diff --git a/.dockerignore b/.dockerignore
index e95a640d6..b43ffe4a2 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -4,11 +4,15 @@
 .githooks/
 .agents/
 .codex/
+.local/
+.playwright-cli/
 
 # Local runtime state and credentials must never enter the build context.
 .colossus/
 **/.env
 **/.env.*
+**/development-credentials/
+**/.authority-key.env
 **/.aws/
 **/.ssh/
 **/.git-credentials
diff --git a/.github/workflows/control-plane-image.yml b/.github/workflows/control-plane-image.yml
new file mode 100644
index 000000000..63167e92d
--- /dev/null
+++ b/.github/workflows/control-plane-image.yml
@@ -0,0 +1,110 @@
+name: Publish Control Plane image
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Published stable or preview release tag
+        required: true
+        type: string
+  pull_request:
+    paths:
+      - .github/workflows/control-plane-image.yml
+      - scripts/ci/*control-plane*.mjs
+      - scripts/ci/publish-control-plane-image.sh
+
+permissions: {}
+
+concurrency:
+  group: control-plane-image-${{ github.event.release.tag_name || inputs.tag || github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  publisher-revision:
+    name: Resolve the protected main publisher
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      revision: ${{ steps.publisher.outputs.revision }}
+    steps:
+      - name: Use proposed code for tests or protected main for publication
+        id: publisher
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "$EVENT_NAME" == pull_request ]]; then
+            revision="$GITHUB_SHA"
+          else
+            revision=$(gh api repos/obscuritylabs/Colossus/git/ref/heads/main --jq .object.sha)
+          fi
+          [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
+          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
+
+  contracts:
+    needs: publisher-revision
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.publisher-revision.outputs.revision }}
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.18.0
+      - run: node --test scripts/ci/control-plane-assets.test.mjs
+      - run: bash -n scripts/ci/publish-control-plane-image.sh
+
+  publish:
+    name: Publish the exact tested multi-platform server
+    needs: [publisher-revision, contracts]
+    if: >-
+      github.repository == 'obscuritylabs/Colossus' &&
+      ((github.event_name == 'release' && github.event.release.draft == false) ||
+       (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - name: Use the same protected publisher revision that passed contracts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.publisher-revision.outputs.revision }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.18.0
+      - name: Authenticate with a job-scoped registry token
+        env:
+          GHCR_TOKEN: ${{ github.token }}
+          GHCR_USER: ${{ github.actor }}
+        run: printf '%s' "$GHCR_TOKEN" | docker login ghcr.io --username "$GHCR_USER" --password-stdin
+      - name: Verify release bytes against trusted tag artifacts and publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: bash scripts/ci/publish-control-plane-image.sh
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: colossus-control-plane-publication
+          path: |
+            ${{ runner.temp }}/control-plane-image/publication.json
+            ${{ runner.temp }}/control-plane-image/assets.json
+          if-no-files-found: error
+          retention-days: 30
+      - name: Remove the job-scoped registry session
+        if: always()
+        run: docker logout ghcr.io
diff --git a/.github/workflows/documentation-candidate.yml b/.github/workflows/documentation-candidate.yml
new file mode 100644
index 000000000..290c55b0d
--- /dev/null
+++ b/.github/workflows/documentation-candidate.yml
@@ -0,0 +1,123 @@
+name: Documentation image candidate
+
+on:
+  push:
+    tags: ["v*"]
+  pull_request:
+    paths:
+      - .github/workflows/documentation-candidate.yml
+      - .github/workflows/documentation-image.yml
+      - .dockerignore
+      - deploy/documentation/**
+      - docs/**
+      - documentation/legacy-routes.tsv
+      - scripts/docs-site
+      - scripts/generate-doc-redirects
+      - scripts/ci/documentation-*.mjs
+      - scripts/ci/publish-documentation-image.sh
+      - scripts/ci/verify-control-plane-assets.mjs
+      - zensical.toml
+
+permissions: {}
+
+concurrency:
+  group: documentation-candidate-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  source:
+    name: Verify documentation candidate source
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.source.outputs.tag }}
+      commit: ${{ steps.source.outputs.commit }}
+      epoch: ${{ steps.source.outputs.epoch }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.18.0
+      - name: Bind the annotated release tag to protected main
+        id: source
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          SOURCE_TAG: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          commit=$(git rev-parse HEAD)
+          tag=v0.0.0-preview.1
+          if [[ "$EVENT_NAME" == push ]]; then
+            tag="$SOURCE_TAG"
+            node --input-type=module - "$tag" "$commit" <<'JS'
+          import { validateRequest } from './scripts/ci/verify-control-plane-assets.mjs';
+          validateRequest(process.argv[2], process.argv[3]);
+          JS
+            git fetch origin refs/heads/main:refs/remotes/origin/main "refs/tags/$tag:refs/tags/$tag"
+            test "$(git cat-file -t "$tag")" = tag
+            test "$(git rev-parse "$tag^{commit}")" = "$commit"
+            git merge-base --is-ancestor "$commit" origin/main
+          fi
+          printf 'tag=%s\ncommit=%s\nepoch=%s\n' "$tag" "$commit" "$(git show -s --format=%ct "$commit")" >> "$GITHUB_OUTPUT"
+      - run: node --test scripts/ci/documentation-candidate.test.mjs
+      - run: bash -n scripts/ci/publish-documentation-image.sh
+
+  candidate:
+    name: Build and smoke linux/${{ matrix.arch }} documentation
+    needs: source
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      SOURCE_TAG: ${{ needs.source.outputs.tag }}
+      SOURCE_COMMIT: ${{ needs.source.outputs.commit }}
+      SOURCE_DATE_EPOCH: ${{ needs.source.outputs.epoch }}
+      IMAGE_ARCH: ${{ matrix.arch }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.source.outputs.commit }}
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.18.0
+      - name: Build exact-source documentation without registry credentials
+        run: |
+          docker build --platform "linux/$IMAGE_ARCH" \
+            --build-arg "COLOSSUS_VERSION=$SOURCE_TAG" \
+            --build-arg "COLOSSUS_REVISION=$SOURCE_COMMIT" \
+            --build-arg "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH" \
+            --tag colossus-documentation:candidate \
+            --file deploy/documentation/Dockerfile .
+      - name: Test browse, search, portable links, and hardened runtime
+        run: node deploy/documentation/smoke.mjs colossus-documentation:candidate
+      - name: Retain only the actual tested image and source-bound candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          candidate_output="$RUNNER_TEMP/documentation-candidate"
+          mkdir -p "$candidate_output"
+          docker save colossus-documentation:candidate | gzip -n > "$candidate_output/Colossus-Documentation-${SOURCE_TAG}-linux-${IMAGE_ARCH}.docker.tar.gz"
+          node scripts/ci/documentation-candidate.mjs create "$candidate_output" "$SOURCE_TAG" "$SOURCE_COMMIT" "$IMAGE_ARCH"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: github.event_name == 'push'
+        with:
+          name: colossus-documentation-${{ matrix.arch }}
+          path: ${{ runner.temp }}/documentation-candidate/*
+          if-no-files-found: error
+          retention-days: 30
diff --git a/.github/workflows/documentation-image.yml b/.github/workflows/documentation-image.yml
new file mode 100644
index 000000000..dcbcd8529
--- /dev/null
+++ b/.github/workflows/documentation-image.yml
@@ -0,0 +1,112 @@
+name: Publish Documentation image
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Published stable or preview release tag
+        required: true
+        type: string
+  pull_request:
+    paths:
+      - .github/workflows/documentation-image.yml
+      - scripts/ci/documentation-*.mjs
+      - scripts/ci/publish-documentation-image.sh
+
+permissions: {}
+
+concurrency:
+  group: documentation-image-${{ github.event.release.tag_name || inputs.tag || github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  publisher-revision:
+    name: Resolve the protected main publisher
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      revision: ${{ steps.publisher.outputs.revision }}
+    steps:
+      - name: Use proposed code for tests or protected main for publication
+        id: publisher
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ "$EVENT_NAME" == pull_request ]]; then
+            revision="$GITHUB_SHA"
+          else
+            revision=$(gh api repos/obscuritylabs/Colossus/git/ref/heads/main --jq .object.sha)
+          fi
+          [[ "$revision" =~ ^[0-9a-f]{40}$ ]]
+          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
+
+  contracts:
+    name: Verify immutable documentation publication contracts
+    needs: publisher-revision
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.publisher-revision.outputs.revision }}
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.18.0
+      - run: node --test scripts/ci/documentation-candidate.test.mjs
+      - run: bash -n scripts/ci/publish-documentation-image.sh
+
+  publish:
+    name: Publish the tested documentation platform index
+    needs: [publisher-revision, contracts]
+    if: >-
+      github.repository == 'obscuritylabs/Colossus' &&
+      ((github.event_name == 'release' && github.event.release.draft == false) ||
+       (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      actions: read
+      contents: read
+      packages: write
+    steps:
+      - name: Use the same protected publisher revision that passed contracts
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.publisher-revision.outputs.revision }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.18.0
+      - name: Authenticate with a job-scoped package token
+        env:
+          GHCR_TOKEN: ${{ github.token }}
+          GHCR_USER: ${{ github.actor }}
+        run: printf '%s' "$GHCR_TOKEN" | docker login ghcr.io --username "$GHCR_USER" --password-stdin
+      - name: Verify release provenance, retained tested candidates, and immutable publication
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: bash scripts/ci/publish-documentation-image.sh
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: colossus-documentation-publication-${{ github.event.release.tag_name || inputs.tag }}
+          path: |
+            ${{ runner.temp }}/documentation-image/publication.json
+            ${{ runner.temp }}/documentation-image/provenance.json
+            ${{ runner.temp }}/documentation-image/trusted/*.json
+          if-no-files-found: error
+          retention-days: 30
+      - name: Remove the job-scoped registry session
+        if: always()
+        run: docker logout ghcr.io
diff --git a/.github/workflows/premerge.yml b/.github/workflows/premerge.yml
index a02d8ae9b..185bf5b48 100644
--- a/.github/workflows/premerge.yml
+++ b/.github/workflows/premerge.yml
@@ -177,9 +177,34 @@ jobs:
         run: >-
           cargo test --locked -p colossus-sidecar
           --test native_lifecycle -- --ignored --nocapture
+      - name: Exercise cloud connection through the native Managed Local grant
+        env:
+          COLOSSUS_ACCEPTANCE_SIDECAR: ${{ github.workspace }}/apps/desktop/src-tauri/binaries/colossus-sidecar-aarch64-apple-darwin
+        run: cargo test --locked -p colossus-cloud-server --lib managed_sidecar_cloud_run_isolated_and_application_exit_disconnects -- --ignored
       - name: Run native isolation and escape acceptance
         run: cargo test --locked -p colossus-cli --test native_sandbox -- --nocapture
 
+  linux-desktop:
+    name: Linux Desktop package and native credential entry
+    if: needs.eligibility.result == 'success'
+    needs: eligibility
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Build sealed Linux Desktop package and test native entry
+        run: docker build -f deploy/cloud/linux-desktop.Dockerfile --target artifacts --output type=local,dest=dist/desktop-linux .
+      - name: Verify Linux package checksums
+        working-directory: dist/desktop-linux
+        run: sha256sum --check ./*.sha256
+      - name: Retain Linux Desktop package
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-desktop-preview
+          path: dist/desktop-linux
+          retention-days: 7
+
   credential-vault:
     name: Credential vault (${{ matrix.os }})
     if: needs.eligibility.result == 'success'
@@ -475,7 +500,7 @@ jobs:
     if: needs.eligibility.result == 'success'
     needs: eligibility
     runs-on: windows-latest-l
-    timeout-minutes: 65
+    timeout-minutes: 75
     env:
       CARGO_INCREMENTAL: "0"
       CARGO_TARGET_DIR: ${{ github.workspace }}\apps\desktop\src-tauri\target
@@ -550,6 +575,20 @@ jobs:
         env:
           COLOSSUS_ACCEPTANCE_SIDECAR: ${{ github.workspace }}/apps/desktop/src-tauri/binaries/colossus-sidecar-x86_64-pc-windows-msvc.exe
         run: cargo test --locked --manifest-path apps/desktop/src-tauri/Cargo.toml --lib managed_runtime::credential_acceptance::native_vault_restarts_reach_managed_sidecar_mcp -- --ignored --exact
+      - name: Exercise Windows cloud transport and native Managed Local lifetime
+        id: cloud_native
+        if: steps.desktop_prepare.outcome == 'success'
+        continue-on-error: true
+        env:
+          COLOSSUS_ACCEPTANCE_SIDECAR: ${{ github.workspace }}/apps/desktop/src-tauri/binaries/colossus-sidecar-x86_64-pc-windows-msvc.exe
+        run: |
+          cargo test --locked -p colossus-cloud-server --lib oidc_to_runtime_prompt_approval_cancel_rotate_and_recover
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          cargo test --locked -p colossus-cloud-server --lib managed_sidecar_cloud_run_isolated_and_application_exit_disconnects -- --ignored
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          cargo test --locked -p colossus-sidecar --test windows_lifecycle -- --ignored
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          cargo test --locked -p colossus-cli --bin colossus public_api_admin::tests
       - name: Exercise Windows setup reset and uninstall credential cleanup
         if: steps.desktop_prepare.outcome == 'success'
         run: |
@@ -618,6 +657,7 @@ jobs:
           NATIVE_TEST_OUTCOME: ${{ steps.native_tests.outcome }}
           PLUGIN_RUNTIME_OUTCOME: ${{ steps.plugin_runtime.outcome }}
           APPROVAL_RUNTIME_OUTCOME: ${{ steps.approval_runtime.outcome }}
+          CLOUD_NATIVE_OUTCOME: ${{ steps.cloud_native.outcome }}
         run: |
           set -eu
           failed=
@@ -626,7 +666,8 @@ jobs:
             "desktop-clippy=$CLIPPY_OUTCOME" \
             "desktop-tests=$NATIVE_TEST_OUTCOME" \
             "desktop-plugin-runtime=$PLUGIN_RUNTIME_OUTCOME" \
-            "desktop-approval-runtime=$APPROVAL_RUNTIME_OUTCOME"
+            "desktop-approval-runtime=$APPROVAL_RUNTIME_OUTCOME" \
+            "desktop-cloud-native=$CLOUD_NATIVE_OUTCOME"
           do
             if test "${result#*=}" != success; then
               failed="$failed ${result%%=*}"
@@ -929,7 +970,7 @@ jobs:
   gate:
     name: Colossus pre-merge gate
     if: always()
-    needs: [eligibility, linux-rust-integration, macos-native, macos-desktop-acceptance, macos-desktop-bundle, windows-runtime, windows-desktop, credential-vault, fuzz, supply-chain, chroma, storage, live-security]
+    needs: [eligibility, linux-rust-integration, linux-desktop, macos-native, macos-desktop-acceptance, macos-desktop-bundle, windows-runtime, windows-desktop, credential-vault, fuzz, supply-chain, chroma, storage, live-security]
     runs-on: ubuntu-slim
     timeout-minutes: 5
     steps:
@@ -943,6 +984,7 @@ jobs:
           RESULTS: >-
             eligibility=${{ needs.eligibility.result }}
             linux-rust-integration=${{ needs['linux-rust-integration'].result }}
+            linux-desktop=${{ needs['linux-desktop'].result }}
             macos=${{ needs['macos-native'].result }}
             macos-desktop-acceptance=${{ needs['macos-desktop-acceptance'].result }}
             macos-desktop-bundle=${{ needs['macos-desktop-bundle'].result }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 176758d01..4d6fdb368 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1186,6 +1186,114 @@ jobs:
           compression-level: 0
           retention-days: 14
 
+  control_plane:
+    name: Control Plane ${{ matrix.target }}
+    needs: validate
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-latest-m
+            target: x86_64-unknown-linux-gnu
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build the portable server and web image from pinned inputs
+        env:
+          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
+          SOURCE_COMMIT: ${{ needs.validate.outputs.source_commit }}
+        run: |
+          docker build --file deploy/control-plane/Dockerfile \
+            --label org.opencontainers.image.source=https://github.com/obscuritylabs/Colossus \
+            --label "org.opencontainers.image.revision=$SOURCE_COMMIT" \
+            --label "org.opencontainers.image.version=$RELEASE_TAG" \
+            --tag colossus-control-plane:release .
+      - name: Smoke the actual unprivileged image
+        run: |
+          test "$(docker image inspect colossus-control-plane:release --format '{{.Config.User}}')" = 10001:10001
+          docker run --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges colossus-control-plane:release --version
+          docker run --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges colossus-control-plane:release --help
+      - name: Package matching server, web, deployment, and offline Docker assets
+        env:
+          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
+          TARGET: ${{ matrix.target }}
+          SOURCE_DATE_EPOCH: ${{ needs.validate.outputs.source_date_epoch }}
+        run: |
+          set -euo pipefail
+          stage="$RUNNER_TEMP/control-plane-stage"
+          output="$RUNNER_TEMP/control-plane-release"
+          mkdir -p "$stage/bin" "$stage/web" "$stage/deploy" "$output"
+          container=$(docker create colossus-control-plane:release)
+          trap 'docker rm "$container" >/dev/null 2>&1 || true' EXIT
+          docker cp "$container:/usr/local/bin/colossus-control-plane" "$stage/bin/"
+          docker cp "$container:/opt/colossus/web/." "$stage/web/"
+          cp -R deploy/control-plane/. "$stage/deploy/"
+          cp LICENSE "$stage/"
+          cp docs/admin/cloud-control-plane.md "$stage/README.md"
+          archive="Colossus-Control-Plane-${RELEASE_TAG}-${TARGET}.tar.gz"
+          tar --sort=name --mtime="@${SOURCE_DATE_EPOCH}" --owner=0 --group=0 --numeric-owner -czf "$output/$archive" -C "$stage" .
+          image="Colossus-Control-Plane-${RELEASE_TAG}-${TARGET}.docker.tar.gz"
+          docker save colossus-control-plane:release | gzip -n > "$output/$image"
+          (cd "$output" && sha256sum "$archive" > "$archive.sha256" && sha256sum "$image" > "$image.sha256")
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: colossus-control-plane-${{ matrix.target }}
+          path: ${{ runner.temp }}/control-plane-release/*
+          if-no-files-found: error
+          retention-days: 30
+
+  vscode:
+    name: VSIX ${{ matrix.target }}
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [linux-x64, linux-arm64, darwin-x64, darwin-arm64, win32-x64, win32-arm64]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.18.0
+          cache: npm
+          cache-dependency-path: apps/vscode/package-lock.json
+      - name: Check and build the shared extension
+        run: |
+          cd sdk/typescript
+          npm ci --ignore-scripts
+          npm run build
+          cd ../../apps/vscode
+          npm ci --ignore-scripts --legacy-peer-deps --install-links
+          npm run check
+          npm run build
+      - name: Package the locked native binding for the exact VS Code target
+        env:
+          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          set -euo pipefail
+          cd apps/vscode
+          node scripts/package.mjs "$TARGET"
+          version=$(node -p "require('./package.json').version")
+          output="$RUNNER_TEMP/vsix-release"
+          mkdir -p "$output"
+          asset="Colossus-VSCode-${RELEASE_TAG}-${TARGET}.vsix"
+          cp "artifacts/colossus-${TARGET}-${version}.vsix" "$output/$asset"
+          (cd "$output" && sha256sum "$asset" > "$asset.sha256")
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: colossus-vsix-${{ matrix.target }}
+          path: ${{ runner.temp }}/vsix-release/*
+          if-no-files-found: error
+
   gate:
     name: Colossus release gate
     if: always()
@@ -1200,6 +1308,8 @@ jobs:
         desktop_macos,
         desktop_windows_preview,
         desktop_windows_signed,
+        control_plane,
+        vscode,
       ]
     runs-on: ubuntu-slim
     timeout-minutes: 5
@@ -1222,7 +1332,9 @@ jobs:
           set -euo pipefail
           ./scripts/ci/require-success.sh \
             validate=${{ needs.validate.result }} \
-            artifacts=${{ needs.artifacts.result }}
+            artifacts=${{ needs.artifacts.result }} \
+            control_plane=${{ needs.control_plane.result }} \
+            vscode=${{ needs.vscode.result }}
           if [ "$TEST_RELEASE" = true ]; then
             test "$TARGET_CHANNEL" = developer_preview
             test "$BOOTSTRAP_RESULT" = skipped
@@ -1293,7 +1405,7 @@ jobs:
           set -euo pipefail
           case "$RELEASE_CHANNEL" in
             stable)
-              test "$(find dist -maxdepth 1 -type f | wc -l | tr -d ' ')" -eq 25
+              test "$(find dist -maxdepth 1 -type f | wc -l | tr -d ' ')" -eq 45
               windows="Colossus-Desktop-STABLE-${RELEASE_TAG}-x86_64-pc-windows-msvc-setup.exe"
               test -f "dist/$windows"
               test -f "dist/$windows.sha256"
@@ -1314,9 +1426,9 @@ jobs:
                 "$sdk_dir" "$RELEASE_VERSION" "$SOURCE_COMMIT"
               ;;
             developer_preview)
-              expected_assets=22
+              expected_assets=42
               if [ "$TEST_RELEASE" = true ]; then
-                expected_assets=18
+                expected_assets=38
               fi
               test "$(find dist -maxdepth 1 -type f | wc -l | tr -d ' ')" -eq "$expected_assets"
               desktop="Colossus-Desktop-DEVELOPER-PREVIEW-${RELEASE_TAG}-aarch64-apple-darwin.zip"
@@ -1343,6 +1455,16 @@ jobs:
               test -f "dist/$bootstrap_asset"
             done
           fi
+          for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
+            test -f "dist/Colossus-Control-Plane-${RELEASE_TAG}-${target}.tar.gz"
+            test -f "dist/Colossus-Control-Plane-${RELEASE_TAG}-${target}.tar.gz.sha256"
+            test -f "dist/Colossus-Control-Plane-${RELEASE_TAG}-${target}.docker.tar.gz"
+            test -f "dist/Colossus-Control-Plane-${RELEASE_TAG}-${target}.docker.tar.gz.sha256"
+          done
+          for target in linux-x64 linux-arm64 darwin-x64 darwin-arm64 win32-x64 win32-arm64; do
+            test -f "dist/Colossus-VSCode-${RELEASE_TAG}-${target}.vsix"
+            test -f "dist/Colossus-VSCode-${RELEASE_TAG}-${target}.vsix.sha256"
+          done
           for checksum in dist/*.sha256; do
             (cd dist && sha256sum --check --strict "$(basename "$checksum")")
           done
diff --git a/.gitignore b/.gitignore
index 65e309128..c1e648481 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,6 +14,8 @@ apps/desktop/design-qa-*.jpg
 apps/desktop/research-settings-qa/
 apps/desktop/artifact-audit/
 .env
+**/development-credentials/
+**/.authority-key.env
 .colossus/config.yaml
 .colossus/config.dev.yaml
 .colossus/dev-keys.env
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8c5a05dc..78bbc9f18 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,15 @@ include breaking changes while the public API is still settling.
 
 ### Added
 
+- Colossus Control Plane with independent PostgreSQL persistence, users, named OIDC
+  and optional local sign-in, explicit project roles/hierarchy, and administration.
+- Fleet agents, workspace/thread navigation, retained realtime conversations, shared
+  Desktop/VS Code/web Markdown and composer components, and shadcn task tables.
+- Project analytics, runtime-reported policy inspection and monitoring baselines,
+  configurable classification markings, and global Desktop connection profiles.
+- Linux Control Plane server/web bundles and offline Docker images, six platform
+  VSIX packages, and verified multi-platform server container publication.
+
 - Workspace workflow schedule management with definition import, reviewed creation,
   pause/enable controls, and independent run inspection.
 - Separate Workflows library with manual runs, schema-based inputs, owned history, and
diff --git a/Cargo.lock b/Cargo.lock
index 7079d131e..1965925d9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -235,6 +235,18 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
 [[package]]
 name = "arraydeque"
 version = "0.5.1"
@@ -461,10 +473,13 @@ checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core",
  "bytes",
+ "form_urlencoded",
  "futures-util",
  "http",
  "http-body",
  "http-body-util",
+ "hyper",
+ "hyper-util",
  "itoa",
  "matchit",
  "memchr",
@@ -472,10 +487,15 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
  "sync_wrapper",
+ "tokio",
  "tower",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -494,6 +514,7 @@ dependencies = [
  "sync_wrapper",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -502,6 +523,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -524,6 +551,18 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bb8"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "457d7ed3f888dfd2c7af56d4975cade43c622f74bdcddfed6d4352f57acc6310"
+dependencies = [
+ "futures-util",
+ "parking_lot",
+ "portable-atomic",
+ "tokio",
+]
+
 [[package]]
 name = "bindgen"
 version = "0.72.1"
@@ -601,6 +640,15 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -666,7 +714,7 @@ version = "3.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dee98b0db6a962de883bf5d20362dee4d7ca0d12fe39a7c6c73c844e1cd7c1f"
 dependencies = [
- "darling",
+ "darling 0.23.0",
  "ident_case",
  "prettyplease",
  "proc-macro2",
@@ -1023,7 +1071,7 @@ name = "colossus-api"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-contracts",
  "colossus-ports",
  "colossus-testkit",
@@ -1055,7 +1103,7 @@ name = "colossus-api-runtime"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-agent",
  "colossus-api",
  "colossus-contracts",
@@ -1085,7 +1133,7 @@ name = "colossus-audit"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-contracts",
  "colossus-journal-redb",
  "colossus-policy",
@@ -1118,7 +1166,7 @@ name = "colossus-bundles"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-contracts",
  "colossus-policy",
  "ed25519-dalek",
@@ -1138,16 +1186,19 @@ version = "0.11.7"
 dependencies = [
  "agent-client-protocol",
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "clap",
  "colossus-access",
  "colossus-api",
  "colossus-bundles",
  "colossus-codex-auth",
+ "colossus-connector",
  "colossus-contracts",
+ "colossus-credentials",
  "colossus-darwin-process",
  "colossus-grpc",
  "colossus-home",
+ "colossus-journal-redb",
  "colossus-native-dictation",
  "colossus-observability",
  "colossus-plugins",
@@ -1190,11 +1241,128 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "colossus-cloud"
+version = "0.11.7"
+dependencies = [
+ "async-trait",
+ "colossus-cloud-protocol",
+ "colossus-contracts",
+ "colossus-ports",
+ "colossus-sdk",
+ "hex",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "tempfile",
+ "thiserror 2.0.18",
+ "time",
+ "tokio",
+ "uuid",
+]
+
+[[package]]
+name = "colossus-cloud-postgres"
+version = "0.11.7"
+dependencies = [
+ "async-trait",
+ "colossus-cloud",
+ "colossus-cloud-protocol",
+ "colossus-network",
+ "colossus-ports",
+ "colossus-sdk",
+ "diesel",
+ "diesel-async",
+ "ed25519-dalek",
+ "futures",
+ "hex",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "time",
+ "tokio",
+ "tokio-postgres",
+ "tokio-postgres-rustls",
+ "uuid",
+ "webpki-roots",
+ "zeroize",
+]
+
+[[package]]
+name = "colossus-cloud-protocol"
+version = "0.11.7"
+dependencies = [
+ "colossus-sdk",
+ "prost",
+ "protoc-bin-vendored",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+ "tonic",
+ "tonic-prost",
+ "tonic-prost-build",
+]
+
+[[package]]
+name = "colossus-cloud-server"
+version = "0.11.7"
+dependencies = [
+ "argon2",
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "chacha20poly1305",
+ "chrono",
+ "colossus-api",
+ "colossus-api-runtime",
+ "colossus-cloud",
+ "colossus-cloud-postgres",
+ "colossus-cloud-protocol",
+ "colossus-connector",
+ "colossus-contracts",
+ "colossus-credentials",
+ "colossus-home",
+ "colossus-journal-postgres",
+ "colossus-journal-redb",
+ "colossus-network",
+ "colossus-policy",
+ "colossus-ports",
+ "colossus-runtime",
+ "colossus-sdk",
+ "colossus-testkit",
+ "futures",
+ "getrandom 0.4.3",
+ "hex",
+ "keyring",
+ "openidconnect",
+ "p256",
+ "rcgen",
+ "reqwest 0.12.28",
+ "rustls",
+ "serde",
+ "serde-saphyr",
+ "serde_json",
+ "sha2 0.10.9",
+ "tempfile",
+ "time",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tonic",
+ "tower",
+ "tower-http",
+ "url",
+ "uuid",
+ "zeroize",
+]
+
 [[package]]
 name = "colossus-codex-auth"
 version = "0.11.7"
 dependencies = [
- "base64",
+ "base64 0.22.1",
+ "colossus-home",
  "colossus-windows-native",
  "directories",
  "fs4",
@@ -1208,6 +1376,36 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "colossus-connector"
+version = "0.11.7"
+dependencies = [
+ "async-trait",
+ "clap",
+ "colossus-cloud-protocol",
+ "colossus-contracts",
+ "colossus-credentials",
+ "colossus-home",
+ "colossus-ports",
+ "colossus-sdk",
+ "fs4",
+ "futures",
+ "hex",
+ "rcgen",
+ "reqwest 0.12.28",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "tempfile",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "url",
+ "uuid",
+ "x509-parser",
+ "zeroize",
+]
+
 [[package]]
 name = "colossus-context"
 version = "0.11.7"
@@ -1244,7 +1442,7 @@ name = "colossus-credentials"
 version = "0.11.7"
 dependencies = [
  "apple-native-keyring-store",
- "base64",
+ "base64 0.22.1",
  "chacha20poly1305",
  "colossus-contracts",
  "colossus-home",
@@ -1290,7 +1488,7 @@ dependencies = [
 name = "colossus-grpc"
 version = "0.11.7"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "colossus-api",
  "colossus-api-proto",
  "colossus-contracts",
@@ -1393,7 +1591,7 @@ dependencies = [
 name = "colossus-journal-redb"
 version = "0.11.7"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "chacha20poly1305",
  "colossus-contracts",
  "colossus-memory",
@@ -1430,7 +1628,7 @@ name = "colossus-mcp"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "chacha20poly1305",
  "colossus-contracts",
  "colossus-network",
@@ -1468,7 +1666,7 @@ name = "colossus-media"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-contracts",
  "colossus-ports",
  "colossus-testkit",
@@ -1578,7 +1776,7 @@ dependencies = [
 name = "colossus-plugins"
 version = "0.11.7"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "colossus-contracts",
  "colossus-journal-redb",
  "colossus-network",
@@ -1611,7 +1809,7 @@ name = "colossus-policy"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-contracts",
  "colossus-network",
  "colossus-ports",
@@ -1680,7 +1878,7 @@ name = "colossus-provider"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-codex-auth",
  "colossus-contracts",
  "colossus-network",
@@ -1726,7 +1924,7 @@ name = "colossus-runtime"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-access",
  "colossus-agent",
  "colossus-audit",
@@ -1790,9 +1988,10 @@ name = "colossus-sandbox"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "capctl",
  "colossus-contracts",
+ "colossus-home",
  "colossus-network",
  "colossus-policy",
  "colossus-ports",
@@ -1826,7 +2025,7 @@ name = "colossus-sdk"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-api",
  "colossus-api-proto",
  "colossus-api-runtime",
@@ -2054,7 +2253,7 @@ name = "colossus-worker"
 version = "0.11.7"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.22.1",
  "colossus-api",
  "colossus-api-proto",
  "colossus-api-runtime",
@@ -2087,7 +2286,7 @@ dependencies = [
 name = "colossus-worker-protocol"
 version = "0.11.7"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "colossus-contracts",
  "getrandom 0.4.3",
  "hex",
@@ -2429,14 +2628,38 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "darling"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
+dependencies = [
+ "darling_core 0.21.3",
+ "darling_macro 0.21.3",
+]
+
 [[package]]
 name = "darling"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
 dependencies = [
- "darling_core",
- "darling_macro",
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -2452,13 +2675,24 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "darling_macro"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
+dependencies = [
+ "darling_core 0.21.3",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
- "darling_core",
+ "darling_core 0.23.0",
  "quote",
  "syn 2.0.118",
 ]
@@ -2582,6 +2816,57 @@ dependencies = [
  "unicode-xid",
 ]
 
+[[package]]
+name = "diesel"
+version = "2.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3b934ddbdcb2abb9f9fc9c30bd47bcc5618b615eea1d334cda5fdf8ff9b072a"
+dependencies = [
+ "bitflags 2.13.0",
+ "byteorder",
+ "diesel_derives",
+ "downcast-rs 2.0.2",
+ "itoa",
+ "serde_json",
+]
+
+[[package]]
+name = "diesel-async"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd39af30158d444884f166fe4c58f35dc40ad71ad017bb59408a3448526ff4bd"
+dependencies = [
+ "bb8",
+ "diesel",
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+ "tokio-postgres",
+]
+
+[[package]]
+name = "diesel_derives"
+version = "2.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecbd51fb6c020672543641167efa4e6417ff7ad76849ed556ace3595e72de03a"
+dependencies = [
+ "diesel_table_macro_syntax",
+ "dsl_auto_type",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
+[[package]]
+name = "diesel_table_macro_syntax"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe2444076b48641147115697648dc743c2c00b61adade0f01ce67133c7babe8c"
+dependencies = [
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -2669,6 +2954,20 @@ version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
 
+[[package]]
+name = "dsl_auto_type"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd122633e4bef06db27737f21d3738fb89c8f6d5360d6d9d7635dda142a7757e"
+dependencies = [
+ "darling 0.21.3",
+ "either",
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -2738,6 +3037,7 @@ dependencies = [
  "ff",
  "generic-array",
  "group",
+ "hkdf",
  "pem-rfc7468",
  "pkcs8",
  "rand_core 0.6.4",
@@ -3387,6 +3687,12 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -3466,7 +3772,7 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-util",
@@ -3731,7 +4037,7 @@ version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5eb2d60ef19920a3a9193c3e371f726ec1dafc045dac788d0fb3704272458971"
 dependencies = [
- "darling",
+ "darling 0.23.0",
  "indoc",
  "proc-macro2",
  "quote",
@@ -3759,6 +4065,15 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
+[[package]]
+name = "itertools"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -3912,7 +4227,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d46662859bc5f60a145b75f4632fbadc84e829e45df6c5de74cfc8e05acb96b5"
 dependencies = [
  "ahash",
- "base64",
+ "base64 0.22.1",
  "bytecount",
  "email_address",
  "fancy-regex",
@@ -3980,6 +4295,9 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin",
+]
 
 [[package]]
 name = "levenshtein_automata"
@@ -4166,6 +4484,16 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -4367,6 +4695,22 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.7",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-cmp"
 version = "0.1.0"
@@ -4476,11 +4820,12 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "chrono",
  "getrandom 0.2.17",
  "http",
  "rand 0.8.7",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
  "serde_path_to_error",
@@ -4631,6 +4976,37 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
+[[package]]
+name = "openidconnect"
+version = "4.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d8c6709ba2ea764bbed26bce1adf3c10517113ddea6f2d4196e4851757ef2b2"
+dependencies = [
+ "base64 0.21.7",
+ "chrono",
+ "dyn-clone",
+ "ed25519-dalek",
+ "hmac 0.12.1",
+ "http",
+ "itertools 0.10.5",
+ "log",
+ "oauth2",
+ "p256",
+ "p384",
+ "rand 0.8.7",
+ "rsa",
+ "serde",
+ "serde-value",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_plain",
+ "serde_with",
+ "sha2 0.10.9",
+ "subtle",
+ "thiserror 1.0.69",
+ "url",
+]
+
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -4732,6 +5108,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
+[[package]]
+name = "ordered-float"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f19d67e5a2795c94e73e0bb1cc1a7edeb2e28efd39e2e1c9b7a40c1108b11c"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "ordered-float"
 version = "5.3.0"
@@ -4778,6 +5163,18 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
 [[package]]
 name = "palette"
 version = "0.7.6"
@@ -4832,13 +5229,24 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "pem"
 version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "serde_core",
 ]
 
@@ -4924,6 +5332,17 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
@@ -5034,7 +5453,7 @@ version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "byteorder",
  "bytes",
  "fallible-iterator",
@@ -5290,7 +5709,7 @@ dependencies = [
  "bytemuck",
  "libm",
  "num-traits",
- "ordered-float",
+ "ordered-float 5.3.0",
  "palette",
  "rand 0.10.2",
  "rand_xoshiro",
@@ -5738,7 +6157,7 @@ version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
@@ -5781,7 +6200,7 @@ version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
@@ -5865,6 +6284,26 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rubato"
 version = "0.16.2"
@@ -6230,7 +6669,7 @@ checksum = "7bd22781911de0ca6debda95f073c8f18bec65d1a94f1fa9573f3102e514cea4"
 dependencies = [
  "ahash",
  "annotate-snippets",
- "base64",
+ "base64 0.22.1",
  "encoding_rs_io",
  "getrandom 0.3.4",
  "granit-parser",
@@ -6241,6 +6680,16 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde-value"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
+dependencies = [
+ "ordered-float 2.10.1",
+ "serde",
+]
+
 [[package]]
 name = "serde_core"
 version = "1.0.228"
@@ -6319,6 +6768,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "serde_plain"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1fc6db65a611022b23a0dec6975d63fb80a302cb3388835ff02c097258d50"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_repr"
 version = "0.1.20"
@@ -6378,7 +6836,7 @@ version = "3.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bs58",
  "chrono",
  "hex",
@@ -6399,7 +6857,7 @@ version = "3.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
 dependencies = [
- "darling",
+ "darling 0.23.0",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -6533,7 +6991,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94ba33ef96bafd16f5dfc954113c37a689dcf721816d11680667626b1ebb0496"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "hex",
  "serde",
  "serde_json",
@@ -6551,7 +7009,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ecc48bf9facc710e772b3e7ab6a3ebc81c34be208a6ebf6c872d0ccbb8b52f"
 dependencies = [
  "aws-lc-rs",
- "base64",
+ "base64 0.22.1",
  "const-oid 0.9.6",
  "der",
  "digest 0.10.7",
@@ -6572,7 +7030,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f6fc5c295b5b9fa929e38acc53b29c8ed9ba3ee93e5fa87e7daa44072f0b26e"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "hex",
  "sigstore-crypto",
  "sigstore-types",
@@ -6585,7 +7043,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ece0d614b93c94e2ddab5c2142959396ce5a5f1d315435779e8ce0f9da250f5d"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "hex",
  "reqwest 0.13.4",
  "serde",
@@ -6603,7 +7061,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a91dbe81d236075c568926b5540d86dbc0e272cd0c6cfc5523e35d5200e71cf0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "directories",
  "hex",
  "jiff",
@@ -6626,7 +7084,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a04c841cdc52fc5da6284d6aa1fbf93f6b65d71437b2cc04751d117eac8aa33"
 dependencies = [
  "aws-lc-rs",
- "base64",
+ "base64 0.22.1",
  "cmpv2",
  "cms",
  "const-oid 0.9.6",
@@ -6673,7 +7131,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a48661f5c7a4f7496de80865e5b258adac0bc514164e6c944b93b65ba5de334b"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "hex",
  "pem",
  "serde",
@@ -6687,7 +7145,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c4fed99a3609ebb236284b781674d8c45beea93bbc823ef2facd2261b3801c7"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "cms",
  "const-oid 0.9.6",
  "hex",
@@ -6770,6 +7228,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -6925,7 +7389,7 @@ checksum = "edde6a10743fff00a4e1a8c9ef020bf5f3cbad301b7d2d39f2b07f123c4eac07"
 dependencies = [
  "aho-corasick",
  "arc-swap",
- "base64",
+ "base64 0.22.1",
  "bitpacking",
  "bon",
  "byteorder",
@@ -7027,7 +7491,7 @@ checksum = "dfadb8526b6da90704feb293b0701a6aae62ea14983143344be2dc5ce30f1d82"
 dependencies = [
  "fnv",
  "nom",
- "ordered-float",
+ "ordered-float 5.3.0",
  "serde",
  "serde_json",
 ]
@@ -7424,7 +7888,7 @@ checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
  "async-trait",
  "axum",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "h2",
  "http",
@@ -7524,10 +7988,19 @@ checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags 2.13.0",
  "bytes",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
  "pin-project-lite",
+ "tokio",
+ "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
@@ -7552,6 +8025,7 @@ version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
diff --git a/Cargo.toml b/Cargo.toml
index 114c3d209..b064082bf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,11 @@
 [workspace]
 resolver = "3"
 members = [
+    "crates/colossus-cloud",
+    "crates/colossus-cloud-postgres",
+    "crates/colossus-cloud-server",
+    "crates/colossus-connector",
+    "crates/colossus-cloud-protocol",
     "xtask",
     "crates/colossus-domain",
     "crates/colossus-contracts",
@@ -69,8 +74,20 @@ repository = "https://github.com/obscuritylabs/Colossus"
 publish-sdks = false
 
 [workspace.dependencies]
+chrono = "0.4.44"
+openidconnect = { version = "4.0.1", default-features = false, features = ["reqwest", "rustls-tls"] }
+colossus-connector = { version = "=0.11.7", path = "crates/colossus-connector" }
+colossus-cloud-server = { version = "=0.11.7", path = "crates/colossus-cloud-server" }
+axum = { version = "0.8.9", features = ["json", "tokio", "http1", "http2"] }
+colossus-cloud-protocol = { version = "=0.11.7", path = "crates/colossus-cloud-protocol" }
+colossus-cloud = { version = "=0.11.7", path = "crates/colossus-cloud" }
+colossus-cloud-postgres = { version = "=0.11.7", path = "crates/colossus-cloud-postgres" }
+diesel = { version = "2.3.13", default-features = false, features = ["postgres_backend", "serde_json"] }
+diesel-async = { version = "0.9.2", features = ["postgres", "bb8"] }
+tokio-postgres = { version = "0.7.16", features = ["with-serde_json-1"] }
 agent-client-protocol = "=2.2.0"
 colossus-bundled-plugins = { version = "=0.11.7", path = "crates/colossus-bundled-plugins" }
+argon2 = { version = "0.5.3", features = ["std"] }
 async-trait = "0.1.89"
 async-recursion = "1.1.1"
 base64 = "0.22.1"
diff --git a/api/colossus/api/v1alpha1/agent_run.proto b/api/colossus/api/v1alpha1/agent_run.proto
index ee447987e..bb0e6d9cb 100644
--- a/api/colossus/api/v1alpha1/agent_run.proto
+++ b/api/colossus/api/v1alpha1/agent_run.proto
@@ -47,6 +47,13 @@ service AgentRunService {
 
