVENT_V1, EXTENSION_INVOCATION_V1, EXTENSION_RESULT_V1, ExtensionEvent,
+    ExtensionInvocation, ExtensionResult,
+};
+
+/// A syntactically complete provider transcript.
+///
+/// Construction is limited to [`decode_provider_stdout`]. The contained
+/// events and result still require Flow-owned semantic and correlation
+/// validation before they can become accepted execution evidence.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct DecodedProcessTranscript {
+    events: Vec<ExtensionEvent>,
+    result: ExtensionResult,
+}
+
+impl DecodedProcessTranscript {
+    #[must_use]
+    pub fn events(&self) -> &[ExtensionEvent] {
+        &self.events
+    }
+
+    #[must_use]
+    pub const fn result(&self) -> &ExtensionResult {
+        &self.result
+    }
+
+    #[must_use]
+    pub fn into_parts(self) -> (Vec<ExtensionEvent>, ExtensionResult) {
+        (self.events, self.result)
+    }
+}
+
+/// A deterministic provider-protocol framing failure.
+#[derive(Clone, Debug, Eq, Error, PartialEq)]
+pub enum ProcessProtocolError {
+    #[error("failed to serialize the invocation frame: {message}")]
+    Serialization { message: String },
+    #[error("provider stdout frame {frame_number} is blank")]
+    BlankFrame { frame_number: usize },
+    #[error(
+        "provider stdout ended with partial frame {frame_number} ({byte_count} unterminated bytes)"
+    )]
+    PartialFrame {
+        frame_number: usize,
+        byte_count: usize,
+    },
+    #[error("provider stdout frame {frame_number} is not valid UTF-8")]
+    InvalidUtf8 { frame_number: usize },
+    #[error("provider stdout frame {frame_number} is malformed JSON")]
+    MalformedJson {
+        frame_number: usize,
+        message: String,
+    },
+    #[error("provider stdout frame {frame_number} is missing schema_version")]
+    MissingSchemaVersion { frame_number: usize },
+    #[error("provider stdout frame {frame_number} has a non-string schema_version")]
+    InvalidSchemaVersion { frame_number: usize },
+    #[error("provider stdout frame {frame_number} uses an unsupported schema_version")]
+    UnknownSchemaVersion {
+        frame_number: usize,
+        schema_version: String,
+    },
+    #[error("provider stdout frame {frame_number} is an invocation; invocations belong on stdin")]
+    InvocationOnStdout { frame_number: usize },
+    #[error("provider stdout contains no terminal result frame")]
+    MissingResult,
+    #[error("provider stdout frame {frame_number} is a duplicate terminal result")]
+    DuplicateResult { frame_number: usize },
+    #[error("provider stdout frame {frame_number} appears after the terminal result")]
+    MessageAfterResult {
+        frame_number: usize,
+        schema_version: String,
+    },
+}
+
+/// Encode one Flow-owned invocation as compact JSON followed by LF.
+///
+/// This encoder is deterministic for the typed invocation model and the
+/// locked serialization dependencies. It is not a general canonical-JSON
+/// implementation and its output must not be treated as a cryptographic
+/// identity.
+///
+/// # Errors
+///
+/// Returns [`ProcessProtocolError::Serialization`] if JSON serialization
+/// fails. This function does not perform semantic invocation validation.
+pub fn encode_invocation_frame(
+    invocation: &ExtensionInvocation,
+) -> Result<Vec<u8>, ProcessProtocolError> {
+    let mut encoded =
+        serde_json::to_vec(invocation).map_err(|error| ProcessProtocolError::Serialization {
+            message: error.to_string(),
+        })?;
+    encoded.push(b'\n');
+    Ok(encoded)
+}
+
+/// Decode a closed provider stdout transcript.
+///
+/// Each frame must contain one existing extension-event or extension-result
+/// contract. The terminal result is required, unique, and final. This function
+/// validates framing and closed JSON shapes only; it deliberately does not
+/// validate event ordering, invocation correlation, diagnostics, outcomes, or
+/// artifacts.
+///
+/// # Errors
+///
+/// Returns a typed protocol error for invalid framing, encoding, JSON shape,
+/// schema version, or transcript state.