   // RespondInteraction answers one caller-bound prompt or approval exactly once.
   rpc RespondInteraction(RespondInteractionRequest) returns (RespondInteractionResponse);
+
+  // The local application explicitly releases its own workspace sessions.
+  rpc SetWorkspaceSharing(SetWorkspaceSharingRequest) returns (SetWorkspaceSharingResponse);
+  // Discovery includes only owned or explicitly shared released runs.
+  rpc ListVisibleRuns(ListVisibleRunsRequest) returns (ListVisibleRunsResponse);
+  // Caller-scoped configuration metadata; never an enforcement attestation or raw config.
+  rpc GetRuntimePolicyPosture(GetRuntimePolicyPostureRequest) returns (GetRuntimePolicyPostureResponse);
 }
 
 // RunMode selects the runtime's public execution mode.
@@ -1124,3 +1131,58 @@ message StopProcessSessionResponse {
   // Bounded process snapshot.
   ProcessSessionSnapshot snapshot = 1;
 }
+
+// Change the authenticated application's local workspace disclosure relationship.
+message SetWorkspaceSharingRequest {
+  // Exact independently enrolled recipient application identity.
+  string recipient_application_id = 1;
+  // Release source-owned sessions, or revoke future reads.
+  bool enabled = 2;
+  // Permit recipient-owned runs to continue source sessions under its own grant.
+  bool allow_continuation = 3;
+}
+// Durable local sharing posture. Enrollment alone does not enable sharing.
+message SetWorkspaceSharingResponse {
+  // Exact recipient application identity.
+  string recipient_application_id = 1;
+  // Whether released source sessions are visible to the recipient.
+  bool enabled = 2;
+  // Whether recipient-owned runs may continue shared sessions.
+  bool allow_continuation = 3;
+}
+// Bounded discovery filters for caller-owned and explicitly shared runs.
+message ListVisibleRunsRequest {
+  // Optional exact session identity within the released source scope.
+  optional string session_id = 1;
+  // Distinct optional lifecycle states; empty includes all states.
+  repeated RunStatus statuses = 2;
+  // Bounded page size and opaque source-stable continuation cursor.
+  PageRequest page = 3;
+  // Include shared and owned archived threads.
+  bool include_archived = 4;
+}
+// Released run and authority derived by the authenticated runtime.
+message VisibleRun {
+  // Public run projection; never private worker data.
+  Run run = 1;
+  // Whether this caller owns cancellation and interaction response authority.
+  bool controllable = 2;
+  // Whether the caller may continue this session using its own grant.
+  bool continuable = 3;
+}
+// Bounded source-stable page of owned and explicitly shared runs.
+message ListVisibleRunsResponse {
+  // Runtime-authorized released run projections.
+  repeated VisibleRun runs = 1;
+  // Opaque continuation cursor bound to current sharing relationships.
+  PageResponse page = 2;
+}
+
+// Requests current metadata beneath the authenticated application ceiling.
+message GetRuntimePolicyPostureRequest {}
+
+// Contains one closed, validated metadata-only RuntimePolicyPosture contract.
+message GetRuntimePolicyPostureResponse {
+  // Strict RuntimePolicyPosture JSON, at most64KiB; unknown fields are rejected by SDKs.
+  bytes policy_json = 1;
+}
diff --git a/apps/desktop/native-credential-ui/Cargo.toml b/apps/desktop/native-credential-ui/Cargo.toml
index 8b03862c5..be424486d 100644
--- a/apps/desktop/native-credential-ui/Cargo.toml
+++ b/apps/desktop/native-credential-ui/Cargo.toml
@@ -49,6 +49,9 @@ objc2-foundation = { version = "0.3.2", default-features = false, features = [
     "std", "NSDate", "NSFormatter", "NSGeometry", "NSNotification", "NSObject", "NSString", "NSThread", "NSTimer",
 ] }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+gtk = "=0.18.2"
+
 [lints.clippy]
 all = "warn"
 pedantic = "warn"
diff --git a/apps/desktop/native-credential-ui/src/appearance.rs b/apps/desktop/native-credential-ui/src/appearance.rs
index a6611b9ea..a890c56d9 100644
--- a/apps/desktop/native-credential-ui/src/appearance.rs
+++ b/apps/desktop/native-credential-ui/src/appearance.rs
@@ -18,7 +18,7 @@ pub enum TextSize {
     Large,
 }
 
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 impl TextSize {
     pub(crate) const fn root_pixels(self) -> i32 {
         match self {
@@ -42,28 +42,28 @@ pub struct DialogAppearance {
 }
 
 #[derive(Clone, Copy)]
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 pub(crate) struct Palette {
     pub surface: u32,
     pub control: u32,
     pub text: u32,
     pub strong: u32,
     pub muted: u32,
-    #[cfg(windows)]
+    #[cfg(any(windows, target_os = "linux"))]
     pub border: u32,
     pub accent: u32,
-    #[cfg(windows)]
+    #[cfg(any(windows, target_os = "linux"))]
     pub accent_hover: u32,
-    #[cfg(windows)]
+    #[cfg(any(windows, target_os = "linux"))]
     pub on_accent: u32,
-    #[cfg(windows)]
+    #[cfg(any(windows, target_os = "linux"))]
     pub hover: u32,
     pub danger: u32,
-    #[cfg(windows)]
+    #[cfg(any(windows, target_os = "linux"))]
     pub focus: u32,
 }
 
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 impl DialogAppearance {
     pub(crate) const fn palette(self) -> Palette {
         match self.color_scheme {
@@ -74,20 +74,20 @@ impl DialogAppearance {
                 strong: 0xf7_fa_ff,
                 muted: 0x91_a2_b8,
 
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 border: 0x2b_42_60,
                 accent: 0x43_89_ff,
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 accent_hover: 0x55_94_ff,
 
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 on_accent: 0x07_10_1d,
 
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 hover: 0x18_2b_41,
 
                 danger: 0xff_ad_b3,
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 focus: 0x45_c8_ed,
             },
             ColorScheme::System | ColorScheme::Light => Palette {
@@ -97,20 +97,20 @@ impl DialogAppearance {
                 strong: 0x10_20_33,
                 muted: 0x52_65_7a,
 
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 border: 0xb8_c7_d8,
                 accent: 0x25_63_d9,
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 accent_hover: 0x1d_4f_b8,
 
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 on_accent: 0xff_ff_ff,
 
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 hover: 0xe6_ed_f6,
 
                 danger: 0x96_2d_3a,
-                #[cfg(windows)]
+                #[cfg(any(windows, target_os = "linux"))]
                 focus: 0x08_7d_a1,
             },
         }
diff --git a/apps/desktop/native-credential-ui/src/lib.rs b/apps/desktop/native-credential-ui/src/lib.rs
index 9e9b8a662..a0d5f4795 100644
--- a/apps/desktop/native-credential-ui/src/lib.rs
+++ b/apps/desktop/native-credential-ui/src/lib.rs
@@ -5,12 +5,15 @@
 //! the displayed control contents can be explicitly cleared here.
 
 mod appearance;
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 mod lifecycle;
 mod prompt;
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 mod validation;
 
+#[cfg(target_os = "linux")]
+mod linux;
+
 #[cfg(target_os = "macos")]
 mod macos;
 #[cfg(windows)]
diff --git a/apps/desktop/native-credential-ui/src/linux.rs b/apps/desktop/native-credential-ui/src/linux.rs
new file mode 100644
index 000000000..174776583
--- /dev/null
+++ b/apps/desktop/native-credential-ui/src/linux.rs
@@ -0,0 +1,256 @@
+//! Owned GTK password entry on Tauri's existing UI thread; no nested event loop.
+use crate::{DialogAppearance, PromptError, lifecycle::Completion, validation};
+use colossus_contracts::HostSecret;
+use gtk::{glib, prelude::*};
+use std::{
+    cell::RefCell,
+    rc::Rc,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+use zeroize::Zeroizing;
+
+mod styling;
+
+pub(crate) fn open(
+    parent: &tauri::Window,
+    cancelled: Arc<AtomicBool>,
+    completion: Completion,
+    appearance: DialogAppearance,
+) {
+    let Ok(parent) = parent.gtk_window() else {
+        completion.finish(Err(PromptError::Unavailable));
+        return;
+    };
+    let _ = create(parent.upcast_ref(), cancelled, completion, appearance);
+}
+
+fn create(
+    parent: &gtk::Window,
+    cancelled: Arc<AtomicBool>,
+    completion: Completion,
+    appearance: DialogAppearance,
+) -> Result<(gtk::Dialog, gtk::Entry), PromptError> {
+    let dialog = gtk::Dialog::builder()
+        .title("Save a credential")
+        .transient_for(parent)
+        .modal(true)
+        .destroy_with_parent(true)
+        .default_width(styling::pixels(appearance, 520))
+        .resizable(false)
+        .build();
+    dialog.add_button("Cancel", gtk::ResponseType::Cancel);
+    dialog.add_button("Save credential", gtk::ResponseType::Accept);
+    dialog.set_default_response(gtk::ResponseType::Accept);
+    let content = dialog.content_area();
+    styling::content(&content, appearance);
+    let description = gtk::Label::new(Some(
+        "This token stays in native credential storage and is never sent to the app's web view.",
+    ));
+    description.set_line_wrap(true);
+    description.set_xalign(0.0);
+    description
+        .style_context()
+        .add_class("credential-description");
+    let label = gtk::Label::new(Some("_Token"));
+    label.set_use_underline(true);
+    label.set_xalign(0.0);
+    label.style_context().add_class("credential-label");
+    let entry = gtk::Entry::new();
+    entry.set_visibility(false);
+    entry.set_input_purpose(gtk::InputPurpose::Password);
+    entry.set_activates_default(true);
+    label.set_mnemonic_widget(Some(&entry));
+    // GTK's password controls already suppress copying. Keep that guarantee
+    // explicit for keyboard/menu signal paths without changing the user's clipboard.
+    entry.connect_copy_clipboard(|entry| entry.stop_signal_emission_by_name("copy-clipboard"));
+    entry.connect_cut_clipboard(|entry| entry.stop_signal_emission_by_name("cut-clipboard"));
+    let error = gtk::Label::new(None);
+    error.set_line_wrap(true);
+    error.set_xalign(0.0);
+    error.style_context().add_class("credential-error");
+    content.add(&description);
+    content.add(&label);
+    content.add(&entry);
+    content.add(&error);
+    if styling::apply(&dialog, appearance).is_err() {
+        dialog.close();
+        completion.finish(Err(PromptError::Unavailable));
+        return Err(PromptError::Unavailable);
+    }
+    let completion = Rc::new(RefCell::new(Some(completion)));
+    let result = Rc::new(RefCell::new(None));
+    dialog.connect_response({
+        let result = result.clone();
+        let entry = entry.clone();
+        move |dialog, response| {
+            // GtkWindow::close emits a second delete response. Preserve the
+            // accepted result until destruction releases native ownership.
+            if result.borrow().is_some() {
+                return;
+            }
+            if response == gtk::ResponseType::Accept {
+                let text = Zeroizing::new(entry.text().to_string());
+                if let Err(invalid) = validation::validate(&text) {
+                    error.set_text(invalid.message());
+                    entry.grab_focus();
+                    return;
+                }
+                *result.borrow_mut() =
+                    Some(HostSecret::new(text.to_string()).map_err(|_| PromptError::Unavailable));
+            } else {
+                *result.borrow_mut() = Some(Err(PromptError::Cancelled));
+            }
+            entry.set_text("");
+            dialog.close();
+        }
+    });
+    dialog.connect_destroy({
+        let entry = entry.clone();
+        move |_| {
+            entry.set_text("");
+            if let Some(completion) = completion.borrow_mut().take() {
+                completion.finish(
+                    result
+                        .borrow_mut()
+                        .take()
+                        .unwrap_or(Err(PromptError::Cancelled)),
+                );
+            }
+        }
+    });
+    let weak = dialog.downgrade();
+    glib::timeout_add_local(Duration::from_millis(50), move || {
+        let Some(dialog) = weak.upgrade() else {
+            return glib::ControlFlow::Break;
+        };
+        if cancelled.load(Ordering::Acquire) {
+            dialog.response(gtk::ResponseType::Cancel);
+            glib::ControlFlow::Break
+        } else {
+            glib::ControlFlow::Continue
+        }
+    });
+    dialog.show_all();
+    entry.grab_focus();
+    Ok((dialog, entry))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn wait_for_completion(
+        received: &mut tokio::sync::oneshot::Receiver<Result<HostSecret, PromptError>>,
+    ) -> Result<HostSecret, PromptError> {
+        let deadline = std::time::Instant::now() + Duration::from_secs(2);
+        loop {
+            match received.try_recv() {
+                Ok(result) => return result,
+                Err(tokio::sync::oneshot::error::TryRecvError::Empty) => {}
+                Err(error) => panic!("native completion closed: {error}"),
+            }
+            assert!(
+                std::time::Instant::now() < deadline,
+                "native dialog did not finish closing"
+            );
+            let context = glib::MainContext::default();
+            while context.pending() {
+                context.iteration(false);
+            }
+            std::thread::sleep(Duration::from_millis(1));
+        }
+    }
+    #[test]
+    #[ignore = "operator-owned: xvfb-run and a GTK display; see cloud development guide"]
+    fn native_linux_password_entry_and_cancel() {
+        let _ownership = crate::lifecycle::TEST_OWNERSHIP.lock().unwrap();
+        gtk::init().unwrap();
+        let parent = gtk::Window::new(gtk::WindowType::Toplevel);
+        parent.show_all();
+        assert_appearance(&parent);
+        let (completion, mut received) = Completion::acquire().unwrap();
+        let (dialog, entry) = create(
+            &parent,
+            Arc::new(AtomicBool::new(false)),
+            completion,
+            DialogAppearance::default(),
+        )
+        .unwrap();
+        assert!(!gtk::prelude::EntryExt::is_visible(&entry));
+        let clipboard = gtk::Clipboard::get(&gtk::gdk::SELECTION_CLIPBOARD);
+        clipboard.set_text("unrelated-synthetic-clipboard");
+        entry.set_text("synthetic-token");
+        entry.select_region(0, -1);
+        entry.emit_copy_clipboard();
+        assert_eq!(
+            clipboard.wait_for_text().as_deref(),
+            Some("unrelated-synthetic-clipboard")
+        );
+        entry.set_text("bad token");
+        dialog.response(gtk::ResponseType::Accept);
+        assert!(received.try_recv().is_err());
+        entry.set_text("synthetic-token");
+        dialog.response(gtk::ResponseType::Accept);
+        wait_for_completion(&mut received).expect("valid native credential entry");
+        let (completion, mut received) = Completion::acquire().unwrap();
+        let (dialog, _) = create(
+            &parent,
+            Arc::new(AtomicBool::new(false)),
+            completion,
+            DialogAppearance::default(),
+        )
+        .unwrap();
+        dialog.response(gtk::ResponseType::Cancel);
+        assert_eq!(
+            wait_for_completion(&mut received).unwrap_err(),
+            PromptError::Cancelled
+        );
+        parent.close();
+    }
+
+    fn assert_appearance(parent: &gtk::Window) {
+        use crate::{ColorScheme, TextSize};
+        let parent_color = parent.style_context().color(gtk::StateFlags::NORMAL);
+        for scheme in [ColorScheme::Light, ColorScheme::Dark] {
+            let mut sizes = Vec::new();
+            let mut widths = Vec::new();
+            for text_size in [TextSize::Compact, TextSize::Comfortable, TextSize::Large] {
+                let appearance = DialogAppearance {
+                    color_scheme: scheme,
+                    text_size,
+                };
+                let (completion, mut received) = Completion::acquire().unwrap();
+                let (dialog, entry) = create(
+                    parent,
+                    Arc::new(AtomicBool::new(false)),
+                    completion,
+                    appearance,
+                )
+                .unwrap();
+                let context = entry.style_context();
+                sizes.push(context.font(gtk::StateFlags::NORMAL).size());
+                widths.push(dialog.default_size().0);
+                let color = context.color(gtk::StateFlags::NORMAL);
+                let expected = appearance.palette().text;
+                for (actual, shift) in [(color.red(), 16), (color.green(), 8), (color.blue(), 0)] {
+                    assert!((actual - f64::from((expected >> shift) & 0xff) / 255.0).abs() < 0.005);
+                }
+                assert_eq!(
+                    parent.style_context().color(gtk::StateFlags::NORMAL),
+                    parent_color
+                );
+                assert!(!gtk::prelude::EntryExt::is_visible(&entry));
+                dialog.response(gtk::ResponseType::Cancel);
+                assert_eq!(
+                    wait_for_completion(&mut received).unwrap_err(),
+                    PromptError::Cancelled
+                );
+            }
+            assert!(sizes[0] < sizes[1] && sizes[1] < sizes[2]);
+            assert!(widths[0] < widths[1] && widths[1] < widths[2]);
+        }
+    }
+}
diff --git a/apps/desktop/native-credential-ui/src/linux/styling.rs b/apps/desktop/native-credential-ui/src/linux/styling.rs
new file mode 100644
index 000000000..c182197ab
--- /dev/null
+++ b/apps/desktop/native-credential-ui/src/linux/styling.rs
@@ -0,0 +1,115 @@
+//! Dialog-local GTK appearance; no application settings or credential state change.
+
+use crate::{ColorScheme, DialogAppearance};
+use gtk::prelude::*;
+use std::fmt::Write as _;
+
+pub(super) fn pixels(appearance: DialogAppearance, logical: i32) -> i32 {
+    (logical * appearance.text_size.root_pixels() + 8) / 16
+}
+
+pub(super) fn content(content: &gtk::Box, appearance: DialogAppearance) {
+    content.set_spacing(pixels(appearance, 12));
+    content.set_margin_start(pixels(appearance, 24));
+    content.set_margin_end(pixels(appearance, 24));
+    content.set_margin_top(pixels(appearance, 20));
+    content.set_margin_bottom(pixels(appearance, 20));
+}
+
+pub(super) fn apply(dialog: &gtk::Dialog, appearance: DialogAppearance) -> Result<(), ()> {
+    if let Some(button) = dialog.widget_for_response(gtk::ResponseType::Accept) {
+        button.style_context().add_class("suggested-action");
+    }
+    let high_contrast = gtk::Settings::default()
+        .and_then(|settings| settings.gtk_theme_name())
+        .is_some_and(|name| {
+            let name = name.to_ascii_lowercase();
+            name.contains("highcontrast") || name.contains("high-contrast")
+        });
+    let provider = gtk::CssProvider::new();
+    provider
+        .load_from_data(stylesheet(appearance, high_contrast).as_bytes())
+        .map_err(|_| ())?;
+    install(dialog.upcast_ref(), &provider);
+    Ok(())
+}
+
+fn install(widget: &gtk::Widget, provider: &gtk::CssProvider) {
+    widget
+        .style_context()
+        .add_provider(provider, gtk::STYLE_PROVIDER_PRIORITY_APPLICATION);
+    if let Some(container) = widget.downcast_ref::<gtk::Container>() {
+        // Include native internal children, such as the action-area buttons.
+        container.forall(|child| install(child, provider));
+    }
+}
+
+fn stylesheet(appearance: DialogAppearance, high_contrast: bool) -> String {
+    let scale = f64::from(appearance.text_size.root_pixels()) / 16.0;
+    let mut css = format!(
+        "* {{ font-size: {}px; }} entry {{ font-size: {}px; }}",
+        14.0 * scale,
+        16.0 * scale
+    );
+    // Keep OS/user colors for System and accessibility themes. The application
+    // priority also lets explicit GTK user CSS take precedence over app colors.
+    if appearance.color_scheme == ColorScheme::System || high_contrast {
+        return css;
+    }
+    let palette = appearance.palette();
+    let _ = write!(
+        css,
+        "
+window {{ background-color: #{surface:06x}; color: #{text:06x}; }}
+label {{ color: #{text:06x}; }}
+label.credential-label {{ color: #{strong:06x}; }}
+label.credential-description {{ color: #{muted:06x}; }}
+label.credential-error {{ color: #{danger:06x}; }}
+entry, button {{ background-image: none; background-color: #{control:06x}; color: #{text:06x}; border-color: #{border:06x}; }}
+button:hover {{ background-color: #{hover:06x}; }}
+entry:focus, button:focus {{ border-color: #{focus:06x}; outline-color: #{focus:06x}; }}
+button.suggested-action {{ background-color: #{accent:06x}; color: #{on_accent:06x}; border-color: #{accent:06x}; }}
+button.suggested-action:hover {{ background-color: #{accent_hover:06x}; }}
+entry selection {{ background-color: #{accent:06x}; color: #{on_accent:06x}; }}
+",
+        surface = palette.surface,
+        text = palette.text,
+        strong = palette.strong,
+        muted = palette.muted,
+        danger = palette.danger,
+        control = palette.control,
+        border = palette.border,
+        hover = palette.hover,
+        focus = palette.focus,
+        accent = palette.accent,
+        on_accent = palette.on_accent,
+        accent_hover = palette.accent_hover,
+    );
+    css
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::TextSize;
+
+    #[test]
+    fn system_and_high_contrast_preserve_native_colors_with_requested_text_scale() {
+        let appearance = DialogAppearance {
+            color_scheme: ColorScheme::Dark,
+            text_size: TextSize::Large,
+        };
+        let high_contrast = stylesheet(appearance, true);
+        let system = stylesheet(
+            DialogAppearance {
+                color_scheme: ColorScheme::System,
+                ..appearance
+            },
+            false,
+        );
+        assert_eq!(system, high_contrast);
+        assert!(system.contains("entry { font-size: 18px; }"));
+        assert!(!system.contains("color:"));
+        assert!(!system.contains("background"));
+    }
+}
diff --git a/apps/desktop/native-credential-ui/src/prompt.rs b/apps/desktop/native-credential-ui/src/prompt.rs
index 52a6724f9..2c5a52403 100644
--- a/apps/desktop/native-credential-ui/src/prompt.rs
+++ b/apps/desktop/native-credential-ui/src/prompt.rs
@@ -1,12 +1,12 @@
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 use std::sync::{Arc, atomic::AtomicBool};
 
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 use crate::ColorScheme;
 use crate::DialogAppearance;
 use colossus_contracts::HostSecret;
 
-#[cfg(any(windows, target_os = "macos"))]
+#[cfg(any(windows, target_os = "macos", target_os = "linux"))]
 use crate::lifecycle::{CancelOnDrop, Completion};
 
 /// Categorical native errors; never contain credential data or platform errors.
@@ -44,12 +44,12 @@ pub async fn prompt(
     parent: tauri::Window,
     appearance: DialogAppearance,
 ) -> Result<HostSecret, PromptError> {
-    #[cfg(not(any(windows, target_os = "macos")))]
+    #[cfg(not(any(windows, target_os = "macos", target_os = "linux")))]
     {
         let _ = (parent, appearance);
         return Err(PromptError::Unsupported);
     }
-    #[cfg(any(windows, target_os = "macos"))]
+    #[cfg(any(windows, target_os = "macos", target_os = "linux"))]
     {
         let mut appearance = appearance;
         if appearance.color_scheme == ColorScheme::System {
@@ -69,6 +69,8 @@ pub async fn prompt(
                 crate::windows::open(&native_parent, cancelled, completion, appearance);
                 #[cfg(target_os = "macos")]
                 crate::macos::open(&native_parent, cancelled, completion, appearance);
+                #[cfg(target_os = "linux")]
+                crate::linux::open(&native_parent, cancelled, completion, appearance);
             })
             .map_err(|_| PromptError::Unavailable)?;
         receiver.await.map_err(|_| PromptError::Cancelled)?
diff --git a/apps/desktop/package-lock.json b/apps/desktop/package-lock.json
index 3c7bad447..4f3b30301 100644
--- a/apps/desktop/package-lock.json
+++ b/apps/desktop/package-lock.json
@@ -26,12 +26,14 @@
       "devDependencies": {
         "@axe-core/playwright": "4.12.1",
         "@playwright/test": "1.62.0",
+        "@tailwindcss/vite": "4.3.3",
         "@tauri-apps/cli": "2.11.4",
         "@types/node": "26.1.1",
         "@types/react": "19.2.17",
         "@types/react-dom": "19.2.3",
         "@vitejs/plugin-react": "6.0.3",
         "prettier": "3.9.5",
+        "tailwindcss": "4.3.3",
         "typescript": "7.0.2",
         "vite": "8.1.5",
         "vitest": "4.1.10"
@@ -58,13 +60,30 @@
       "resolved": "file:../ui",
       "license": "Apache-2.0",
       "dependencies": {
-        "@tabler/icons-react": "3.45.0"
+        "@radix-ui/react-dropdown-menu": "2.1.24",
+        "@radix-ui/react-slot": "1.3.3",
+        "@tabler/icons-react": "3.45.0",
+        "@tanstack/react-table": "9.2.6",
+        "class-variance-authority": "0.7.1",
+        "clsx": "2.1.1",
+        "react-is": "19.2.7",
+        "react-markdown": "10.1.0",
+        "recharts": "3.10.1",
+        "rehype-sanitize": "6.0.0",
+        "remark-gfm": "4.0.1",
+        "tailwind-merge": "3.7.0"
       },
       "peerDependencies": {
         "react": "19.2.7",
         "react-dom": "19.2.7"
       }
     },
+    "node_modules/@colossus/ui/node_modules/react-is": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.7.tgz",
+      "integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
+      "license": "MIT"
+    },
     "node_modules/@emnapi/core": {
       "version": "1.11.1",
       "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
@@ -99,6 +118,76 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@floating-ui/core": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.8.0.tgz",
+      "integrity": "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/utils": "^0.2.12"
+      }
+    },
+    "node_modules/@floating-ui/dom": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.8.0.tgz",
+      "integrity": "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/core": "^1.8.0",
+        "@floating-ui/utils": "^0.2.12"
+      }
+    },
+    "node_modules/@floating-ui/react-dom": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.9.tgz",
+      "integrity": "sha512-JDjEFGCpImxDCA7JJKviA0M9+RtmJdj0m/NVU5IMgBK+AmZouAQQ7/+2GLH0GXXY0YMw9oXPB8hKdbPYg5QLYg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/dom": "^1.8.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@floating-ui/utils": {
+      "version": "0.2.12",
+      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.12.tgz",
+      "integrity": "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==",
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/@jridgewell/sourcemap-codec": {
       "version": "1.5.5",
       "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
@@ -106,6 +195,17 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.1.6",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
@@ -151,232 +251,1419 @@
         "node": ">=20"
       }
     },
-    "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
-      "integrity": "sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
+    "node_modules/@radix-ui/primitive": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.7.tgz",
+      "integrity": "sha512-rqWnm76nYT8HoNNqEjpgJ7Pw/DrBj5iBTrmEPo6HTX5+VJyBNOqTdv4g89G63HuR5g0AaENoAcH7Is5fF2kZ8Q==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/react-arrow": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.15.tgz",
+      "integrity": "sha512-v4zggRcjadnI+ClKDuijlQEW4tw3NoaeHc/PwpKnLoLLKNUG4InLegkstooLcRIUWCs+8L22dGURCVuFfOKfnA==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@rolldown/binding-darwin-arm64": {
+    "node_modules/@radix-ui/react-collection": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.15.tgz",
+      "integrity": "sha512-9W+B9NPF0NaaPh/1NJd3+KqsnlLqU9H7T2rvww+fp+T/evVXdNAyYcnfRQZFOjkR1ajQp3yORlqnI8soawLvNA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-slot": "1.3.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-compose-refs": {
       "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.5.tgz",
-      "integrity": "sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.5.tgz",
+      "integrity": "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-context": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.2.2.tgz",
+      "integrity": "sha512-RHCUGwKHDr0hDGg4X7ma4JG4/+12qxw8rkh5QKdDldlCvtja6nUx1Ef/8HVrJze81lEsgLQlqjzjGNHantgnQA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-direction": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.4.tgz",
+      "integrity": "sha512-5pzg4FGQNpExhnhT2zlrP1wZFaYCd1K0nYWoFAdcYoYK868IEigqMX3B3f8yIoRlAhAeDWciLI6ZdCKHF9P4Vg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dismissable-layer": {
+      "version": "1.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.19.tgz",
+      "integrity": "sha512-8g4pfOL9HoKKLWGiypT+dphVqjFfmcXO5GBnhsG6zI+lxAx/8feQpr+1LSN8Re3hiZ+XkLNS4O9ztK11/LzQ6w==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-effect-event": "0.0.5"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dropdown-menu": {
+      "version": "2.1.24",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.24.tgz",
+      "integrity": "sha512-geq8l2rJkxvkXsT9RMgtUE3P8pITFpTsvYpbySi1IH4fZEABD/Gp85myayFgxk0ktljGMJnCbeFkyTusvSvv7g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-menu": "2.1.24",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-controllable-state": "1.2.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-guards": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.6.tgz",
+      "integrity": "sha512-RNOJjfZMTyBM6xYmV3IVGXkPjIhcBAuv48POevAXwrGJhkWZ9p1rFoIS1JFooPuT193AZmRsCPhpoVJxx6OPoQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-scope": {
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.16.tgz",
+      "integrity": "sha512-wmRZ2WWLvmt6KHy2rNPOdPUjwq5xOHY02+m+udwJTn0aNIox/rkskAvJTyTLGhPK6KgrUjlJUJpgmx/+wFiFIQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-id": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.1.4.tgz",
+      "integrity": "sha512-TMQp2llA+RYn7JcjnrMnz7wN4pcVttPZnRZo52PLQsoLVKzNlVwUeHmfePgTgRluXFvlD3GD5g5MOVVTJCO0qA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-menu": {
+      "version": "2.1.24",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.24.tgz",
+      "integrity": "sha512-uW7RVuU6Lp/ZtfeY4b3kL32zccgEWvPv1+cf17ubYzHa9cL8AHokmk36cG/XEiH/smbQvumnieXX9j/e9RqJWA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-collection": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-direction": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.19",
+        "@radix-ui/react-focus-guards": "1.1.6",
+        "@radix-ui/react-focus-scope": "1.1.16",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-popper": "1.3.7",
+        "@radix-ui/react-portal": "1.1.17",
+        "@radix-ui/react-presence": "1.1.10",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-roving-focus": "1.1.19",
+        "@radix-ui/react-slot": "1.3.3",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "aria-hidden": "^1.2.4",
+        "react-remove-scroll": "^2.7.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-popper": {
+      "version": "1.3.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.3.7.tgz",
+      "integrity": "sha512-UsJrrd7w4wuKKTdvd/DNERVlwSlUcyXzjhyDwBk+3aPOsCjOY6ZSbxuw8E6lZTjjfP8Cpd0J8VVkrYUWyGYXyg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/react-dom": "^2.0.0",
+        "@radix-ui/react-arrow": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-layout-effect": "1.1.4",
+        "@radix-ui/react-use-rect": "1.1.4",
+        "@radix-ui/react-use-size": "1.1.4",
+        "@radix-ui/rect": "1.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-portal": {
+      "version": "1.1.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.17.tgz",
+      "integrity": "sha512-vKQLcWypUnwZVvfV7UkGahH2g6ySe8M8R+zYBwPrv5byZ9QAW6cQVvNKo7GgmD+p8aYb6D9JBuvy8/WhOno2wQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-presence": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.10.tgz",
+      "integrity": "sha512-3wyzCQ6+ubRA+D4uv9m95JYLXxmOHp05qjrkjeA7uKHHtjpPggQzc6DAb0URl7j67oR0K2foO4ip27TiX037Bw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-primitive": {
+      "version": "2.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.10.tgz",
+      "integrity": "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-slot": "1.3.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-roving-focus": {
+      "version": "1.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.19.tgz",
+      "integrity": "sha512-V9jI6hDjT7l3jsCQD9bLNvDLM3tH/gdbOTp7Tefp3hbbgCGQoK7tUvrWiRlcoBHIZ809ElXwNQwVo0B98LuTXQ==",
       "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-collection": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-direction": "1.1.4",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-controllable-state": "1.2.6",
+        "@radix-ui/react-use-is-hydrated": "0.1.3",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-slot": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.3.3.tgz",
+      "integrity": "sha512-qx7oqnYbxnK9kYI9m317qmFmEgo6ywqWvbTogdj7cL9p3/yx4M48p7Rnw5z3H890cL/ow/EeWJsuTykeZVXP5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.5"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-callback-ref": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.1.4.tgz",
+      "integrity": "sha512-R6OUY2e2fA6Yn6s+VSx5KBV6Nx8LQEhu+cz7LCej18rQ1HLyg9PSC9jP/ZNx0o6FAIK9c0F1kHylzSxKsdlkrQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-controllable-state": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.2.6.tgz",
+      "integrity": "sha512-uEQJGT97ZA/TgP/Hydw47lHu+/vQj6z/0jA+WeTbK1o9Rx45GImjpD0tc3W5ad3D6XTSR6e1yEO0FvGq6WQfVQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-use-effect-event": "0.0.5",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-effect-event": {
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-effect-event/-/react-use-effect-event-0.0.5.tgz",
+      "integrity": "sha512-7cshFL8HGS/7HEiHH+9kL9HBwp2sa9yX18Knwek6KYWmXwM7pegMgta2AXMQKI+rq3JnfSj9x8wYqFMTdG1Jgg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-is-hydrated": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-is-hydrated/-/react-use-is-hydrated-0.1.3.tgz",
+      "integrity": "sha512-umO/aJ+82CpOnhDZUTbILCQf7kU/g0iv+oGs/Q8jw7IkhWBzaEP4sA268PhFAJTFetbwp3ICc6ktpI4TqtxcIw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-layout-effect": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.4.tgz",
+      "integrity": "sha512-K20DkRkUwDnxEYMBPcg3Y6voLkEy5p5QQmszZgLngKKiC7dzBR/aEuK3w1qlx2JWDUNH6FluahYdgR3BP+QbYw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-rect": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-rect/-/react-use-rect-1.1.4.tgz",
+      "integrity": "sha512-cSOCh6JlkmfjLyNcLiu2nB4v+nm+dkZ+Q5KHWk/soo4U7ZLiEQFKHK9/YmtBHjfCEaU43IBKQOc4/uJmCaiCTQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/rect": "1.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-size": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.4.tgz",
+      "integrity": "sha512-D3anSY15EJoxrihpsXI6SMrmmonnQtR2ni7arO+Lfdg3O95b9hNXxONk8jA5C8ANdF/h5HMAxejgs8PWJ6rlhw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/rect": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/rect/-/rect-1.1.3.tgz",
+      "integrity": "sha512-JtyZR+mqgBibTo8xea3B6ZRmzZiM/YeVBtUkas6zMuXjAlfIFIW2FgqeM9eLyvEaYX66vr6DJMK+4U6LV0KhNw==",
+      "license": "MIT"
+    },
+    "node_modules/@reduxjs/toolkit": {
+      "version": "2.13.0",
+      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.13.0.tgz",
+      "integrity": "sha512-f6jwVRfwW30+tnllz4YcsHHpPYYOE7abcHkyUCovD+P7DyhdAI5prz2Fh/8TLhakjpN+7aIEion1s5L/tvlYlA==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/utils": "^0.3.0",
+        "immer": "^11.0.0",
+        "redux": "^5.0.1",
+        "redux-thunk": "^3.1.0",
+        "reselect": "^5.1.0"
+      },
+      "peerDependencies": {
+        "react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
+        "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
+      "integrity": "sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.5.tgz",
+      "integrity": "sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.5.tgz",
+      "integrity": "sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.5.tgz",
+      "integrity": "sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.5.tgz",
+      "integrity": "sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.5.tgz",
+      "integrity": "sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.5.tgz",
+      "integrity": "sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.5.tgz",
+      "integrity": "sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.5.tgz",
+      "integrity": "sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.5.tgz",
+      "integrity": "sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.5.tgz",
+      "integrity": "sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.5.tgz",
+      "integrity": "sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.5.tgz",
+      "integrity": "sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.5.tgz",
+      "integrity": "sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.5.tgz",
+      "integrity": "sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@shikijs/core": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/primitive": "4.3.1",
+        "@shikijs/types": "4.3.1",
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "@types/hast": "^3.0.4",
+        "hast-util-to-html": "^9.0.5"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@shikijs/engine-javascript": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "4.3.1",
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "oniguruma-to-es": "^4.3.6"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@shikijs/langs": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "4.3.1"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@shikijs/primitive": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
+      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "4.3.1",
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "@types/hast": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@shikijs/themes": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/types": "4.3.1"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@shikijs/types": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
+      "license": "MIT",
+      "dependencies": {
+        "@shikijs/vscode-textmate": "^10.0.2",
+        "@types/hast": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@shikijs/vscode-textmate": {
+      "version": "10.0.2",
+      "resolved": "https://registry.npmjs.org/@shikijs/vscode-textmate/-/vscode-textmate-10.0.2.tgz",
+      "integrity": "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==",
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
+      "license": "MIT"
+    },
+    "node_modules/@tabler/icons": {
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.45.0.tgz",
+      "integrity": "sha512-jiATwV8+zGYLTZ7gMLGivCic+KtsMZXcDmufIG8umlLxoHhI6902hGYIEt0Oa9Y9SXblNzUlrisHm5jOFMxOQA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/codecalm"
+      }
+    },
+    "node_modules/@tabler/icons-react": {
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons-react/-/icons-react-3.45.0.tgz",
+      "integrity": "sha512-t/AuKs7ALMDDTY+B9IvfZnlO0mbLlP/lJxP/HnGC49QkM8mCsTN38kYyxjXxgrb1+TeK53ioVBJqIV7n/eysXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tabler/icons": "3.45.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/codecalm"
+      },
+      "peerDependencies": {
+        "react": ">= 16"
+      }
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
+      "integrity": "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "^5.24.1",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
       "optional": true,
       "os": [
-        "darwin"
+        "win32"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.5.tgz",
-      "integrity": "sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g==",
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
       "cpu": [
         "x64"
       ],
       "dev": true,
-      "license": "MIT",
+      "license": "MPL-2.0",
       "optional": true,
       "os": [
-        "darwin"
+        "win32"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.5.tgz",
-      "integrity": "sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA==",
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz",
+      "integrity": "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-x64": "4.3.3",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.3",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.3",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.3",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.3.tgz",
+      "integrity": "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==",
       "cpu": [
-        "x64"
+        "arm64"
       ],
       "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "freebsd"
+        "android"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.5.tgz",
-      "integrity": "sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw==",
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.3.tgz",
+      "integrity": "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==",
       "cpu": [
-        "arm"
+        "arm64"
       ],
       "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
+        "darwin"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.5.tgz",
-      "integrity": "sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q==",
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.3.tgz",
+      "integrity": "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
+        "darwin"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.5.tgz",
-      "integrity": "sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA==",
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.3.tgz",
+      "integrity": "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
+        "freebsd"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.5.tgz",
-      "integrity": "sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg==",
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.3.tgz",
+      "integrity": "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==",
       "cpu": [
-        "ppc64"
+        "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.5.tgz",
-      "integrity": "sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.3.tgz",
+      "integrity": "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==",
       "cpu": [
-        "s390x"
+        "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.5.tgz",
-      "integrity": "sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.3.tgz",
+      "integrity": "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==",
       "cpu": [
-        "x64"
+        "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.5.tgz",
-      "integrity": "sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg==",
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.3.tgz",
+      "integrity": "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==",
       "cpu": [
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.5.tgz",
-      "integrity": "sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw==",
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.3.tgz",
+      "integrity": "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==",
       "cpu": [
-        "arm64"
+        "x64"
       ],
       "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "openharmony"
+        "linux"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.5.tgz",
-      "integrity": "sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+      "integrity": "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
       "cpu": [
         "wasm32"
       ],
@@ -384,18 +1671,21 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.11.1",
-        "@emnapi/runtime": "1.11.1",
-        "@napi-rs/wasm-runtime": "^1.1.6"
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
       },
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.5.tgz",
-      "integrity": "sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw==",
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
+      "integrity": "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==",
       "cpu": [
         "arm64"
       ],
@@ -406,13 +1696,13 @@
         "win32"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.5.tgz",
-      "integrity": "sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA==",
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.3.tgz",
+      "integrity": "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==",
       "cpu": [
         "x64"
       ],
@@ -423,134 +1713,86 @@
         "win32"
       ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
-      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+    "node_modules/@tailwindcss/vite": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz",
+      "integrity": "sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@shikijs/core": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
-      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/primitive": "4.3.1",
-        "@shikijs/types": "4.3.1",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.4",
-        "hast-util-to-html": "^9.0.5"
+        "@tailwindcss/node": "4.3.3",
+        "@tailwindcss/oxide": "4.3.3",
+        "tailwindcss": "4.3.3"
       },
-      "engines": {
-        "node": ">=20"
+      "peerDependencies": {
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
       }
     },
-    "node_modules/@shikijs/engine-javascript": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
-      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
+    "node_modules/@tanstack/react-store": {
+      "version": "0.11.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.11.2.tgz",
+      "integrity": "sha512-oj5O5DmiMWE+ih+SioX2ayC1kbK7d3fpLx0B75fPJr9nY3zU+hoW010yr64qXsY/9fyiLVE2bn5mGNV3owm8RQ==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.3.1",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "oniguruma-to-es": "^4.3.6"
+        "@tanstack/store": "0.11.2",
+        "use-sync-external-store": "^1.6.0"
       },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/langs": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
-      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "4.3.1"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
       },
-      "engines": {
-        "node": ">=20"
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/@shikijs/primitive": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
-      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
+    "node_modules/@tanstack/react-table": {
+      "version": "9.2.6",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-table/-/react-table-9.2.6.tgz",
+      "integrity": "sha512-Wmt3sbzwz+5CtB0pqIxGw2FrNW9mF4AhJ9KnS1/VGZ8cDAEg51S4ixru2dnF0xQnY407kdYNLer3ms+n8zCN6w==",
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.3.1",
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.4"
+        "@tanstack/react-store": "^0.11.2",
+        "@tanstack/table-core": "9.2.6"
       },
       "engines": {
         "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/themes": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
-      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/types": "4.3.1"
       },
-      "engines": {
-        "node": ">=20"
-      }
-    },
-    "node_modules/@shikijs/types": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
-      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
-      "license": "MIT",
-      "dependencies": {
-        "@shikijs/vscode-textmate": "^10.0.2",
-        "@types/hast": "^3.0.4"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
       },
-      "engines": {
-        "node": ">=20"
+      "peerDependencies": {
+        "react": ">=18"
       }
     },
-    "node_modules/@shikijs/vscode-textmate": {
-      "version": "10.0.2",
-      "resolved": "https://registry.npmjs.org/@shikijs/vscode-textmate/-/vscode-textmate-10.0.2.tgz",
-      "integrity": "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==",
-      "license": "MIT"
-    },
-    "node_modules/@standard-schema/spec": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@tabler/icons": {
-      "version": "3.45.0",
-      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.45.0.tgz",
-      "integrity": "sha512-jiATwV8+zGYLTZ7gMLGivCic+KtsMZXcDmufIG8umlLxoHhI6902hGYIEt0Oa9Y9SXblNzUlrisHm5jOFMxOQA==",
+    "node_modules/@tanstack/store": {
+      "version": "0.11.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/store/-/store-0.11.2.tgz",
+      "integrity": "sha512-sJ4mjol8uQsHV0gOJzzjwXfh2Fwm+Sz0+8deqiTm4jGbMdjzNSW+xZCFm0kUa870uhd8yi+DpKnZb5Kc4apa0Q==",
       "license": "MIT",
       "funding": {
         "type": "github",
-        "url": "https://github.com/sponsors/codecalm"
+        "url": "https://github.com/sponsors/tannerlinsley"
       }
     },
-    "node_modules/@tabler/icons-react": {
-      "version": "3.45.0",
-      "resolved": "https://registry.npmjs.org/@tabler/icons-react/-/icons-react-3.45.0.tgz",
-      "integrity": "sha512-t/AuKs7ALMDDTY+B9IvfZnlO0mbLlP/lJxP/HnGC49QkM8mCsTN38kYyxjXxgrb1+TeK53ioVBJqIV7n/eysXQ==",
+    "node_modules/@tanstack/table-core": {
+      "version": "9.2.6",
+      "resolved": "https://registry.npmjs.org/@tanstack/table-core/-/table-core-9.2.6.tgz",
+      "integrity": "sha512-t5LaLx8gDCgzjvwtZo5xtLklJP11D9zaKOW8q6jOCyuQYhkqpTK1heqMfgTQwDlhl0dU8f1X66Xurbj3jpCUSw==",
       "license": "MIT",
       "dependencies": {
-        "@tabler/icons": "3.45.0"
+        "@tanstack/store": "^0.11.2"
+      },
+      "engines": {
+        "node": ">=20"
       },
       "funding": {
         "type": "github",
-        "url": "https://github.com/sponsors/codecalm"
-      },
-      "peerDependencies": {
-        "react": ">= 16"
+        "url": "https://github.com/sponsors/tannerlinsley"
       }
     },
     "node_modules/@tauri-apps/api": {
@@ -652,9 +1894,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -672,9 +1911,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -692,9 +1928,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -712,9 +1945,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -732,9 +1962,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -817,6 +2044,12 @@
         "assertion-error": "^2.0.1"
       }
     },
+    "node_modules/@types/d3-array": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
+      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
+      "license": "MIT"
+    },
     "node_modules/@types/d3-color": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
@@ -832,19 +2065,61 @@
         "@types/d3-selection": "*"
       }
     },
+    "node_modules/@types/d3-ease": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
+      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
+      "license": "MIT"
+    },
     "node_modules/@types/d3-interpolate": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
       "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
       "license": "MIT",
       "dependencies": {
-        "@types/d3-color": "*"
+        "@types/d3-color": "*"
+      }
+    },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
+      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
+    "node_modules/@types/d3-selection": {
+      "version": "3.0.11",
+      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-3.0.11.tgz",
+      "integrity": "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-kVd74ta9eof3eJOvbNd1vGKS/XERRyQbT26Og63hIsvDO84cjD5gEOhsXf26w3FSoNlPVz84DOFcKv/oou+fMw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
       }
     },
-    "node_modules/@types/d3-selection": {
-      "version": "3.0.11",
-      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-3.0.11.tgz",
-      "integrity": "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==",
+    "node_modules/@types/d3-time": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
+      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-timer": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
+      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
       "license": "MIT"
     },
     "node_modules/@types/d3-transition": {
@@ -956,6 +2231,12 @@
       "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
       "license": "MIT"
     },
+    "node_modules/@types/use-sync-external-store": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
+      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
+      "license": "MIT"
+    },
     "node_modules/@typescript/typescript-aix-ppc64": {
       "version": "7.0.2",
       "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
@@ -1492,6 +2773,18 @@
         "d3-zoom": "^3.0.0"
       }
     },
+    "node_modules/aria-hidden": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
+      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/assertion-error": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
@@ -1582,12 +2875,33 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/class-variance-authority": {
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
+      "integrity": "sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "clsx": "^2.1.1"
+      },
+      "funding": {
+        "url": "https://polar.sh/cva"
+      }
+    },
     "node_modules/classcat": {
       "version": "5.0.5",
       "resolved": "https://registry.npmjs.org/classcat/-/classcat-5.0.5.tgz",
       "integrity": "sha512-JhZUT7JFcQy/EzW605k/ktHtncoo9vnyW/2GspNYwFlN1C/WmjuV/xtS04e9SOkL2sTdw0VAZ2UGCcQ9lR6p6w==",
       "license": "MIT"
     },
+    "node_modules/clsx": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/comma-separated-tokens": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
@@ -1611,6 +2925,18 @@
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
       "license": "MIT"
     },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-color": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
@@ -1651,6 +2977,15 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-format": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
+      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-interpolate": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
@@ -1663,6 +2998,31 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-selection": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-3.0.0.tgz",
@@ -1672,6 +3032,42 @@
         "node": ">=12"
       }
     },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/d3-timer": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
@@ -1733,6 +3129,12 @@
         }
       }
     },
+    "node_modules/decimal.js-light": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
+      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
+      "license": "MIT"
+    },
     "node_modules/decode-named-character-reference": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
@@ -1765,6 +3167,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/detect-node-es": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
+      "integrity": "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==",
+      "license": "MIT"
+    },
     "node_modules/devlop": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
@@ -1778,6 +3186,20 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/enhanced-resolve": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.26.0.tgz",
+      "integrity": "sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
     "node_modules/es-module-lexer": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.1.tgz",
@@ -1785,6 +3207,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/es-toolkit": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.52.0.tgz",
+      "integrity": "sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA==",
+      "license": "MIT",
+      "workspaces": [
+        "docs",
+        "benchmarks",
+        "tests/types",
+        "tests/browser-compat"
+      ]
+    },
     "node_modules/escape-string-regexp": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
@@ -1817,6 +3251,12 @@
         "@types/estree": "^1.0.0"
       }
     },
+    "node_modules/eventemitter3": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
+      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
+      "license": "MIT"
+    },
     "node_modules/expect-type": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
@@ -1866,6 +3306,22 @@
         "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
+    "node_modules/get-nonce": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-nonce/-/get-nonce-1.0.1.tgz",
+      "integrity": "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/hast-util-sanitize": {
       "version": "5.0.2",
       "resolved": "https://registry.npmjs.org/hast-util-sanitize/-/hast-util-sanitize-5.0.2.tgz",
@@ -1964,12 +3420,31 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/immer": {
+      "version": "11.1.21",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.21.tgz",
+      "integrity": "sha512-bZSadeCPGdaY5/qRLgr6mDSH1ra21rD3rqpiWk7+QTr4ayYPTE9qZYdLh/NdPhMe0wSrTvHD/Lk8q5EwhUs0aw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
     "node_modules/inline-style-parser": {
       "version": "0.2.7",
       "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.2.7.tgz",
       "integrity": "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==",
       "license": "MIT"
     },
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/is-alphabetical": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
@@ -2026,6 +3501,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
+    },
     "node_modules/lightningcss": {
       "version": "1.33.0",
       "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
@@ -2169,9 +3654,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2193,9 +3675,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2217,9 +3696,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -2241,9 +3717,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -3393,6 +4866,13 @@
         "react": "^19.2.7"
       }
     },
+    "node_modules/react-is": {
+      "version": "19.3.0",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.3.0.tgz",
+      "integrity": "sha512-UpMYezM4v5/18F28aC66AEsjXIgE02kyEMH6yLdgLXu/UTfa1Ntwck/nNLrbqJsEXW7gPb0coNO9FQse9WTovA==",
+      "license": "MIT",
+      "peer": true
+    },
     "node_modules/react-markdown": {
       "version": "10.1.0",
       "resolved": "https://registry.npmjs.org/react-markdown/-/react-markdown-10.1.0.tgz",
@@ -3420,6 +4900,143 @@
         "react": ">=18"
       }
     },
+    "node_modules/react-redux": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
+      "integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/use-sync-external-store": "^0.0.6",
+        "use-sync-external-store": "^1.4.0"
+      },
+      "peerDependencies": {
+        "@types/react": "^18.2.25 || ^19",
+        "react": "^18.0 || ^19",
+        "redux": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.7.2.tgz",
+      "integrity": "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-remove-scroll-bar": "^2.3.7",
+        "react-style-singleton": "^2.2.3",
+        "tslib": "^2.1.0",
+        "use-callback-ref": "^1.3.3",
+        "use-sidecar": "^1.1.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll-bar": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll-bar/-/react-remove-scroll-bar-2.3.8.tgz",
+      "integrity": "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-style-singleton": "^2.2.2",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-style-singleton": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/react-style-singleton/-/react-style-singleton-2.2.3.tgz",
+      "integrity": "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==",
+      "license": "MIT",
+      "dependencies": {
+        "get-nonce": "^1.0.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/recharts": {
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.10.1.tgz",
+      "integrity": "sha512-QXFrvt6IVcw7eeZCoyXTwkIJAX3Dv1nyVhMicXJ47GsGDDpcN8z6o644DibE9XjpBTThtsomLKnTV6lc+cVFUA==",
+      "license": "MIT",
+      "workspaces": [
+        "www"
+      ],
+      "dependencies": {
+        "@reduxjs/toolkit": "^1.9.0 || 2.x.x",
+        "clsx": "^2.1.1",
+        "decimal.js-light": "^2.5.1",
+        "es-toolkit": "^1.39.3",
+        "eventemitter3": "^5.0.1",
+        "immer": "^11.1.8",
+        "react-redux": "8.x.x || 9.x.x",
+        "reselect": "5.2.0",
+        "tiny-invariant": "^1.3.3",
+        "use-sync-external-store": "^1.2.2",
+        "victory-vendor": "^37.0.2"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/redux": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
+      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
+      "license": "MIT"
+    },
+    "node_modules/redux-thunk": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
+      "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "redux": "^5.0.0"
+      }
+    },
     "node_modules/regex": {
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/regex/-/regex-6.1.0.tgz",
@@ -3524,6 +5141,12 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/reselect": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.2.0.tgz",
+      "integrity": "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw==",
+      "license": "MIT"
+    },
     "node_modules/rolldown": {
       "version": "1.1.5",
       "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.5.tgz",
@@ -3572,9 +5195,9 @@
       "license": "ISC"
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -3637,6 +5260,43 @@
         "inline-style-parser": "0.2.7"
       }
     },
+    "node_modules/tailwind-merge": {
+      "version": "3.7.0",
+      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.7.0.tgz",
+      "integrity": "sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/dcastil"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz",
+      "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/tiny-invariant": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
+      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
+      "license": "MIT"
+    },
     "node_modules/tinybench": {
       "version": "2.9.0",
       "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
@@ -3705,9 +5365,7 @@
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "dev": true,
-      "license": "0BSD",
-      "optional": true
+      "license": "0BSD"
     },
     "node_modules/typescript": {
       "version": "7.0.2",
@@ -3838,6 +5496,49 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/use-callback-ref": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.3.tgz",
+      "integrity": "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sidecar": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/use-sidecar/-/use-sidecar-1.1.3.tgz",
+      "integrity": "sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==",
+      "license": "MIT",
+      "dependencies": {
+        "detect-node-es": "^1.1.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/use-sync-external-store": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
@@ -3875,6 +5576,28 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/victory-vendor": {
+      "version": "37.3.6",
+      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-37.3.6.tgz",
+      "integrity": "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==",
+      "license": "MIT AND ISC",
+      "dependencies": {
+        "@types/d3-array": "^3.0.3",
+        "@types/d3-ease": "^3.0.0",
+        "@types/d3-interpolate": "^3.0.1",
+        "@types/d3-scale": "^4.0.2",
+        "@types/d3-shape": "^3.1.0",
+        "@types/d3-time": "^3.0.0",
+        "@types/d3-timer": "^3.0.0",
+        "d3-array": "^3.1.6",
+        "d3-ease": "^3.0.1",
+        "d3-interpolate": "^3.0.1",
+        "d3-scale": "^4.0.2",
+        "d3-shape": "^3.1.0",
+        "d3-time": "^3.0.0",
+        "d3-timer": "^3.0.1"
+      }
+    },
     "node_modules/vite": {
       "version": "8.1.5",
       "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.5.tgz",
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 9ac0754a4..718e1d46b 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -30,9 +30,11 @@
     "tauri:build": "npm run prepare:sidecars:release && tauri build --no-bundle -- --locked",
     "tauri:bundle:macos": "../../scripts/package-desktop-macos",
     "tauri:bundle:windows": "pwsh -File ../../scripts/package-desktop-windows.ps1",
+    "tauri:bundle:linux": "sh ../../scripts/package-desktop-linux",
     "prepare:dictation": "node ../../scripts/stage-dictation-model.mjs"
   },
   "dependencies": {
+    "@colossus/ui": "file:../ui",
     "@shikijs/core": "4.3.1",
     "@shikijs/engine-javascript": "4.3.1",
     "@shikijs/langs": "4.3.1",
@@ -45,18 +47,19 @@
     "react-dom": "19.2.7",
     "react-markdown": "10.1.0",
     "rehype-sanitize": "6.0.0",
-    "remark-gfm": "4.0.1",
-    "@colossus/ui": "file:../ui"
+    "remark-gfm": "4.0.1"
   },
   "devDependencies": {
     "@axe-core/playwright": "4.12.1",
     "@playwright/test": "1.62.0",
+    "@tailwindcss/vite": "4.3.3",
     "@tauri-apps/cli": "2.11.4",
     "@types/node": "26.1.1",
     "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "@vitejs/plugin-react": "6.0.3",
     "prettier": "3.9.5",
+    "tailwindcss": "4.3.3",
     "typescript": "7.0.2",
     "vite": "8.1.5",
     "vitest": "4.1.10"
diff --git a/apps/desktop/src-tauri/Cargo.lock b/apps/desktop/src-tauri/Cargo.lock
index 45a292c5b..66b795f49 100644
--- a/apps/desktop/src-tauri/Cargo.lock
+++ b/apps/desktop/src-tauri/Cargo.lock
@@ -109,12 +109,56 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
 [[package]]
 name = "anstyle"
 version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.104"
@@ -838,6 +882,46 @@ dependencies = [
  "libloading 0.8.9",
 ]
 
+[[package]]
+name = "clap"
+version = "4.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "301b56658598e48f3648647ac6fc887be7e7108eddfa4e9b63fcf3ec58c0cadf"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94a65403d1a1bd28f7dc68eb8506e8874808ee5eecb59298de588e2e1407a078"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.2",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
 [[package]]
 name = "cmake"
 version = "0.1.58"
@@ -871,6 +955,12 @@ dependencies = [
  "x509-cert",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "colossus-api"
 version = "0.11.7"
@@ -901,11 +991,27 @@ dependencies = [
  "tonic-prost-build",
 ]
 
+[[package]]
+name = "colossus-cloud-protocol"
+version = "0.11.7"
+dependencies = [
+ "colossus-sdk",
+ "prost",
+ "protoc-bin-vendored",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.19",
+ "tonic",
+ "tonic-prost",
+ "tonic-prost-build",
+]
+
 [[package]]
 name = "colossus-codex-auth"
 version = "0.11.7"
 dependencies = [
  "base64 0.22.1",
+ "colossus-home",
  "colossus-windows-native",
  "directories",
  "fs4",
@@ -919,6 +1025,35 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "colossus-connector"
+version = "0.11.7"
+dependencies = [
+ "async-trait",
+ "clap",
+ "colossus-cloud-protocol",
+ "colossus-contracts",
+ "colossus-credentials",
+ "colossus-home",
+ "colossus-ports",
+ "colossus-sdk",
+ "fs4",
+ "futures",
+ "hex",
+ "rcgen",
+ "reqwest 0.12.28",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "url",
+ "uuid",
+ "x509-parser",
+ "zeroize",
+]
+
 [[package]]
 name = "colossus-contracts"
 version = "0.11.7"
@@ -968,6 +1103,7 @@ dependencies = [
  "apple-native-keyring-store",
  "base64 0.22.1",
  "colossus-codex-auth",
+ "colossus-connector",
  "colossus-contracts",
  "colossus-credentials",
  "colossus-home",
@@ -983,6 +1119,7 @@ dependencies = [
  "colossus-windows-native",
  "colossus-worker-protocol",
  "directories",
+ "fs4",
  "futures-util",
  "getrandom 0.4.3",
  "git2",
@@ -1139,6 +1276,7 @@ name = "colossus-native-credential-ui"
 version = "0.1.0"
 dependencies = [
  "colossus-contracts",
+ "gtk",
  "objc2",
  "objc2-app-kit",
  "objc2-foundation",
@@ -1262,6 +1400,7 @@ dependencies = [
  "rustls",
  "security-framework",
  "serde",
+ "serde_json",
  "sha2",
  "sysinfo",
  "tempfile",
@@ -3164,6 +3303,12 @@ version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -4233,6 +4378,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "opaque-debug"
 version = "0.3.1"
@@ -7443,6 +7594,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
 version = "1.24.0"
diff --git a/apps/desktop/src-tauri/Cargo.toml b/apps/desktop/src-tauri/Cargo.toml
index e05a2e4ba..742ab1e1d 100644
--- a/apps/desktop/src-tauri/Cargo.toml
+++ b/apps/desktop/src-tauri/Cargo.toml
@@ -49,6 +49,7 @@ sha2 = "0.10.9"
 tauri-build = { version = "=2.6.3", features = [] }
 
 [dependencies]
+colossus-connector = { version = "=0.11.7", path = "../../../crates/colossus-connector" }
 anyhow = "1.0.104"
 base64 = "0.22.1"
 zip = { version = "4.6.1", default-features = false, features = ["deflate-flate2"] }
@@ -85,6 +86,7 @@ tauri-plugin-updater = { version = "=2.9.0", default-features = false, features
 tokio = { version = "1.49.0", features = ["io-util", "macros", "net", "process", "rt", "sync", "time"] }
 tempfile = "3.23.0"
 url = "2.5.8"
+fs4 = "0.13.1"
 uuid = { version = "1.23.4", features = ["v4", "v7"] }
 zeroize = { version = "1.8.2", features = ["serde"] }
 git2 = { version = "0.21.0", default-features = false, features = ["vendored-libgit2"] }
diff --git a/apps/desktop/src-tauri/build.rs b/apps/desktop/src-tauri/build.rs
index 4ff378d24..10bc0de50 100644
--- a/apps/desktop/src-tauri/build.rs
+++ b/apps/desktop/src-tauri/build.rs
@@ -109,6 +109,15 @@ const COMMANDS: &[&str] = &[
     "set_terminal_enabled",
     "connect_colossus",
     "connection_status",
+    "cloud_enroll",
+    "cloud_connect",
+    "cloud_status",
+    "control_plane_profiles",
+    "save_control_plane_profiles",
+    "cloud_set_workspace_sharing",
+    "cloud_disconnect",
+    "cloud_forget",
+    "cloud_revoke",
     "create_run",
     "choose_run_attachment",
     "read_artifact_content",
@@ -217,6 +226,18 @@ fn export_release_trust_configuration() {
             ),
             _ => panic!("{CHANNEL_VARIABLE} must be stable, developer_preview, or validation_only"),
         }
+    } else if target_os == "linux" {
+        assert!(
+            team_id == "UNSIGNED",
+            "Linux packaging requires {TEAM_VARIABLE}=UNSIGNED"
+        );
+        assert!(
+            matches!(
+                release_channel.as_str(),
+                "developer_preview" | "validation_only"
+            ),
+            "Linux packages require an explicit developer_preview or validation_only channel"
+        );
     } else {
         let canonical_team = team_id.len() == 10
             && team_id
@@ -235,7 +256,9 @@ fn export_release_trust_configuration() {
         }
     }
     let signing_status = match (target_os.as_str(), release_channel.as_str()) {
-        ("windows", "validation_only") => "unsigned",
+        ("windows", "validation_only") | ("linux", "developer_preview" | "validation_only") => {
+            "unsigned"
+        }
         ("windows", "stable" | "developer_preview") | ("macos", "stable") => "verified",
         ("macos", "developer_preview" | "validation_only") => "ad_hoc",
         _ => "unsupported",
diff --git a/apps/desktop/src-tauri/capabilities/main-chat.json b/apps/desktop/src-tauri/capabilities/main-chat.json
index 49f37860b..9e08b9ba2 100644
--- a/apps/desktop/src-tauri/capabilities/main-chat.json
+++ b/apps/desktop/src-tauri/capabilities/main-chat.json
@@ -117,6 +117,15 @@
     "allow-set-terminal-enabled",
     "allow-connect-colossus",
     "allow-connection-status",
+    "allow-cloud-enroll",
+    "allow-cloud-connect",
+    "allow-cloud-status",
+    "allow-control-plane-profiles",
+    "allow-save-control-plane-profiles",
+    "allow-cloud-set-workspace-sharing",
+    "allow-cloud-disconnect",
+    "allow-cloud-forget",
+    "allow-cloud-revoke",
     "allow-create-run",
     "allow-choose-run-attachment",
     "allow-read-artifact-content",
diff --git a/apps/desktop/src-tauri/src/bundle.rs b/apps/desktop/src-tauri/src/bundle.rs
index 6dcc10ece..2e76a8894 100644
--- a/apps/desktop/src-tauri/src/bundle.rs
+++ b/apps/desktop/src-tauri/src/bundle.rs
@@ -28,11 +28,11 @@ const EXPECTED_RELEASE_TEAM_ID: &str = env!("COLOSSUS_DESKTOP_TEAM_ID");
 const EXPECTED_RELEASE_CHANNEL: &str = env!("COLOSSUS_DESKTOP_RELEASE_CHANNEL");
 #[cfg(all(not(debug_assertions), target_os = "macos"))]
 const DESKTOP_CODE_IDENTIFIER: &str = "com.obscuritylabs.colossus.desktop";
-#[cfg(not(debug_assertions))]
+#[cfg(all(not(debug_assertions), any(target_os = "macos", windows)))]
 const SIDECAR_CODE_IDENTIFIER: &str = "com.obscuritylabs.colossus.desktop.sidecar";
-#[cfg(not(debug_assertions))]
+#[cfg(all(not(debug_assertions), any(target_os = "macos", windows)))]
 const CLI_CODE_IDENTIFIER: &str = "com.obscuritylabs.colossus.desktop.cli";
-#[cfg(not(debug_assertions))]
+#[cfg(all(not(debug_assertions), any(target_os = "macos", windows)))]
 const RIPGREP_CODE_IDENTIFIER: &str = "com.obscuritylabs.colossus.desktop.ripgrep";
 
 #[derive(Debug, Deserialize)]
@@ -344,9 +344,14 @@ fn release_app_root() -> Option<PathBuf> {
         .and_then(|executable| executable.parent().map(Path::to_owned))
 }
 
+#[cfg(all(not(debug_assertions), target_os = "linux"))]
+fn release_app_root() -> Option<PathBuf> {
+    release_directory()
+}
+
 #[cfg(all(
     not(debug_assertions),
-    not(any(target_os = "macos", target_os = "windows"))
+    not(any(target_os = "macos", target_os = "windows", target_os = "linux"))
 ))]
 fn release_app_root() -> Option<PathBuf> {
     None
@@ -474,8 +479,24 @@ fn verify_outer_app_signature(app_root: &Path) -> Result<(), CommandErrorDto> {
     }
 }
 
+#[cfg(all(target_os = "linux", not(debug_assertions)))]
+fn verify_outer_app_signature(app_root: &Path) -> Result<(), CommandErrorDto> {
+    use std::os::unix::fs::MetadataExt as _;
+    // Linux preview distribution trust comes from the reviewed artifact and its
+    // checksum. The running ELF binds the manifest; it does not claim OS signing.
+    let metadata = std::fs::symlink_metadata(app_root).map_err(|_| integrity_error())?;
+    if EXPECTED_RELEASE_TEAM_ID != "UNSIGNED"
+        || expected_release_channel()? != ReleaseChannel::DeveloperPreview
+        || !metadata.is_dir()
+        || metadata.mode() & 0o022 != 0
+    {
+        return Err(integrity_error());
+    }
+    Ok(())
+}
+
 #[cfg(all(
-    not(any(target_os = "macos", target_os = "windows")),
+    not(any(target_os = "macos", target_os = "windows", target_os = "linux")),
     not(debug_assertions)
 ))]
 fn verify_outer_app_signature(_app_root: &Path) -> Result<(), CommandErrorDto> {
@@ -554,7 +575,7 @@ fn verify_release_code_identity(
 }
 