+pub fn decode_provider_stdout(
+    stdout: &[u8],
+) -> Result<DecodedProcessTranscript, ProcessProtocolError> {
+    let mut events = Vec::new();
+    let mut result = None;
+    let mut cursor = 0;
+    let mut frame_number = 1;
+
+    while cursor < stdout.len() {
+        let Some(relative_end) = stdout[cursor..].iter().position(|byte| *byte == b'\n') else {
+            return Err(ProcessProtocolError::PartialFrame {
+                frame_number,
+                byte_count: stdout.len() - cursor,
+            });
+        };
+        let frame_end = cursor + relative_end;
+        let mut frame = &stdout[cursor..frame_end];
+        cursor = frame_end + 1;
+
+        if frame.last() == Some(&b'\r') {
+            frame = &frame[..frame.len() - 1];
+        }
+        if frame.is_empty() {
+            return Err(ProcessProtocolError::BlankFrame { frame_number });
+        }
+
+        match decode_provider_frame(frame, frame_number)? {
+            ProviderFrame::Event(event) => {
+                if result.is_some() {
+                    return Err(ProcessProtocolError::MessageAfterResult {
+                        frame_number,
+                        schema_version: EXTENSION_EVENT_V1.to_owned(),
+                    });
+                }
+                events.push(*event);
+            }
+            ProviderFrame::Result(decoded_result) => {
+                if result.is_some() {
+                    return Err(ProcessProtocolError::DuplicateResult { frame_number });
+                }
+                result = Some(decoded_result);
+            }
+        }
+
+        frame_number += 1;
+    }
+
+    let result = result.ok_or(ProcessProtocolError::MissingResult)?;
+    Ok(DecodedProcessTranscript {
+        events,
+        result: *result,
+    })
+}
+
+enum ProviderFrame {
+    Event(Box<ExtensionEvent>),
+    Result(Box<ExtensionResult>),
+}
+
+fn decode_provider_frame(
+    frame: &[u8],
+    frame_number: usize,
+) -> Result<ProviderFrame, ProcessProtocolError> {
+    let frame =
+        str::from_utf8(frame).map_err(|_| ProcessProtocolError::InvalidUtf8 { frame_number })?;
+    let value: Value =
+        serde_json::from_str(frame).map_err(|error| ProcessProtocolError::MalformedJson {
+            frame_number,
+            message: error.to_string(),
+        })?;
+    let schema_value = value
+        .as_object()
+        .and_then(|object| object.get("schema_version"))
+        .ok_or(ProcessProtocolError::MissingSchemaVersion { frame_number })?;
+    let schema_version = schema_value
+        .as_str()
+        .ok_or(ProcessProtocolError::InvalidSchemaVersion { frame_number })?;
+
+    match schema_version {
+        EXTENSION_EVENT_V1 => serde_json::from_str(frame)
+            .map(Box::new)
+            .map(ProviderFrame::Event)
+            .map_err(|error| ProcessProtocolError::MalformedJson {
+                frame_number,
+                message: error.to_string(),
+            }),
+        EXTENSION_RESULT_V1 => serde_json::from_str(frame)
+            .map(Box::new)
+            .map(ProviderFrame::Result)
+            .map_err(|error| ProcessProtocolError::MalformedJson {
+                frame_number,
+                message: error.to_string(),
+            }),
+        EXTENSION_INVOCATION_V1 => Err(ProcessProtocolError::InvocationOnStdout { frame_number }),
+        _ => Err(ProcessProtocolError::UnknownSchemaVersion {
+            frame_number,
+            schema_version: schema_version.to_owned(),
+        }),
+    }
+}
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index 27c6939..137ba86 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -48,6 +48,16 @@ pub fn request() -> ResolutionRequest {
     )
 }
 
+pub fn process_request() -> ResolutionRequest {
+    ResolutionRequest::new(
+        "test-case-process",
+        "optiflow/inspect-collection",
+        Domain::Optiflow,
+        "synthetic-process",
+        ExecutionModeKind::Process,
+    )
+}
+
 pub fn resolved_fixture() -> (ExtensionCatalog, ResolutionRequest) {
     let manifest = manifest();
     let observation = observation(&manifest, true);
@@ -56,6 +66,14 @@ pub fn resolved_fixture() -> (ExtensionCatalog, ResolutionRequest) {
     (catalog, request())
 }
 
+pub fn resolved_process_fixture() -> (ExtensionCatalog, ResolutionRequest) {
+    let manifest = manifest();
+    let observation = observation(&manifest, true);
+    let catalog = ExtensionCatalog::inspect([manifest], lock(), [observation])
+        .expect("fixture catalog must inspect");
+    (catalog, process_request())
+}
+
 pub fn invocation(resolved: &ResolvedExtension) -> ExtensionInvocation {
     ExtensionInvocation {