 #[cfg(all(
-    not(any(target_os = "macos", target_os = "windows")),
+    not(any(target_os = "macos", target_os = "windows", target_os = "linux")),
     not(debug_assertions)
 ))]
 fn verify_release_code_identity(
diff --git a/apps/desktop/src-tauri/src/cloud_connector.rs b/apps/desktop/src-tauri/src/cloud_connector.rs
new file mode 100644
index 000000000..71620f894
--- /dev/null
+++ b/apps/desktop/src-tauri/src/cloud_connector.rs
@@ -0,0 +1,668 @@
+//! Narrow native cloud enrollment and lifecycle; renderer never receives runtime credentials.
+use crate::{
+    desktop_credentials::DesktopCredentials, desktop_settings::SettingsStore, dto::CommandErrorDto,
+    state::AppState,
+};
+use colossus_connector::{ConnectionConfig, ConnectorStatus, EnrollmentStore, RuntimeConnector};
+use colossus_sdk::AgentRunClient;
+use serde::{Deserialize, Serialize};
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, Ordering},
+};
+use tauri::{AppHandle, State};
+use tauri_plugin_dialog::{DialogExt, MessageDialogButtons};
+use tokio::sync::watch;
+use zeroize::Zeroizing;
+
+mod sharing;
+mod status_cache;
+
+pub(crate) struct CloudSession {
+    config: ConnectionConfig,
+    status: watch::Receiver<ConnectorStatus>,
+    shutdown: watch::Sender<bool>,
+    task: Option<tauri::async_runtime::JoinHandle<()>>,
+    alive: Arc<AtomicBool>,
+    sharing_recovery_required: bool,
+    shutdown_confirmed: bool,
+    sharing_restart_required: bool,
+}
+impl Drop for CloudSession {
+    fn drop(&mut self) {
+        self.alive.store(false, Ordering::Release);
+        let _ = self.shutdown.send(true);
+        if let Some(task) = &self.task {
+            task.abort();
+        }
+    }
+}
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct CloudStatus {
+    target_id: String,
+    status: ConnectorStatus,
+    node_id: Option<String>,
+    project_id: Option<String>,
+    endpoint: Option<String>,
+    host_id: Option<String>,
+    workspace_id: Option<String>,
+    shared_sessions: bool,
+    shared_continuation: bool,
+    sharing_supported: bool,
+    #[serde(default)]
+    sharing_recovery_required: sharing::Requirement,
+    #[serde(default)]
+    sharing_restart_required: sharing::Requirement,
+}
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct EnrollInput {
+    target_id: String,
+    enrollment_url: String,
+    token: Zeroizing<String>,
+}
+fn failure(message: &str) -> CommandErrorDto {
+    CommandErrorDto::invalid("cloud_connection", message)
+}
+fn store(state: &AppState, target: &str) -> Result<Arc<EnrollmentStore>, CommandErrorDto> {
+    let settings = SettingsStore::open_application()?;
+    let credentials = DesktopCredentials::for_settings(state, &settings)?;
+    EnrollmentStore::new(credentials.native_vault(), target)
+        .map(Arc::new)
+        .map_err(failure)
+}
+fn dto(target: String, config: Option<&ConnectionConfig>, status: ConnectorStatus) -> CloudStatus {
+    CloudStatus {
+        target_id: target,
+        status,
+        node_id: config.map(|config| config.node_id.clone()),
+        project_id: config.map(|config| config.project_id.clone()),
+        endpoint: config.map(|config| config.endpoint.clone()),
+        host_id: config
+            .and_then(|config| config.inventory.as_ref())
+            .map(|inventory| inventory.host_id.clone()),
+        workspace_id: config
+            .and_then(|config| config.inventory.as_ref())
+            .map(|inventory| inventory.workspace_id.clone()),
+        shared_sessions: config
+            .and_then(|config| config.inventory.as_ref())
+            .is_some_and(|inventory| {
+                inventory.sharing == colossus_connector::WorkspaceSharing::SharedVisibleSessions
+            }),
+        shared_continuation: config.is_some_and(|config| config.shared_continuation),
+        sharing_supported: config
+            .and_then(|config| config.inventory.as_ref())
+            .is_some_and(|inventory| {
+                inventory.deployment_kind == colossus_connector::DeploymentKind::Desktop
+            }),
+        sharing_recovery_required: sharing::Requirement::Clear,
+        sharing_restart_required: sharing::Requirement::Clear,
+    }
+}
+
+impl CloudSession {
+    fn snapshot(&self, target: String) -> CloudStatus {
+        let status = if self.alive.load(Ordering::Acquire) {
+            *self.status.borrow()
+        } else if *self.status.borrow() == ConnectorStatus::Revoked {
+            ConnectorStatus::Revoked
+        } else {
+            ConnectorStatus::Disconnected
+        };
+        let mut summary = dto(target, Some(&self.config), status);
+        summary.sharing_recovery_required = self.sharing_recovery_required.into();
+        summary.sharing_restart_required = self.sharing_restart_required.into();
+        summary
+    }
+}
+
+fn disconnected_summary(
+    target: String,
+    config: Option<&ConnectionConfig>,
+    status: ConnectorStatus,
+) -> CloudStatus {
+    let mut summary = dto(target, config, status);
+    // A saved choice is not a runtime observation. Explicit reconnect reconciles
+    // it; disconnected metadata must not claim that permission is currently applied.
+    summary.sharing_recovery_required = summary.sharing_supported.into();
+    summary
+}
+async fn cache_status(status: CloudStatus) -> Result<CloudStatus, CommandErrorDto> {
+    let summary = status.clone();
+    let retained = tauri::async_runtime::spawn_blocking(move || {
+        if summary.node_id.is_some() {
+            status_cache::remember(summary)
+        } else {
+            status_cache::forget(summary.target_id)
+        }
+    })
+    .await;
+    if !matches!(retained, Ok(Ok(()))) {
+        // Presentation metadata cannot prevent or reinterpret an authorized lifecycle action.
+        eprintln!("Control Plane connection summary could not be retained.");
+    }
+    Ok(status)
+}
+
+async fn disconnected_status(
+    target: &str,
+    config: Option<&ConnectionConfig>,
+    removed: Option<ConnectorStatus>,
+) -> ConnectorStatus {
+    let Some(config) = config else {
+        return ConnectorStatus::Disconnected;
+    };
+    if config.revoked || removed == Some(ConnectorStatus::Revoked) {
+        return ConnectorStatus::Revoked;
+    }
+    let target = target.to_owned();
+    let node = config.node_id.clone();
+    // A read/disconnect does not undo a terminal remote observation. This cache
+    // affects presentation only; reconnect still checks the native enrollment.
+    tauri::async_runtime::spawn_blocking(move || {
+        status_cache::retained_disconnected_status(&target, &node)
+    })
+    .await
+    .ok()
+    .and_then(Result::ok)
+    .unwrap_or(ConnectorStatus::Disconnected)
+}
+pub(crate) async fn global_connections(
+    state: &AppState,
+) -> Result<Vec<CloudStatus>, CommandErrorDto> {
+    let mut summaries = tauri::async_runtime::spawn_blocking(status_cache::load)
+        .await
+        .map_err(|_| failure("Connection summaries are unavailable."))??;
+    let sessions = state.cloud_connections.lock().await;
+    for summary in summaries.values_mut() {
+        if summary.sharing_supported {
+            summary.sharing_recovery_required = sharing::Requirement::Required;
+        }
+        // Restart fencing is process-local. After restart, an explicit connection
+        // may reconcile the saved choice; the cache supplies no authorization.
+        summary.sharing_restart_required = sharing::Requirement::Clear;
+    }
+    for (target, session) in sessions.iter() {
+        summaries.insert(target.clone(), session.snapshot(target.clone()));
+    }
+    let mut connections = summaries.into_values().collect::<Vec<_>>();
+    connections.sort_by(|left, right| left.target_id.cmp(&right.target_id));
+    Ok(connections)
+}
+async fn confirm(app: &AppHandle, message: String) -> Result<(), CommandErrorDto> {
+    confirm_action(
+        app,
+        message,
+        "Connect runtime to Colossus Control Plane",
+        "Connect runtime",
+    )
+    .await
+}
+async fn confirm_action(
+    app: &AppHandle,
+    message: String,
+    title: &str,
+    action: &str,
+) -> Result<(), CommandErrorDto> {
+    let app = app.clone();
+    let title = title.to_owned();
+    let action = action.to_owned();
+    let accepted = tauri::async_runtime::spawn_blocking(move || {
+        app.dialog()
+            .message(message)
+            .title(title)
+            .buttons(MessageDialogButtons::OkCancelCustom(
+                action,
+                "Cancel".into(),
+            ))
+            .blocking_show()
+    })
+    .await
+    .map_err(|_| failure("Native connection confirmation is unavailable."))?;
+    if accepted {
+        Ok(())
+    } else {
+        Err(failure("The native confirmation was cancelled."))
+    }
+}
+async fn reconcile_managed_sharing(
+    state: &AppState,
+    target: &str,
+    config: &ConnectionConfig,
+    primary: &dyn AgentRunClient,
+) -> Result<(), CommandErrorDto> {
+    // Every explicit Managed Local start reconciles the protected saved choice,
+    // including after restart or cache loss. Metadata never supplies authority.
+    let result = sharing::update(
+        &state.cloud_connections,
+        target,
+        config,
+        sharing::saved_request(config),
+        |request| primary.set_workspace_sharing(request),
+        || std::future::ready(Ok(config.clone())),
+    )
+    .await;
+    if let Err(error) = result {
+        if let Some(summary) = sharing::summary(&state.cloud_connections, target).await {
+            cache_status(summary).await?;
+        }
+        return Err(error);
+    }
+    Ok(())
+}
+fn spawn_connector(
+    connector: RuntimeConnector,
+    receiver: watch::Receiver<bool>,
+    status: watch::Sender<ConnectorStatus>,
+    terminal_target: String,
+    terminal_node: String,
+    terminal_alive: Arc<AtomicBool>,
+) -> tauri::async_runtime::JoinHandle<()> {
+    tauri::async_runtime::spawn(async move {
+        let failed = connector.run(receiver, status.clone()).await.is_err();
+        let revoked = *status.borrow() == ConnectorStatus::Revoked;
+        if failed && !revoked {
+            status.send_replace(ConnectorStatus::Disconnected);
+        }
+        if revoked {
+            let saved = tauri::async_runtime::spawn_blocking(move || {
+                status_cache::remember_remote_revocation(
+                    terminal_target,
+                    terminal_node,
+                    terminal_alive,
+                )
+            })
+            .await;
+            if !matches!(saved, Ok(Ok(()))) {
+                eprintln!("Control Plane revocation summary could not be retained.");
+            }
+        }
+    })
+}
+async fn start(
+    state: &AppState,
+    target: String,
+    mut config: ConnectionConfig,
+    key: Zeroizing<String>,
+    runs: Arc<dyn AgentRunClient>,
+) -> Result<CloudStatus, CommandErrorDto> {
+    sharing::check_start(&state.cloud_connections, &target).await?;
+    let lease = state
+        .selected_target(&target)
+        .await
+        .ok_or_else(|| failure("Select the workspace before connecting Control Plane."))?;
+    if lease
+        .target
+        .client
+        .instance_id()
+        .map(|id| id.to_string())
+        .as_deref()
+        != Some(&config.instance_id)
+    {
+        return Err(failure("The enrolled local runtime identity has changed."));
+    }
+    if config.inventory.is_none() {
+        let inventory = colossus_connector::native_inventory(
+            format!("workspace:{}", config.instance_id),
+            "Desktop workspace".into(),
+            colossus_connector::DeploymentKind::Desktop,
+        )
+        .map_err(failure)?;
+        config = store(state, &target)?
+            .set_inventory(inventory)
+            .await
+            .map_err(failure)?;
+    }
+    let connector = RuntimeConnector::new(config.clone(), key, runs)
+        .map_err(failure)?
+        .with_enrollment_store((*store(state, &target)?).clone());
+    if lease.target.consent == crate::state::TargetConsentContext::ManagedLocal {
+        reconcile_managed_sharing(
+            state,
+            &target,
+            &config,
+            lease.target.client.agent_runs().as_ref(),
+        )
+        .await?;
+    }
+    let (shutdown, receiver) = watch::channel(false);
+    let (status, updates) = watch::channel(ConnectorStatus::Connecting);
+    let mut connections = state.cloud_connections.lock().await;
+    if let Some(existing) = connections.get(&target) {
+        if matches!(
+            existing.snapshot(target.clone()).status,
+            ConnectorStatus::Connecting
+                | ConnectorStatus::Connected
+                | ConnectorStatus::Reconnecting
+        ) {
+            return Err(failure(
+                "Disconnect the existing Control Plane connection first.",
+            ));
+        }
+        connections.remove(&target);
+    }
+    if connections.len() >= 16 {
+        return Err(failure("Desktop Control Plane connection limit reached."));
+    }
+    drop(connections);
+    // Invalidate the previous session before saving a replacement summary. Its
+    // terminal callback must never overwrite this enrollment or resurrect forget.
+    cache_status(dto(
+        target.clone(),
+        Some(&config),
+        ConnectorStatus::Disconnected,
+    ))
+    .await?;
+    let alive = Arc::new(AtomicBool::new(true));
+    let task = spawn_connector(
+        connector,
+        receiver,
+        status,
+        target.clone(),
+        config.node_id.clone(),
+        Arc::clone(&alive),
+    );
+    let result = dto(target.clone(), Some(&config), ConnectorStatus::Connecting);
+    state.cloud_connections.lock().await.insert(
+        target,
+        CloudSession {
+            config,
+            status: updates,
+            shutdown,
+            task: Some(task),
+            alive,
+            sharing_recovery_required: false,
+            shutdown_confirmed: false,
+            sharing_restart_required: false,
+        },
+    );
+    Ok(result)
+}
+#[tauri::command(rename_all = "camelCase")]
+pub(crate) async fn cloud_enroll(
+    app: AppHandle,
+    state: State<'_, AppState>,
+    request: EnrollInput,
+) -> Result<CloudStatus, CommandErrorDto> {
+    let _operation = state.cloud_operation.lock().await;
+    sharing::ensure_recoverable(&state.cloud_connections, &request.target_id).await?;
+    let lease = state
+        .selected_target(&request.target_id)
+        .await
+        .ok_or_else(|| failure("Select the connected runtime before enrolling it."))?;
+    let runs=lease.target.client.connector_runs().ok_or_else(||failure("This runtime has no dedicated Control Plane grant. Enroll a dedicated application with the CLI first."))?;
+    let instance = lease
+        .target
+        .client
+        .instance_id()
+        .ok_or_else(|| failure("Runtime identity is unavailable."))?
+        .to_string();
+    let url = url::Url::parse(&request.enrollment_url)
+        .map_err(|_| failure("Enter a valid enrollment URL."))?;
+    confirm(&app,format!("Connect the selected runtime ({instance}) to {}? Project members with execution permission can submit tasks under this runtime's dedicated local cloud grant. Approvals remain exact runtime interactions. Work in Managed Local stops when Desktop closes.",url.origin().ascii_serialization())).await?;
+    let store = store(&state, &request.target_id)?;
+    let config = store
+        .enroll(
+            request.enrollment_url,
+            request.token,
+            instance,
+            lease
+                .target
+                .client
+                .capabilities()
+                .iter()
+                .map(str::to_owned)
+                .collect(),
+            cfg!(debug_assertions),
+        )
+        .await
+        .map_err(failure)?;
+    let (_, workspace, managed) = state.terminal_workspace_context().await;
+    let inventory = colossus_connector::native_inventory(
+        if managed {
+            request.target_id.clone()
+        } else {
+            format!("workspace:{}", config.instance_id)
+        },
+        workspace.map_or_else(
+            || "Desktop workspace".into(),
+            |workspace| workspace.display_name,
+        ),
+        if managed {
+            colossus_connector::DeploymentKind::Desktop
+        } else {
+            colossus_connector::DeploymentKind::Cli
+        },
+    )
+    .map_err(failure)?;
+    let config = store.set_inventory(inventory).await.map_err(failure)?;
+    let (_, key) = tokio::task::spawn_blocking(move || store.load())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?
+        .ok_or_else(|| failure("Enrollment was not persisted."))?;
+    start(&state, request.target_id, config, key, runs).await
+}
+#[tauri::command(rename_all = "camelCase")]
+pub(crate) async fn cloud_connect(
+    app: AppHandle,
+    state: State<'_, AppState>,
+    target_id: String,
+) -> Result<CloudStatus, CommandErrorDto> {
+    let _operation = state.cloud_operation.lock().await;
+    sharing::ensure_recoverable(&state.cloud_connections, &target_id).await?;
+    let lease = state
+        .selected_target(&target_id)
+        .await
+        .ok_or_else(|| failure("Select the connected runtime before connecting cloud."))?;
+    let runs = lease
+        .target
+        .client
+        .connector_runs()
+        .ok_or_else(|| failure("A dedicated cloud runtime grant is required."))?;
+    let store = store(&state, &target_id)?;
+    let (config, key) = tokio::task::spawn_blocking(move || store.load())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?
+        .ok_or_else(|| failure("Enroll this runtime first."))?;
+    if lease
+        .target
+        .client
+        .instance_id()
+        .map(|id| id.to_string())
+        .as_deref()
+        != Some(&config.instance_id)
+    {
+        return Err(failure("The enrolled local runtime identity has changed."));
+    }
+    confirm(
+        &app,
+        sharing::reconnect_message(
+            &config,
+            lease.target.consent == crate::state::TargetConsentContext::ManagedLocal,
+        ),
+    )
+    .await?;
+    start(&state, target_id, config, key, runs).await
+}
+#[tauri::command(rename_all = "camelCase")]
+pub(crate) async fn cloud_status(
+    state: State<'_, AppState>,
+    target_id: String,
+) -> Result<CloudStatus, CommandErrorDto> {
+    if let Some(session) = state.cloud_connections.lock().await.get(&target_id) {
+        return Ok(session.snapshot(target_id));
+    }
+    let store = store(&state, &target_id)?;
+    let config = tokio::task::spawn_blocking(move || store.load())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?
+        .map(|(config, _)| config);
+    let status = disconnected_status(&target_id, config.as_ref(), None).await;
+    cache_status(disconnected_summary(target_id, config.as_ref(), status)).await
+}
+#[tauri::command(rename_all = "camelCase")]
+pub(crate) async fn cloud_set_workspace_sharing(
+    app: AppHandle,
+    state: State<'_, AppState>,
+    target_id: String,
+    enabled: bool,
+    allow_continuation: bool,
+) -> Result<CloudStatus, CommandErrorDto> {
+    let _operation = state.cloud_operation.lock().await;
+    sharing::ensure_recoverable(&state.cloud_connections, &target_id).await?;
+    let lease = state
+        .selected_target(&target_id)
+        .await
+        .ok_or_else(|| failure("Select the workspace before changing sharing."))?;
+    if lease.target.consent != crate::state::TargetConsentContext::ManagedLocal {
+        return Err(failure(
+            "Configure sharing for an external daemon with its local CLI application.",
+        ));
+    }
+    let enrollment = store(&state, &target_id)?;
+    let reader = enrollment.clone();
+    let (previous_config, key) = tokio::task::spawn_blocking(move || reader.load())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?
+        .ok_or_else(|| failure("Enroll this workspace before sharing sessions."))?;
+    if enabled {
+        confirm_action(&app, format!("Share this workspace's existing and future Desktop conversations with project {} at {}? Released history will be retained in the Control Plane for authorized project members. {} Local roles, tools, policy, and approvals remain enforced. Disabling sharing stops future synchronization but does not erase previously synchronized history.",
+            previous_config.project_id,previous_config.endpoint,
+            if allow_continuation {"Members with execution permission may continue these conversations using the dedicated Control Plane grant."} else {"Existing Desktop runs remain read-only in the Control Plane."}),"Workspace sharing","Update sharing").await?;
+    }
+    let primary = lease.target.client.agent_runs();
+    let update = sharing::update(
+        &state.cloud_connections,
+        &target_id,
+        &previous_config,
+        sharing::request(enabled, allow_continuation),
+        |request| primary.set_workspace_sharing(request),
+        || enrollment.set_sharing(enabled, allow_continuation),
+    )
+    .await;
+    let (config, status) = match update {
+        Ok(result) => result,
+        Err(error) => {
+            if let Some(summary) = sharing::summary(&state.cloud_connections, &target_id).await {
+                cache_status(summary).await?;
+            }
+            return Err(error);
+        }
+    };
+    // Refresh native inventory only after both writes succeeded. Accepted runtime
+    // work is independent of the stopped connector and remains running locally.
+    if matches!(
+        status,
+        ConnectorStatus::Connected | ConnectorStatus::Connecting | ConnectorStatus::Reconnecting
+    ) {
+        let key = if config.certificate_pem == previous_config.certificate_pem {
+            key
+        } else {
+            let reader = enrollment.clone();
+            let (current, key) = tokio::task::spawn_blocking(move || reader.load())
+                .await
+                .map_err(|_| failure("Enrollment vault unavailable."))?
+                .map_err(failure)?
+                .ok_or_else(|| failure("Enrollment unavailable."))?;
+            if current.certificate_pem != config.certificate_pem {
+                return Err(failure(
+                    "Enrollment changed while updating sharing; reconnect.",
+                ));
+            }
+            key
+        };
+        let runs = lease
+            .target
+            .client
+            .connector_runs()
+            .ok_or_else(|| failure("Dedicated cloud grant unavailable."))?;
+        start(&state, target_id, config, key, runs).await
+    } else {
+        let summary = sharing::summary(&state.cloud_connections, &target_id)
+            .await
+            .ok_or_else(|| failure("Sharing confirmation is unavailable."))?;
+        cache_status(summary).await
+    }
+}
+#[tauri::command(rename_all = "camelCase")]
+pub(crate) async fn cloud_revoke(
+    app: AppHandle,
+    state: State<'_, AppState>,
+    target_id: String,
+) -> Result<CloudStatus, CommandErrorDto> {
+    let _operation = state.cloud_operation.lock().await;
+    sharing::ensure_recoverable(&state.cloud_connections, &target_id).await?;
+    let enrollment = store(&state, &target_id)?;
+    let reader = enrollment.clone();
+    let (config, _) = tokio::task::spawn_blocking(move || reader.load())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?
+        .ok_or_else(|| failure("This runtime is not enrolled."))?;
+    let message = format!(
+        "Revoke runtime {} in project {} at {}? This removes its Control Plane authority. Accepted tasks continue under local runtime policy.",
+        config.node_id, config.project_id, config.endpoint
+    );
+    let accepted = tauri::async_runtime::spawn_blocking(move || {
+        app.dialog()
+            .message(message)
+            .title("Revoke cloud enrollment")
+            .buttons(MessageDialogButtons::OkCancelCustom(
+                "Revoke enrollment".into(),
+                "Cancel".into(),
+            ))
+            .blocking_show()
+    })
+    .await
+    .map_err(|_| failure("Native revocation confirmation is unavailable."))?;
+    if !accepted {
+        return Err(failure("Cloud revocation was cancelled."));
+    }
+    state.cloud_connections.lock().await.remove(&target_id);
+    enrollment.revoke().await.map_err(failure)?;
+    let config = tokio::task::spawn_blocking(move || enrollment.load())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?
+        .map(|(config, _)| config);
+    cache_status(dto(target_id, config.as_ref(), ConnectorStatus::Revoked)).await
+}
+#[tauri::command(rename_all = "camelCase")]
+pub(crate) async fn cloud_disconnect(
+    state: State<'_, AppState>,
+    target_id: String,
+) -> Result<CloudStatus, CommandErrorDto> {
+    let _operation = state.cloud_operation.lock().await;
+    sharing::ensure_recoverable(&state.cloud_connections, &target_id).await?;
+    let session = state.cloud_connections.lock().await.remove(&target_id);
+    let removed_status = session.as_ref().map(|session| *session.status.borrow());
+    drop(session);
+    let enrollment = store(&state, &target_id)?;
+    let config = tokio::task::spawn_blocking(move || enrollment.load())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?
+        .map(|(config, _)| config);
+    let status = disconnected_status(&target_id, config.as_ref(), removed_status).await;
+    cache_status(disconnected_summary(target_id, config.as_ref(), status)).await
+}
+#[tauri::command(rename_all = "camelCase")]
+pub(crate) async fn cloud_forget(
+    state: State<'_, AppState>,
+    target_id: String,
+) -> Result<CloudStatus, CommandErrorDto> {
+    let _operation = state.cloud_operation.lock().await;
+    sharing::ensure_recoverable(&state.cloud_connections, &target_id).await?;
+    state.cloud_connections.lock().await.remove(&target_id);
+    let store = store(&state, &target_id)?;
+    tokio::task::spawn_blocking(move || store.forget())
+        .await
+        .map_err(|_| failure("Enrollment vault unavailable."))?
+        .map_err(failure)?;
+    cache_status(dto(target_id, None, ConnectorStatus::Disconnected)).await
+}
diff --git a/apps/desktop/src-tauri/src/cloud_connector/sharing.rs b/apps/desktop/src-tauri/src/cloud_connector/sharing.rs
new file mode 100644
index 000000000..57495166c
--- /dev/null
+++ b/apps/desktop/src-tauri/src/cloud_connector/sharing.rs
@@ -0,0 +1,326 @@
+//! Quiesce disclosure before updating the separately durable runtime and enrollment.
+use super::{CloudSession, CloudStatus, failure};
+use crate::dto::CommandErrorDto;
+use colossus_connector::{ConnectionConfig, ConnectorStatus, WorkspaceSharing};
+use colossus_sdk::{ApiErrorCode, ApiResult, SetWorkspaceSharingRequest, WorkspaceSharingState};
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+use std::{
+    collections::HashMap,
+    future::Future,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+use tokio::sync::{Mutex, watch};
+
+type Connections = Mutex<HashMap<String, CloudSession>>;
+const STOP_TIMEOUT: Duration = Duration::from_secs(5);
+#[derive(Clone, Copy)]
+struct Deadlines {
+    runtime: Duration,
+    persistence: Duration,
+}
+const UPDATE_DEADLINES: Deadlines = Deadlines {
+    runtime: Duration::from_secs(15),
+    persistence: Duration::from_secs(30),
+};
+
+/// Native confirmation requirements retain the existing strict boolean wire shape.
+#[derive(Clone, Copy, Default)]
+pub(super) enum Requirement {
+    #[default]
+    Clear,
+    Required,
+}
+
+impl Requirement {
+    pub(super) fn is_required(self) -> bool {
+        matches!(self, Self::Required)
+    }
+}
+
+impl From<bool> for Requirement {
+    fn from(required: bool) -> Self {
+        if required {
+            Self::Required
+        } else {
+            Self::Clear
+        }
+    }
+}
+
+impl Serialize for Requirement {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_bool(self.is_required())
+    }
+}
+
+impl<'de> Deserialize<'de> for Requirement {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        bool::deserialize(deserializer).map(Self::from)
+    }
+}
+
+pub(super) fn request(enabled: bool, continuation: bool) -> SetWorkspaceSharingRequest {
+    SetWorkspaceSharingRequest {
+        recipient_application_id: "app:colossus-desktop-cloud".into(),
+        enabled,
+        allow_continuation: enabled && continuation,
+    }
+}
+
+pub(super) fn saved_request(config: &ConnectionConfig) -> SetWorkspaceSharingRequest {
+    request(
+        config
+            .inventory
+            .as_ref()
+            .is_some_and(|inventory| inventory.sharing == WorkspaceSharing::SharedVisibleSessions),
+        config.shared_continuation,
+    )
+}
+
+pub(super) fn saved_choice(config: &ConnectionConfig) -> &'static str {
+    match saved_request(config) {
+        SetWorkspaceSharingRequest { enabled: false, .. } => "keep Desktop history private",
+        SetWorkspaceSharingRequest {
+            allow_continuation: true,
+            ..
+        } => "share Desktop history and allow continuation",
+        _ => "share Desktop history for viewing",
+    }
+}
+
+pub(super) fn reconnect_message(config: &ConnectionConfig, managed: bool) -> String {
+    if managed {
+        format!(
+            "Reconnect runtime {} to {}? The last saved sharing choice is to {}. Reconnecting reapplies that choice before synchronizing; it also reconciles any incomplete sharing update.",
+            config.instance_id,
+            config.endpoint,
+            saved_choice(config)
+        )
+    } else {
+        format!(
+            "Reconnect runtime {} to {}?",
+            config.instance_id, config.endpoint
+        )
+    }
+}
+
+fn recovery_error(stage: &str, disabled: bool) -> CommandErrorDto {
+    CommandErrorDto {
+        code: "sharing_reconciliation_required".into(),
+        message: format!(
+            "{stage} The Control Plane connection is stopped. {} Reconnect to reapply the last saved sharing choice, or save a new choice.",
+            if disabled {
+                "Runtime sharing was disabled."
+            } else {
+                "Runtime sharing could not be verified."
+            }
+        ),
+        retryable: false,
+        outcome_unknown: !disabled,
+        violations: Vec::new(),
+    }
+}
+
+fn uncertain_error() -> CommandErrorDto {
+    CommandErrorDto {
+        code: "sharing_reconciliation_required".into(),
+        message: "The sharing outcome is uncertain and synchronization is stopped. Restart Desktop before reconnecting or updating sharing.".into(),
+        retryable: false,
+        outcome_unknown: true,
+        violations: Vec::new(),
+    }
+}
+
+pub(super) async fn ensure_recoverable(
+    connections: &Connections,
+    target: &str,
+) -> Result<(), CommandErrorDto> {
+    if connections
+        .lock()
+        .await
+        .get(target)
+        .is_some_and(|session| session.sharing_restart_required)
+    {
+        Err(uncertain_error())
+    } else {
+        Ok(())
+    }
+}
+
+async fn mark_uncertain(connections: &Connections, target: &str) {
+    if let Some(session) = connections.lock().await.get_mut(target) {
+        session.sharing_restart_required = true;
+    }
+}
+
+async fn quiesce(
+    connections: &Connections,
+    target: &str,
+    config: &ConnectionConfig,
+    timeout: Duration,
+) -> Result<ConnectorStatus, CommandErrorDto> {
+    ensure_recoverable(connections, target).await?;
+    let session = connections.lock().await.remove(target);
+    let mut session = session.unwrap_or_else(|| {
+        let (shutdown, _) = watch::channel(false);
+        let (_, status) = watch::channel(ConnectorStatus::Disconnected);
+        CloudSession {
+            config: config.clone(),
+            status,
+            shutdown,
+            task: None,
+            alive: Arc::new(AtomicBool::new(false)),
+            sharing_recovery_required: true,
+            shutdown_confirmed: true,
+            sharing_restart_required: false,
+        }
+    });
+    let previous = session.snapshot(target.to_owned()).status;
+    session.sharing_recovery_required = true;
+    session.alive.store(false, Ordering::Release);
+    let _ = session.shutdown.send(true);
+    let stopped = if let Some(mut task) = session.task.take() {
+        match tokio::time::timeout(timeout, &mut task).await {
+            Ok(Ok(())) => true,
+            Ok(Err(_)) => false,
+            Err(_) => {
+                task.abort();
+                session.task = Some(task);
+                false
+            }
+        }
+    } else {
+        session.shutdown_confirmed
+    };
+    session.shutdown_confirmed = stopped;
+    session.sharing_restart_required |= !stopped;
+    // The retained record has no active task after quiescence. It exposes uncertainty
+    // immediately, even if the metadata cache itself cannot be written.
+    connections.lock().await.insert(target.to_owned(), session);
+    if stopped {
+        Ok(previous)
+    } else {
+        Err(CommandErrorDto { code: "sharing_reconciliation_required".into(), message: "Connector termination could not be confirmed. Sharing was not changed; restart Desktop before changing sharing.".into(), retryable: false, outcome_unknown: true, violations: Vec::new() })
+    }
+}
+
+pub(super) async fn update<C, CF, P, PF>(
+    connections: &Connections,
+    target: &str,
+    config: &ConnectionConfig,
+    desired: SetWorkspaceSharingRequest,
+    commit: C,
+    persist: P,
+) -> Result<(ConnectionConfig, ConnectorStatus), CommandErrorDto>
+where
+    C: FnMut(SetWorkspaceSharingRequest) -> CF,
+    CF: Future<Output = ApiResult<WorkspaceSharingState>>,
+    P: FnOnce() -> PF,
+    PF: Future<Output = Result<ConnectionConfig, &'static str>>,
+{
+    update_with_deadlines(
+        connections,
+        target,
+        config,
+        desired,
+        commit,
+        persist,
+        UPDATE_DEADLINES,
+    )
+    .await
+}
+
+async fn update_with_deadlines<C, CF, P, PF>(
+    connections: &Connections,
+    target: &str,
+    config: &ConnectionConfig,
+    desired: SetWorkspaceSharingRequest,
+    mut commit: C,
+    persist: P,
+    deadlines: Deadlines,
+) -> Result<(ConnectionConfig, ConnectorStatus), CommandErrorDto>
+where
+    C: FnMut(SetWorkspaceSharingRequest) -> CF,
+    CF: Future<Output = ApiResult<WorkspaceSharingState>>,
+    P: FnOnce() -> PF,
+    PF: Future<Output = Result<ConnectionConfig, &'static str>>,
+{
+    let previous = quiesce(connections, target, config, STOP_TIMEOUT).await?;
+    let committed = tokio::time::timeout(deadlines.runtime, commit(desired)).await;
+    if !matches!(committed, Ok(Ok(_))) {
+        let uncertain = committed.is_err()
+            || matches!(committed, Ok(Err(ref error)) if matches!(error.code, ApiErrorCode::OutcomeUnknown | ApiErrorCode::Unavailable | ApiErrorCode::Cancelled | ApiErrorCode::Internal));
+        let disabled = matches!(
+            tokio::time::timeout(deadlines.runtime, commit(request(false, false))).await,
+            Ok(Ok(_))
+        );
+        if uncertain || !disabled {
+            mark_uncertain(connections, target).await;
+            return Err(uncertain_error());
+        }
+        return Err(recovery_error(
+            "The runtime sharing update failed.",
+            disabled,
+        ));
+    }
+    let saved = match tokio::time::timeout(deadlines.persistence, persist()).await {
+        Ok(Ok(saved)) => saved,
+        result => {
+            // Persistence may have committed before its acknowledgement failed. Do
+            // not recreate an old enabled grant as a guessed rollback.
+            let disabled = matches!(
+                tokio::time::timeout(deadlines.runtime, commit(request(false, false))).await,
+                Ok(Ok(_))
+            );
+            if result.is_err() || !disabled {
+                mark_uncertain(connections, target).await;
+                return Err(uncertain_error());
+            }
+            return Err(recovery_error(
+                "The sharing choice could not be saved.",
+                disabled,
+            ));
+        }
+    };
+    if let Some(session) = connections.lock().await.get_mut(target) {
+        session.config = saved.clone();
+        session.sharing_recovery_required = false;
+    }
+    Ok((saved, previous))
+}
+
+pub(super) async fn summary(connections: &Connections, target: &str) -> Option<CloudStatus> {
+    connections
+        .lock()
+        .await
+        .get(target)
+        .map(|session| session.snapshot(target.to_owned()))
+}
+
+pub(super) async fn check_start(
+    connections: &Connections,
+    target: &str,
+) -> Result<(), CommandErrorDto> {
+    ensure_recoverable(connections, target).await?;
+    if connections.lock().await.get(target).is_some_and(|session| {
+        matches!(
+            session.snapshot(target.to_owned()).status,
+            ConnectorStatus::Connecting
+                | ConnectorStatus::Connected
+                | ConnectorStatus::Reconnecting
+        )
+    }) {
+        Err(failure(
+            "Disconnect the existing Control Plane connection first.",
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/desktop/src-tauri/src/cloud_connector/sharing/tests.rs b/apps/desktop/src-tauri/src/cloud_connector/sharing/tests.rs
new file mode 100644
index 000000000..57818745d
--- /dev/null
+++ b/apps/desktop/src-tauri/src/cloud_connector/sharing/tests.rs
@@ -0,0 +1,657 @@
+use super::*;
+use colossus_connector::{DeploymentKind, EnrollmentStore, RuntimeInventory};
+use colossus_contracts::VaultRecord;
+use colossus_ports::{CredentialError, CredentialKey, CredentialVault};
+use std::{
+    future::ready,
+    sync::{Mutex as StdMutex, atomic::AtomicUsize},
+};
+
+fn config(enabled: bool) -> ConnectionConfig {
+    ConnectionConfig {
+        endpoint: "https://control-plane.example".into(),
+        project_id: "synthetic-project".into(),
+        node_id: "synthetic-node".into(),
+        instance_id: "synthetic-instance".into(),
+        certificate_pem: "synthetic-certificate".into(),
+        ca_pem: "synthetic-ca".into(),
+        capabilities: Vec::new(),
+        revoked: false,
+        inventory: Some(RuntimeInventory {
+            policy: None,
+            host_id: "synthetic-host".into(),
+            host_label: "Synthetic host".into(),
+            platform: "macos".into(),
+            deployment_kind: DeploymentKind::Desktop,
+            workspace_id: "synthetic-workspace".into(),
+            workspace_label: "Synthetic workspace".into(),
+            sharing: if enabled {
+                WorkspaceSharing::SharedVisibleSessions
+            } else {
+                WorkspaceSharing::CloudOwned
+            },
+        }),
+        shared_continuation: enabled,
+    }
+}
+
+struct Vault {
+    record: StdMutex<VaultRecord>,
+    fail_write: bool,
+    commit_before_failure: bool,
+    writes: AtomicUsize,
+}
+impl Vault {
+    fn new(config: &ConnectionConfig, fail_write: bool, commit_before_failure: bool) -> Arc<Self> {
+        let record = serde_json::json!({ "config": config, "pending": { "client_key_pem": "synthetic-private-key", "csr_pem": "synthetic-csr", "token": "", "enrollment_url": "https://control-plane.example/api/enroll", "instance_id": config.instance_id }, "rotation": null });
+        Arc::new(Self {
+            record: StdMutex::new(VaultRecord::new(serde_json::to_vec(&record).unwrap()).unwrap()),
+            fail_write,
+            commit_before_failure,
+            writes: AtomicUsize::new(0),
+        })
+    }
+}
+impl CredentialVault for Vault {
+    fn read(&self, _: &CredentialKey) -> Result<Option<VaultRecord>, CredentialError> {
+        Ok(Some(
+            VaultRecord::new(self.record.lock().unwrap().expose().to_vec()).unwrap(),
+        ))
+    }
+    fn write(&self, _: &CredentialKey, record: &VaultRecord) -> Result<(), CredentialError> {
+        self.writes.fetch_add(1, Ordering::SeqCst);
+        if !self.fail_write || self.commit_before_failure {
+            *self.record.lock().unwrap() = VaultRecord::new(record.expose().to_vec()).unwrap();
+        }
+        if self.fail_write {
+            Err(CredentialError::Io)
+        } else {
+            Ok(())
+        }
+    }
+    fn delete(&self, _: &CredentialKey) -> Result<(), CredentialError> {
+        panic!("sharing must not delete enrollment")
+    }
+}
+
+struct TaskLifetime(Arc<AtomicBool>);
+impl Drop for TaskLifetime {
+    fn drop(&mut self) {
+        self.0.store(true, Ordering::Release);
+    }
+}
+
+async fn active(config: &ConnectionConfig) -> (Connections, Arc<AtomicBool>, Arc<AtomicBool>) {
+    active_with_stop(config, true).await
+}
+
+async fn active_with_stop(
+    config: &ConnectionConfig,
+    cooperative: bool,
+) -> (Connections, Arc<AtomicBool>, Arc<AtomicBool>) {
+    let (shutdown, mut receiver) = watch::channel(false);
+    let (_, status) = watch::channel(ConnectorStatus::Connected);
+    let alive = Arc::new(AtomicBool::new(true));
+    let dropped = Arc::new(AtomicBool::new(false));
+    let lifetime = TaskLifetime(Arc::clone(&dropped));
+    let (started, started_receiver) = tokio::sync::oneshot::channel();
+    let task = tauri::async_runtime::spawn(async move {
+        let _lifetime = lifetime;
+        started.send(()).unwrap();
+        if cooperative {
+            let _ = receiver.changed().await;
+        } else {
+            std::future::pending::<()>().await;
+        }
+    });
+    started_receiver.await.unwrap();
+    let connections = Mutex::new(HashMap::from([(
+        "target".into(),
+        CloudSession {
+            config: config.clone(),
+            status,
+            shutdown,
+            task: Some(task),
+            alive: Arc::clone(&alive),
+            sharing_recovery_required: false,
+            shutdown_confirmed: false,
+            sharing_restart_required: false,
+        },
+    )]));
+    (connections, alive, dropped)
+}
+
+fn state(request: SetWorkspaceSharingRequest) -> WorkspaceSharingState {
+    WorkspaceSharingState {
+        recipient_application_id: request.recipient_application_id,
+        enabled: request.enabled,
+        allow_continuation: request.allow_continuation,
+    }
+}
+
+fn assert_paused(connections: &Connections, dropped: &AtomicBool) {
+    assert!(
+        dropped.load(Ordering::Acquire),
+        "connector destructor completed before any permission change"
+    );
+    let sessions = connections.try_lock().unwrap();
+    let session = &sessions["target"];
+    assert!(session.task.is_none());
+    assert!(!session.alive.load(Ordering::Acquire));
+    assert!(session.sharing_recovery_required);
+}
+
+#[tokio::test]
+async fn successful_update_quiesces_before_grant_and_real_enrollment_write() {
+    let original = config(false);
+    let (connections, alive, dropped) = active(&original).await;
+    let vault = Vault::new(&original, false, false);
+    let store = EnrollmentStore::new(vault.clone(), "target").unwrap();
+    let (saved, previous) = update(
+        &connections,
+        "target",
+        &original,
+        request(true, true),
+        |request| {
+            assert_paused(&connections, &dropped);
+            ready(Ok(state(request)))
+        },
+        || store.set_sharing(true, true),
+    )
+    .await
+    .unwrap();
+    assert_eq!(previous, ConnectorStatus::Connected);
+    assert!(!alive.load(Ordering::Acquire));
+    assert!(saved_request(&saved).allow_continuation);
+    assert!(saved_request(&store.load().unwrap().unwrap().0).enabled);
+    assert_eq!(vault.writes.load(Ordering::SeqCst), 1);
+    let summary = summary(&connections, "target").await.unwrap();
+    assert_eq!(summary.status, ConnectorStatus::Disconnected);
+    assert!(!summary.sharing_recovery_required.is_required());
+}
+
+#[tokio::test]
+async fn failed_enable_cannot_export_new_sessions_and_compensates_without_restart() {
+    let original = config(false);
+    let (connections, _, dropped) = active(&original).await;
+    let vault = Vault::new(&original, true, false);
+    let store = EnrollmentStore::new(vault, "target").unwrap();
+    let mut calls = Vec::new();
+    let mut runtime_enabled = false;
+    let mut escaped = 0;
+    let error = update(
+        &connections,
+        "target",
+        &original,
+        request(true, true),
+        |request| {
+            if request.enabled && !dropped.load(Ordering::Acquire) {
+                escaped += 1;
+            }
+            assert_paused(&connections, &dropped);
+            runtime_enabled = request.enabled;
+            calls.push((request.enabled, request.allow_continuation));
+            ready(Ok(state(request)))
+        },
+        || store.set_sharing(true, true),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(calls, [(true, true), (false, false)]);
+    assert_eq!(escaped, 0);
+    assert!(!runtime_enabled);
+    assert!(!error.outcome_unknown);
+    assert!(!saved_request(&store.load().unwrap().unwrap().0).enabled);
+    let summary = summary(&connections, "target").await.unwrap();
+    assert_eq!(summary.status, ConnectorStatus::Disconnected);
+    assert!(summary.sharing_recovery_required.is_required());
+}
+
+#[tokio::test]
+async fn failed_disable_never_restores_an_old_grant_and_explicit_reconnect_reconciles_saved_choice()
+{
+    let original = config(true);
+    let (connections, _, dropped) = active(&original).await;
+    let vault = Vault::new(&original, true, false);
+    let store = EnrollmentStore::new(vault, "target").unwrap();
+    let mut calls = Vec::new();
+    let mut runtime_enabled = true;
+    update(
+        &connections,
+        "target",
+        &original,
+        request(false, true),
+        |request| {
+            assert_paused(&connections, &dropped);
+            calls.push((request.enabled, request.allow_continuation));
+            runtime_enabled = request.enabled;
+            ready(Ok(state(request)))
+        },
+        || store.set_sharing(false, true),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(calls, [(false, false), (false, false)]);
+    assert!(!runtime_enabled);
+    let retained = store.load().unwrap().unwrap().0;
+    assert!(saved_request(&retained).enabled);
+    let summary_before = summary(&connections, "target").await.unwrap();
+    assert!(
+        summary_before.shared_sessions,
+        "retained choice, not an actual permission claim"
+    );
+    assert!(summary_before.sharing_recovery_required.is_required());
+    assert_eq!(
+        saved_choice(&retained),
+        "share Desktop history and allow continuation"
+    );
+    update(
+        &connections,
+        "target",
+        &retained,
+        saved_request(&retained),
+        |request| {
+            assert_paused(&connections, &dropped);
+            runtime_enabled = request.enabled;
+            ready(Ok(state(request)))
+        },
+        || ready(Ok(retained.clone())),
+    )
+    .await
+    .unwrap();
+    assert!(
+        runtime_enabled,
+        "only the subsequent explicitly confirmed saved-choice reconciliation restores sharing"
+    );
+    assert!(
+        !summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_recovery_required
+            .is_required()
+    );
+}
+
+#[tokio::test]
+async fn failed_write_acknowledgement_and_compensation_remain_unknown() {
+    let original = config(false);
+    let (connections, _, dropped) = active(&original).await;
+    let vault = Vault::new(&original, true, true);
+    let store = EnrollmentStore::new(vault, "target").unwrap();
+    let mut calls = 0;
+    let error = update(
+        &connections,
+        "target",
+        &original,
+        request(true, true),
+        |request| {
+            assert_paused(&connections, &dropped);
+            calls += 1;
+            if calls == 1 {
+                ready(Ok(state(request)))
+            } else {
+                ready(Err(colossus_sdk::ApiError::failed_precondition(
+                    colossus_sdk::ApiErrorReason::InternalInvariant,
+                    "synthetic compensation failure",
+                )))
+            }
+        },
+        || store.set_sharing(true, true),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert!(
+        saved_request(&store.load().unwrap().unwrap().0).enabled,
+        "write committed before acknowledgement failed"
+    );
+    assert!(error.outcome_unknown);
+    assert!(!error.retryable);
+    assert!(
+        summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_recovery_required
+            .is_required()
+    );
+}
+
+#[tokio::test]
+async fn runtime_failure_does_not_persist_and_always_attempts_disable() {
+    let original = config(false);
+    let (connections, _, dropped) = active(&original).await;
+    let vault = Vault::new(&original, false, false);
+    let store = EnrollmentStore::new(vault.clone(), "target").unwrap();
+    let mut calls = Vec::new();
+    let error = update(
+        &connections,
+        "target",
+        &original,
+        request(true, true),
+        |request| {
+            assert_paused(&connections, &dropped);
+            calls.push(request.enabled);
+            if calls.len() == 1 {
+                ready(Err(colossus_sdk::ApiError::failed_precondition(
+                    colossus_sdk::ApiErrorReason::InternalInvariant,
+                    "synthetic known runtime rejection",
+                )))
+            } else {
+                ready(Ok(state(request)))
+            }
+        },
+        || store.set_sharing(true, true),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(calls, [true, false]);
+    assert_eq!(vault.writes.load(Ordering::SeqCst), 0);
+    assert!(!error.outcome_unknown);
+    assert!(
+        summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_recovery_required
+            .is_required()
+    );
+}
+
+#[tokio::test]
+async fn fresh_private_enrollment_clears_prior_sharing_before_connector_start() {
+    let fresh = config(false);
+    let connections = Mutex::new(HashMap::new());
+    let mut runtime_enabled = true;
+    update(
+        &connections,
+        "target",
+        &fresh,
+        saved_request(&fresh),
+        |request| {
+            assert_eq!(
+                request.recipient_application_id,
+                "app:colossus-desktop-cloud"
+            );
+            runtime_enabled = request.enabled;
+            assert!(!request.allow_continuation);
+            ready(Ok(state(request)))
+        },
+        || ready(Ok(fresh.clone())),
+    )
+    .await
+    .unwrap();
+    assert!(!runtime_enabled);
+    assert!(connections.lock().await["target"].task.is_none());
+    assert!(
+        !summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_recovery_required
+            .is_required()
+    );
+}
+
+#[tokio::test]
+async fn stop_timeout_blocks_permission_changes_even_after_forced_parent_abort() {
+    let original = config(false);
+    let (connections, _, _) = active_with_stop(&original, false).await;
+    let error = quiesce(&connections, "target", &original, Duration::from_millis(10))
+        .await
+        .err()
+        .unwrap();
+    assert!(error.outcome_unknown);
+    let mut commits = 0;
+    for _ in 0..2 {
+        update(
+            &connections,
+            "target",
+            &original,
+            request(true, true),
+            |request| {
+                commits += 1;
+                ready(Ok(state(request)))
+            },
+            || ready(Ok(original.clone())),
+        )
+        .await
+        .err()
+        .unwrap();
+    }
+    assert_eq!(
+        commits, 0,
+        "parent abort is not proof that its child watches were joined"
+    );
+    assert!(
+        summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_recovery_required
+            .is_required()
+    );
+}
+
+#[test]
+fn disconnected_saved_metadata_does_not_claim_current_runtime_sharing() {
+    let shared = config(true);
+    let summary = super::super::disconnected_summary(
+        "target".into(),
+        Some(&shared),
+        ConnectorStatus::Disconnected,
+    );
+    assert!(
+        summary.shared_sessions,
+        "retained saved intent remains available for explicit confirmation"
+    );
+    assert!(summary.sharing_recovery_required.is_required());
+}
+
+#[test]
+fn reconnect_confirmation_reconciles_only_managed_local_authority() {
+    let shared = config(true);
+    let managed = reconnect_message(&shared, true);
+    assert!(managed.contains("share Desktop history and allow continuation"));
+    assert!(managed.contains("Reconnecting reapplies"));
+    let external = reconnect_message(&shared, false);
+    assert_eq!(
+        external,
+        "Reconnect runtime synthetic-instance to https://control-plane.example?"
+    );
+}
+
+fn short_deadlines() -> Deadlines {
+    Deadlines {
+        runtime: Duration::from_millis(10),
+        persistence: Duration::from_millis(10),
+    }
+}
+
+#[tokio::test]
+async fn timed_out_runtime_commit_stays_unknown_after_disable_ack_and_late_server_commit() {
+    let original = config(false);
+    let (connections, _, dropped) = active(&original).await;
+    let runtime_enabled = Arc::new(AtomicBool::new(false));
+    let delayed_state = Arc::clone(&runtime_enabled);
+    let (release, delayed) = tokio::sync::oneshot::channel();
+    let server = tokio::spawn(async move {
+        delayed.await.unwrap();
+        delayed_state.store(true, Ordering::Release);
+    });
+    let mut calls = 0;
+    let error = update_with_deadlines(
+        &connections,
+        "target",
+        &original,
+        request(true, true),
+        |request| {
+            assert_paused(&connections, &dropped);
+            calls += 1;
+            let first = calls == 1;
+            let runtime_enabled = Arc::clone(&runtime_enabled);
+            async move {
+                if first {
+                    std::future::pending::<ApiResult<WorkspaceSharingState>>().await
+                } else {
+                    runtime_enabled.store(false, Ordering::Release);
+                    Ok(state(request))
+                }
+            }
+        },
+        || ready(Ok(original.clone())),
+        short_deadlines(),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(calls, 2);
+    assert!(
+        error.outcome_unknown,
+        "a disable ACK cannot order an older timed-out RPC"
+    );
+    assert!(!runtime_enabled.load(Ordering::Acquire));
+    release.send(()).unwrap();
+    server.await.unwrap();
+    assert!(
+        runtime_enabled.load(Ordering::Acquire),
+        "the old server request may complete late"
+    );
+    let snapshot = summary(&connections, "target").await.unwrap();
+    assert!(
+        snapshot.sharing_restart_required.is_required()
+            && snapshot.sharing_recovery_required.is_required()
+    );
+    assert!(
+        ensure_recoverable(&connections, "target").await.is_err(),
+        "disconnect/forget/revoke/enroll share the same restart fence"
+    );
+    assert!(check_start(&connections, "target").await.is_err());
+    let mut retry_calls = 0;
+    update(
+        &connections,
+        "target",
+        &original,
+        request(false, false),
+        |request| {
+            retry_calls += 1;
+            ready(Ok(state(request)))
+        },
+        || ready(Ok(original.clone())),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(retry_calls, 0);
+}
+
+#[tokio::test]
+async fn persistence_timeout_remains_unconfirmed_even_when_disable_succeeds() {
+    let original = config(false);
+    let (connections, _, dropped) = active(&original).await;
+    let mut requests = Vec::new();
+    let error = update_with_deadlines(
+        &connections,
+        "target",
+        &original,
+        request(true, true),
+        |request| {
+            assert_paused(&connections, &dropped);
+            requests.push(request.enabled);
+            ready(Ok(state(request)))
+        },
+        std::future::pending::<Result<ConnectionConfig, &'static str>>,
+        short_deadlines(),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(requests, [true, false]);
+    assert!(error.outcome_unknown);
+    assert!(
+        summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_restart_required
+            .is_required()
+    );
+    assert!(ensure_recoverable(&connections, "target").await.is_err());
+}
+
+#[tokio::test]
+async fn pending_compensation_is_bounded_and_requires_restart_without_retry() {
+    let original = config(false);
+    let (connections, _, dropped) = active(&original).await;
+    let mut calls = 0;
+    let error = update_with_deadlines(
+        &connections,
+        "target",
+        &original,
+        request(true, true),
+        |request| {
+            assert_paused(&connections, &dropped);
+            calls += 1;
+            let pending = calls == 2;
+            async move {
+                if pending {
+                    std::future::pending::<ApiResult<WorkspaceSharingState>>().await
+                } else {
+                    Ok(state(request))
+                }
+            }
+        },
+        || ready(Err("synthetic persistence failure")),
+        short_deadlines(),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(calls, 2);
+    assert!(error.outcome_unknown && !error.retryable);
+    assert!(
+        summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_restart_required
+            .is_required()
+    );
+}
+
+#[tokio::test]
+async fn lost_transport_acknowledgement_is_not_a_definitive_disable_even_after_compensation() {
+    let original = config(false);
+    let (connections, _, _) = active(&original).await;
+    let mut calls = 0;
+    let error = update(
+        &connections,
+        "target",
+        &original,
+        request(true, false),
+        |request| {
+            calls += 1;
+            if calls == 1 {
+                ready(Err(colossus_sdk::ApiError {
+                    code: ApiErrorCode::Unavailable,
+                    ..colossus_sdk::ApiError::failed_precondition(
+                        colossus_sdk::ApiErrorReason::InternalInvariant,
+                        "synthetic lost transport acknowledgement",
+                    )
+                }))
+            } else {
+                ready(Ok(state(request)))
+            }
+        },
+        || ready(Ok(original.clone())),
+    )
+    .await
+    .err()
+    .unwrap();
+    assert_eq!(calls, 2);
+    assert!(error.outcome_unknown);
+    assert!(
+        summary(&connections, "target")
+            .await
+            .unwrap()
+            .sharing_restart_required
+            .is_required()
+    );
+}
diff --git a/apps/desktop/src-tauri/src/cloud_connector/status_cache.rs b/apps/desktop/src-tauri/src/cloud_connector/status_cache.rs
new file mode 100644
index 000000000..b81c17f0e
--- /dev/null
+++ b/apps/desktop/src-tauri/src/cloud_connector/status_cache.rs
@@ -0,0 +1,236 @@
+//! Nonsecret enrollment summaries for connection lists; never execution authority.
+use super::{CloudStatus, failure};
+use crate::dto::CommandErrorDto;
+use colossus_connector::ConnectorStatus;
+use colossus_home::{ColossusHome, ConfinedRoot};
+use fs4::fs_std::FileExt;
+use std::{
+    collections::BTreeMap,
+    io::{Read, Write},
+    path::Path,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+};
+
+const MAX_BYTES: u64 = 512 * 1024;
+
+pub(super) fn load() -> Result<BTreeMap<String, CloudStatus>, CommandErrorDto> {
+    access(None, ColossusHome::resolve_and_ensure)
+}
+
+pub(super) fn remember(status: CloudStatus) -> Result<(), CommandErrorDto> {
+    access(
+        Some((status.target_id.clone(), Some(status))),
+        ColossusHome::resolve_and_ensure,
+    )
+    .map(|_| ())
+}
+
+pub(super) fn forget(target: String) -> Result<(), CommandErrorDto> {
+    access(Some((target, None)), ColossusHome::resolve_and_ensure).map(|_| ())
+}
+
+pub(super) fn retained_disconnected_status(
+    target: &str,
+    node: &str,
+) -> Result<ConnectorStatus, CommandErrorDto> {
+    access(None, ColossusHome::resolve_and_ensure)
+        .map(|statuses| disconnected_status(&statuses, target, node))
+}
+
+fn disconnected_status(
+    statuses: &BTreeMap<String, CloudStatus>,
+    target: &str,
+    node: &str,
+) -> ConnectorStatus {
+    if statuses.get(target).is_some_and(|status| {
+        status.node_id.as_deref() == Some(node) && status.status == ConnectorStatus::Revoked
+    }) {
+        ConnectorStatus::Revoked
+    } else {
+        ConnectorStatus::Disconnected
+    }
+}
+
+/// Retain an observed terminal status only for this still-owned enrollment.
+/// The cache lock orders this with forget/replacement; no absent row is created.
+pub(super) fn remember_remote_revocation(
+    target: String,
+    node: String,
+    alive: Arc<AtomicBool>,
+) -> Result<(), CommandErrorDto> {
+    access_change(
+        Some(Change::Revoked {
+            target,
+            node,
+            alive,
+        }),
+        ColossusHome::resolve_and_ensure,
+    )
+    .map(|_| ())
+}
+
+enum Change {
+    Remember(String, CloudStatus),
+    Forget(String),
+    Revoked {
+        target: String,
+        node: String,
+        alive: Arc<AtomicBool>,
+    },
+}
+
+fn unavailable() -> CommandErrorDto {
+    failure("Saved Control Plane connection summaries are unavailable.")
+}
+
+fn valid(status: &CloudStatus) -> bool {
+    let bounded = |value: &str| {
+        !value.is_empty() && value.len() <= 256 && !value.chars().any(char::is_control)
+    };
+    bounded(&status.target_id)
+        && status.node_id.as_deref().is_some_and(bounded)
+        && status.project_id.as_deref().is_some_and(bounded)
+        && status.host_id.as_deref().is_none_or(bounded)
+        && status.workspace_id.as_deref().is_none_or(bounded)
+        && matches!(
+            status.status,
+            ConnectorStatus::Disconnected | ConnectorStatus::Revoked
+        )
+        && status.endpoint.as_deref().is_some_and(|endpoint| {
+            endpoint.len() <= 2048
+                && url::Url::parse(endpoint).is_ok_and(|url| {
+                    let loopback = matches!(
+                        url.host_str(),
+                        Some("localhost" | "127.0.0.1" | "[::1]" | "::1")
+                    );
+                    (url.scheme() == "https" || url.scheme() == "http" && loopback)
+                        && url.username().is_empty()
+                        && url.password().is_none()
+                        && url.query().is_none()
+                        && url.fragment().is_none()
+                })
+        })
+}
+
+fn access(
+    update: Option<(String, Option<CloudStatus>)>,
+    resolve_home: impl FnOnce() -> Result<ColossusHome, colossus_home::HomeError>,
+) -> Result<BTreeMap<String, CloudStatus>, CommandErrorDto> {
+    access_change(
+        update.map(|(target, status)| match status {
+            Some(status) => Change::Remember(target, status),
+            None => Change::Forget(target),
+        }),
+        resolve_home,
+    )
+}
+
+fn access_change(
+    change: Option<Change>,
+    resolve_home: impl FnOnce() -> Result<ColossusHome, colossus_home::HomeError>,
+) -> Result<BTreeMap<String, CloudStatus>, CommandErrorDto> {
+    let home = resolve_home().map_err(|_| unavailable())?;
+    let root = ConfinedRoot::bind(
+        home.confined_root()
+            .prepare_directory(Path::new("desktop-control-plane"))
+            .map_err(|_| unavailable())?,
+    )
+    .map_err(|_| unavailable())?;
+    let lock = root
+        .open_file(Path::new("connections.lock"))
+        .map_err(|_| unavailable())?;
+    lock.file().lock_exclusive().map_err(|_| unavailable())?;
+    let result = (|| {
+        let retained = root
+            .open_file(Path::new("connections.json"))
+            .map_err(|_| unavailable())?;
+        retained.revalidate(&root).map_err(|_| unavailable())?;
+        let mut bytes = Vec::new();
+        Read::by_ref(&mut retained.file())
+            .take(MAX_BYTES + 1)
+            .read_to_end(&mut bytes)
+            .map_err(|_| unavailable())?;
+        if bytes.len() as u64 > MAX_BYTES {
+            return Err(unavailable());
+        }
+        let mut statuses: BTreeMap<String, CloudStatus> = if bytes.is_empty() {
+            BTreeMap::new()
+        } else {
+            serde_json::from_slice(&bytes).map_err(|_| unavailable())?
+        };
+        if statuses.len() > 128
+            || statuses
+                .iter()
+                .any(|(target, status)| target != &status.target_id || !valid(status))
+        {
+            return Err(unavailable());
+        }
+        if let Some(change) = change {
+            match change {
+                Change::Remember(target, mut status) => {
+                    status.status = if status.status == ConnectorStatus::Revoked {
+                        ConnectorStatus::Revoked
+                    } else {
+                        ConnectorStatus::Disconnected
+                    };
+                    if !valid(&status) || status.target_id != target {
+                        return Err(unavailable());
+                    }
+                    statuses.insert(target, status);
+                }
+                Change::Forget(target) => {
+                    statuses.remove(&target);
+                }
+                Change::Revoked {
+                    target,
+                    node,
+                    alive,
+                } => {
+                    // This check belongs under connections.lock. Drop invalidates the
+                    // token before forget/replacement tries to acquire that same lock.
+                    if !alive.load(Ordering::Acquire) {
+                        return Ok(statuses);
+                    }
+                    let Some(existing) = statuses.get_mut(&target) else {
+                        return Ok(statuses);
+                    };
+                    if existing.node_id.as_deref() != Some(node.as_str())
+                        || existing.target_id != target
+                    {
+                        return Ok(statuses);
+                    }
+                    existing.status = ConnectorStatus::Revoked;
+                }
+            }
+            if statuses.len() > 128 {
+                return Err(unavailable());
+            }
+            let bytes = serde_json::to_vec(&statuses).map_err(|_| unavailable())?;
+            if bytes.len() as u64 > MAX_BYTES {
+                return Err(unavailable());
+            }
+            let name = format!("connections-{}.tmp", uuid::Uuid::new_v4());
+            let temporary = root
+                .open_file(Path::new(&name))
+                .map_err(|_| unavailable())?;
+            temporary
+                .file()
+                .write_all(&bytes)
+                .map_err(|_| unavailable())?;
+            temporary.file().sync_all().map_err(|_| unavailable())?;
+            retained.revalidate(&root).map_err(|_| unavailable())?;
+            temporary.revalidate(&root).map_err(|_| unavailable())?;
+            std::fs::rename(temporary.path(), retained.path()).map_err(|_| unavailable())?;
+            root.sync_directory().map_err(|_| unavailable())?;
+        }
+        Ok(statuses)
+    })();
+    let _ = FileExt::unlock(lock.file());
+    result
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/desktop/src-tauri/src/cloud_connector/status_cache/tests.rs b/apps/desktop/src-tauri/src/cloud_connector/status_cache/tests.rs
new file mode 100644
index 000000000..fafec2949
--- /dev/null
+++ b/apps/desktop/src-tauri/src/cloud_connector/status_cache/tests.rs
@@ -0,0 +1,326 @@
+use super::*;
+use std::fs;
+
+fn home() -> (tempfile::TempDir, ColossusHome) {
+    #[cfg(windows)]
+    let directory =
+        tempfile::tempdir_in(std::env::var_os("LOCALAPPDATA").expect("Windows private parent"))
+            .expect("test directory");
+    #[cfg(not(windows))]
+    let directory = tempfile::tempdir().expect("test directory");
+    let parent = fs::canonicalize(directory.path()).expect("canonical parent");
+    let home = ColossusHome::ensure_at(parent.join("home")).expect("private test home");
+    (directory, home)
+}
+
+fn status(state: ConnectorStatus) -> CloudStatus {
+    CloudStatus {
+        target_id: "owned-workspace".into(),
+        status: state,
+        node_id: Some("owned-node".into()),
+        project_id: Some("owned-project".into()),
+        endpoint: Some("https://control-plane.example".into()),
+        host_id: Some("owned-host".into()),
+        workspace_id: Some("owned-workspace".into()),
+        shared_sessions: false,
+        shared_continuation: false,
+        sharing_supported: true,
+        sharing_recovery_required: super::super::sharing::Requirement::Clear,
+        sharing_restart_required: super::super::sharing::Requirement::Clear,
+    }
+}
+
+#[test]
+fn saved_connections_survive_reopen_without_claiming_live_connectivity() {
+    let (_guard, home) = home();
+    access(
+        Some((
+            "owned-workspace".into(),
+            Some(status(ConnectorStatus::Connected)),
+        )),
+        || Ok(home.clone()),
+    )
+    .expect("remember public fields");
+    let reopened = ColossusHome::ensure_at(home.root()).expect("reopened home");
+    let saved = access(None, || Ok(reopened)).expect("saved summary without credential store");
+    assert_eq!(
+        saved["owned-workspace"].status,
+        ConnectorStatus::Disconnected
+    );
+    assert_eq!(
+        saved["owned-workspace"].project_id.as_deref(),
+        Some("owned-project")
+    );
+    let bytes =
+        fs::read(home.root().join("desktop-control-plane/connections.json")).expect("public cache");
+    let encoded = String::from_utf8(bytes).expect("UTF8 metadata");
+    let mut wire: serde_json::Value = serde_json::from_str(&encoded).expect("wire metadata");
+    let row = wire["owned-workspace"]
+        .as_object_mut()
+        .expect("status object");
+    assert_eq!(row["sharingRecoveryRequired"], false);
+    assert_eq!(row["sharingRestartRequired"], false);
+    row.remove("sharingRecoveryRequired");
+    row.remove("sharingRestartRequired");
+    let legacy: CloudStatus = serde_json::from_value(serde_json::Value::Object(row.clone()))
+        .expect("legacy status defaults");
+    assert!(!legacy.sharing_recovery_required.is_required());
+    assert!(!legacy.sharing_restart_required.is_required());
+    row.insert(
+        "sharingRecoveryRequired".into(),
+        serde_json::json!("required"),
+    );
+    assert!(
+        serde_json::from_value::<CloudStatus>(serde_json::Value::Object(row.clone())).is_err(),
+        "wire flags remain strict booleans"
+    );
+    for forbidden in ["credential", "bearer", "privateKey", "certificate"] {
+        assert!(!encoded.contains(forbidden));
+    }
+}
+
+#[test]
+fn revocation_and_forgetting_update_the_public_summary() {
+    let (_guard, home) = home();
+    access(
+        Some((
+            "owned-workspace".into(),
+            Some(status(ConnectorStatus::Revoked)),
+        )),
+        || Ok(home.clone()),
+    )
+    .expect("revoked summary");
+    assert_eq!(
+        access(None, || Ok(home.clone())).expect("revoked read")["owned-workspace"].status,
+        ConnectorStatus::Revoked
+    );
+    access(Some(("owned-workspace".into(), None)), || Ok(home.clone())).expect("forget summary");
+    assert!(access(None, || Ok(home)).expect("empty summary").is_empty());
+}
+
+#[test]
+fn remote_revocation_updates_matching_existing_summary_and_survives_reopen() {
+    let (_guard, home) = home();
+    access(
+        Some((
+            "owned-workspace".into(),
+            Some(status(ConnectorStatus::Disconnected)),
+        )),
+        || Ok(home.clone()),
+    )
+    .expect("retained enrollment");
+    access_change(
+        Some(Change::Revoked {
+            target: "owned-workspace".into(),
+            node: "owned-node".into(),
+            alive: Arc::new(AtomicBool::new(true)),
+        }),
+        || Ok(home.clone()),
+    )
+    .expect("remote terminal status");
+    let reopened = ColossusHome::ensure_at(home.root()).expect("reopened home");
+    assert_eq!(
+        access(None, || Ok(reopened)).expect("retained terminal state")["owned-workspace"].status,
+        ConnectorStatus::Revoked
+    );
+    let saved = access(None, || Ok(home.clone())).expect("read after restart");
+    let preserved = disconnected_status(&saved, "owned-workspace", "owned-node");
+    assert_eq!(
+        preserved,
+        ConnectorStatus::Revoked,
+        "read-only settings refresh retains terminal observation"
+    );
+    let mut disconnected = status(ConnectorStatus::Disconnected);
+    disconnected.status = preserved;
+    access(Some(("owned-workspace".into(), Some(disconnected))), || {
+        Ok(home.clone())
+    })
+    .expect("later disconnect persists retained terminal state");
+    assert_eq!(
+        access(None, || Ok(home.clone())).expect("later reopen")["owned-workspace"].status,
+        ConnectorStatus::Revoked
+    );
+    assert_eq!(
+        disconnected_status(&saved, "owned-workspace", "replacement-node"),
+        ConnectorStatus::Disconnected,
+        "different enrollment never inherits old revocation"
+    );
+}
+
+#[test]
+fn terminal_callback_cannot_resurrect_forget_or_overwrite_a_replacement() {
+    let (_guard, home) = home();
+    let live = Arc::new(AtomicBool::new(true));
+    access(
+        Some((
+            "owned-workspace".into(),
+            Some(status(ConnectorStatus::Disconnected)),
+        )),
+        || Ok(home.clone()),
+    )
+    .expect("retained enrollment");
+    access(Some(("owned-workspace".into(), None)), || Ok(home.clone())).expect("forget");
+    access_change(
+        Some(Change::Revoked {
+            target: "owned-workspace".into(),
+            node: "owned-node".into(),
+            alive: Arc::clone(&live),
+        }),
+        || Ok(home.clone()),
+    )
+    .expect("absent enrollment never inserted even before token invalidation");
+    assert!(
+        access(None, || Ok(home.clone()))
+            .expect("forgotten cache")
+            .is_empty()
+    );
+
+    let mut replacement = status(ConnectorStatus::Disconnected);
+    replacement.node_id = Some("replacement-node".into());
+    access(Some(("owned-workspace".into(), Some(replacement))), || {
+        Ok(home.clone())
+    })
+    .expect("replacement enrollment");
+    access_change(
+        Some(Change::Revoked {
+            target: "owned-workspace".into(),
+            node: "owned-node".into(),
+            alive: Arc::clone(&live),
+        }),
+        || Ok(home.clone()),
+    )
+    .expect("different node not overwritten");
+    assert_eq!(
+        access(None, || Ok(home.clone())).expect("replacement state")["owned-workspace"].status,
+        ConnectorStatus::Disconnected
+    );
+
+    // Reconnect may retain the same node. The old session token still distinguishes it.
+    live.store(false, Ordering::Release);
+    access(
+        Some((
+            "owned-workspace".into(),
+            Some(status(ConnectorStatus::Disconnected)),
+        )),
+        || Ok(home.clone()),
+    )
+    .expect("same-node replacement session");
+    access_change(
+        Some(Change::Revoked {
+            target: "owned-workspace".into(),
+            node: "owned-node".into(),
+            alive: live,
+        }),
+        || Ok(home.clone()),
+    )
+    .expect("dropped old session cannot mark replacement revoked");
+    assert_eq!(
+        access(None, || Ok(home)).expect("same-node replacement state")["owned-workspace"].status,
+        ConnectorStatus::Disconnected
+    );
+}
+
+#[test]
+fn terminal_callback_checks_liveness_after_waiting_for_cache_lock() {
+    let (_guard, home) = home();
+    access(
+        Some((
+            "owned-workspace".into(),
+            Some(status(ConnectorStatus::Disconnected)),
+        )),
+        || Ok(home.clone()),
+    )
+    .expect("retained enrollment");
+    let root = ConfinedRoot::bind(home.root().join("desktop-control-plane")).expect("cache root");
+    let lock = root
+        .open_existing_file_read_write(Path::new("connections.lock"))
+        .expect("lock");
+    lock.file().lock_exclusive().expect("hold cache lock");
+    let live = Arc::new(AtomicBool::new(true));
+    let (entered, waiting) = std::sync::mpsc::channel();
+    let worker_home = home.clone();
+    let worker_live = Arc::clone(&live);
+    let task = std::thread::spawn(move || {
+        access_change(
+            Some(Change::Revoked {
+                target: "owned-workspace".into(),
+                node: "owned-node".into(),
+                alive: worker_live,
+            }),
+            || {
+                entered.send(()).expect("notify before cache lock");
+                Ok(worker_home)
+            },
+        )
+    });
+    waiting
+        .recv_timeout(std::time::Duration::from_secs(5))
+        .expect("terminal callback started");
+    live.store(false, Ordering::Release);
+    FileExt::unlock(lock.file()).expect("release cache lock");
+    task.join()
+        .expect("callback thread")
+        .expect("invalidated callback is a no-op");
+    assert_eq!(
+        access(None, || Ok(home.clone())).expect("no stale terminal write")["owned-workspace"]
+            .status,
+        ConnectorStatus::Disconnected
+    );
+    access(Some(("owned-workspace".into(), None)), || Ok(home.clone())).expect("serialized forget");
+    assert!(
+        access(None, || Ok(home))
+            .expect("forgotten summary")
+            .is_empty()
+    );
+}
+
+#[test]
+fn forged_connected_states_and_secret_bearing_fields_are_rejected() {
+    let (_guard, home) = home();
+    access(None, || Ok(home.clone())).expect("prepare public cache");
+    let path = home.root().join("desktop-control-plane/connections.json");
+    let forged = BTreeMap::from([("owned-workspace", status(ConnectorStatus::Connected))]);
+    fs::write(&path, serde_json::to_vec(&forged).expect("forged JSON"))
+        .expect("write forged cache");
+    assert!(access(None, || Ok(home.clone())).is_err());
+    let mut forged = serde_json::to_value(BTreeMap::from([(
+        "owned-workspace",
+        status(ConnectorStatus::Disconnected),
+    )]))
+    .expect("summary JSON");
+    forged["owned-workspace"]["bearer"] = serde_json::json!("synthetic-forbidden-field");
+    fs::write(&path, serde_json::to_vec(&forged).expect("forged JSON"))
+        .expect("write forbidden field");
+    assert!(access(None, || Ok(home.clone())).is_err());
+    fs::write(
+        &path,
+        vec![b' '; usize::try_from(MAX_BYTES).expect("bounded cache size fits usize") + 1],
+    )
+    .expect("oversized cache");
+    assert!(access(None, || Ok(home)).is_err());
+}
+
+#[cfg(unix)]
+#[test]
+fn symlinked_cache_directory_cannot_redirect_metadata_writes() {
+    let (_guard, home) = home();
+    let outside = tempfile::tempdir().expect("outside test directory");
+    std::os::unix::fs::symlink(outside.path(), home.root().join("desktop-control-plane"))
+        .expect("directory symlink");
+    assert!(
+        access(
+            Some((
+                "owned-workspace".into(),
+                Some(status(ConnectorStatus::Disconnected))
+            )),
+            || Ok(home)
+        )
+        .is_err()
+    );
+    assert!(
+        fs::read_dir(outside.path())
+            .expect("outside contents")
+            .next()
+            .is_none()
+    );
+}
diff --git a/apps/desktop/src-tauri/src/commands.rs b/apps/desktop/src-tauri/src/commands.rs
index ccc6658ad..000bbaef7 100644
--- a/apps/desktop/src-tauri/src/commands.rs
+++ b/apps/desktop/src-tauri/src/commands.rs
@@ -206,6 +206,7 @@ pub(crate) async fn create_run(
     mut request: CreateRunInput,
 ) -> Result<RunDto, CommandErrorDto> {
     let branch = request.branch_link();
+    let thread_fork = request.is_thread_fork();
     let settings = SettingsStore::open_application()?.load()?;
     if branch.is_some() {
         require_selected_space(&settings, &target_id)?;
@@ -283,7 +284,12 @@ pub(crate) async fn create_run(
         .bind_runs(&target, vec![response.run.run_id.clone()])
         .await;
     let run: RunDto = response.run.into();
-    register_or_advance_aside(&target_id, branch, source.as_ref(), &run)?;
+    register_or_advance_aside(
+        &target_id,
+        if thread_fork { None } else { branch },
+        source.as_ref(),
+        &run,
+    )?;
     index_released_runs(&target_id, std::slice::from_ref(&run));
     Ok(run)
 }
diff --git a/apps/desktop/src-tauri/src/control_plane_profiles.rs b/apps/desktop/src-tauri/src/control_plane_profiles.rs
new file mode 100644
index 000000000..0d9ac531b
--- /dev/null
+++ b/apps/desktop/src-tauri/src/control_plane_profiles.rs
@@ -0,0 +1,191 @@
+//! Global connection bookmarks; never credentials, enrollment, or execution authority.
+use crate::{cloud_connector, dto::CommandErrorDto, state::AppState};
+use colossus_home::{ColossusHome, ConfinedRoot};
+use fs4::fs_std::FileExt;
+use serde::{Deserialize, Serialize};
+use std::{
+    collections::BTreeSet,
+    io::{Read, Write},
+    path::Path,
+};
+use tauri::State;
+
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct ControlPlaneProfile {
+    id: String,
+    label: String,
+    endpoint: String,
+}
+
+#[derive(Clone, Default, Deserialize, Serialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(crate) struct Catalog {
+    revision: u64,
+    profiles: Vec<ControlPlaneProfile>,
+    default_profile: Option<String>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct ProfileSnapshot {
+    #[serde(flatten)]
+    catalog: Catalog,
+    connections: Vec<cloud_connector::CloudStatus>,
+    connection_status_unavailable: bool,
+}
+
+fn snapshot(
+    catalog: Catalog,
+    connections: Result<Vec<cloud_connector::CloudStatus>, CommandErrorDto>,
+) -> ProfileSnapshot {
+    let connection_status_unavailable = connections.is_err();
+    ProfileSnapshot {
+        catalog,
+        connections: connections.unwrap_or_default(),
+        connection_status_unavailable,
+    }
+}
+
+fn failure() -> CommandErrorDto {
+    CommandErrorDto::invalid(
+        "control_plane_profiles",
+        "Connection settings are unavailable or changed; reload and try again.",
+    )
+}
+
+fn access(next: Option<Catalog>) -> Result<Catalog, CommandErrorDto> {
+    access_with_home(next, ColossusHome::resolve_and_ensure)
+}
+
+fn access_with_home(
+    next: Option<Catalog>,
+    resolve_home: impl FnOnce() -> Result<ColossusHome, colossus_home::HomeError>,
+) -> Result<Catalog, CommandErrorDto> {
+    if let Some(next) = &next {
+        let mut ids = BTreeSet::new();
+        let mut names = BTreeSet::new();
+        if next.profiles.len() > 32
+            || next.profiles.iter().any(|profile| {
+                let valid_id = !profile.id.is_empty()
+                    && profile.id.len() <= 128
+                    && profile
+                        .id
+                        .bytes()
+                        .all(|c| c.is_ascii_alphanumeric() || b"-_".contains(&c));
+                let valid_label = !profile.label.trim().is_empty()
+                    && profile.label.len() <= 128
+                    && !profile.label.chars().any(char::is_control);
+                let valid_url = url::Url::parse(&profile.endpoint).is_ok_and(|url| {
+                    let local = matches!(
+                        url.host_str(),
+                        Some("localhost" | "127.0.0.1" | "[::1]" | "::1")
+                    );
+                    (url.scheme() == "https" || url.scheme() == "http" && local)
+                        && url.username().is_empty()
+                        && url.password().is_none()
+                        && url.query().is_none()
+                        && url.fragment().is_none()
+                        && profile.endpoint.len() <= 2048
+                });
+                !valid_id
+                    || !valid_label
+                    || !valid_url
+                    || !ids.insert(&profile.id)
+                    || !names.insert(profile.label.trim().to_lowercase())
+            })
+            || next
+                .default_profile
+                .as_ref()
+                .is_some_and(|id| !ids.contains(id))
+        {
+            return Err(CommandErrorDto::invalid(
+                "control_plane_profiles",
+                "Use unique connection names and HTTPS endpoints, or HTTP on loopback. Endpoints cannot include credentials, query parameters, or fragments.",
+            ));
+        }
+    }
+    let home = resolve_home().map_err(|_| failure())?;
+    let root = ConfinedRoot::bind(
+        home.confined_root()
+            .prepare_directory(Path::new("desktop-control-plane"))
+            .map_err(|_| failure())?,
+    )
+    .map_err(|_| failure())?;
+    let lock = root
+        .open_file(Path::new("profiles.lock"))
+        .map_err(|_| failure())?;
+    lock.file().lock_exclusive().map_err(|_| failure())?;
+    let retained = root
+        .open_file(Path::new("profiles.json"))
+        .map_err(|_| failure())?;
+    let mut file = retained.file();
+    let result = (|| {
+        retained.revalidate(&root).map_err(|_| failure())?;
+        let mut bytes = Vec::new();
+        Read::by_ref(&mut file)
+            .take(32769)
+            .read_to_end(&mut bytes)
+            .map_err(|_| failure())?;
+        if bytes.len() > 32768 {
+            return Err(failure());
+        }
+        let old: Catalog = if bytes.is_empty() {
+            Catalog::default()
+        } else {
+            serde_json::from_slice(&bytes).map_err(|_| failure())?
+        };
+        let Some(mut next) = next else { return Ok(old) };
+        if next.revision != old.revision {
+            return Err(failure());
+        }
+        next.revision = old.revision.checked_add(1).ok_or_else(failure)?;
+        let bytes = serde_json::to_vec(&next).map_err(|_| failure())?;
+        if bytes.len() > 32768 {
+            return Err(failure());
+        }
+        let temp_name = format!("profiles-{}.tmp", uuid::Uuid::new_v4());
+        let temp = root
+            .open_file(Path::new(&temp_name))
+            .map_err(|_| failure())?;
+        let mut output = temp.file();
+        output.write_all(&bytes).map_err(|_| failure())?;
+        output.sync_all().map_err(|_| failure())?;
+        retained.revalidate(&root).map_err(|_| failure())?;
+        temp.revalidate(&root).map_err(|_| failure())?;
+        std::fs::rename(temp.path(), retained.path()).map_err(|_| failure())?;
+        Ok(next)
+    })();
+    let _ = FileExt::unlock(lock.file());
+    result
+}
+
+#[tauri::command]
+pub(crate) async fn control_plane_profiles(
+    state: State<'_, AppState>,
+) -> Result<ProfileSnapshot, CommandErrorDto> {
+    let catalog = tauri::async_runtime::spawn_blocking(|| access(None))
+        .await
+        .map_err(|_| failure())??;
+    Ok(snapshot(
+        catalog,
+        cloud_connector::global_connections(&state).await,
+    ))
+}
+
+#[tauri::command]
+pub(crate) async fn save_control_plane_profiles(
+    state: State<'_, AppState>,
+    catalog: Catalog,
+) -> Result<ProfileSnapshot, CommandErrorDto> {
+    let catalog = tauri::async_runtime::spawn_blocking(move || access(Some(catalog)))
+        .await
+        .map_err(|_| failure())??;
+    Ok(snapshot(
+        catalog,
+        cloud_connector::global_connections(&state).await,
+    ))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/apps/desktop/src-tauri/src/control_plane_profiles/tests.rs b/apps/desktop/src-tauri/src/control_plane_profiles/tests.rs
new file mode 100644
index 000000000..8dce9ec17
--- /dev/null
+++ b/apps/desktop/src-tauri/src/control_plane_profiles/tests.rs
@@ -0,0 +1,187 @@
+use super::*;
+use std::fs;
+
+fn home() -> (tempfile::TempDir, ColossusHome) {
+    #[cfg(windows)]
+    let directory = tempfile::tempdir_in(
+        std::env::var_os("LOCALAPPDATA").expect("private Windows test parent"),
+    )
+    .expect("temporary profile parent");
+    #[cfg(not(windows))]
+    let directory = tempfile::tempdir().expect("temporary profile parent");
+    let parent = fs::canonicalize(directory.path()).expect("canonical test parent");
+    let home = ColossusHome::ensure_at(parent.join("home")).expect("private test home");
+    (directory, home)
+}
+
+fn catalog(revision: u64, endpoint: &str) -> Catalog {
+    Catalog {
+        revision,
+        profiles: vec![ControlPlaneProfile {
+            id: "acceptance-profile".into(),
+            label: "Control Plane".into(),
+            endpoint: endpoint.into(),
+        }],
+        default_profile: Some("acceptance-profile".into()),
+    }
+}
+
+fn rejected_before_home(catalog: Catalog) {
+    assert!(
+        access_with_home(Some(catalog), || panic!("invalid metadata resolved a home")).is_err()
+    );
+}
+
+#[test]
+fn profiles_allow_https_and_strict_loopback_endpoints() {
+    let (_guard, home) = home();
+    let mut revision = 0;
+    for endpoint in [
+        "https://control-plane.example/api",
+        "http://127.0.0.1:8090",
+        "http://localhost:8090",
+        "http://[::1]:8090",
+    ] {
+        let saved = access_with_home(Some(catalog(revision, endpoint)), || Ok(home.clone()))
+            .expect("valid connection metadata");
+        assert_eq!(saved.profiles[0].endpoint, endpoint);
+        revision = saved.revision;
+    }
+}
+
+#[test]
+fn profiles_reject_credential_urls_remote_http_and_invalid_names() {
+    for endpoint in [
+        "http://control-plane.example",
+        "http://127.0.0.1.example",
+        "https://user@control-plane.example",
+        "https://user:password@control-plane.example",
+        "https://control-plane.example?token=synthetic",
+        "https://control-plane.example#fragment",
+        "file:///private/tmp/profiles",
+    ] {
+        rejected_before_home(catalog(0, endpoint));
+    }
+    for id in ["", "../profile", "profile.name"] {
+        let mut invalid = catalog(0, "https://control-plane.example");
+        invalid.profiles[0].id = id.into();
+        rejected_before_home(invalid);
+    }
+    for label in [" ", "Control\nPlane"] {
+        let mut invalid = catalog(0, "https://control-plane.example");
+        invalid.profiles[0].label = label.into();
+        rejected_before_home(invalid);
+    }
+    let mut duplicate = catalog(0, "https://control-plane.example");
+    duplicate.profiles.push(duplicate.profiles[0].clone());
+    rejected_before_home(duplicate.clone());
+    duplicate.profiles[1].id = "another-profile".into();
+    duplicate.profiles[1].label = " control plane ".into();
+    rejected_before_home(duplicate);
+    let mut unknown_default = catalog(0, "https://control-plane.example");
+    unknown_default.default_profile = Some("missing-profile".into());
+    rejected_before_home(unknown_default);
+}
+
+#[test]
+fn profiles_revision_cas_is_durable_across_reopen() {
+    let (_guard, home) = home();
+    let initial = access_with_home(None, || Ok(home.clone())).expect("empty catalog");
+    assert_eq!(initial.revision, 0);
+    assert!(initial.profiles.is_empty());
+    let saved = access_with_home(Some(catalog(0, "https://first.example")), || {
+        Ok(home.clone())
+    })
+    .expect("first save");
+    assert_eq!(saved.revision, 1);
+    assert!(
+        access_with_home(Some(catalog(0, "https://stale.example")), || {
+            Ok(home.clone())
+        })
+        .is_err()
+    );
+    let reopened = ColossusHome::ensure_at(home.root()).expect("reopened private home");
+    let unchanged = access_with_home(None, || Ok(reopened.clone())).expect("retained catalog");
+    assert_eq!(unchanged.revision, 1);
+    assert_eq!(unchanged.profiles[0].endpoint, "https://first.example");
+    let updated = access_with_home(Some(catalog(1, "https://second.example")), || {
+        Ok(reopened.clone())
+    })
+    .expect("next revision save");
+    assert_eq!(updated.revision, 2);
+    let retained = access_with_home(None, || Ok(reopened)).expect("updated retained catalog");
+    assert_eq!(retained.revision, 2);
+    assert_eq!(retained.profiles[0].endpoint, "https://second.example");
+    assert_eq!(
+        retained.default_profile.as_deref(),
+        Some("acceptance-profile")
+    );
+}
+
+#[test]
+fn unavailable_enrollment_metadata_does_not_reinterpret_a_committed_bookmark_save() {
+    let (_guard, home) = home();
+    let saved = access_with_home(Some(catalog(0, "https://saved.example")), || Ok(home))
+        .expect("bookmark committed");
+    let response =
+        serde_json::to_value(snapshot(saved, Err(failure()))).expect("public command response");
+    assert_eq!(response["revision"], 1);
+    assert_eq!(response["profiles"][0]["endpoint"], "https://saved.example");
+    assert_eq!(response["connectionStatusUnavailable"], true);
+    assert_eq!(response["connections"], serde_json::json!([]));
+    assert!(response.get("connection_status_unavailable").is_none());
+}
+
+#[test]
+fn profiles_concurrent_writers_share_one_revision() {
+    let (_guard, home) = home();
+    let barrier = std::sync::Arc::new(std::sync::Barrier::new(2));
+    let results = std::thread::scope(|scope| {
+        let writers = ["https://first.example", "https://second.example"].map(|endpoint| {
+            let home = home.clone();
+            let barrier = barrier.clone();
+            scope.spawn(move || {
+                barrier.wait();
+                access_with_home(Some(catalog(0, endpoint)), || Ok(home)).is_ok()
+            })
+        });
+        writers.map(|writer| writer.join().expect("profile writer"))
+    });
+    assert_eq!(results.into_iter().filter(|saved| *saved).count(), 1);
+    let retained = access_with_home(None, || Ok(home)).expect("one durable winning catalog");
+    assert_eq!(retained.revision, 1);
+    assert!(matches!(
+        retained.profiles[0].endpoint.as_str(),
+        "https://first.example" | "https://second.example"
+    ));
+}
+
+#[cfg(unix)]
+#[test]
+fn profiles_reject_symlinked_directory_and_catalog() {
+    let (_guard, home) = home();
+    let outside = home.root().parent().expect("test parent").join("outside");
+    fs::create_dir(&outside).expect("outside test directory");
+    let profiles = home.root().join("desktop-control-plane");
+    std::os::unix::fs::symlink(&outside, &profiles).expect("synthetic directory link");
+    assert!(access_with_home(None, || Ok(home.clone())).is_err());
+    assert_eq!(fs::read_dir(&outside).expect("untouched target").count(), 0);
+    fs::remove_file(&profiles).expect("remove synthetic directory link");
+    access_with_home(None, || Ok(home.clone())).expect("create confined catalog");
+    let outside_file = outside.join("retained.json");
+    fs::write(&outside_file, b"retain exactly").expect("outside marker");
+    fs::remove_file(profiles.join("profiles.json")).expect("remove empty test catalog");
+    std::os::unix::fs::symlink(&outside_file, profiles.join("profiles.json"))
+        .expect("synthetic catalog link");
+    assert!(
+        access_with_home(Some(catalog(0, "https://control-plane.example")), || {
+            Ok(home.clone())
+        })
+        .is_err()
+    );
+    assert!(access_with_home(None, || Ok(home)).is_err());
+    assert_eq!(
+        fs::read(outside_file).expect("untouched marker"),
+        b"retain exactly"
+    );
+}
diff --git a/apps/desktop/src-tauri/src/desktop_credentials.rs b/apps/desktop/src-tauri/src/desktop_credentials.rs
index aefa7bf89..b6b18bf57 100644
--- a/apps/desktop/src-tauri/src/desktop_credentials.rs
+++ b/apps/desktop/src-tauri/src/desktop_credentials.rs
@@ -44,6 +44,10 @@ impl CredentialAvailability {
 }
 