         schema_version: EXTENSION_INVOCATION_V1.to_owned(),
diff --git a/tests/process_execution.rs b/tests/process_execution.rs
new file mode 100644
index 0000000..f6c4d0e
--- /dev/null
+++ b/tests/process_execution.rs
@@ -0,0 +1,365 @@
+mod common;
+
+use flow::{
+    EventKind, EventSink, EventSinkError, EventState, ExecutionError, ExtensionEvent,
+    ExtensionInvocation, ExtensionPort, ExtensionResult, FailureClassification, HermeticExtension,
+    Orchestrator, Outcome, PortIdentity, ProcessCompletion, ProcessStream, ProcessTranscript,
+};
+
+use common::{invocation, resolved_fixture, resolved_process_fixture};
+
+fn provider_evidence(
+    resolved: &flow::ResolvedExtension,
+    invocation: &ExtensionInvocation,
+) -> (Vec<ExtensionEvent>, ExtensionResult) {
+    let provider = HermeticExtension::new(PortIdentity::from_resolved(resolved));
+    let mut events = Vec::new();
+    let result = provider
+        .invoke(invocation, &mut events)
+        .expect("hermetic provider evidence must be available");
+    (events, result)
+}
+
+fn stdout(events: &[ExtensionEvent], result: &ExtensionResult) -> Vec<u8> {
+    let mut stdout = Vec::new();
+    for event in events {
+        stdout.extend(serde_json::to_vec(event).expect("event fixture must serialize"));
+        stdout.push(b'\n');
+    }
+    stdout.extend(serde_json::to_vec(result).expect("result fixture must serialize"));
+    stdout.push(b'\n');
+    stdout
+}
+
+#[test]
+fn process_request_and_transcript_reuse_flow_owned_validation() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (events, result) = provider_evidence(resolved, &invocation);
+    let provider_stdout = stdout(&events, &result);
+    let request_bytes = Orchestrator::encode_process_request(resolved, &invocation).unwrap();
+    let mut observed = Vec::new();
+
+    let validated = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            b"bounded operational diagnostic",
+        ),
+        &mut observed,
+    )
+    .unwrap();
+
+    assert_eq!(request_bytes.last(), Some(&b'\n'));
+    assert_eq!(validated.events(), events);
+    assert_eq!(validated.result(), &result);
+    assert_eq!(observed, events);
+}
+
+#[test]
+fn execution_modes_fail_closed_at_the_wrong_seam() {
+    let (process_catalog, process_request) = resolved_process_fixture();
+    let process_outcome = process_catalog.resolve(&process_request);
+    let process_resolved = process_outcome.resolved().unwrap();
+    let process_invocation = invocation(process_resolved);
+    let process_port = HermeticExtension::new(PortIdentity::from_resolved(process_resolved));
+    let mut observed = Vec::new();
+
+    let error = Orchestrator::execute(
+        process_resolved,
+        &process_invocation,
+        &process_port,
+        &mut observed,
+    )
+    .unwrap_err();
+    assert!(matches!(error, ExecutionError::Preflight { .. }));
+    assert!(observed.is_empty());
+
+    let (in_process_catalog, in_process_request) = resolved_fixture();
+    let in_process_outcome = in_process_catalog.resolve(&in_process_request);
+    let in_process_resolved = in_process_outcome.resolved().unwrap();
+    let in_process_invocation = invocation(in_process_resolved);
+    let error = Orchestrator::encode_process_request(in_process_resolved, &in_process_invocation)
+        .unwrap_err();
+    assert!(matches!(error, ExecutionError::Preflight { .. }));
+}
+
+#[test]
+fn captured_stream_limits_are_inclusive_and_checked_before_protocol_acceptance() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (events, mut result) = provider_evidence(resolved, &invocation);
+
+    let mut provider_stdout = stdout(&events, &result);
+    let stdout_limit = usize::try_from(invocation.limits.max_stdout_bytes).unwrap();
+    let padding = stdout_limit - provider_stdout.len();
+    result.explanation.push_str(&"x".repeat(padding));
+    provider_stdout = stdout(&events, &result);
+    assert_eq!(provider_stdout.len(), stdout_limit);
+
+    let stderr_limit = usize::try_from(invocation.limits.max_stderr_bytes).unwrap();
+    let provider_stderr = vec![b'x'; stderr_limit];
+    let mut observed = Vec::new();
+    Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            &provider_stderr,
+        ),
+        &mut observed,
+    )
+    .unwrap();
+
+    provider_stdout.push(b' ');
+    let error = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(1) },
+            &provider_stdout,
+            &[],
+        ),
+        &mut Vec::new(),
+    )
+    .unwrap_err();
+    assert!(matches!(
+        error,
+        ExecutionError::ProcessOutputLimit {
+            stream: ProcessStream::Stdout,
+            ..