 impl DesktopCredentials {
+    pub(crate) fn native_vault(&self) -> Arc<dyn CredentialVault> {
+        self.vault.clone()
+    }
+
     /// Store a validated PEM identity in the native vault under an opaque ID.
     pub(crate) async fn write_client_identity(
         self: &Arc<Self>,
@@ -157,8 +161,27 @@ impl DesktopCredentials {
             return Ok(Arc::clone(store));
         }
         let confined = ConfinedRoot::bind(root).map_err(|_| unavailable())?;
-        let vault =
-            PlatformCredentialVault::new(confined, "desktop-manual").map_err(credential_error)?;
+        let vault = if std::env::var_os(colossus_credentials::DEVELOPMENT_AUTHORITY_VARIABLE)
+            .is_some()
+        {
+            // Release selection fails before any key file is opened. The native
+            // host alone reads the opted-in home-bound authority; no renderer or
+            // process environment contains its wrapping key.
+            if !cfg!(debug_assertions) {
+                return Err(unavailable());
+            }
+            let home = ConfinedRoot::bind(settings.home_root()?).map_err(|_| unavailable())?;
+            let authority = colossus_credentials::DevelopmentAuthority::selected(&home, &[])
+                .map_err(credential_error)?
+                .ok_or_else(unavailable)?;
+            let keys = authority
+                .store(colossus_credentials::DevelopmentStoreScope::DesktopVault)
+                .map_err(credential_error)?;
+            PlatformCredentialVault::with_key_store(confined, "desktop-manual", Arc::new(keys))
+                .map_err(credential_error)?
+        } else {
+            PlatformCredentialVault::new(confined, "desktop-manual").map_err(credential_error)?
+        };
         let store = Arc::new(Self {
             root: root.to_owned(),
             vault: Arc::new(vault),
diff --git a/apps/desktop/src-tauri/src/dto.rs b/apps/desktop/src-tauri/src/dto.rs
index e6fd0e6fa..c06e94d38 100644
--- a/apps/desktop/src-tauri/src/dto.rs
+++ b/apps/desktop/src-tauri/src/dto.rs
@@ -1549,6 +1549,16 @@ pub(crate) struct CreateRunInput {
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct RunBranchInput {
     source_run_id: String,
+    #[serde(default)]
+    kind: RunBranchKindInput,
+}
+
+#[derive(Clone, Copy, Debug, Default, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+enum RunBranchKindInput {
+    #[default]
+    Aside,
+    Thread,
 }
 
 impl CreateRunInput {
@@ -1570,6 +1580,12 @@ impl CreateRunInput {
             .map(|branch| branch.source_run_id.clone())
     }
 
+    pub(crate) fn is_thread_fork(&self) -> bool {
+        self.branch
+            .as_ref()
+            .is_some_and(|branch| branch.kind == RunBranchKindInput::Thread)
+    }
+
     pub(crate) fn into_sdk(self) -> Result<CreateRunRequest, CommandErrorDto> {
         validate_text(&self.prompt, "prompt", false)?;
         if let Some(session_id) = self.session_id.as_deref() {
@@ -1615,7 +1631,7 @@ impl CreateRunInput {
         if branch.is_some() && (self.session_id.is_some() || plan_action.is_some()) {
             return Err(CommandErrorDto::invalid(
                 "branch",
-                "An Aside must start a separate session and cannot continue a Plan.",
+                "A conversation branch must start a separate session and cannot continue a Plan.",
             ));
         }
         Ok(CreateRunRequest {
@@ -2063,6 +2079,27 @@ mod tests {
         assert_eq!(request.max_turns, 0);
     }
 