+        }
+    ));
+
+    let oversized_stderr = vec![b'x'; stderr_limit + 1];
+    let error = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &stdout(&events, &result),
+            &oversized_stderr,
+        ),
+        &mut Vec::new(),
+    )
+    .unwrap_err();
+    assert!(matches!(
+        error,
+        ExecutionError::ProcessOutputLimit {
+            stream: ProcessStream::Stderr,
+            ..
+        }
+    ));
+}
+
+#[test]
+fn abnormal_completion_cannot_promote_provider_success() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (events, result) = provider_evidence(resolved, &invocation);
+    let provider_stdout = stdout(&events, &result);
+
+    let cases = [
+        (ProcessCompletion::Exited { code: Some(7) }, "nonzero-exit"),
+        (ProcessCompletion::Exited { code: None }, "signal-exit"),
+        (ProcessCompletion::TimedOut, "timeout"),
+        (ProcessCompletion::Cancelled, "forced-cancellation"),
+    ];
+
+    for (completion, case) in cases {
+        let mut observed = Vec::new();
+        let error = Orchestrator::validate_process_transcript(
+            resolved,
+            &invocation,
+            ProcessTranscript::new(completion, &provider_stdout, &[]),
+            &mut observed,
+        )
+        .unwrap_err();
+        assert!(
+            matches!(
+                error,
+                ExecutionError::ProcessExit { .. }
+                    | ExecutionError::ProcessTimeout
+                    | ExecutionError::ProcessCancelled
+            ),
+            "unexpected failure for {case}: {error}"
+        );
+        assert!(error.provider_result().is_none());
+        assert!(observed.is_empty());
+    }
+}
+
+#[test]
+fn result_without_a_terminal_event_remains_unaccepted() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (_, result) = provider_evidence(resolved, &invocation);
+    let provider_stdout = stdout(&[], &result);
+
+    let error = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            &[],
+        ),
+        &mut Vec::new(),
+    )
+    .unwrap_err();
+
+    assert!(matches!(error, ExecutionError::InvalidResult { .. }));
+    assert!(error.events().is_empty());
+    assert_eq!(error.provider_result(), Some(&result));
+}
+
+#[test]
+fn graceful_provider_cancellation_with_exit_zero_is_valid_evidence() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (mut events, mut result) = provider_evidence(resolved, &invocation);
+    let terminal = events.last_mut().unwrap();
+    terminal.kind = EventKind::Cancelled;
+    terminal.state = EventState::Cancelled;
+    result.outcome = Outcome::Cancelled;
+    result.failure.classification = FailureClassification::Cancelled;
+    result.failure.code = "provider.cancelled".to_owned();
+    result.failure.message = "provider observed the cancellation request".to_owned();
+    result.failure.retryable = true;
+    let provider_stdout = stdout(&events, &result);
+
+    let validated = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            &[],
+        ),
+        &mut Vec::new(),
+    )
+    .unwrap();
+
+    assert_eq!(validated.result().outcome, Outcome::Cancelled);
+}
+
+#[test]
+fn framed_events_still_use_existing_order_and_identity_validation() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (mut events, result) = provider_evidence(resolved, &invocation);
+    events[1].sequence = events[0].sequence;
+    let provider_stdout = stdout(&events, &result);
+
+    let error = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            &[],
+        ),
+        &mut Vec::new(),
+    )
+    .unwrap_err();
+    assert!(matches!(error, ExecutionError::InvalidEvent { .. }));
+    assert_eq!(error.events(), events);
+    assert!(error.provider_result().is_some());
+
+    let (events, mut result) = provider_evidence(resolved, &invocation);
+    result.capability_id = "flow/mismatch".to_owned();
+    let provider_stdout = stdout(&events, &result);
+    let error = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            &[],
+        ),
+        &mut Vec::new(),
+    )
+    .unwrap_err();
+    assert!(matches!(error, ExecutionError::InvalidResult { .. }));
+    assert_eq!(error.provider_result(), Some(&result));
+}
+
+#[test]
+fn successful_observers_do_not_change_authoritative_result_identity() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (events, result) = provider_evidence(resolved, &invocation);
+    let provider_stdout = stdout(&events, &result);
+    let transcript = ProcessTranscript::new(
+        ProcessCompletion::Exited { code: Some(0) },
+        &provider_stdout,
+        &[],
+    );
+    let mut no_op = |_event: &ExtensionEvent| Ok::<(), EventSinkError>(());
+    let without_collection =
+        Orchestrator::validate_process_transcript(resolved, &invocation, transcript, &mut no_op)
+            .unwrap();
+    let mut collected = Vec::new();
+    let with_collection = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        transcript,
+        &mut collected,
+    )
+    .unwrap();
+
+    assert_eq!(without_collection, with_collection);
+    assert_eq!(collected, events);
+}
+
+#[test]
+fn rejecting_event_sink_rejects_process_evidence_without_fallback() {
+    let (catalog, request) = resolved_process_fixture();
+    let outcome = catalog.resolve(&request);
+    let resolved = outcome.resolved().unwrap();
+    let invocation = invocation(resolved);
+    let (events, result) = provider_evidence(resolved, &invocation);
+    let provider_stdout = stdout(&events, &result);
+    let mut sink = RejectingSink;
+
+    let error = Orchestrator::validate_process_transcript(
+        resolved,
+        &invocation,
+        ProcessTranscript::new(
+            ProcessCompletion::Exited { code: Some(0) },
+            &provider_stdout,
+            &[],
+        ),
+        &mut sink,
+    )
+    .unwrap_err();
+
+    assert!(matches!(error, ExecutionError::EventSink { .. }));
+    assert_eq!(error.events(), events);
+    assert_eq!(error.provider_result(), Some(&result));
+}
+
+struct RejectingSink;
+
+impl EventSink for RejectingSink {
+    fn emit(&mut self, _event: &ExtensionEvent) -> Result<(), EventSinkError> {
+        Err(EventSinkError::new("authoritative observer rejected event"))
+    }
+}
diff --git a/tests/process_protocol.rs b/tests/process_protocol.rs
new file mode 100644
index 0000000..784deef
--- /dev/null
+++ b/tests/process_protocol.rs
@@ -0,0 +1,277 @@
+use flow::process::{ProcessProtocolError, decode_provider_stdout, encode_invocation_frame};
+use flow::{ExtensionEvent, ExtensionInvocation, ExtensionResult};
+use serde::Serialize;
+use serde_json::json;
+
+fn invocation() -> ExtensionInvocation {
+    serde_json::from_str(include_str!(
+        "../contracts/examples/extension-invocation.v1.example.json"
+    ))
+    .expect("checked-in invocation must deserialize")
+}
+
+fn event() -> ExtensionEvent {
+    serde_json::from_str(include_str!(
+        "../contracts/examples/extension-event.v1.example.json"
+    ))
+    .expect("checked-in event must deserialize")
+}
+
+fn result() -> ExtensionResult {
+    serde_json::from_str(include_str!(
+        "../contracts/examples/extension-result.v1.example.json"
+    ))
+    .expect("checked-in result must deserialize")
+}
+
+fn line(value: &impl Serialize) -> Vec<u8> {
+    let mut encoded = serde_json::to_vec(value).expect("fixture must serialize");
+    encoded.push(b'\n');
+    encoded
+}
+
+fn transcript(frames: &[Vec<u8>]) -> Vec<u8> {
+    frames.iter().flatten().copied().collect()
+}
+
+#[test]
+fn invocation_encoding_is_deterministic_compact_json_with_one_lf() {