+    #[test]
+    fn thread_fork_keeps_the_canonical_branch_boundary_and_is_not_an_aside() {
+        let input: CreateRunInput = serde_json::from_value(json!({
+            "prompt": "Explore another approach", "role": "primary", "mode": "execute",
+            "branch": { "sourceRunId": "owned-source", "kind": "thread" },
+            "maxTurns": 0, "idempotencyKey": "thread-fork"
+        }))
+        .expect("thread fork input");
+        assert!(input.is_thread_fork());
+        assert_eq!(input.branch_link().as_deref(), Some("owned-source"));
+        let request = input.into_sdk().expect("canonical branch request");
+        assert!(request.session_id.is_none());
+        assert!(request.plan_action.is_none());
+        let branch = request.branch.expect("branch retained");
+        assert_eq!(branch.source_message_count, 0);
+        assert_eq!(
+            branch.context_mode,
+            RunBranchContextMode::SourceRunConversation
+        );
+    }
+
     #[test]
     fn aside_branch_resolves_its_boundary_natively() {
         let input: CreateRunInput = serde_json::from_value(json!({
diff --git a/apps/desktop/src-tauri/src/lib.rs b/apps/desktop/src-tauri/src/lib.rs
index cb806ef40..0a78855bb 100644
--- a/apps/desktop/src-tauri/src/lib.rs
+++ b/apps/desktop/src-tauri/src/lib.rs
@@ -1,3 +1,10 @@
+mod cloud_connector;
+mod control_plane_profiles;
+use cloud_connector::{
+    cloud_connect, cloud_disconnect, cloud_enroll, cloud_forget, cloud_revoke,
+    cloud_set_workspace_sharing, cloud_status,
+};
+use control_plane_profiles::{control_plane_profiles, save_control_plane_profiles};
 mod app_context;
 mod approval_adapter;
 mod browser;
@@ -307,6 +314,15 @@ pub fn run() {
             set_terminal_enabled,
             connect_colossus,
             connection_status,
+            cloud_enroll,
+            cloud_connect,
+            cloud_status,
+            control_plane_profiles,
+            save_control_plane_profiles,
+            cloud_set_workspace_sharing,
+            cloud_disconnect,
+            cloud_forget,
+            cloud_revoke,
             create_run,
             choose_run_attachment,
             read_artifact_content,
diff --git a/apps/desktop/src-tauri/src/managed_runtime.rs b/apps/desktop/src-tauri/src/managed_runtime.rs
index e7334d856..e908ff54e 100644
--- a/apps/desktop/src-tauri/src/managed_runtime.rs
+++ b/apps/desktop/src-tauri/src/managed_runtime.rs
@@ -964,6 +964,7 @@ fn managed_bootstrap(
     .with_colossus_home(paths.colossus_home)?
     .with_risk_auto_approvals()
     .with_approval_broker_grant(approval_broker_grant)?
+    .with_connector_grant(connector_application_grant(resolved.access_profile)?)?
     .with_host_credentials(host_credentials)?
     .with_worker_ipc_authentication(Secret::new(worker_authentication.to_vec())?)?;
     #[cfg(debug_assertions)]
@@ -1361,6 +1362,20 @@ fn managed_worker_endpoint(
 }
 
 fn application_grant(profile: AccessProfileSetting) -> Result<SidecarApplicationGrant, SdkError> {
+    application_grant_for(profile, APPLICATION_ID, false)
+}
+
+fn connector_application_grant(
+    profile: AccessProfileSetting,
+) -> Result<SidecarApplicationGrant, SdkError> {
+    application_grant_for(profile, "app:colossus-desktop-cloud", true)
+}
+
+fn application_grant_for(
+    profile: AccessProfileSetting,
+    application_id: &str,
+    cloud: bool,
+) -> Result<SidecarApplicationGrant, SdkError> {
     let scopes = PRIMARY_SCOPES
         .into_iter()
         .map(ApiScope::new)
@@ -1374,7 +1389,22 @@ fn application_grant(profile: AccessProfileSetting) -> Result<SidecarApplication
             .map(|tool| (*tool).to_owned())
             .collect()
     };
-    SidecarApplicationGrant::new(APPLICATION_ID, scopes, ["primary".to_owned()], tools)
+    let scopes = if cloud {
+        [
+            scopes::RUNS_EXECUTE,
+            scopes::RUNS_READ,
+            scopes::RUNS_CONTROL,
+            scopes::PROMPTS_RESPOND,
+            scopes::APPROVALS_RESPOND,
+        ]
+        .into_iter()
+        .map(ApiScope::new)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|_| SdkError::InvalidConfiguration("invalid cloud scope"))?
+    } else {
+        scopes
+    };
+    SidecarApplicationGrant::new(application_id, scopes, ["primary".to_owned()], tools)
 }
 
 fn approval_broker_grant() -> Result<SidecarApprovalBrokerGrant, SdkError> {
diff --git a/apps/desktop/src-tauri/src/state.rs b/apps/desktop/src-tauri/src/state.rs
index 812639bdc..b14315399 100644
--- a/apps/desktop/src-tauri/src/state.rs
+++ b/apps/desktop/src-tauri/src/state.rs
@@ -252,6 +252,8 @@ pub(crate) struct AppState {
         >,
     >,
     pub(crate) browser: crate::browser::BrowserManager,
+    pub(crate) cloud_connections: Mutex<HashMap<String, crate::cloud_connector::CloudSession>>,
+    pub(crate) cloud_operation: Mutex<()>,
     pub(crate) credential_vault:
         StdMutex<Option<Arc<crate::desktop_credentials::DesktopCredentials>>>,
     pub(crate) mcp_health_history:
@@ -418,6 +420,8 @@ impl Default for AppState {
         let (selection_updates, _) = watch::channel(0);
         Self {
             browser: crate::browser::BrowserManager::default(),
+            cloud_connections: Mutex::new(HashMap::new()),
+            cloud_operation: Mutex::new(()),
             configuration_updates: Mutex::new(HashMap::new()),
             targets: RwLock::new(HashMap::new()),
             credential_vault: StdMutex::new(None),
diff --git a/apps/desktop/src-tauri/src/terminal.rs b/apps/desktop/src-tauri/src/terminal.rs
index e9f3a4163..d2a443de8 100644
--- a/apps/desktop/src-tauri/src/terminal.rs
+++ b/apps/desktop/src-tauri/src/terminal.rs
@@ -303,6 +303,7 @@ pub(crate) enum TerminalError {
     InvalidWorkspace,
     InvalidConfiguration,
     ProgramUnavailable,
+    #[cfg(any(target_os = "macos", target_os = "windows"))]
     ShellUnavailable,
     InvalidSize,
     InputTooLarge,
@@ -324,6 +325,7 @@ impl TerminalError {
             Self::InvalidWorkspace => "invalid_workspace",
             Self::InvalidConfiguration => "invalid_configuration",
             Self::ProgramUnavailable => "program_unavailable",
+            #[cfg(any(target_os = "macos", target_os = "windows"))]
             Self::ShellUnavailable => "shell_unavailable",
             Self::InvalidSize | Self::InputTooLarge => "invalid_argument",
             Self::InputBackpressure => "terminal_backpressure",
@@ -345,6 +347,7 @@ impl TerminalError {
             Self::InvalidWorkspace => "The selected local workspace is unavailable.",
             Self::InvalidConfiguration => "The managed Colossus configuration is unavailable.",
             Self::ProgramUnavailable => PROGRAM_UNAVAILABLE_MESSAGE,
+            #[cfg(any(target_os = "macos", target_os = "windows"))]
             Self::ShellUnavailable => {
                 "The operating system shell is unavailable. Check that it is installed and accessible."
             }
diff --git a/apps/desktop/src/App.tsx b/apps/desktop/src/App.tsx
index 2584bc55e..e49e59523 100644
--- a/apps/desktop/src/App.tsx
+++ b/apps/desktop/src/App.tsx
@@ -80,7 +80,6 @@ import {
   ExecutionBoundaryBanner,
   executionBoundaryBannerVisible,
 } from "./components/ExecutionBoundaryBanner";
-import { OperationsSurface } from "./components/OperationsSurface";
 import { pluginSelectionKey } from "./plugins";
 import { usePluginSkills } from "./use-plugin-skills";
 import type { AsideDraft } from "./components/AsidePanel";
@@ -96,6 +95,16 @@ import {
   pasteIntoComposerDraft,
 } from "./composer-paste";
 import { WorkSidebar } from "./components/WorkSidebar";
+import {
+  canForkThread,
+  createThreadForkDraft,
+  defaultForkTitle,
+  readThreadForkDrafts,
+  storeThreadForkDrafts,
+  threadForkBranch,
+  threadForkDraftRun,
+} from "./thread-fork";
+import type { ThreadForkDraft } from "./thread-fork";
 import { ToastRegion, useToastQueue } from "./components/ToastRegion";
 import type {
   SpaceActionFeedback,
@@ -224,6 +233,12 @@ const OnboardingSurface = lazy(() =>
   })),
 );
 
+const OperationsSurface = lazy(() =>
+  import("./components/OperationsSurface").then((module) => ({
+    default: module.OperationsSurface,
+  })),
+);
+
 const FIXTURE_QUERY = new URLSearchParams(window.location.search);
 const FIXTURE_SCENARIO = FIXTURE_QUERY.get("fixture");
 const FIXTURE_MODE =
@@ -878,6 +893,7 @@ interface RunSubmission {
   idempotencyKey: string;
   sessionId?: string;
   planRevision?: PlanRevisionTarget;
+  branch?: CreateRunRequest["branch"];
 }
 
 type RunSubmissionResult =
@@ -934,12 +950,24 @@ export default function App() {
     );
   const [asideHistory, setAsideHistory] = useState<readonly Aside[]>([]);
   const [asideBusy, setAsideBusy] = useState(false);
+  const forkDraftFocus = useRef<string | null>(null);
+  const [threadForkDrafts, setThreadForkDrafts] =
+    useState(readThreadForkDrafts);
+  const [forkPreviewViews, setForkPreviewViews] = useState<
+    ReadonlyMap<string, readonly RunView[]>
+  >(new Map());
   const [asideError, setAsideError] = useState<CommandError | null>(null);
   const [asideReadOnly, setAsideReadOnly] = useState(false);
   const appShellRef = useRef<HTMLDivElement>(null);
   const [initialWorkSidebarWidth] = useState(readStoredWorkSidebarWidth);
   const workSidebarWidthRef = useRef(initialWorkSidebarWidth);
   const [desktop, setDesktop] = useState<DesktopStatus>(INITIAL_DESKTOP);
+  const activeForkDraft = threadForkDrafts.find(
+    (draft) =>
+      draft.id === chat.activeRunId &&
+      draft.materializedSessionId === undefined &&
+      draft.spaceId === desktop.selectedSpaceId,
+  );
   const [conversationSkills, setConversationSkills] = useState<
     Record<string, readonly string[]>
   >({});
@@ -1006,8 +1034,18 @@ export default function App() {
   const [showOnboarding, setShowOnboarding] = useState(false);
   const [surface, setSurface] = useState<WorkspaceSurface>("work");
   const [settingsStartTab, setSettingsStartTab] = useState<
-    "runtime" | "providers" | "plugins" | "terminal" | "dictation"
+    | "runtime"
+    | "providers"
+    | "models"
+    | "plugins"
+    | "terminal"
+    | "dictation"
+    | "cloud"
+    | "control-plane"
   >("runtime");
+  const [settingsSpaceId, setSettingsSpaceId] = useState<string | undefined>(
+    undefined,
+  );
   const [workNavigationOpen, setWorkNavigationOpen] = useState(false);
   const [workspaceFileOpenRequest, setWorkspaceFileOpenRequest] =
     useState<WorkspaceFileOpenRequest | null>(null);
@@ -1149,6 +1187,10 @@ export default function App() {
         "managed_local",
       );
       targetRoutes.current.bindRuns(chat.views.keys(), route);
+      targetRoutes.current.bindRuns(
+        chat.recentRuns.map((run) => run.runId),
+        route,
+      );
     }
   }
   const connectingRef = useRef(false);
@@ -1287,10 +1329,147 @@ export default function App() {
     });
   }
 
+  function updateForkDrafts(
+    update: (drafts: readonly ThreadForkDraft[]) => readonly ThreadForkDraft[],
+  ) {
+    setThreadForkDrafts((current) => {
+      const next = update(current);
+      storeThreadForkDrafts(next);
+      return next;
+    });
+  }
+
+  async function beginThreadFork(run: Run) {
+    const spaceId = desktopRef.current.selectedSpaceId;
+    if (
+      !canForkThread(run) ||
+      spaceId === null ||
+      submitInFlight.current ||
+      connectingRef.current
+    )
+      return;
+    try {
+      const title = defaultForkTitle(
+        resolveThreadTitle(spaceId, run.sessionId, run.title),
+      );
+      const draft = createThreadForkDraft(run, spaceId, title);
+      updateForkDrafts((current) => [draft, ...current].slice(0, 64));
+      dictation?.controller.reset();
+      setPrompt("");
+      setAttachments([]);
+      setComposerError(null);
+      await openForkDraft(draft);
+    } catch (error: unknown) {
+      setActionError(commandError(error));
+    }
+  }
+
+  async function loadForkPreview(draft: ThreadForkDraft, route: TargetRoute) {
+    try {
+      let preview = chatRef.current;
+      let sourceSessionId = draft.sourceSessionId;
+      let sourceCreatedAt = draft.sourceCreatedAt;
+      if (FIXTURE_MODE) {
+        const source = preview.recentRuns.find(
+          (run) => run.runId === draft.sourceRunId,
+        );
+        if (source !== undefined)
+          preview = chatReducer(preview, { type: "upsert_run", run: source });
+      } else {
+        const details = await getRun(route.targetId, {
+          runId: draft.sourceRunId,
+        });
+        if (targetRoutes.current?.isCurrent(route) !== true) return;
+        sourceSessionId = details.run.sessionId;
+        sourceCreatedAt = details.run.createdAt;
+        preview = chatReducer(preview, { type: "hydrate_run", details });
+        const history = await listRuns(route.targetId, {
+          sessionId: sourceSessionId,
+          pageToken: "",
+        });
+        for (const run of history.runs
+          .filter(
+            (run) =>
+              run.runId !== draft.sourceRunId &&
+              run.createdAt <= sourceCreatedAt,
+          )
+          .slice(0, MAX_CONVERSATION_RUNS - 1)) {
+          if (targetRoutes.current?.isCurrent(route) !== true) return;
+          const historical = await getRun(route.targetId, { runId: run.runId });
+          preview = chatReducer(preview, {
+            type: "hydrate_run",
+            details: historical,
+          });
+        }
+      }
+      if (targetRoutes.current?.isCurrent(route) !== true) return;
+      const views = selectConversationViews(preview, sourceSessionId).filter(
+        (view) => view.run.createdAt <= sourceCreatedAt,
+      );
+      setForkPreviewViews((current) => {
+        const next = new Map(current);
+        next.delete(draft.id);
+        next.set(draft.id, views);
+        while (next.size > 8) {
+          const oldest = next.keys().next().value;
+          if (oldest === undefined) break;
+          next.delete(oldest);
+        }
+        return next;
+      });
+    } catch (error: unknown) {
+      if (
+        targetRoutes.current?.isCurrent(route) === true &&
+        (chatRef.current.activeRunId === draft.id ||
+          chatRef.current.views.get(chatRef.current.activeRunId ?? "")?.run
+            .sessionId === draft.materializedSessionId)
+      )
+        setRunLoadError(commandError(error).message);
+    }
+  }
+
+  async function openForkDraft(draft: ThreadForkDraft) {
+    const route = targetRoutes.current?.capture() ?? null;
+    if (
+      route === null ||
+      draft.spaceId !== desktopRef.current.selectedSpaceId ||
+      submitInFlight.current ||
+      connectingRef.current
+    )
+      return;
+    setPlanRevision(null);
+    setWorkNavigationOpen(false);
+    setSurface("work");
+    setRole(draft.role);
+    setRunLoadError("");
+    setActionError(null);
+    forkDraftFocus.current = draft.id;
+    dispatch({ type: "select_run", runId: draft.id });
+    await loadForkPreview(draft, route);
+  }
+
   useEffect(() => {
     chatRef.current = chat;
   }, [chat]);
 
+  useEffect(() => {
+    const draftId = forkDraftFocus.current;
+    if (draftId === null) return;
+    if (chat.activeRunId !== draftId || surface !== "work") {
+      forkDraftFocus.current = null;
+      return;
+    }
+    if (workNavigationOpen) return;
+    // The compact drawer must release the workspace's inert state first.
+    const frame = requestAnimationFrame(() => {
+      if (chatRef.current.activeRunId === draftId) {
+        composerRef.current?.focus();
+        forkDraftFocus.current = null;
+      }
+    });
+    return () => cancelAnimationFrame(frame);
+  }, [chat.activeRunId, surface, workNavigationOpen]);
+
   useEffect(() => {
     desktopRef.current = desktop;
   }, [desktop]);
@@ -1999,6 +2178,15 @@ export default function App() {
     if (submitInFlight.current || connectingRef.current) {
       return;
     }
+    const forkDraft = threadForkDrafts.find(
+      (draft) =>
+        draft.id === run.runId &&
+        draft.spaceId === desktopRef.current.selectedSpaceId,
+    );
+    if (forkDraft !== undefined) {
+      await openForkDraft(forkDraft);
+      return;
+    }
     if (FIXTURE_MODE) {
       setPlanRevision(null);
       setWorkNavigationOpen(false);
@@ -2007,6 +2195,14 @@ export default function App() {
       dispatch({ type: "select_run", runId: run.runId });
       setRunLoadError("");
       setActionError(null);
+      const origin = threadForkDrafts.find(
+        (draft) =>
+          draft.materializedSessionId === run.sessionId &&
+          draft.spaceId === desktopRef.current.selectedSpaceId,
+      );
+      const route = targetRoutes.current?.capture() ?? null;
+      if (origin !== undefined && route !== null)
+        void loadForkPreview(origin, route);
       return;
     }
     const route = targetRoutes.current?.routeForRun(run.runId) ?? null;
@@ -2015,6 +2211,12 @@ export default function App() {
       return;
     }
     targetRoutes.current.bindRun(run.runId, route);
+    const origin = threadForkDrafts.find(
+      (draft) =>
+        draft.materializedSessionId === run.sessionId &&
+        draft.spaceId === desktopRef.current.selectedSpaceId,
+    );
+    if (origin !== undefined) void loadForkPreview(origin, route);
     setPlanRevision(null);
     setWorkNavigationOpen(false);
     setSurface("work");
@@ -2175,6 +2377,9 @@ export default function App() {
         ...(submission.sessionId === undefined
           ? {}
           : { sessionId: submission.sessionId }),
+        ...(submission.branch === undefined
+          ? {}
+          : { branch: submission.branch }),
         ...(submission.planRevision === undefined
           ? {}
           : {
@@ -2590,7 +2795,10 @@ export default function App() {
       return;
     }
 
-    const sessionId = continuationView?.run.sessionId;
+    const sessionId =
+      activeForkDraft === undefined
+        ? continuationView?.run.sessionId
+        : undefined;
     if (sessionId) setThreadQueuePaused(route.targetId, sessionId, false);
     const effectiveMode: RunMode = planRevision === null ? mode : "plan";
     if (effectiveMode === "research" && researchSources.length === 0) {
@@ -2612,6 +2820,8 @@ export default function App() {
         ? [researchDepth, ...researchSources]
         : []),
       maxTurns,
+      activeForkDraft?.sourceRunId ?? "",
+      activeForkDraft?.id ?? "",
       planRevision?.sourceRunId ?? "",
       planRevision?.planId ?? "",
       planRevision?.revision ?? 0,
@@ -2638,11 +2848,42 @@ export default function App() {
         maxTurns,
         idempotencyKey: attempt.key,
         ...(sessionId === undefined ? {} : { sessionId }),
+        ...(activeForkDraft === undefined
+          ? {}
+          : { branch: threadForkBranch(activeForkDraft) }),
         ...(planRevision === null ? {} : { planRevision }),
       },
       route,
     );
     if (result.type === "accepted") {
+      if (activeForkDraft !== undefined) {
+        const forkTitle = resolveThreadTitle(
+          activeForkDraft.spaceId,
+          activeForkDraft.id,
+          activeForkDraft.title,
+        );
+        setStoredThreadNames((current) => {
+          const next = setThreadName(
+            current,
+            activeForkDraft.spaceId,
+            result.run.sessionId,
+            forkTitle,
+          );
+          storeThreadNames(next);
+          return next;
+        });
+        if (pinnedThreadSessionIds.has(activeForkDraft.id)) {
+          updateThreadPin(activeForkDraft.spaceId, activeForkDraft.id, false);
+          updateThreadPin(activeForkDraft.spaceId, result.run.sessionId, true);
+        }
+        updateForkDrafts((current) =>
+          current.map((draft) =>
+            draft.id === activeForkDraft.id
+              ? { ...draft, materializedSessionId: result.run.sessionId }
+              : draft,
+          ),
+        );
+      }
       createAttempt.current = null;
       setPrompt("");
       setPlanRevision(null);
@@ -4229,6 +4470,25 @@ export default function App() {
   }
 
   async function handleArchiveThread(run: Run) {
+    const forkDraft = threadForkDrafts.find(
+      (draft) =>
+        draft.id === run.runId &&
+        draft.spaceId === desktopRef.current.selectedSpaceId,
+    );
+    if (forkDraft !== undefined) {
+      if (connectingRef.current || submitInFlight.current) return;
+      updateForkDrafts((current) =>
+        current.filter((draft) => draft.id !== forkDraft.id),
+      );
+      setForkPreviewViews((current) => {
+        const next = new Map(current);
+        next.delete(forkDraft.id);
+        return next;
+      });
+      if (chatRef.current.activeRunId === forkDraft.id) newWork();
+      updateThreadPin(forkDraft.spaceId, forkDraft.id, false);
+      return;
+    }
     if (
       connectingRef.current ||
       submitInFlight.current ||
@@ -4704,6 +4964,12 @@ export default function App() {
   const activeView =
     chat.activeRunId === null ? undefined : chat.views.get(chat.activeRunId);
   const activeRun = activeView?.run;
+  const activeForkOrigin = threadForkDrafts.find(
+    (draft) =>
+      draft.spaceId === desktop.selectedSpaceId &&
+      draft.materializedSessionId !== undefined &&
+      draft.materializedSessionId === activeRun?.sessionId,
+  );
   useEffect(() => {
     delegateRequest.current = null;
     dispatchDelegate({ type: "reset" });
@@ -4857,8 +5123,11 @@ export default function App() {
     submitting,
   ]);
   const conversationViews = useMemo(
-    () => selectConversationViews(chat, activeRun?.sessionId ?? null),
-    [activeRun?.sessionId, chat],
+    () =>
+      activeForkDraft === undefined
+        ? selectConversationViews(chat, activeRun?.sessionId ?? null)
+        : (forkPreviewViews.get(activeForkDraft.id) ?? []),
+    [activeRun?.sessionId, activeForkDraft, forkPreviewViews, chat],
   );
   const asideView =
     asideChat.activeRunId === null
@@ -5030,17 +5299,23 @@ export default function App() {
   const generatedTitle =
     openingRun?.title ?? conversationViews[0]?.run.title ?? activeRun?.title;
   const title =
-    activeRun === undefined || generatedTitle === undefined
-      ? "New work"
-      : safeDisplayLabel(
-          resolveThreadTitle(
-            desktop.selectedSpaceId,
-            activeRun.sessionId,
-            generatedTitle,
-          ),
-          agentRoleLabel(activeRun.role),
-          160,
-        );
+    activeForkDraft !== undefined
+      ? resolveThreadTitle(
+          activeForkDraft.spaceId,
+          activeForkDraft.id,
+          activeForkDraft.title,
+        )
+      : activeRun === undefined || generatedTitle === undefined
+        ? "New work"
+        : safeDisplayLabel(
+            resolveThreadTitle(
+              desktop.selectedSpaceId,
+              activeRun.sessionId,
+              generatedTitle,
+            ),
+            agentRoleLabel(activeRun.role),
+            160,
+          );
   const closeWorkNavigation = useCallback(
     () => setWorkNavigationOpen(false),
     [],
@@ -5054,7 +5329,10 @@ export default function App() {
 
   const selectSurface = useCallback((nextSurface: WorkspaceSurface) => {
     setWorkNavigationOpen(false);
-    if (nextSurface === "settings") setSettingsStartTab("runtime");
+    if (nextSurface === "settings") {
+      setSettingsStartTab("runtime");
+      setSettingsSpaceId(undefined);
+    }
     setSurface(nextSurface);
   }, []);
 
@@ -5102,7 +5380,7 @@ export default function App() {
         configuration: desktop.managedModelConfiguration,
       }}
       onOpenModelSettings={() => {
-        setSettingsStartTab("providers");
+        setSettingsStartTab("models");
         setWorkNavigationOpen(false);
         setSurface("settings");
       }}
@@ -5264,7 +5542,16 @@ export default function App() {
 
       {onboardingActive || surface === "settings" ? null : (
         <WorkSidebar
-          runs={chat.recentRuns}
+          runs={[
+            ...threadForkDrafts
+              .filter(
+                (draft) =>
+                  draft.spaceId === desktop.selectedSpaceId &&
+                  draft.materializedSessionId === undefined,
+              )
+              .map(threadForkDraftRun),
+            ...chat.recentRuns,
+          ]}
           spaces={desktop.spaces}
           selectedSpaceId={desktop.selectedSpaceId}
           surface={surface}
@@ -5273,7 +5560,7 @@ export default function App() {
           terminalEnabled={desktop.terminalEnabled}
           terminalConsentPending={desktop.terminalConsentPending === true}
           terminalAvailable={terminalAvailable}
-          activeSessionId={activeRun?.sessionId ?? null}
+          activeSessionId={activeForkDraft?.id ?? activeRun?.sessionId ?? null}
           pinnedSessionIds={pinnedThreadSessionIds}
           resolveThreadTitle={resolveThreadTitle}
           query={workQuery}
@@ -5317,6 +5604,9 @@ export default function App() {
           onRestoreSpace={(spaceId) => void handleRestoreSpace(spaceId)}
           onArchiveThread={(run) => void handleArchiveThread(run)}
           onRenameThread={handleRenameThread}
+          onForkThread={
+            desktop.selectedSpaceId === null ? undefined : beginThreadFork
+          }
           onToggleThreadPinned={handleToggleThreadPinned}
           onRestoreThread={(result) => void handleRestoreThread(result)}
           onSelectSurface={selectSurface}
@@ -5413,6 +5703,12 @@ export default function App() {
           }}
           title={title}
           view={activeView}
+          forkDraft={activeForkDraft !== undefined}
+          inheritedViews={
+            activeForkOrigin === undefined
+              ? []
+              : (forkPreviewViews.get(activeForkOrigin.id) ?? [])
+          }
           conversationViews={conversationViews}
           connection={connection}
           connecting={connecting}
@@ -5558,70 +5854,97 @@ export default function App() {
           onCloseAside={closeAside}
         />
       ) : (
-        <OperationsSurface
-          scheduleInspection={
-            scheduleInspection?.targetId === desktop.selectedTargetId
-              ? scheduleInspection
-              : null
-          }
-          initialSettingsTab={settingsStartTab}
-          onConfigurePluginConnection={() => {
-            setSettingsStartTab("plugins");
-            setSurface("settings");
-          }}
-          onReturnToWork={() => selectSurface("work")}
-          pluginSelections={pluginSelections}
-          onUsePluginSkill={(id) => {
-            setConversationSkills((current) => ({
-              ...current,
-              [selectionKey]: [
-                ...new Set([...(current[selectionKey] ?? []), id]),
-              ],
-            }));
-            setSurface("work");
-            requestAnimationFrame(() => composerRef.current?.focus());
-          }}
-          surface={surface}
-          connection={connection}
-          desktop={desktop}
-          connecting={connecting}
-          updateChecking={updateChecking}
-          updateMessage={updateMessage}
-          runs={chat.recentRuns}
-          artifacts={allArtifacts}
-          demoParticipants={FIXTURE_MODE ? DEMO_PARTICIPANTS : null}
-          workNavigationOpen={workNavigationOpen}
-          onOpenWorkNavigation={openWorkNavigation}
-          onConnect={() => void connect(desktop.selectedTargetId ?? undefined)}
-          onOpenRun={(run) => void openRun(run)}
-          onSelectTarget={(targetId) => void handleSelectTarget(targetId)}
-          onAddExternalTarget={() => void handleAddExternalTarget()}
-          onRemoveExternalTarget={(targetId) =>
-            void handleRemoveExternalTarget(targetId)
-          }
-          onChooseWorkspace={() => void handleChooseWorkspace()}
-          onConfigureManaged={() => setShowOnboarding(true)}
-          onRestartManaged={() => void handleRestartManaged()}
-          onSetTerminalEnabled={(enabled) =>
-            void handleSetTerminalEnabled(enabled)
+        <Suspense
+          fallback={
+            <main className="overview-surface">
+              <p role="status">Loading page…</p>
+            </main>
           }
-          onOpenTerminal={(kind) => void handleOpenTerminal(kind)}
-          onExportDiagnostics={() => {
-            void exportDiagnostics().catch((error: unknown) => {
-              setActionError(
-                error instanceof CommandFailure
-                  ? error.detail
-                  : FALLBACK_ACTION_ERROR,
-              );
-            });
-          }}
-          onCheckForUpdates={() => void handleCheckDesktopUpdate()}
-          onInstallUpdate={() => void handleInstallDesktopUpdate()}
-          onImportCaBundle={() => void handleImportCaBundle()}
-          onRemoveCaBundle={() => void handleRemoveCaBundle()}
-          onImportClientIdentity={() => void handleImportClientIdentity()}
-          onRemoveClientIdentity={() => void handleRemoveClientIdentity()}
-        />
+        >
+          <OperationsSurface
+            scheduleInspection={
+              scheduleInspection?.targetId === desktop.selectedTargetId
+                ? scheduleInspection
+                : null
+            }
+            initialSettingsTab={settingsStartTab}
+            initialSettingsSpaceId={settingsSpaceId}
+            onManageControlPlaneWorkspace={(spaceId) => {
+              if (
+                !desktopRef.current.spaces.some(
+                  (space) => space.spaceId === spaceId,
+                )
+              )
+                return;
+              setSettingsSpaceId(spaceId);
+              setSettingsStartTab("cloud");
+              setSurface("settings");
+            }}
+            onManageControlPlaneProfiles={() => {
+              setSettingsSpaceId(undefined);
+              setSettingsStartTab("control-plane");
+              setSurface("settings");
+            }}
+            onConfigurePluginConnection={() => {
+              setSettingsStartTab("plugins");
+              setSurface("settings");
+            }}
+            onReturnToWork={() => selectSurface("work")}
+            pluginSelections={pluginSelections}
+            onUsePluginSkill={(id) => {
+              setConversationSkills((current) => ({
+                ...current,
+                [selectionKey]: [
+                  ...new Set([...(current[selectionKey] ?? []), id]),
+                ],
+              }));
+              setSurface("work");
+              requestAnimationFrame(() => composerRef.current?.focus());
+            }}
+            surface={surface}
+            connection={connection}
+            desktop={desktop}
+            connecting={connecting}
+            updateChecking={updateChecking}
+            updateMessage={updateMessage}
+            runs={chat.recentRuns}
+            artifacts={allArtifacts}
+            demoParticipants={FIXTURE_MODE ? DEMO_PARTICIPANTS : null}
+            workNavigationOpen={workNavigationOpen}
+            onOpenWorkNavigation={openWorkNavigation}
+            onConnect={() =>
+              void connect(desktop.selectedTargetId ?? undefined)
+            }
+            onOpenRun={(run) => void openRun(run)}
+            onSelectTarget={(targetId) => void handleSelectTarget(targetId)}
+            onAddExternalTarget={() => void handleAddExternalTarget()}
+            onRemoveExternalTarget={(targetId) =>
+              void handleRemoveExternalTarget(targetId)
+            }
+            onChooseWorkspace={() => void handleChooseWorkspace()}
+            onConfigureManaged={() => setShowOnboarding(true)}
+            onRestartManaged={() => void handleRestartManaged()}
+            onSetTerminalEnabled={(enabled) =>
+              void handleSetTerminalEnabled(enabled)
+            }
+            onOpenTerminal={(kind) => void handleOpenTerminal(kind)}
+            onExportDiagnostics={() => {
+              void exportDiagnostics().catch((error: unknown) => {
+                setActionError(
+                  error instanceof CommandFailure
+                    ? error.detail
+                    : FALLBACK_ACTION_ERROR,
+                );
+              });
+            }}
+            onCheckForUpdates={() => void handleCheckDesktopUpdate()}
+            onInstallUpdate={() => void handleInstallDesktopUpdate()}
+            onImportCaBundle={() => void handleImportCaBundle()}
+            onRemoveCaBundle={() => void handleRemoveCaBundle()}
+            onImportClientIdentity={() => void handleImportClientIdentity()}
+            onRemoveClientIdentity={() => void handleRemoveClientIdentity()}
+          />
+        </Suspense>
       )}
     </div>
   );
diff --git a/apps/desktop/src/api.ts b/apps/desktop/src/api.ts
index 8ddb2fc86..594b24ef5 100644
--- a/apps/desktop/src/api.ts
+++ b/apps/desktop/src/api.ts
@@ -345,6 +345,7 @@ import type {
   ConfigureManagedRuntimeRequest,
   CodexAuthStatus,
   ConnectionStatus,
+  ControlPlaneProfiles,
   CreateRunRequest,
   DesktopStatus,
   DesktopReleaseChannel,
@@ -497,6 +498,11 @@ export function desktopStatus(): Promise<DesktopStatus> {
   return call("desktop_status");
 }
 
+/** Cached public status and saved bookmarks; does not read the enrollment vault. */
+export function controlPlaneProfiles(): Promise<ControlPlaneProfiles> {
+  return call("control_plane_profiles");
+}
+
 export function codexAuthStatus(): Promise<CodexAuthStatus> {
   return call("codex_auth_status");
 }
diff --git a/apps/desktop/src/components/CatalogInventory.tsx b/apps/desktop/src/components/CatalogInventory.tsx
index 6dcb7b700..18e77cf0d 100644
--- a/apps/desktop/src/components/CatalogInventory.tsx
+++ b/apps/desktop/src/components/CatalogInventory.tsx
@@ -1,459 +1,3 @@
-import {
-  IconActivityHeartbeat,
-  IconChevronRight,
-  IconCloud,
-  IconCpu,
-  IconDots,
-  IconInfoCircle,
-  IconKey,
-  IconPlus,
-  IconSearch,
-  IconTrash,
-  IconX,
-} from "@tabler/icons-react";
-import {
-  Fragment,
-  type ReactNode,
-  useEffect,
-  useId,
-  useRef,
-  useState,
-} from "react";
+export { CatalogInventory } from "@colossus/ui";
+export type { CatalogInventoryRow } from "@colossus/ui";
 import "./catalog-inventory.css";
-
-export interface CatalogInventoryRow {
-  id: string;
-  label: string;
-  name: string;
-  description: string;
-  icon?: ReactNode;
-  searchText: string;
-  connection: ReactNode;
-  usage: string;
-  details: ReactNode;
-  actionLabel?: string;
-  actionIcon?: ReactNode;
-  actionAriaLabel?: string;
-  mutationDisabled?: boolean;
-  onEdit: () => void;
-  onDelete?: (trigger: HTMLButtonElement) => void;
-}
-
-const catalogKinds = {
-  model: {
-    title: "Models",
-    singular: "model",
-    plural: "models",
-    column: "Model",
-    description: "Choose and manage the models your workspaces use.",
-    connectionLabel: "Provider",
-    usageLabel: "Active workspaces",
-    Icon: IconCpu,
-    className: "models-settings",
-  },
-  provider: {
-    title: "Providers",
-    singular: "provider",
-    plural: "providers",
-    column: "Provider",
-    description: "Saved connections for your workspaces.",
-    connectionLabel: "Sign-in",
-    usageLabel: "Configured models",
-    Icon: IconCloud,
-    className: "providers-settings",
-  },
-  credential: {
-    title: "Credentials",
-    singular: "credential",
-    plural: "credentials",
-    column: "Credential",
-    description: "API keys, tokens, and client secrets for your connections.",
-    connectionLabel: "Status",
-    usageLabel: "Used by",
-    Icon: IconKey,
-    className: "credentials-settings",
-  },
-  search: {
-    title: "Search services",
-    singular: "search service",
-    plural: "search services",
-    column: "Service",
-    description:
-      "Saved search services. Enable each service in Workspace settings.",
-    connectionLabel: "Credential",
-    usageLabel: "Active workspaces",
-    Icon: IconSearch,
-    className: "search-settings",
-  },
-  telemetry: {
-    title: "Telemetry connections",
-    singular: "telemetry connection",
-    plural: "telemetry connections",
-    column: "Connection",
-    description: "Manage collectors, exported signals, and audit content.",
-    connectionLabel: "Exported data",
-    usageLabel: "Active workspaces",
-    Icon: IconActivityHeartbeat,
-    className: "telemetry-settings",
-  },
-} as const;
-
-/** Shared presentation only; catalog mutations remain with the settings owner. */
-export function CatalogInventory({
-  kind,
-  summary,
-  rows,
-  busy,
-  editing,
-  onAdd,
-  children,
-}: {
-  kind: keyof typeof catalogKinds;
-  summary: string;
-  rows: CatalogInventoryRow[];
-  busy: boolean;
-  editing: boolean;
-  onAdd: () => void;
-  children: ReactNode;
-}) {
-  const [query, setQuery] = useState("");
-  const search = useRef<HTMLInputElement>(null);
-  const [expanded, setExpanded] = useState<string | null>(null);
-  const id = useId();
-  const {
-    title,
-    singular,
-    plural,
-    column,
-    description,
-    connectionLabel,
-    usageLabel,
-    Icon,
-    className,
-  } = catalogKinds[kind];
-  const searchLabel =
-    kind === "search" ? "Search services" : `Search ${plural}`;
-  const needle = query.trim().toLocaleLowerCase();
-  const visible = rows.filter((row) =>
-    row.searchText.toLocaleLowerCase().includes(needle),
-  );
-
-  return (
-    <section
-      className={`managed-settings-body ${className} catalog-settings`}
-      aria-labelledby={`${id}-heading`}
-    >
-      <header className="catalog-heading">
-        <div>
-          <h3 id={`${id}-heading`}>{title}</h3>
-          <p>{description}</p>
-        </div>
-        <button
-          id={`add-${kind}`}
-          className="button primary"
-          type="button"
-          disabled={busy || editing}
-          onClick={() => {
-            setQuery("");
-            onAdd();
-          }}
-        >
-          <IconPlus size={16} aria-hidden="true" /> Add {singular}
-        </button>
-      </header>
-      <p className="catalog-summary">{summary}</p>
-      {children}
-      <div className="catalog-search">
-        <IconSearch size={18} aria-hidden="true" />
-        <input
-          ref={search}
-          aria-label={searchLabel}
-          placeholder={searchLabel}
-          value={query}
-          onChange={(event) => setQuery(event.target.value)}
-        />
-        {query ? (
-          <button
-            type="button"
-            className="icon-button"
-            aria-label="Clear search"
-            onClick={() => {
-              setQuery("");
-              search.current?.focus();
-            }}
-          >
-            <IconX size={16} aria-hidden="true" />
-          </button>
-        ) : null}
-      </div>
-      <div className="catalog-table-container">
-        <table className="catalog-table" aria-label={`Configured ${plural}`}>
-          <colgroup>
-            <col className="catalog-name-column" />
-            <col />
-            <col />
-            <col className="catalog-actions-column" />
-          </colgroup>
-          <thead>
-            <tr>
-              <th scope="col">{column}</th>
-              <th scope="col">{connectionLabel}</th>
-              <th scope="col">{usageLabel}</th>
-              <th scope="col">
-                <span className="sr-only">Actions</span>
-              </th>
-            </tr>
-          </thead>
-          <tbody>
-            {visible.map((row) => {
-              const open = expanded === row.id;
-              const detailsId = `${id}-${row.id}-details`;
-              const toggle = () => setExpanded(open ? null : row.id);
-              return (
-                <Fragment key={row.id}>
-                  <tr className="catalog-inventory-row" data-expanded={open}>
-                    <th scope="row">
-                      <div className="catalog-identity">
-                        <span
-                          className={
-                            row.icon ? "catalog-provider-icon" : "resource-icon"
-                          }
-                        >
-                          {row.icon ?? <Icon size={19} aria-hidden="true" />}
-                        </span>
-                        <div>
-                          <button
-                            type="button"
-                            className="catalog-name"
-                            aria-label={`Details for ${row.label}`}
-                            aria-expanded={open}
-                            aria-controls={detailsId}
-                            onClick={toggle}
-                          >
-                            {row.name}
-                          </button>
-                          <small>{row.description}</small>
-                        </div>
-                      </div>
-                    </th>
-                    <td data-label={connectionLabel}>
-                      <span className="catalog-connection">
-                        {row.connection}
-                      </span>
-                    </td>
-                    <td data-label={usageLabel}>
-                      <button
-                        type="button"
-                        className="catalog-text-button catalog-usage"
-                        aria-label={`${kind === "credential" ? "Connections" : usageLabel} for ${row.label}: ${row.usage}`}
-                        aria-expanded={open}
-                        aria-controls={detailsId}
-                        onClick={toggle}
-                      >
-                        {row.usage}
-                        <IconChevronRight size={16} aria-hidden="true" />
-                      </button>
-                    </td>
-                    <td className="catalog-row-actions">
-                      <div className="catalog-action-group">
-                        <button
-                          type="button"
-                          className={
-                            row.actionIcon
-                              ? "icon-button"
-                              : "catalog-text-button"
-                          }
-                          disabled={busy || row.mutationDisabled}
-                          aria-label={
-                            row.actionAriaLabel ?? `Edit ${row.label}`
-                          }
-                          title={row.actionAriaLabel ?? `Edit ${row.label}`}
-                          onClick={row.onEdit}
-                        >
-                          {row.actionIcon ?? row.actionLabel ?? "Edit"}
-                        </button>
-                        {row.onDelete ? (
-                          <CatalogActions
-                            label={row.label}
-                            busy={busy}
-                            deleteDisabled={row.mutationDisabled}
-                            onDetails={() => setExpanded(row.id)}
-                            onDelete={row.onDelete}
-                          />
-                        ) : null}
-                      </div>
-                    </td>
-                  </tr>
-                  <tr
-                    hidden={!open}
-                    className="catalog-detail-row"
-                    id={detailsId}
-                  >
-                    <td colSpan={4}>
-                      <section
-                        className="catalog-details"
-                        aria-label={`Details for ${row.label}`}
-                      >
-                        {row.details}
-                      </section>
-                    </td>
-                  </tr>
-                </Fragment>
-              );
-            })}
-            {!visible.length ? (
-              <tr>
-                <td colSpan={4} className="catalog-empty">
-                  <strong>
-                    {rows.length ? `No matching ${plural}` : `No ${plural} yet`}
-                  </strong>
-                  <p>
-                    {rows.length
-                      ? "Try a different name or clear your search."
-                      : `Add a ${singular} to get started.`}
-                  </p>
-                </td>
-              </tr>
-            ) : null}
-          </tbody>
-        </table>
-      </div>
-      <p className={needle ? "catalog-hint" : "sr-only"} role="status">
-        {needle
-          ? `${visible.length} of ${rows.length} ${plural} match your search.`
-          : ""}
-      </p>
-    </section>
-  );
-}
-
-function CatalogActions({
-  label,
-  busy,
-  onDetails,
-  onDelete,
-  deleteDisabled,
-}: {
-  label: string;
-  busy: boolean;
-  deleteDisabled?: boolean | undefined;
-  onDetails: () => void;
-  onDelete: (trigger: HTMLButtonElement) => void;
-}) {
-  const [open, setOpen] = useState(false);
-  const wrapper = useRef<HTMLDivElement>(null);
-  const trigger = useRef<HTMLButtonElement>(null);
-  const menu = useRef<HTMLDivElement>(null);
-  const id = useId();
-  useEffect(() => {
-    if (!open) return;
-    menu.current?.querySelector<HTMLButtonElement>("button")?.focus();
-    const dismiss = (event: PointerEvent) => {
-      if (
-        event.target instanceof Node &&
-        !wrapper.current?.contains(event.target)
-      )
-        setOpen(false);
-    };
-    document.addEventListener("pointerdown", dismiss);
-    return () => document.removeEventListener("pointerdown", dismiss);
-  }, [open]);
-  const close = () => {
-    setOpen(false);
-    trigger.current?.focus();
-  };
-  return (
-    <div
-      className="catalog-actions-menu"
-      ref={wrapper}
-      onBlur={(event) => {
-        if (!event.currentTarget.contains(event.relatedTarget)) setOpen(false);
-      }}
-    >
-      <button
-        ref={trigger}
-        className="icon-button"
-        type="button"
-        disabled={busy}
-        aria-label={`More actions for ${label}`}
-        aria-haspopup="menu"
-        aria-expanded={open}
-        aria-controls={open ? id : undefined}
-        onClick={() => setOpen(!open)}
-        onKeyDown={(event) => {
-          if (event.key === "ArrowDown" || event.key === "ArrowUp") {
-            event.preventDefault();
-            setOpen(true);
-          }
-        }}
-      >
-        <IconDots size={20} aria-hidden="true" />
-      </button>
-      {open ? (
-        <div
-          ref={menu}
-          id={id}
-          className="catalog-actions-popup"
-          role="menu"
-          aria-label={`Actions for ${label}`}
-          onKeyDown={(event) => {
-            if (event.key === "Escape") {
-              event.preventDefault();
-              event.stopPropagation();
-              close();
-              return;
-            }
-            const items = Array.from(
-              event.currentTarget.querySelectorAll<HTMLButtonElement>(
-                "button:not(:disabled)",
-              ),
-            );
-            const index = items.indexOf(
-              document.activeElement as HTMLButtonElement,
-            );
-            const next =
-              event.key === "ArrowDown"
-                ? (index + 1) % items.length
-                : event.key === "ArrowUp"
-                  ? (index + items.length - 1) % items.length
-                  : event.key === "Home"
-                    ? 0
-                    : event.key === "End"
-                      ? items.length - 1
-                      : null;
-            if (next !== null) {
-              event.preventDefault();
-              items[next]?.focus();
-            }
-          }}
-        >
-          <button
-            type="button"
-            role="menuitem"
-            tabIndex={-1}
-            onClick={() => {
-              close();
-              onDetails();
-            }}
-          >
-            <IconInfoCircle size={16} aria-hidden="true" /> View details
-          </button>
-          <button
-            type="button"
-            role="menuitem"
-            tabIndex={-1}
-            className="catalog-delete-action"
-            disabled={busy || deleteDisabled}
-            aria-label={`Delete ${label}`}
-            onClick={() => {
-              close();
-              onDelete(trigger.current!);
-            }}
-          >
-            <IconTrash size={16} aria-hidden="true" /> Delete
-          </button>
-        </div>
-      ) : null}
-    </div>
-  );
-}
diff --git a/apps/desktop/src/components/CloudConnectionPane.tsx b/apps/desktop/src/components/CloudConnectionPane.tsx
new file mode 100644
index 000000000..2dd6f45f0
--- /dev/null
+++ b/apps/desktop/src/components/CloudConnectionPane.tsx
@@ -0,0 +1,357 @@
+import { useEffect, useId, useRef, useState } from "react";
+import { invoke } from "@tauri-apps/api/core";
+import { Button, RadioGroup, TextInput } from "@colossus/ui";
+import {
+  IconPlugConnected,
+  IconPlugConnectedX,
+  IconRefresh,
+  IconShieldLock,
+} from "@tabler/icons-react";
+import "./cloud-connection.css";
+import type { ControlPlaneProfiles } from "./ControlPlaneSettingsPane";
+interface CloudStatus {
+  targetId: string;
+  status:
+    "connecting" | "connected" | "reconnecting" | "disconnected" | "revoked";
+  nodeId: string | null;
+  projectId: string | null;
+  endpoint: string | null;
+  hostId?: string | null;
+  workspaceId?: string | null;
+  sharedSessions?: boolean;
+  sharedContinuation?: boolean;
+  sharingSupported?: boolean;
+  sharingRecoveryRequired?: boolean;
+  sharingRestartRequired?: boolean;
+}
+export function CloudConnectionPane({ targetId }: { targetId: string }) {
+  const headingId = useId(),
+    sharingHeadingId = useId();
+  const [status, setStatus] = useState<CloudStatus | null>(null),
+    [url, setUrl] = useState(""),
+    [token, setToken] = useState(""),
+    [busy, setBusy] = useState(false),
+    [error, setError] = useState("");
+  const [sharing, setSharing] = useState("private");
+  const operation = useRef(0),
+    busyRef = useRef(false);
+  useEffect(() => {
+    let alive = true;
+    void invoke<ControlPlaneProfiles>("control_plane_profiles")
+      .then((catalog) => {
+        const profile = catalog.profiles.find(
+          (item) => item.id === catalog.defaultProfile,
+        );
+        if (alive && profile)
+          setUrl(
+            (current) =>
+              current || `${profile.endpoint.replace(/\/$/, "")}/api/enroll`,
+          );
+      })
+      .catch(() => undefined);
+    return () => {
+      alive = false;
+    };
+  }, [targetId]);
+  useEffect(() => {
+    let alive = true,
+      refreshing = false;
+    const refresh = () => {
+      if (refreshing || busyRef.current) return;
+      refreshing = true;
+      const generation = operation.current;
+      void invoke<CloudStatus>("cloud_status", { targetId })
+        .then((status) => {
+          if (alive && generation === operation.current) setStatus(status);
+        })
+        .catch((error) => {
+          if (alive && generation === operation.current)
+            setError(
+              typeof error === "object" && error !== null && "message" in error
+                ? String(error.message)
+                : "Control Plane enrollment is unavailable.",
+            );
+        })
+        .finally(() => {
+          refreshing = false;
+        });
+    };
+    refresh();
+    const timer = setInterval(refresh, 2000);
+    return () => {
+      alive = false;
+      operation.current++;
+      clearInterval(timer);
+    };
+  }, [targetId]);
+  async function action(
+    command: string,
+    parameters: Record<string, unknown> = { targetId },
+  ) {
+    if (busyRef.current) return;
+    busyRef.current = true;
+    const generation = ++operation.current;
+    setBusy(true);
+    setError("");
+    // The native command owns this one-use value as soon as it is submitted.
+    if (command === "cloud_enroll") setToken("");
+    try {
+      const next = await invoke<CloudStatus>(command, parameters);
+      if (operation.current === generation) setStatus(next);
+    } catch (error) {
+      if (operation.current === generation)
+        setError(
+          typeof error === "object" && error !== null && "message" in error
+            ? String(error.message)
+            : "The Control Plane connection could not be changed.",
+        );
+    } finally {
+      busyRef.current = false;
+      if (operation.current === generation) setBusy(false);
+    }
+  }
+  const active =
+    status &&
+    ["connected", "connecting", "reconnecting"].includes(status.status);
+  const sharingBlocked = Boolean(status?.sharingRestartRequired);
+  useEffect(() => {
+    setSharing(
+      status?.sharedSessions
+        ? status.sharedContinuation
+          ? "continue"
+          : "read"
+        : "private",
+    );
+  }, [status?.sharedSessions, status?.sharedContinuation, targetId]);
+  return (
+    <section
+      className="managed-settings-body cloud-settings"
+      aria-labelledby={headingId}
+    >
+      <div className="managed-section-heading">
+        <div>
+          <p className="eyebrow">Workspace connection</p>
+          <h3 id={headingId}>Control Plane</h3>
+          <p className="managed-heading-copy">
+            Make this runtime available to your project's Control Plane.
+          </p>
+        </div>
+      </div>
+      {error && (
+        <p className="cloud-settings-error" role="alert">
+          {error}
+        </p>
+      )}
+      <div className="cloud-settings-state" role="status" aria-live="polite">
+        <span
+          className={`cloud-state-dot ${status?.status === "connected" ? "connected" : ""}`}
+        />
+        <strong>
+          {status
+            ? status.status[0]?.toUpperCase() + status.status.slice(1)
+            : error
+              ? "Enrollment unavailable"
+              : "Checking enrollment…"}
+        </strong>
+        {status?.projectId && <span>{status.projectId}</span>}
+      </div>
+      {!status && error && (
+        <Button
+          variant="secondary"
+          disabled={busy}
+          onClick={() => void action("cloud_status")}
+        >
+          Retry status
+        </Button>
+      )}
+      {status?.nodeId ? (
+        <>
+          <dl>
+            <dt>Control Plane endpoint</dt>
+            <dd>{status.endpoint}</dd>
+            <dt>Node identity</dt>
+            <dd>{status.nodeId}</dd>
+            {status.hostId && (
+              <>
+                <dt>Host identity</dt>
+                <dd>{status.hostId}</dd>
+              </>
+            )}
+          </dl>
+          <div className="cloud-settings-actions">
+            {active ? (
+              <Button
+                variant="secondary"
+                disabled={busy}
+                onClick={() => void action("cloud_disconnect")}
+              >
+                <IconPlugConnectedX size={17} />
+                Disconnect
+              </Button>
+            ) : (
+              <Button
+                variant="primary"
+                disabled={busy || status.status === "revoked" || sharingBlocked}
+                onClick={() => void action("cloud_connect")}
+              >
+                <IconRefresh size={17} />
+                Reconnect runtime
+              </Button>
+            )}
+            <Button
+              variant="danger"
+              disabled={busy || status.status === "revoked" || sharingBlocked}
+              onClick={() => void action("cloud_revoke")}
+            >
+              Revoke enrollment
+            </Button>
+            <Button
+              variant="secondary"
+              disabled={busy || !!active || sharingBlocked}
+              onClick={() => void action("cloud_forget")}
+            >
+              Forget enrollment
+            </Button>
+          </div>
+          <p className="cloud-settings-note">
+            {status.status === "revoked"
+              ? "Forget this enrollment, then use a new invitation to connect again. Accepted tasks remain under local runtime policy."
+              : "Disconnecting leaves accepted tasks running locally. Revocation removes this runtime's Control Plane authority until it is enrolled again."}
+          </p>
+          {status.sharingSupported && (
+            <form
+              className="cloud-settings-sharing"
+              aria-labelledby={sharingHeadingId}
+              onSubmit={(event) => {
+                event.preventDefault();
+                void action("cloud_set_workspace_sharing", {
+                  targetId,
+                  enabled: sharing !== "private",
+                  allowContinuation: sharing === "continue",
+                });
+              }}
+            >
+              <div className="cloud-settings-control-column">
+                <h4 id={sharingHeadingId}>Desktop conversation sharing</h4>
+                {status.sharingRecoveryRequired ? (
+                  <div className="managed-settings-notice error" role="alert">
+                    <strong>Sharing needs reconciliation</strong>
+                    <p>
+                      Synchronization is paused and the sharing state is
+                      unconfirmed.{" "}
+                      {sharingBlocked
+                        ? "Restart Desktop before changing sharing or reconnecting."
+                        : "Save your choice again, or reconnect to apply the last saved choice."}{" "}
+                      Previously shared history remains available in the Control
+                      Plane.
+                    </p>
+                  </div>
+                ) : null}
+                <RadioGroup
+                  variant="compact"
+                  value={sharing}
+                  onValueChange={setSharing}
+                  disabled={
+                    busy || status.status === "revoked" || sharingBlocked
+                  }
+                  aria-label="Desktop conversation sharing"
+                  options={[
+                    {
+                      value: "private",
+                      label: "Control Plane conversations only",
+                    },
+                    {
+                      value: "read",
+                      label: "Share Desktop history for viewing",
+                    },
+                    {
+                      value: "continue",
+                      label: "Share history and allow continuation",
+                    },
+                  ]}
+                />
+              </div>
+              <p className="cloud-settings-note">
+                Sharing includes existing and future conversations in this
+                workspace. Enabling sharing requires local confirmation.
+                Disabling it stops future synchronization; history already
+                synchronized remains in the Control Plane.
+              </p>
+              <Button
+                type="submit"
+                variant="secondary"
+                disabled={busy || status.status === "revoked" || sharingBlocked}
+              >
+                Save conversation sharing
+              </Button>
+            </form>
+          )}
+        </>
+      ) : (
+        <form
+          className="cloud-settings-enrollment cloud-settings-control-column"
+          onSubmit={(event) => {
+            event.preventDefault();
+            void action("cloud_enroll", {
+              request: { targetId, enrollmentUrl: url, token },
+            });
+          }}
+        >
+          <label>
+            Enrollment URL
+            <TextInput
+              type="url"
+              value={url}
+              onChange={(event) => setUrl(event.target.value)}
+              placeholder="https://control-plane.example.com/api/enroll"
+              required
+              disabled={busy || !status}
+            />
+          </label>
+          <label>
+            One-use invitation
+            <TextInput
+              type="password"
+              value={token}
+              onChange={(event) => setToken(event.target.value)}
+              placeholder="Paste the invitation from Runtime fleet"
+              required
+              maxLength={64}
+              pattern="[a-fA-F0-9]{64}"
+              autoComplete="off"
+              spellCheck={false}
+              disabled={busy || !status}
+            />
+          </label>
+          <Button
+            type="submit"
+            variant="primary"
+            disabled={busy || !status || !url || token.length !== 64}
+          >
+            <IconPlugConnected size={17} />
+            {busy ? "Enrolling runtime…" : "Enroll and connect"}
+          </Button>
+          {error && (
+            <Button
+              type="button"
+              variant="secondary"
+              disabled={busy}
+              onClick={() => void action("cloud_forget")}
+            >
+              Reset local enrollment
+            </Button>
+          )}
+        </form>
+      )}
+      <aside className="cloud-settings-policy">
+        <IconShieldLock size={18} aria-hidden="true" />
+        <p>
+          Only authorized project members can submit tasks. This runtime's
+          roles, tools, policy, and approval rules still apply. Managed Local
+          work depends on Desktop staying open; use a CLI daemon for persistent
+          execution.
+        </p>
+      </aside>
+    </section>
+  );
+}
diff --git a/apps/desktop/src/components/ControlPlaneConnections.test.ts b/apps/desktop/src/components/ControlPlaneConnections.test.ts
new file mode 100644
index 000000000..e518f21ca
--- /dev/null
+++ b/apps/desktop/src/components/ControlPlaneConnections.test.ts
@@ -0,0 +1,142 @@
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { expect, it } from "vitest";
+import {
+  ControlPlaneConnectionInventory,
+  controlPlaneState,
+} from "./ControlPlaneConnections";
+import type { ControlPlaneProfiles } from "../types";
+
+const catalog: ControlPlaneProfiles = {
+  revision: 1,
+  defaultProfile: "bookmark",
+  profiles: [
+    {
+      id: "bookmark",
+      label: "Saved team endpoint",
+      endpoint: "https://bookmark.example.test",
+    },
+  ],
+  connections: [
+    {
+      targetId: "target-a",
+      status: "connected",
+      projectId: "project-a",
+      endpoint: "https://live.example.test",
+      sharedSessions: false,
+    },
+    {
+      targetId: "space-b",
+      status: "disconnected",
+      projectId: "project-b",
+      endpoint: "https://offline.example.test",
+      sharedSessions: false,
+    },
+    {
+      targetId: "missing",
+      status: "revoked",
+      projectId: "project-removed",
+      endpoint: "https://removed.example.test",
+      sharedSessions: false,
+    },
+  ],
+};
+
+it("separates actual enrolled workspace state from endpoint bookmarks and missing workspace navigation", () => {
+  const markup = renderToStaticMarkup(
+    createElement(ControlPlaneConnectionInventory, {
+      catalog,
+      spaces: [
+        {
+          spaceId: "space-a",
+          targetId: "target-a",
+          displayName: "Workspace A",
+        },
+        {
+          spaceId: "space-b",
+          targetId: "target-b",
+          displayName: "Workspace B",
+        },
+      ],
+      onManageWorkspace: () => undefined,
+      onManageProfiles: () => undefined,
+    }),
+  );
+  expect(markup).toContain("Workspace A");
+  expect(markup).toContain("Workspace B");
+  expect(markup).toContain("Connected");
+  expect(markup).toContain("Disconnected");
+  expect(markup).toContain("Revoked");
+  expect(markup).toContain("project-b");
+  expect(markup).toContain("https://offline.example.test");
+  expect(markup).toMatch(
+    /disabled=""[^>]*aria-label="Manage Control Plane for missing"/,
+  );
+  const bookmark = markup.slice(
+    markup.indexOf('class="control-plane-bookmarks"'),
+  );
+  expect(bookmark).toContain("Default bookmark");
+  expect(bookmark).not.toContain("Connected");
+});
+
+it("never turns an unrecognized or unavailable status into Connected", () => {
+  expect(controlPlaneState("connected")).toEqual({
+    label: "Connected",
+    tone: "success",
+  });
+  expect(controlPlaneState("connecting").label).toBe("Connecting");
+  expect(controlPlaneState("reconnecting").label).toBe("Reconnecting");
+  expect(controlPlaneState("unexpected").label).toBe("Unknown");
+  expect(controlPlaneState("connected", true).label).toBe("Unknown");
+});
+
+it("surfaces incomplete sharing changes without changing workspace navigation", () => {
+  const markup = renderToStaticMarkup(
+    createElement(ControlPlaneConnectionInventory, {
+      catalog: {
+        ...catalog,
+        connections: [
+          { ...catalog.connections[1]!, sharingRecoveryRequired: true },
+        ],
+      },
+      spaces: [
+        {
+          spaceId: "space-b",
+          targetId: "target-b",
+          displayName: "Workspace B",
+        },
+      ],
+      onManageWorkspace: () => undefined,
+      onManageProfiles: () => undefined,
+    }),
+  );
+  expect(markup).toContain("Sharing needs reconciliation");
+  expect(markup).toContain("Disconnected");
+  expect(markup).toContain('aria-label="Manage Control Plane for Workspace B"');
+  expect(markup).not.toMatch(
+    /disabled=""[^>]*aria-label="Manage Control Plane for Workspace B"/,
+  );
+});
+
+it("marks retained enrollment metadata Unknown while keeping endpoint bookmarks usable", () => {
+  const markup = renderToStaticMarkup(
+    createElement(ControlPlaneConnectionInventory, {
+      catalog: { ...catalog, connectionStatusUnavailable: true },
+      spaces: [
+        {
+          spaceId: "space-a",
+          targetId: "target-a",
+          displayName: "Workspace A",
+        },
+      ],
+      onManageWorkspace: () => undefined,
+      onManageProfiles: () => undefined,
+    }),
+  );
+  expect(markup).toContain("Unknown");
+  expect(markup).not.toContain(">Connected<");
+  expect(markup).not.toContain(">Revoked<");
+  expect(markup).toContain("Saved team endpoint");
+  expect(markup).toContain("Default bookmark");
+  expect(markup).toContain("Manage endpoints");
+});
diff --git a/apps/desktop/src/components/ControlPlaneConnections.tsx b/apps/desktop/src/components/ControlPlaneConnections.tsx
new file mode 100644
index 000000000..39792bf52
--- /dev/null
+++ b/apps/desktop/src/components/ControlPlaneConnections.tsx
@@ -0,0 +1,233 @@
+import { useEffect, useRef, useState } from "react";
+import { Button } from "@colossus/ui";
+import { IconCloud, IconRefresh, IconSettings } from "@tabler/icons-react";
+import { controlPlaneProfiles } from "../api";
+import type { ControlPlaneProfiles, SpaceSummary } from "../types";
+import "./control-plane-connections.css";
+
+export function controlPlaneState(status: string, unavailable = false) {
+  if (unavailable) return { label: "Unknown", tone: "neutral" };
+  switch (status) {
+    case "connected":
+      return { label: "Connected", tone: "success" };
+    case "connecting":
+      return { label: "Connecting", tone: "warning" };
+    case "reconnecting":
+      return { label: "Reconnecting", tone: "warning" };
+    case "disconnected":
+      return { label: "Disconnected", tone: "neutral" };
+    case "revoked":
+      return { label: "Revoked", tone: "danger" };
+    default:
+      return { label: "Unknown", tone: "neutral" };
+  }
+}
+
+/** Display-only inventory. Navigation never selects or starts a runtime. */
+export function ControlPlaneConnectionInventory({
+  catalog,
+  spaces,
+  unavailable = false,
+  disabled = false,
+  onManageWorkspace,
+  onManageProfiles,
+}: {
+  catalog: ControlPlaneProfiles;
+  spaces: readonly Pick<SpaceSummary, "spaceId" | "targetId" | "displayName">[];
+  unavailable?: boolean;
+  disabled?: boolean;
+  onManageWorkspace: (spaceId: string) => void;
+  onManageProfiles: () => void;
+}) {
+  return (
+    <>
+      <div className="control-plane-connection-list">
+        {catalog.connections.map((connection) => {
+          const space =
+            spaces.find((space) => space.spaceId === connection.targetId) ??
+            spaces.find((space) => space.targetId === connection.targetId);
+          const status = controlPlaneState(
+            connection.status,
+            unavailable || Boolean(catalog.connectionStatusUnavailable),
+          );
+          return (
+            <article
+              key={connection.targetId}
+              className="control-plane-connection-row"
+            >
+              <div className="control-plane-connection-heading">
+                <IconCloud size={18} aria-hidden="true" />
+                <strong>{space?.displayName ?? "Unavailable workspace"}</strong>
+                <span className={`status-chip tone-${status.tone}`}>
+                  {status.label}
+                </span>
+                <Button
+                  variant="secondary"
+                  disabled={disabled || !space}
+                  onClick={() => space && onManageWorkspace(space.spaceId)}
+                  aria-label={`Manage Control Plane for ${space?.displayName ?? connection.targetId}`}
+                >
+                  <IconSettings size={15} aria-hidden="true" />
+                  Manage
+                </Button>
+              </div>
+              <dl>
+                <dt>Project</dt>
+                <dd>{connection.projectId ?? "Not reported"}</dd>
+                <dt>Endpoint</dt>
+                <dd>{connection.endpoint ?? "Not reported"}</dd>
+                {connection.sharingRecoveryRequired ? (
+                  <>
+                    <dt>Sharing</dt>
+                    <dd>
+                      {connection.sharingRestartRequired
+                        ? "Restart Desktop to reconcile sharing"
+                        : "Sharing needs reconciliation"}
+                    </dd>
+                  </>
+                ) : null}
+              </dl>
+              {!space ? (
+                <p className="control-plane-connection-note">
+                  This enrolled workspace is not in the current Desktop
+                  inventory. No other workspace will be selected.
+                </p>
+              ) : null}
+            </article>
+          );
+        })}
+        {catalog.connections.length === 0 ? (
+          <p className="inline-empty">
+            No Control Plane enrollments are currently reported by this Desktop.
+          </p>
+        ) : null}
+      </div>
+      <div className="control-plane-bookmarks">
+        <div className="section-heading">
+          <div>
+            <h4>Saved endpoints</h4>
+            <p className="control-plane-connection-note">
+              Bookmarks help with enrollment; they do not indicate a runtime
+              connection.
+            </p>
+          </div>
+          <Button
+            variant="secondary"
+            disabled={disabled}
+            onClick={onManageProfiles}
+          >
+            Manage endpoints
+          </Button>
+        </div>
+        {catalog.profiles.length ? (
+          <ul>
+            {catalog.profiles.map((profile) => (
+              <li key={profile.id}>
+                <strong>{profile.label}</strong>
+                <span>{profile.endpoint}</span>
+                {catalog.defaultProfile === profile.id ? (
+                  <span className="status-chip tone-neutral">
+                    Default bookmark
+                  </span>
+                ) : null}
+              </li>
+            ))}
+          </ul>
+        ) : (
+          <p className="inline-empty">No saved endpoints.</p>
+        )}
+      </div>
+    </>
+  );
+}
+
+export function ControlPlaneConnections(
+  props: Omit<
+    Parameters<typeof ControlPlaneConnectionInventory>[0],
+    "catalog" | "unavailable"
+  >,
+) {
+  const [catalog, setCatalog] = useState<ControlPlaneProfiles | null>(null);
+  const [unavailable, setUnavailable] = useState(false);
+  const [loading, setLoading] = useState(true);
+  const alive = useRef(false),
+    pending = useRef(false);
+  async function refresh() {
+    if (pending.current) return;
+    pending.current = true;
+    try {
+      const next = await controlPlaneProfiles();
+      if (alive.current) {
+        setCatalog((current) => ({
+          ...next,
+          connections:
+            next.connectionStatusUnavailable && !next.connections.length
+              ? (current?.connections ?? [])
+              : next.connections,
+        }));
+        setUnavailable(Boolean(next.connectionStatusUnavailable));
+      }
+    } catch {
+      if (alive.current) setUnavailable(true);
+    } finally {
+      pending.current = false;
+      if (alive.current) setLoading(false);
+    }
+  }
+  useEffect(() => {
+    alive.current = true;
+    void refresh();
+    const timer = setInterval(() => void refresh(), 5000);
+    return () => {
+      alive.current = false;
+      clearInterval(timer);
+    };
+  }, []);
+  return (
+    <section
+      className="overview-section"
+      aria-label="Control Plane connections"
+    >
+      <div className="section-heading">
+        <div>
+          <p className="eyebrow">Enrolled workspace runtimes</p>
+          <h3>Control Plane</h3>
+        </div>
+        <Button
+          variant="secondary"
+          onClick={() => void refresh()}
+          disabled={loading}
+        >
+          <IconRefresh size={15} aria-hidden="true" />
+          Refresh status
+        </Button>
+      </div>
+      {loading && !catalog ? (
+        <p className="inline-empty" role="status">
+          Reading Control Plane enrollment status…
+        </p>
+      ) : null}
+      {unavailable ? (
+        <p className="managed-settings-notice error" role="alert">
+          Control Plane status could not be refreshed. Any retained enrollment
+          state is unknown until a successful read.
+        </p>
+      ) : null}
+      {catalog ? (
+        <ControlPlaneConnectionInventory
+          {...props}
+          catalog={catalog}
+          unavailable={unavailable}
+        />
+      ) : unavailable ? (
+        <Button
+          variant="secondary"
+          disabled={props.disabled}
+          onClick={props.onManageProfiles}
+        >
+          Open Control Plane settings
+        </Button>
+      ) : null}
+    </section>
+  );
+}
diff --git a/apps/desktop/src/components/ControlPlaneSettingsPane.tsx b/apps/desktop/src/components/ControlPlaneSettingsPane.tsx
new file mode 100644
index 000000000..8d05d7fdb
--- /dev/null
+++ b/apps/desktop/src/components/ControlPlaneSettingsPane.tsx
@@ -0,0 +1,269 @@
+import { useEffect, useRef, useState } from "react";
+import { invoke } from "@tauri-apps/api/core";
+import { IconCloud } from "@tabler/icons-react";
+import { Button, CatalogInventory, TextInput } from "@colossus/ui";
+import "./cloud-connection.css";
+import type { ControlPlaneProfile, ControlPlaneProfiles } from "../types";
+export type { ControlPlaneProfiles } from "../types";
+
+export function ControlPlaneSettingsPane() {
+  const [catalog, setCatalog] = useState<ControlPlaneProfiles | null>(null);
+  const [label, setLabel] = useState("");
+  const [endpoint, setEndpoint] = useState("");
+  const [editorOpen, setEditorOpen] = useState(false);
+  const [editing, setEditing] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const busyRef = useRef(false);
+  const [error, setError] = useState("");
+  useEffect(() => {
+    let alive = true;
+    const refresh = () => {
+      if (busyRef.current) return;
+      void invoke<ControlPlaneProfiles>("control_plane_profiles")
+        .then((value) => {
+          if (alive)
+            setCatalog((current) =>
+              current && current.revision > value.revision ? current : value,
+            );
+        })
+        .catch(() => {
+          if (alive) setError("Control Plane settings are unavailable.");
+        });
+    };
+    refresh();
+    const timer = setInterval(refresh, 5000);
+    return () => {
+      alive = false;
+      clearInterval(timer);
+    };
+  }, []);
+  async function save(
+    profiles: ControlPlaneProfile[],
+    defaultProfile: string | null,
+  ) {
+    if (!catalog || busyRef.current) return;
+    busyRef.current = true;
+    setBusy(true);
+    setError("");
+    try {
+      const next = await invoke<ControlPlaneProfiles>(
+        "save_control_plane_profiles",
+        {
+          catalog: { revision: catalog.revision, profiles, defaultProfile },
+        },
+      );
+      setCatalog(next);
+      setEditorOpen(false);
+      setEditing(null);
+      setLabel("");
+      setEndpoint("");
+    } catch (failure) {
+      setError(
+        typeof failure === "object" && failure !== null && "message" in failure
+          ? String(failure.message)
+          : "Connection settings could not be saved. Reload and try again.",
+      );
+    } finally {
+      busyRef.current = false;
+      setBusy(false);
+    }
+  }
+  const profiles = catalog?.profiles ?? [];
+  if (!catalog)
+    return (
+      <section className="managed-settings-body control-plane-settings">
+        <div className="managed-section-heading">
+          <div>
+            <p className="eyebrow">Shared resources</p>
+            <h3>Control Plane</h3>
+          </div>
+        </div>
+        <p
+          className={
+            error ? "managed-settings-notice error" : "managed-heading-copy"
+          }
+          role={error ? "alert" : "status"}
+        >
+          {error || "Loading Control Plane connections…"}
+        </p>
+      </section>
+    );
+  return (
+    <CatalogInventory
+      kind={{
+        title: "Control Plane",
+        singular: "connection",
+        plural: "connections",
+        column: "Connection",
+        description:
+          "Save endpoints for your workspaces. Enrollment and sharing are managed in each workspace.",
+        connectionLabel: "Default",
+        usageLabel: "Enrollment",
+        Icon: IconCloud,
+        className: "providers-settings control-plane-settings",
+      }}
+      summary={`${profiles.length} saved ${profiles.length === 1 ? "connection" : "connections"}`}
+      busy={busy}
+      editing={editorOpen}
+      onAdd={() => {
+        setEditorOpen(true);
+        setEditing(null);
+        setLabel("");
+        setEndpoint("");
+      }}
+      emptyDescription="Add an endpoint, then enroll a workspace from its Control Plane settings."
+      rows={profiles.map((profile) => ({
+        id: profile.id,
+        label: profile.label,
+        name: profile.label,
+        description: profile.endpoint,
+        searchText: `${profile.label} ${profile.endpoint}`,
+        connection:
+          catalog.defaultProfile === profile.id ? (
+            "Default"
+          ) : (
+            <Button
+              type="button"
+              disabled={busy}
+              onClick={() => void save(profiles, profile.id)}
+            >
+              Use by default
+            </Button>
+          ),
+        usage: "Per workspace",
+        details: (
+          <p>
+            Workspace runtimes keep their own enrollment and sharing choice.
+          </p>
+        ),
+        onEdit: () => {
+          setEditing(profile.id);
+          setEditorOpen(true);
+          setLabel(profile.label);
+          setEndpoint(profile.endpoint);
+        },
+        onDelete: () =>
+          void save(
+            profiles.filter((item) => item.id !== profile.id),
+            catalog.defaultProfile === profile.id
+              ? null
+              : catalog.defaultProfile,
+          ),
+      }))}
+      footer={
+        catalog.connections.length || catalog.connectionStatusUnavailable ? (
+          <section className="control-plane-workspaces">
+            <h4>Enrolled workspace runtimes</h4>
+            {catalog.connectionStatusUnavailable ? (
+              <p className="managed-settings-notice error" role="alert">
+                Enrollment status is unavailable. Saved endpoints remain usable.
+              </p>
+            ) : null}
+            <ul className="control-plane-workspace-list">
+              {catalog.connections.map((connection) => (
+                <li key={connection.targetId}>
+                  <strong>{connection.projectId ?? "Workspace"}</strong>
+                  <span>
+                    {catalog.connectionStatusUnavailable
+                      ? "Unknown"
+                      : connection.status}{" "}
+                    ·{" "}
+                    {catalog.connectionStatusUnavailable
+                      ? "Sharing status unknown"
+                      : connection.sharingRestartRequired
+                        ? "Restart Desktop to reconcile sharing"
+                        : connection.sharingRecoveryRequired
+                          ? "Sharing needs reconciliation"
+                          : connection.sharedSessions
+                            ? "Workspace history shared"
+                            : "Local history private"}
+                  </span>
+                </li>
+              ))}
+            </ul>
+          </section>
+        ) : null
+      }
+    >
+      {error ? (
+        <p className="managed-settings-notice error" role="alert">
+          {error}
+        </p>
+      ) : null}
+      {editorOpen ? (
+        <form
+          className="mcp-editor catalog-editor provider-editor"
+          onSubmit={(event) => {
+            event.preventDefault();
+            const id = editing ?? crypto.randomUUID();
+            void save(
+              [
+                ...profiles.filter((profile) => profile.id !== id),
+                { id, label: label.trim(), endpoint: endpoint.trim() },
+              ],
+              catalog.defaultProfile ?? id,
+            );
+          }}
+        >
+          <div className="provider-editor-heading">
+            <IconCloud size={24} aria-hidden="true" />
+            <div>
+              <h4>{editing ? "Edit connection" : "Add connection"}</h4>
+              <p>
+                Use HTTPS, or HTTP on loopback for local development. Workspace
+                enrollments are managed separately.
+              </p>
+            </div>
+          </div>
+          <div className="provider-editor-section">
+            <div className="provider-editor-grid">
+              <label>
+                Connection name
+                <TextInput
+                  value={label}
+                  onChange={(event) => setLabel(event.target.value)}
+                  maxLength={128}
+                  placeholder="Team Control Plane"
+                  disabled={busy}
+                  required
+                  autoFocus
+                />
+              </label>
+              <label>
+                Web endpoint
+                <TextInput
+                  value={endpoint}
+                  onChange={(event) => setEndpoint(event.target.value)}
+                  maxLength={2048}
+                  placeholder="https://control-plane.example.com"
+                  disabled={busy}
+                  required
+                />
+              </label>
+            </div>
+          </div>
+          <div className="mcp-editor-actions">
+            <Button
+              type="submit"
+              disabled={busy || !label.trim() || !endpoint.trim()}
+            >
+              {busy ? "Saving…" : "Save connection"}
+            </Button>
+            <Button
+              type="button"
+              disabled={busy}
+              onClick={() => {
+                setEditorOpen(false);
+                setEditing(null);
+                setLabel("");
+                setEndpoint("");
+              }}
+            >
+              Cancel
+            </Button>
+          </div>
+        </form>
+      ) : null}
+    </CatalogInventory>
+  );
+}
diff --git a/apps/desktop/src/components/ManagedSettingsPane.test.ts b/apps/desktop/src/components/ManagedSettingsPane.test.ts
index 7e2c304bb..e3e07c1f3 100644
--- a/apps/desktop/src/components/ManagedSettingsPane.test.ts
+++ b/apps/desktop/src/components/ManagedSettingsPane.test.ts
@@ -1,5 +1,6 @@
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
+import { RadioGroup } from "@colossus/ui";
 import { describe, expect, it, vi } from "vitest";
 import { deleteMcpFixture, managedMcpConsumers } from "../mcp-deletion";
 import { McpDeleteDialog } from "./McpDeleteDialog";
@@ -267,7 +268,9 @@ function desktop(): DesktopStatus {
   };
 }
 
-function renderPane(): string {
+function renderPane(
+  overrides: Partial<Parameters<typeof ManagedSettingsPane>[0]> = {},
+): string {
   return renderToStaticMarkup(
     createElement(ManagedSettingsPane, {
       desktop: desktop(),
@@ -288,6 +291,7 @@ function renderPane(): string {
       onImportClientIdentity: vi.fn(),
       onRemoveClientIdentity: vi.fn(),
       onExportDiagnostics: vi.fn(),
+      ...overrides,
     }),
   );
 }
@@ -1602,3 +1606,46 @@ describe("MCP deletion", () => {
     ).toThrow(/unknown/);
   });
 });
+
+it("offers compact settings radio choices without changing the default cards or selection semantics", () => {
+  const options = [
+    { value: "private", label: "Control Plane conversations only" },
+    { value: "read", label: "Share Desktop history for viewing" },
+  ];
+  const compact = renderToStaticMarkup(
+    createElement(RadioGroup, {
+      value: "private",
+      onValueChange: () => undefined,
+      options,
+      variant: "compact",
+      "aria-label": "Desktop conversation sharing",
+    }),
+  );
+  expect(compact).toContain("ui-radio-group--compact");
+  expect(compact).toContain('role="radiogroup"');
+  expect(compact).toContain('aria-label="Desktop conversation sharing"');
+  expect(compact).toMatch(/aria-checked="true"[^>]*tabindex="0"/);
+  expect(compact).toMatch(/aria-checked="false"[^>]*tabindex="-1"/);
+  const cards = renderToStaticMarkup(
+    createElement(RadioGroup, {
+      value: "private",
+      onValueChange: () => undefined,
+      options,
+      "aria-label": "Desktop conversation sharing",
+    }),
+  );
+  expect(cards).not.toContain("ui-radio-group--compact");
+  expect(cards).toContain("ui:px-3 ui:py-3");
+});
+
+it("opens explicit Control Plane settings without falling through a missing workspace", () => {
+  expect(renderPane({ initialSpaceTab: "control-plane" })).toContain(
+    "Loading Control Plane connections",
+  );
+  const missing = renderPane({
+    initialSpaceTab: "cloud",
+    initialSpaceId: "missing-workspace",
+  });
+  expect(missing).not.toContain("cloud-settings-state");
+  expect(missing).not.toContain("Make this runtime available");
+});
diff --git a/apps/desktop/src/components/ManagedSettingsPane.tsx b/apps/desktop/src/components/ManagedSettingsPane.tsx
index 725b1314d..4828cd2e3 100644
--- a/apps/desktop/src/components/ManagedSettingsPane.tsx
+++ b/apps/desktop/src/components/ManagedSettingsPane.tsx
@@ -1,3 +1,5 @@
+import { CloudConnectionPane } from "./CloudConnectionPane";
+import { ControlPlaneSettingsPane } from "./ControlPlaneSettingsPane";
 import { ModelFeatureControl } from "./ModelFeatureControl";
 import type { ModelFeatureMode, ManagedModelCapabilities } from "../types";
 import { RememberedCommands } from "./RememberedCommands";
@@ -6,6 +8,7 @@ import { useSetupPackages } from "./setup/useSetupPackages";
 import { ImportedProviderActions } from "./setup/ImportedProviderActions";
 import { SettingsFrame } from "./SettingsFrame";
 import { ModelRoleRouting } from "./ModelRoleRouting";
+import { ModelRoutingOverview } from "./ModelRoutingOverview";
 import { RuntimeProfileRow } from "./RuntimeProfileRow";
 import {
   subscribeSettingsUpdates,
@@ -220,6 +223,7 @@ type DesktopTab = (typeof DESKTOP_PAGES)[number]["id"];
 
 type SettingsScope = "global" | "space";
 type GlobalTab =
+  | "control-plane"
   | "providers"
   | "models"
   | "credentials"
@@ -230,8 +234,11 @@ type GlobalTab =
   | "defaults"
   | DesktopTab;
 type SpaceTab =
+  | "cloud"
   | "runtime"
   | "providers"
+  | "models"
+  | "routing"
   | "mcp"
   | "plugins"
   | "access"
@@ -244,7 +251,17 @@ type SpaceTab =
 
 interface ManagedSettingsPaneProps {
   initialSpaceTab?:
-    "runtime" | "providers" | "plugins" | "terminal" | "dictation" | undefined;
+    | "runtime"
+    | "providers"
+    | "models"
+    | "routing"
+    | "plugins"
+    | "terminal"
+    | "dictation"
+    | "cloud"
+    | "control-plane"
+    | undefined;
+  initialSpaceId?: string | undefined;
   desktop: DesktopStatus;
   connecting: boolean;
   updateChecking: boolean;
@@ -370,6 +387,7 @@ const GLOBAL_TABS: ReadonlyArray<{
   group?: string;
 }> = [
   { id: "providers", label: "Providers", group: "Global settings" },
+  { id: "control-plane", label: "Control Plane", group: "Global settings" },
   { id: "models", label: "Models", group: "Global settings" },
   { id: "credentials", label: "Credentials", group: "Global settings" },
   { id: "mcp", label: "MCP", group: "Global settings" },
@@ -382,7 +400,10 @@ const GLOBAL_TABS: ReadonlyArray<{
 
 const SPACE_TABS: ReadonlyArray<{ id: SpaceTab; label: string }> = [
   { id: "runtime", label: "Runtime" },
+  { id: "cloud", label: "Control Plane" },
   { id: "providers", label: "Providers" },
+  { id: "models", label: "Models" },
+  { id: "routing", label: "Routing" },
   { id: "mcp", label: "MCP" },
   { id: "plugins", label: "Plugins" },
   { id: "access", label: "Access" },
@@ -1683,6 +1704,7 @@ function mcpEntry(
 
 export function ManagedSettingsPane({
   initialSpaceTab = "runtime",
+  initialSpaceId,
   onReturnToWork,
   desktop,
   connecting,
@@ -1708,17 +1730,23 @@ export function ManagedSettingsPane({
   );
   const [snapshot, setSnapshot] = useState(initial);
   const [scope, setScope] = useState<SettingsScope>(
-    initialSpaceTab === "terminal" || initialSpaceTab === "dictation"
+    initialSpaceTab === "terminal" ||
+      initialSpaceTab === "dictation" ||
+      initialSpaceTab === "control-plane"
       ? "global"
       : "space",
   );
   const [globalTab, setGlobalTab] = useState<GlobalTab>(
-    initialSpaceTab === "terminal" || initialSpaceTab === "dictation"
+    initialSpaceTab === "terminal" ||
+      initialSpaceTab === "dictation" ||
+      initialSpaceTab === "control-plane"
       ? initialSpaceTab
       : "mcp",
   );
   const [spaceTab, setSpaceTab] = useState<SpaceTab>(
-    initialSpaceTab === "terminal" || initialSpaceTab === "dictation"
+    initialSpaceTab === "terminal" ||
+      initialSpaceTab === "dictation" ||
+      initialSpaceTab === "control-plane"
       ? "runtime"
       : initialSpaceTab,
   );
@@ -1727,7 +1755,7 @@ export function ManagedSettingsPane({
     ReadonlySet<string>
   >(() => new Set());
   const [selectedSpaceId, setSelectedSpaceId] = useState(
-    desktop.selectedSpaceId ?? initial.spaces[0]?.id ?? "",
+    initialSpaceId ?? desktop.selectedSpaceId ?? initial.spaces[0]?.id ?? "",
   );
   const [query, setQuery] = useState("");
   const [actionBusy, setBusy] = useState(false);
@@ -1823,7 +1851,7 @@ export function ManagedSettingsPane({
 
   const selectedSpace =
     snapshot.spaces.find((candidate) => candidate.id === selectedSpaceId) ??
-    snapshot.spaces[0];
+    (initialSpaceId === undefined ? snapshot.spaces[0] : undefined);
 