+    let mut invocation = invocation();
+    invocation
+        .configuration
+        .values
+        .insert("multiline".to_owned(), json!("first line\nsecond line"));
+
+    let first = encode_invocation_frame(&invocation).unwrap();
+    let second = encode_invocation_frame(&invocation).unwrap();
+
+    assert_eq!(first, second);
+    assert_eq!(first.last(), Some(&b'\n'));
+    assert!(!first[..first.len() - 1].contains(&b'\n'));
+    assert!(!first[..first.len() - 1].contains(&b'\r'));
+    assert_eq!(
+        serde_json::from_slice::<ExtensionInvocation>(&first[..first.len() - 1]).unwrap(),
+        invocation
+    );
+}
+
+#[test]
+fn provider_transcript_decodes_lf_and_crlf_frames() {
+    let expected_event = event();
+    let expected_result = result();
+    let lf = transcript(&[line(&expected_event), line(&expected_result)]);
+    let crlf = lf
+        .iter()
+        .flat_map(|byte| {
+            if *byte == b'\n' {
+                vec![b'\r', b'\n']
+            } else {
+                vec![*byte]
+            }
+        })
+        .collect::<Vec<_>>();
+
+    for encoded in [&lf, &crlf] {
+        let decoded = decode_provider_stdout(encoded).unwrap();
+        assert_eq!(decoded.events(), std::slice::from_ref(&expected_event));
+        assert_eq!(decoded.result(), &expected_result);
+
+        let (events, decoded_result) = decoded.into_parts();
+        assert_eq!(events.as_slice(), std::slice::from_ref(&expected_event));
+        assert_eq!(decoded_result, expected_result);
+    }
+}
+
+#[test]
+fn caller_chunk_boundaries_do_not_affect_closed_transcript_decoding() {
+    let encoded = transcript(&[line(&event()), line(&result())]);
+    let expected = decode_provider_stdout(&encoded).unwrap();
+
+    for chunk_size in [1, 2, 3, 7, 64, encoded.len()] {
+        let captured = encoded
+            .chunks(chunk_size)
+            .flatten()
+            .copied()
+            .collect::<Vec<_>>();
+        assert_eq!(decode_provider_stdout(&captured).unwrap(), expected);
+    }
+}
+
+#[test]
+fn terminal_result_without_events_is_a_closed_framing_transcript() {
+    let expected = result();
+    let decoded = decode_provider_stdout(&line(&expected)).unwrap();
+
+    assert!(decoded.events().is_empty());
+    assert_eq!(decoded.result(), &expected);
+}
+
+#[test]
+fn blank_frame_is_rejected() {
+    assert_eq!(
+        decode_provider_stdout(b"\n").unwrap_err(),
+        ProcessProtocolError::BlankFrame { frame_number: 1 }
+    );
+    assert_eq!(
+        decode_provider_stdout(b"\r\n").unwrap_err(),
+        ProcessProtocolError::BlankFrame { frame_number: 1 }
+    );
+}
+
+#[test]
+fn unterminated_final_frame_is_rejected_without_implicit_eof_completion() {
+    let encoded = serde_json::to_vec(&result()).unwrap();
+
+    assert_eq!(
+        decode_provider_stdout(&encoded).unwrap_err(),
+        ProcessProtocolError::PartialFrame {
+            frame_number: 1,
+            byte_count: encoded.len(),
+        }
+    );
+
+    let first = line(&event());
+    let mut after_event = first.clone();
+    after_event.extend_from_slice(&encoded);
+    assert_eq!(
+        decode_provider_stdout(&after_event).unwrap_err(),
+        ProcessProtocolError::PartialFrame {
+            frame_number: 2,
+            byte_count: encoded.len(),
+        }
+    );
+}
+
+#[test]
+fn invalid_utf8_frame_is_rejected() {
+    assert_eq!(
+        decode_provider_stdout(&[0xff, b'\n']).unwrap_err(),
+        ProcessProtocolError::InvalidUtf8 { frame_number: 1 }
+    );
+}
+
+#[test]
+fn malformed_json_frame_is_rejected() {
+    let error = decode_provider_stdout(b"{not-json}\n").unwrap_err();
+
+    assert!(matches!(
+        error,
+        ProcessProtocolError::MalformedJson {
+            frame_number: 1,
+            ..
+        }
+    ));
+}
+
+#[test]
+fn byte_order_mark_and_pretty_printed_multiline_json_are_rejected() {
+    let mut with_bom = vec![0xef, 0xbb, 0xbf];
+    with_bom.extend(line(&result()));
+    assert!(matches!(
+        decode_provider_stdout(&with_bom),
+        Err(ProcessProtocolError::MalformedJson {
+            frame_number: 1,
+            ..
+        })
+    ));
+
+    let mut multiline = serde_json::to_vec_pretty(&result()).unwrap();
+    multiline.push(b'\n');
+    assert!(matches!(
+        decode_provider_stdout(&multiline),
+        Err(ProcessProtocolError::MalformedJson {
+            frame_number: 1,
+            ..
+        })
+    ));
+}
+
+#[test]
+fn missing_or_non_string_schema_version_is_rejected() {
+    assert_eq!(
+        decode_provider_stdout(b"{}\n").unwrap_err(),
+        ProcessProtocolError::MissingSchemaVersion { frame_number: 1 }
+    );
+    assert_eq!(
+        decode_provider_stdout(b"{\"schema_version\":1}\n").unwrap_err(),
+        ProcessProtocolError::InvalidSchemaVersion { frame_number: 1 }
+    );
+}
+
+#[test]
+fn unknown_schema_version_is_rejected_without_downgrade() {
+    let error =
+        decode_provider_stdout(b"{\"schema_version\":\"flow.extension-event/v2\"}\n").unwrap_err();
+
+    assert_eq!(
+        error,
+        ProcessProtocolError::UnknownSchemaVersion {
+            frame_number: 1,
+            schema_version: "flow.extension-event/v2".to_owned(),
+        }
+    );
+    assert!(!error.to_string().contains("flow.extension-event/v2"));
+}
+
+#[test]
+fn invocation_frame_on_provider_stdout_is_rejected() {
+    assert_eq!(
+        decode_provider_stdout(&encode_invocation_frame(&invocation()).unwrap()).unwrap_err(),
+        ProcessProtocolError::InvocationOnStdout { frame_number: 1 }
+    );
+}
+
+#[test]
+fn empty_or_event_only_stdout_is_missing_a_terminal_result() {
+    assert_eq!(
+        decode_provider_stdout(&[]).unwrap_err(),
+        ProcessProtocolError::MissingResult
+    );
+    assert_eq!(
+        decode_provider_stdout(&line(&event())).unwrap_err(),
+        ProcessProtocolError::MissingResult
+    );
+}
+
+#[test]
+fn duplicate_terminal_result_is_rejected() {
+    let terminal = line(&result());
+    let encoded = transcript(&[terminal.clone(), terminal]);
+
+    assert_eq!(
+        decode_provider_stdout(&encoded).unwrap_err(),
+        ProcessProtocolError::DuplicateResult { frame_number: 2 }
+    );
+}
+
+#[test]
+fn event_after_terminal_result_is_rejected() {
+    let encoded = transcript(&[line(&result()), line(&event())]);
+
+    assert_eq!(
+        decode_provider_stdout(&encoded).unwrap_err(),
+        ProcessProtocolError::MessageAfterResult {
+            frame_number: 2,
+            schema_version: "flow.extension-event/v1".to_owned(),
+        }
+    );
+}
+
+#[test]
+fn typed_frames_remain_closed_to_unknown_fields() {
+    let mut value = serde_json::to_value(result()).unwrap();
+    value
+        .as_object_mut()
+        .unwrap()
+        .insert("unexpected".to_owned(), json!(true));
+    let error = decode_provider_stdout(&line(&value)).unwrap_err();
+
+    assert!(matches!(
+        &error,
+        ProcessProtocolError::MalformedJson {
+            frame_number: 1,
+            ..
+        }
+    ));
+    assert!(!error.to_string().contains("unexpected"));
+}