   useEffect(() => {
     if (!isTauriRuntime()) return;
@@ -3068,79 +3096,90 @@ export function ManagedSettingsPane({
       ) : (
         <>
           {selectedSpace ? (
-            <SpaceSettingsBody
-              tab={spaceTab}
-              snapshot={snapshot}
-              selectedSpace={selectedSpace}
-              draft={space}
-              setDraft={setSpace}
-              descriptors={descriptors}
-              effective={effective}
-              focusedFieldId={focusedFieldId}
-              expandedAdvancedSections={expandedAdvancedSections}
-              onAdvancedSectionToggle={(section, open) => {
-                setExpandedAdvancedSections((current) => {
-                  if (current.has(section) === open) return current;
-                  const next = new Set(current);
-                  if (open) next.add(section);
-                  else next.delete(section);
-                  return next;
-                });
-                if (
-                  !open &&
-                  descriptors.find(({ id }) => id === focusedFieldId)
-                    ?.section === section
-                ) {
-                  setFocusedFieldId(null);
+            spaceTab === "cloud" ? (
+              <CloudConnectionPane
+                key={selectedSpace.id}
+                targetId={selectedSpace.id}
+              />
+            ) : (
+              <SpaceSettingsBody
+                tab={spaceTab}
+                snapshot={snapshot}
+                selectedSpace={selectedSpace}
+                draft={space}
+                setDraft={setSpace}
+                descriptors={descriptors}
+                effective={effective}
+                focusedFieldId={focusedFieldId}
+                expandedAdvancedSections={expandedAdvancedSections}
+                onAdvancedSectionToggle={(section, open) => {
+                  setExpandedAdvancedSections((current) => {
+                    if (current.has(section) === open) return current;
+                    const next = new Set(current);
+                    if (open) next.add(section);
+                    else next.delete(section);
+                    return next;
+                  });
+                  if (
+                    !open &&
+                    descriptors.find(({ id }) => id === focusedFieldId)
+                      ?.section === section
+                  ) {
+                    setFocusedFieldId(null);
+                  }
+                }}
+                busy={busy}
+                mcpDiagnostics={mcpDiagnostics}
+                mcpOauthStatuses={mcpOauthStatuses}
+                mcpOauthLogins={mcpOauthLogins}
+                mcpOauthCallbacks={mcpOauthCallbacks}
+                onMcpOauthCallback={(server, value) =>
+                  setMcpOauthCallbacks((current) => ({
+                    ...current,
+                    [server]: value,
+                  }))
                 }
-              }}
-              busy={busy}
-              mcpDiagnostics={mcpDiagnostics}
-              mcpOauthStatuses={mcpOauthStatuses}
-              mcpOauthLogins={mcpOauthLogins}
-              mcpOauthCallbacks={mcpOauthCallbacks}
-              onMcpOauthCallback={(server, value) =>
-                setMcpOauthCallbacks((current) => ({
-                  ...current,
-                  [server]: value,
-                }))
-              }
-              onTestMcp={testMcpServer}
-              onLoadMcpOAuthStatus={loadMcpOAuthStatus}
-              onLoginMcpOAuth={loginMcpOAuth}
-              onCompleteMcpOAuth={completeMcpOAuth}
-              onLogoutMcpOAuth={logoutMcpOAuth}
-              runtimeDiagnostics={runtimeDiagnostics}
-              testingRuntimeProfile={testingRuntimeProfile}
-              runtimeDiagnosticErrors={runtimeDiagnosticErrors}
-              onTestRuntimeProfile={testRuntimeProfile}
-              onTestSearchRole={testSearchRole}
-              onTestTelemetry={testTelemetry}
-              extensionInventory={extensionInventory}
-              extensionInventoryBusy={extensionInventoryBusy}
-              onRefreshExtensionInventory={() => void loadExtensionInventory()}
-            />
+                onTestMcp={testMcpServer}
+                onLoadMcpOAuthStatus={loadMcpOAuthStatus}
+                onLoginMcpOAuth={loginMcpOAuth}
+                onCompleteMcpOAuth={completeMcpOAuth}
+                onLogoutMcpOAuth={logoutMcpOAuth}
+                runtimeDiagnostics={runtimeDiagnostics}
+                testingRuntimeProfile={testingRuntimeProfile}
+                runtimeDiagnosticErrors={runtimeDiagnosticErrors}
+                onTestRuntimeProfile={testRuntimeProfile}
+                onTestSearchRole={testSearchRole}
+                onTestTelemetry={testTelemetry}
+                extensionInventory={extensionInventory}
+                extensionInventoryBusy={extensionInventoryBusy}
+                onRefreshExtensionInventory={() =>
+                  void loadExtensionInventory()
+                }
+              />
+            )
           ) : (
             <EmptySettings
               icon={<IconFolder size={24} />}
               title="No Workspace selected"
             />
           )}
-          <SettingsActionBar
-            dirty={spaceDirty}
-            busy={busy}
-            failure={failure}
-            label="Apply Workspace changes"
-            pending={
-              selectedSpace?.pendingGlobalRevision ? selectedSpace : undefined
-            }
-            onDiscard={() =>
-              selectedSpace && setSpace(spaceDraft(selectedSpace))
-            }
-            onApply={() =>
-              void (spaceDirty ? saveSpace() : applyPendingRevision())
-            }
-          />
+          {spaceTab !== "cloud" && (
+            <SettingsActionBar
+              dirty={spaceDirty}
+              busy={busy}
+              failure={failure}
+              label="Apply Workspace changes"
+              pending={
+                selectedSpace?.pendingGlobalRevision ? selectedSpace : undefined
+              }
+              onDiscard={() =>
+                selectedSpace && setSpace(spaceDraft(selectedSpace))
+              }
+              onApply={() =>
+                void (spaceDirty ? saveSpace() : applyPendingRevision())
+              }
+            />
+          )}
           {importProposal ? (
             <RepositoryImportDialog
               proposal={importProposal}
@@ -3316,6 +3355,8 @@ function GlobalSettingsBody({
     );
   };
   const global = snapshot.globalConfiguration;
+  if (tab === "control-plane") return <ControlPlaneSettingsPane />;
+
   if (tab === "plugins") {
     return (
       <PluginSettingsBody
@@ -4932,7 +4973,7 @@ export function SpaceSettingsBody({
       </section>
     );
   }
-  if (tab === "providers") {
+  if (tab === "providers" || tab === "models" || tab === "routing") {
     const selectedModels = snapshot.globalConfiguration.models.filter((entry) =>
       draft.selectedModels.includes(entry.id),
     );
@@ -4965,129 +5006,176 @@ export function SpaceSettingsBody({
         <div className="managed-settings-body">
           <div className="managed-section-heading">
             <div>
-              <p className="eyebrow">Pinned global revisions</p>
-              <h3>Providers and models</h3>
+              <p className="eyebrow">
+                {tab === "routing"
+                  ? "Workspace routes"
+                  : "Pinned global revisions"}
+              </p>
+              <h3>
+                {tab === "providers"
+                  ? "Providers"
+                  : tab === "models"
+                    ? "Models"
+                    : "Routing"}
+              </h3>
+              <p className="managed-heading-copy">
+                {tab === "providers"
+                  ? "Choose which provider connections this workspace can use."
+                  : tab === "models"
+                    ? "Enable models from the providers selected for this workspace."
+                    : "Assign models to roles and inspect their effective provider routes."}
+              </p>
             </div>
             <span>
-              {draft.selectedProviders.length} providers ·{" "}
-              {draft.selectedModels.length} models
+              {tab === "providers"
+                ? `${draft.selectedProviders.length} selected ${draft.selectedProviders.length === 1 ? "provider" : "providers"}`
+                : `${draft.selectedModels.length} enabled ${draft.selectedModels.length === 1 ? "model" : "models"}`}
             </span>
           </div>
-          <div className="managed-list mcp-selection-list">
-            {snapshot.globalConfiguration.providers.map((entry) => {
-              const provider = currentValue(entry);
-              const enabled = draft.selectedProviders.includes(entry.id);
-              return (
-                <RuntimeProfileRow
-                  key={entry.id}
-                  kind="provider"
-                  label={entry.label}
-                  subtitle={provider.baseUrl}
-                  selected={enabled}
-                  busy={busy}
-                  {...testState("provider", entry, provider.profile, enabled)}
-                >
-                  <SwitchInput
-                    disabled={busy}
-                    checked={enabled}
-                    aria-label={`Select ${entry.label}`}
-                    onChange={(event) => {
-                      const selectedProviders = event.target.checked
-                        ? [...draft.selectedProviders, entry.id]
-                        : draft.selectedProviders.filter(
-                            (id) => id !== entry.id,
-                          );
-                      const removedModels = new Set(
-                        snapshot.globalConfiguration.models
-                          .filter(
-                            (model) =>
-                              currentValue(model).providerProfile ===
-                              provider.profile,
-                          )
-                          .map((model) => model.id),
-                      );
-                      const selectedModelProfiles = new Set(
-                        snapshot.globalConfiguration.models
-                          .filter(
-                            (model) =>
-                              event.target.checked ||
-                              !removedModels.has(model.id),
-                          )
-                          .map((model) => currentValue(model).profile),
-                      );
-                      setDraft({
-                        ...draft,
-                        selectedProviders,
-                        selectedModels: event.target.checked
-                          ? draft.selectedModels
-                          : draft.selectedModels.filter(
-                              (id) => !removedModels.has(id),
-                            ),
-                        modelRoles: Object.fromEntries(
-                          Object.entries(draft.modelRoles).filter(
-                            ([, profile]) => selectedModelProfiles.has(profile),
-                          ),
-                        ),
-                      });
-                    }}
-                  />
-                </RuntimeProfileRow>
-              );
-            })}
-            {snapshot.globalConfiguration.models.map((entry) => {
-              const model = currentValue(entry);
-              const providerSelected =
-                snapshot.globalConfiguration.providers.some(
-                  (provider) =>
-                    draft.selectedProviders.includes(provider.id) &&
-                    currentValue(provider).profile === model.providerProfile,
-                );
-              const enabled = draft.selectedModels.includes(entry.id);
-              return (
-                <RuntimeProfileRow
-                  key={entry.id}
-                  kind="model"
-                  label={entry.label}
-                  subtitle={`${model.model} · ${model.providerProfile}`}
-                  selected={enabled}
-                  busy={busy}
-                  {...testState(
-                    "model",
-                    entry,
-                    model.profile,
-                    enabled && providerSelected,
-                  )}
-                >
-                  <SwitchInput
-                    disabled={busy || !providerSelected}
-                    checked={enabled}
-                    aria-label={`Select ${entry.label}`}
-                    onChange={(event) => {
-                      const selectedModels = event.target.checked
-                        ? [...draft.selectedModels, entry.id]
-                        : draft.selectedModels.filter((id) => id !== entry.id);
-                      const modelRoles = Object.fromEntries(
-                        Object.entries(draft.modelRoles).filter(
-                          ([, profile]) =>
-                            event.target.checked || profile !== model.profile,
-                        ),
+          {tab !== "routing" ? (
+            <div className="managed-list mcp-selection-list">
+              {tab === "providers"
+                ? snapshot.globalConfiguration.providers.map((entry) => {
+                    const provider = currentValue(entry);
+                    const enabled = draft.selectedProviders.includes(entry.id);
+                    return (
+                      <RuntimeProfileRow
+                        key={entry.id}
+                        kind="provider"
+                        label={entry.label}
+                        subtitle={provider.baseUrl}
+                        selected={enabled}
+                        busy={busy}
+                        {...testState(
+                          "provider",
+                          entry,
+                          provider.profile,
+                          enabled,
+                        )}
+                      >
+                        <SwitchInput
+                          disabled={busy}
+                          checked={enabled}
+                          aria-label={`Select ${entry.label}`}
+                          onChange={(event) => {
+                            const selectedProviders = event.target.checked
+                              ? [...draft.selectedProviders, entry.id]
+                              : draft.selectedProviders.filter(
+                                  (id) => id !== entry.id,
+                                );
+                            const removedModels = new Set(
+                              snapshot.globalConfiguration.models
+                                .filter(
+                                  (model) =>
+                                    currentValue(model).providerProfile ===
+                                    provider.profile,
+                                )
+                                .map((model) => model.id),
+                            );
+                            const selectedModelProfiles = new Set(
+                              snapshot.globalConfiguration.models
+                                .filter(
+                                  (model) =>
+                                    event.target.checked ||
+                                    !removedModels.has(model.id),
+                                )
+                                .map((model) => currentValue(model).profile),
+                            );
+                            setDraft({
+                              ...draft,
+                              selectedProviders,
+                              selectedModels: event.target.checked
+                                ? draft.selectedModels
+                                : draft.selectedModels.filter(
+                                    (id) => !removedModels.has(id),
+                                  ),
+                              modelRoles: Object.fromEntries(
+                                Object.entries(draft.modelRoles).filter(
+                                  ([, profile]) =>
+                                    selectedModelProfiles.has(profile),
+                                ),
+                              ),
+                            });
+                          }}
+                        />
+                      </RuntimeProfileRow>
+                    );
+                  })
+                : null}
+              {tab === "models"
+                ? snapshot.globalConfiguration.models.map((entry) => {
+                    const model = currentValue(entry);
+                    const providerSelected =
+                      snapshot.globalConfiguration.providers.some(
+                        (provider) =>
+                          draft.selectedProviders.includes(provider.id) &&
+                          currentValue(provider).profile ===
+                            model.providerProfile,
                       );
-                      setDraft({ ...draft, selectedModels, modelRoles });
-                    }}
-                  />
-                </RuntimeProfileRow>
-              );
-            })}
-          </div>
-          <ModelRoleRouting
-            roles={draft.modelRoles}
-            models={selectedModels.map((entry) => ({
-              ...currentValue(entry),
-              label: entry.label,
-            }))}
-            disabled={busy}
-            onChange={(modelRoles) => setDraft({ ...draft, modelRoles })}
-          />
+                    const enabled = draft.selectedModels.includes(entry.id);
+                    return (
+                      <RuntimeProfileRow
+                        key={entry.id}
+                        kind="model"
+                        label={entry.label}
+                        subtitle={`${model.model} · ${model.providerProfile}`}
+                        selected={enabled}
+                        busy={busy}
+                        {...testState(
+                          "model",
+                          entry,
+                          model.profile,
+                          enabled && providerSelected,
+                        )}
+                      >
+                        <SwitchInput
+                          disabled={busy || !providerSelected}
+                          checked={enabled}
+                          aria-label={`Select ${entry.label}`}
+                          onChange={(event) => {
+                            const selectedModels = event.target.checked
+                              ? [...draft.selectedModels, entry.id]
+                              : draft.selectedModels.filter(
+                                  (id) => id !== entry.id,
+                                );
+                            const modelRoles = Object.fromEntries(
+                              Object.entries(draft.modelRoles).filter(
+                                ([, profile]) =>
+                                  event.target.checked ||
+                                  profile !== model.profile,
+                              ),
+                            );
+                            setDraft({ ...draft, selectedModels, modelRoles });
+                          }}
+                        />
+                      </RuntimeProfileRow>
+                    );
+                  })
+                : null}
+            </div>
+          ) : null}
+          {tab === "routing" ? (
+            <>
+              <ModelRoutingOverview
+                roles={draft.modelRoles}
+                models={selectedModels.map((entry) => ({
+                  ...currentValue(entry),
+                  label: entry.label,
+                }))}
+                disabled={busy}
+                onChange={(modelRoles) => setDraft({ ...draft, modelRoles })}
+              />
+              <ModelRoleRouting
+                roles={draft.modelRoles}
+                models={selectedModels.map((entry) => ({
+                  ...currentValue(entry),
+                  label: entry.label,
+                }))}
+                disabled={busy}
+                onChange={(modelRoles) => setDraft({ ...draft, modelRoles })}
+              />
+            </>
+          ) : null}
         </div>
       </section>
     );
diff --git a/apps/desktop/src/components/MarkdownContent.test.ts b/apps/desktop/src/components/MarkdownContent.test.ts
index 4172ddd42..13203ac71 100644
--- a/apps/desktop/src/components/MarkdownContent.test.ts
+++ b/apps/desktop/src/components/MarkdownContent.test.ts
@@ -39,8 +39,8 @@ const ready = true;
     expect(markup).toContain("<code>inline code</code>");
     expect(markup).toContain('class="markdown-table-scroll"');
     expect(markup).toContain("<table>");
-    expect(markup).toContain(
-      'aria-label="Scrollable Markdown code block" tabindex="0"',
+    expect(markup).toMatch(
+      /aria-label="Scrollable Markdown code block [^"]+" tabindex="0"/,
     );
     expect(markup).toContain('<code class="language-ts">');
   });
diff --git a/apps/desktop/src/components/MarkdownContent.tsx b/apps/desktop/src/components/MarkdownContent.tsx
index d2e799afd..756c614d5 100644
--- a/apps/desktop/src/components/MarkdownContent.tsx
+++ b/apps/desktop/src/components/MarkdownContent.tsx
@@ -1,251 +1,27 @@
 import { memo } from "react";
-import type { ComponentPropsWithoutRef, ReactNode } from "react";
-import rehypeSanitize from "rehype-sanitize";
-import ReactMarkdown from "react-markdown";
-import type { Components, UrlTransform } from "react-markdown";
-import remarkGfm from "remark-gfm";
-import { BrowserLink, webLink } from "./browser/BrowserLink";
-
+import {
+  MarkdownContent as SharedMarkdownContent,
+  markdownContentPropsAreEqual,
+} from "@colossus/ui/conversation";
+import { BrowserLink } from "./browser/BrowserLink";
+export {
+  MAX_MARKDOWN_CHARACTERS,
+  MAX_MARKDOWN_AST_NODES,
+  markdownContentPropsAreEqual,
+} from "@colossus/ui/conversation";
 interface MarkdownContentProps {
   content: string;
   className?: string;
 }
-
-interface MarkdownAstNode {
-  type: string;
-  children?: MarkdownAstNode[];
-  depth?: number;
-  value?: string;
-}
-
-interface MarkdownAstRoot extends MarkdownAstNode {
-  children: MarkdownAstNode[];
-}
-
-interface MarkdownFile {
-  value?: unknown;
-}
-
-export const MAX_MARKDOWN_CHARACTERS = 16_384;
-export const MAX_MARKDOWN_AST_NODES = 1_000;
-const MAX_MARKDOWN_AST_DEPTH = 32;
-const STRUCTURE_FALLBACK_NOTICE =
-  "Complex response shown as plain text for performance and safety.";
-
-const ALLOWED_ELEMENTS = [
-  "a",
-  "blockquote",
-  "br",
-  "code",
-  "del",
-  "em",
-  "h1",
-  "h2",
-  "h3",
-  "h4",
-  "h5",
-  "h6",
-  "hr",
-  "img",
-  "input",
-  "li",
-  "ol",
-  "p",
-  "pre",
-  "strong",
-  "table",
-  "tbody",
-  "td",
-  "th",
-  "thead",
-  "tr",
-  "ul",
-];
-const REHYPE_PLUGINS = [rehypeSanitize];
-
-// Remote images remain blocked. Links become explicit native-browser actions
-// only when a browser controller is available; never privileged-view navigation.
-// Preserve the validated spelling for native checks against saved instructions.
-const safeDestination: UrlTransform = (url, key) =>
-  key === "href" && webLink(url) ? url : null;
-
-function BlockedImage({ alt }: Pick<ComponentPropsWithoutRef<"img">, "alt">) {
-  return (
-    <span className="markdown-image-blocked" role="note">
-      Image omitted{alt === undefined || alt === "" ? "" : `: ${alt}`}
-    </span>
-  );
-}
-
-function MarkdownTable({
-  children,
-}: Pick<ComponentPropsWithoutRef<"table">, "children">) {
-  return (
-    <div
-      className="markdown-table-scroll"
-      role="region"
-      aria-label="Scrollable Markdown table"
-      tabIndex={0}
-    >
-      <table>{children}</table>
-    </div>
-  );
-}
-
-function MarkdownPre({
-  children,
-}: Pick<ComponentPropsWithoutRef<"pre">, "children">) {
-  return (
-    <pre role="region" aria-label="Scrollable Markdown code block" tabIndex={0}>
-      {children}
-    </pre>
-  );
-}
-
-function replaceWithPlainText(tree: MarkdownAstRoot, file: MarkdownFile): void {
-  const content = typeof file.value === "string" ? file.value : "";
-  tree.children = [
-    {
-      type: "blockquote",
-      children: [
-        {
-          type: "paragraph",
-          children: [{ type: "text", value: STRUCTURE_FALLBACK_NOTICE }],
-        },
-      ],
-    },
-    { type: "code", value: content },
-  ];
-}
-
-/**
- * Caps the eventual React tree and keeps response headings beneath the
- * assistant article heading. The character cap separately bounds parser work.
- */
-function enforceStructureBudget() {
-  return (tree: MarkdownAstRoot, file: MarkdownFile): void => {
-    let nodeCount = 0;
-    let shallowestHeading = 7;
-    const stack = [{ node: tree as MarkdownAstNode, depth: 0 }];
-
-    while (stack.length > 0) {
-      const current = stack.pop();
-      if (current === undefined) {
-        break;
-      }
-
-      nodeCount += 1;
-      if (
-        nodeCount > MAX_MARKDOWN_AST_NODES ||
-        current.depth > MAX_MARKDOWN_AST_DEPTH
-      ) {
-        replaceWithPlainText(tree, file);
-        return;
-      }
-
-      if (
-        current.node.type === "heading" &&
-        typeof current.node.depth === "number"
-      ) {
-        shallowestHeading = Math.min(shallowestHeading, current.node.depth);
-      }
-
-      for (const child of current.node.children ?? []) {
-        stack.push({ node: child, depth: current.depth + 1 });
-      }
-    }
-
-    if (shallowestHeading > 6) {
-      return;
-    }
-
-    const headingStack = [tree as MarkdownAstNode];
-    while (headingStack.length > 0) {
-      const node = headingStack.pop();
-      if (node === undefined) {
-        break;
-      }
-      if (node.type === "heading" && typeof node.depth === "number") {
-        node.depth = Math.min(6, 4 + node.depth - shallowestHeading);
-      }
-      headingStack.push(...(node.children ?? []));
-    }
-  };
-}
-
-const REMARK_PLUGINS = [remarkGfm, enforceStructureBudget];
-
-const MARKDOWN_COMPONENTS: Components = {
-  a: BrowserLink,
-  img: BlockedImage,
-  pre: MarkdownPre,
-  table: MarkdownTable,
-  input: ({ checked }) => (
-    <input
-      type="checkbox"
-      checked={checked}
-      disabled
-      tabIndex={-1}
-      readOnly
-      aria-label={checked ? "Completed task" : "Incomplete task"}
-    />
-  ),
-};
-
-function joinClasses(...classes: Array<string | undefined>): string {
-  return classes
-    .filter((value) => value !== undefined && value !== "")
-    .join(" ");
-}
-
-/**
- * Renders model-authored Markdown without interpreting HTML, fetching remote
- * media, or allowing model output to navigate the privileged desktop webview.
- */
-function MarkdownContentView({
+export const MarkdownContent = memo(function MarkdownContent({
   content,
   className,
-}: MarkdownContentProps): ReactNode {
-  const classes = joinClasses("markdown-content", className);
-
-  if (content.length > MAX_MARKDOWN_CHARACTERS) {
-    return (
-      <div className={joinClasses(classes, "markdown-content-fallback")}>
-        <p className="markdown-render-notice">
-          Large response shown as plain text for performance and safety.
-        </p>
-        <div className="markdown-plain-text preserve-lines">{content}</div>
-      </div>
-    );
-  }
-
+}: MarkdownContentProps) {
   return (
-    <div className={classes}>
-      <ReactMarkdown
-        allowedElements={ALLOWED_ELEMENTS}
-        components={MARKDOWN_COMPONENTS}
-        rehypePlugins={REHYPE_PLUGINS}
-        remarkPlugins={REMARK_PLUGINS}
-        skipHtml
-        urlTransform={safeDestination}
-      >
-        {content}
-      </ReactMarkdown>
-    </div>
-  );
-}
-
-export function markdownContentPropsAreEqual(
-  previous: MarkdownContentProps,
-  next: MarkdownContentProps,
-): boolean {
-  return (
-    previous.content === next.content && previous.className === next.className
+    <SharedMarkdownContent
+      content={content}
+      className={className ?? ""}
+      linkComponent={BrowserLink}
+    />
   );
-}
-
-export const MarkdownContent = memo(
-  MarkdownContentView,
-  markdownContentPropsAreEqual,
-);
-MarkdownContent.displayName = "MarkdownContent";
+}, markdownContentPropsAreEqual);
diff --git a/apps/desktop/src/components/ModelRoleRouting.tsx b/apps/desktop/src/components/ModelRoleRouting.tsx
index 2a53ce4f6..03cb90da4 100644
--- a/apps/desktop/src/components/ModelRoleRouting.tsx
+++ b/apps/desktop/src/components/ModelRoleRouting.tsx
@@ -2,7 +2,7 @@ import { useId } from "react";
 import { DropdownSelect } from "./DropdownSelect";
 import "./model-role-routing.css";
 
-const MODEL_ROLES = [
+export const MODEL_ROLES = [
   {
     id: "primary",
     label: "Primary",
@@ -47,13 +47,69 @@ const MODEL_ROLES = [
   },
 ] as const;
 
-interface RoleModel {
+export interface RoleModel {
   profile: string;
   label: string;
   model: string;
   providerProfile: string;
 }
 
+/** One role editor shared by the routing matrix and graph inspector. */
+export function ModelRoleSelect({
+  roleId,
+  roles,
+  models,
+  onChange,
+  disabled = false,
+  id,
+  describedBy,
+  label,
+}: {
+  roleId: string;
+  roles: Record<string, string>;
+  models: RoleModel[];
+  onChange: (roles: Record<string, string>) => void;
+  disabled?: boolean;
+  id?: string;
+  describedBy?: string;
+  label: string;
+}) {
+  const primary = roleId === "primary";
+  const assigned = roles[roleId] ?? "";
+  const unavailable =
+    assigned && !models.some((model) => model.profile === assigned);
+  return (
+    <DropdownSelect
+      {...(id ? { id } : {})}
+      aria-label={label}
+      {...(describedBy ? { "aria-describedby": describedBy } : {})}
+      required={primary}
+      disabled={disabled || !models.length}
+      value={assigned}
+      onChange={(event) => {
+        const next = { ...roles };
+        if (event.target.value) next[roleId] = event.target.value;
+        else delete next[roleId];
+        onChange(next);
+      }}
+    >
+      <option value="" disabled={primary}>
+        {primary ? "Choose a model" : "Use primary"}
+      </option>
+      {unavailable ? (
+        <option value={assigned} disabled>
+          Unavailable model: {assigned}
+        </option>
+      ) : null}
+      {models.map((model) => (
+        <option key={model.profile} value={model.profile}>
+          {model.label} · {model.model}
+        </option>
+      ))}
+    </DropdownSelect>
+  );
+}
+
 export function ModelRoleRouting({
   roles,
   models,
@@ -88,8 +144,6 @@ export function ModelRoleRouting({
           const effective = models.find(
             (model) => model.profile === effectiveProfile,
           );
-          const unavailable =
-            assigned && !models.some((model) => model.profile === assigned);
           return (
             <div
               className={`model-role-row${primary ? " model-role-primary" : ""}`}
@@ -106,34 +160,16 @@ export function ModelRoleRouting({
                 <code>{role.id}</code>
               </div>
               <div className="model-role-selection">
-                <DropdownSelect
+                <ModelRoleSelect
                   id={`${id}-${role.id}`}
-                  aria-label={`${role.label} model`}
-                  aria-describedby={`${id}-${role.id}-description ${id}-${role.id}-effective`}
-                  required={primary}
-                  disabled={disabled || !models.length}
-                  value={assigned}
-                  onChange={(event) => {
-                    const next = { ...roles };
-                    if (event.target.value) next[role.id] = event.target.value;
-                    else delete next[role.id];
-                    onChange(next);
-                  }}
-                >
-                  <option value="" disabled={primary}>
-                    {primary ? "Choose a model" : "Use primary"}
-                  </option>
-                  {unavailable ? (
-                    <option value={assigned} disabled>
-                      Unavailable model: {assigned}
-                    </option>
-                  ) : null}
-                  {models.map((model) => (
-                    <option key={model.profile} value={model.profile}>
-                      {model.label} · {model.model}
-                    </option>
-                  ))}
-                </DropdownSelect>
+                  roleId={role.id}
+                  roles={roles}
+                  models={models}
+                  label={`${role.label} model`}
+                  describedBy={`${id}-${role.id}-description ${id}-${role.id}-effective`}
+                  disabled={disabled}
+                  onChange={onChange}
+                />
                 <small id={`${id}-${role.id}-effective`}>
                   {effective
                     ? `Uses ${effective.model} · ${effective.providerProfile}`
diff --git a/apps/desktop/src/components/ModelRoutingGraph.tsx b/apps/desktop/src/components/ModelRoutingGraph.tsx
new file mode 100644
index 000000000..6d4bf323b
--- /dev/null
+++ b/apps/desktop/src/components/ModelRoutingGraph.tsx
@@ -0,0 +1,338 @@
+import {
+  Background,
+  BackgroundVariant,
+  Handle,
+  MarkerType,
+  Position,
+  ReactFlow,
+  type Edge,
+  type Node,
+  type NodeProps,
+  type ReactFlowInstance,
+} from "@xyflow/react";
+import {
+  IconCloud,
+  IconCpu,
+  IconFocus2,
+  IconUserCircle,
+  IconZoomIn,
+  IconZoomOut,
+} from "@tabler/icons-react";
+import { memo, useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { GraphWorkspace } from "@colossus/ui";
+import { DropdownSelect } from "./DropdownSelect";
+import {
+  MODEL_ROLES,
+  ModelRoleSelect,
+  type RoleModel,
+} from "./ModelRoleRouting";
+import { modelRouteGroups } from "./model-routing-map";
+import "@xyflow/react/dist/style.css";
+import "./workflow-logic.css";
+
+type RouteNode = Node<
+  {
+    kind: "role" | "model" | "provider";
+    label: string;
+    detail: string;
+    selected: boolean;
+    onSelect?: () => void;
+  },
+  "route"
+>;
+
+const RoutingNode = memo(function RoutingNode({ data }: NodeProps<RouteNode>) {
+  const Icon =
+    data.kind === "role"
+      ? IconUserCircle
+      : data.kind === "model"
+        ? IconCpu
+        : IconCloud;
+  const content = (
+    <>
+      <span className="workflow-flow-kind">
+        <Icon size={15} aria-hidden="true" />
+        {data.kind}
+      </span>
+      <strong>{data.label}</strong>
+      <small>{data.detail}</small>
+    </>
+  );
+  return (
+    <>
+      {data.kind !== "role" ? (
+        <Handle type="target" position={Position.Left} isConnectable={false} />
+      ) : null}
+      {data.kind !== "provider" ? (
+        <Handle type="source" position={Position.Right} isConnectable={false} />
+      ) : null}
+      {data.kind === "role" ? (
+        <button
+          type="button"
+          className="workflow-flow-step routing-flow-node"
+          aria-label={`${data.kind}: ${data.label}. ${data.detail}`}
+          aria-pressed={data.selected}
+          onClick={data.onSelect}
+          onFocus={(event) => {
+            if (event.currentTarget.matches(":focus-visible"))
+              data.onSelect?.();
+          }}
+        >
+          {content}
+        </button>
+      ) : (
+        <div
+          className="workflow-flow-step routing-flow-node"
+          data-highlighted={data.selected}
+        >
+          {content}
+        </div>
+      )}
+    </>
+  );
+});
+const NODE_TYPES = { route: RoutingNode };
+const FIT = { padding: 0.13, minZoom: 0.25, maxZoom: 1 };
+
+export function ModelRoutingGraph({
+  roles,
+  models,
+  onChange,
+  disabled = false,
+}: {
+  roles: Record<string, string>;
+  models: RoleModel[];
+  onChange?: ((roles: Record<string, string>) => void) | undefined;
+  disabled?: boolean;
+}) {
+  const [selectedRole, setSelectedRole] = useState("primary");
+  const flow = useRef<ReactFlowInstance<RouteNode, Edge> | null>(null);
+  const canvas = useRef<HTMLDivElement>(null);
+  const profile =
+    roles[selectedRole] ||
+    (selectedRole === "primary" ? "" : roles.primary) ||
+    "";
+  const model = models.find((candidate) => candidate.profile === profile);
+  const role = MODEL_ROLES.find((candidate) => candidate.id === selectedRole)!;
+  const inherited = selectedRole !== "primary" && !roles[selectedRole];
+  const selectRole = useCallback((id: string) => {
+    setSelectedRole(id);
+  }, []);
+  const { nodes, edges } = useMemo(() => {
+    const groups = modelRouteGroups(roles, models);
+    const providers = [
+      ...new Set(groups.map((group) => group.model?.providerProfile || "")),
+    ];
+    const height = (MODEL_ROLES.length - 1) * 86;
+    const nodes: RouteNode[] = MODEL_ROLES.map((item, index) => ({
+      id: `role:${item.id}`,
+      type: "route",
+      position: { x: 0, y: index * 86 },
+      width: 210,
+      height: 72,
+      data: {
+        kind: "role",
+        label: item.label,
+        detail:
+          !roles[item.id] && item.id === "primary"
+            ? "Assignment required"
+            : item.id !== "primary" && !roles[item.id]
+              ? "Inherits Primary"
+              : "Explicit assignment",
+        selected: selectedRole === item.id,
+        onSelect: () => selectRole(item.id),
+      },
+    }));
+    groups.forEach((group, index) =>
+      nodes.push({
+        id: `model:${group.profile}`,
+        type: "route",
+        position: {
+          x: 320,
+          y:
+            groups.length === 1
+              ? height / 2
+              : (index * height) / (groups.length - 1),
+        },
+        width: 210,
+        height: 72,
+        data: {
+          kind: "model",
+          label:
+            group.model?.label ||
+            (group.profile ? "Unavailable model" : "No model assigned"),
+          detail:
+            group.model?.model || group.profile || "Choose a primary model",
+          selected: group.profile === profile,
+        },
+      }),
+    );
+    providers.forEach((provider, index) =>
+      nodes.push({
+        id: `provider:${provider}`,
+        type: "route",
+        position: {
+          x: 640,
+          y:
+            providers.length === 1
+              ? height / 2
+              : (index * height) / (providers.length - 1),
+        },
+        width: 210,
+        height: 72,
+        data: {
+          kind: "provider",
+          label: provider || "Unresolved",
+          detail: provider ? "Configured connection" : "No available provider",
+          selected: provider === (model?.providerProfile || ""),
+        },
+      }),
+    );
+    const edges: Edge[] = [];
+    for (const group of groups) {
+      for (const item of group.roles) {
+        const active = item.id === selectedRole;
+        const color = active ? "var(--blue)" : "var(--border-strong)";
+        edges.push({
+          id: `role-edge:${item.id}`,
+          source: `role:${item.id}`,
+          target: `model:${group.profile}`,
+          type: "smoothstep",
+          markerEnd: { type: MarkerType.ArrowClosed, color },
+          style: {
+            stroke: color,
+            strokeWidth: active ? 2.5 : 1.5,
+            strokeDasharray: item.inherited ? "5 4" : undefined,
+          },
+        });
+      }
+      const active = group.profile === profile;
+      const color = active ? "var(--blue)" : "var(--border-strong)";
+      edges.push({
+        id: `provider-edge:${group.profile}`,
+        source: `model:${group.profile}`,
+        target: `provider:${group.model?.providerProfile || ""}`,
+        type: "smoothstep",
+        markerEnd: { type: MarkerType.ArrowClosed, color },
+        style: { stroke: color, strokeWidth: active ? 2.5 : 1.5 },
+      });
+    }
+    return { nodes, edges };
+  }, [
+    roles,
+    models,
+    selectedRole,
+    profile,
+    model?.providerProfile,
+    selectRole,
+  ]);
+  const fit = useCallback(() => {
+    void flow.current?.fitView(FIT);
+  }, []);
+  useEffect(() => {
+    if (!canvas.current) return;
+    const observer = new ResizeObserver(fit);
+    observer.observe(canvas.current);
+    return () => observer.disconnect();
+  }, [fit]);
+  useEffect(() => {
+    const frame = requestAnimationFrame(fit);
+    return () => cancelAnimationFrame(frame);
+  }, [roles, models, fit]);
+  return (
+    <GraphWorkspace
+      canvasRef={canvas}
+      label="Routing graph view"
+      fitLabel="Fit routes"
+      onZoomIn={() => void flow.current?.zoomIn()}
+      onZoomOut={() => void flow.current?.zoomOut()}
+      onFit={fit}
+      zoomInIcon={<IconZoomIn size={18} />}
+      zoomOutIcon={<IconZoomOut size={18} />}
+      fitIcon={<IconFocus2 size={18} />}
+      hint="Dashed: inherits Primary · Drag to pan"
+      inspectorLabel="Route details"
+      inspector={
+        <>
+          <span className="workflow-logic-eyebrow">ROUTE DETAILS</span>
+          <label>
+            Choose a role
+            <DropdownSelect
+              aria-label="Inspect role"
+              value={selectedRole}
+              onChange={(event) => selectRole(event.target.value)}
+            >
+              {MODEL_ROLES.map((item) => (
+                <option key={item.id} value={item.id}>
+                  {item.label}
+                </option>
+              ))}
+            </DropdownSelect>
+          </label>
+          <h4>{role.label}</h4>
+          <p className="workflow-logic-step-summary">
+            {!profile
+              ? "Choose a Primary model to resolve this route."
+              : inherited
+                ? "Inherits the Primary assignment."
+                : "Uses its own model assignment."}
+          </p>
+          {onChange ? (
+            <label>
+              Model assignment
+              <ModelRoleSelect
+                roleId={selectedRole}
+                roles={roles}
+                models={models}
+                onChange={onChange}
+                disabled={disabled}
+                label={`${role.label} assignment`}
+              />
+            </label>
+          ) : null}
+          <dl className="routing-graph-route-details">
+            <dt>Model</dt>
+            <dd>
+              {model?.label || (profile ? "Unavailable model" : "Not assigned")}
+            </dd>
+            <dt>Provider</dt>
+            <dd>{model?.providerProfile || "Unresolved"}</dd>
+          </dl>
+          <p className="workflow-logic-step-summary">{role.description}</p>
+        </>
+      }
+    >
+      <ReactFlow<RouteNode, Edge>
+        nodes={nodes}
+        edges={edges}
+        nodeTypes={NODE_TYPES}
+        onInit={(instance) => {
+          flow.current = instance;
+          void instance.fitView(FIT);
+        }}
+        onNodeClick={() => undefined}
+        fitView
+        fitViewOptions={FIT}
+        minZoom={0.25}
+        maxZoom={1.8}
+        nodesDraggable={false}
+        nodesConnectable={false}
+        nodesFocusable={false}
+        edgesFocusable={false}
+        elementsSelectable={false}
+        panOnDrag
+        zoomOnScroll={false}
+        zoomOnDoubleClick={false}
+        preventScrolling={false}
+        aria-label="Model routing graph"
+      >
+        <Background
+          variant={BackgroundVariant.Dots}
+          gap={20}
+          size={1}
+          color="var(--border)"
+        />
+      </ReactFlow>
+    </GraphWorkspace>
+  );
+}
diff --git a/apps/desktop/src/components/ModelRoutingOverview.test.ts b/apps/desktop/src/components/ModelRoutingOverview.test.ts
new file mode 100644
index 000000000..8ed38f5aa
--- /dev/null
+++ b/apps/desktop/src/components/ModelRoutingOverview.test.ts
@@ -0,0 +1,72 @@
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+import { ModelRoutingOverview, modelRouteGroups } from "./ModelRoutingOverview";
+
+const models = [
+  {
+    profile: "general",
+    label: "General",
+    model: "general-model",
+    providerProfile: "company",
+  },
+  {
+    profile: "fast",
+    label: "Fast",
+    model: "fast-model",
+    providerProfile: "local",
+  },
+];
+
+describe("model routing map", () => {
+  it("moves inherited routes with Primary and preserves explicit assignments", () => {
+    const before = modelRouteGroups(
+      { primary: "general", research_planner: "fast" },
+      models,
+    );
+    expect(
+      before.find((group) => group.profile === "general")?.roles,
+    ).toHaveLength(6);
+    expect(before.find((group) => group.profile === "fast")?.roles).toEqual([
+      { id: "research_planner", label: "Research planner", inherited: false },
+    ]);
+    const after = modelRouteGroups(
+      { primary: "fast", research_planner: "general" },
+      models,
+    );
+    expect(after.find((group) => group.profile === "fast")?.roles).toHaveLength(
+      6,
+    );
+    expect(
+      after.find((group) => group.profile === "general")?.roles[0]?.inherited,
+    ).toBe(false);
+  });
+
+  it("shows an unavailable explicit target instead of silently using Primary", () => {
+    const groups = modelRouteGroups(
+      { primary: "general", risk_evaluator: "removed" },
+      models,
+    );
+    const missing = groups.find((group) => group.profile === "removed");
+    expect(missing?.model).toBeUndefined();
+    expect(missing?.roles).toEqual([
+      { id: "risk_evaluator", label: "Risk evaluator", inherited: false },
+    ]);
+    const markup = renderToStaticMarkup(
+      createElement(ModelRoutingOverview, {
+        roles: { primary: "general", risk_evaluator: "removed" },
+        models,
+      }),
+    );
+    expect(markup).toContain("Routing map");
+  });
+
+  it("leaves inherited routes unresolved when Primary has no model", () => {
+    const groups = modelRouteGroups({ research_worker: "fast" }, models);
+    expect(groups.find((group) => group.profile === "")?.roles).toHaveLength(6);
+    expect(groups.find((group) => group.profile === "")?.model).toBeUndefined();
+    expect(groups.find((group) => group.profile === "fast")?.roles[0]?.id).toBe(
+      "research_worker",
+    );
+  });
+});
diff --git a/apps/desktop/src/components/ModelRoutingOverview.tsx b/apps/desktop/src/components/ModelRoutingOverview.tsx
new file mode 100644
index 000000000..cec154f73
--- /dev/null
+++ b/apps/desktop/src/components/ModelRoutingOverview.tsx
@@ -0,0 +1,44 @@
+import { lazy, Suspense, useState } from "react";
+import type { RoleModel } from "./ModelRoleRouting";
+import "./model-routing-overview.css";
+
+export { modelRouteGroups } from "./model-routing-map";
+
+const ModelRoutingGraph = lazy(() =>
+  import("./ModelRoutingGraph").then((module) => ({
+    default: module.ModelRoutingGraph,
+  })),
+);
+
+/** A configuration projection; selecting a route never invokes a provider. */
+export function ModelRoutingOverview({
+  roles,
+  models,
+  onChange,
+  disabled = false,
+}: {
+  roles: Record<string, string>;
+  models: RoleModel[];
+  onChange?: (roles: Record<string, string>) => void;
+  disabled?: boolean;
+}) {
+  const [expanded, setExpanded] = useState(false);
+  return (
+    <details
+      className="model-routing-overview"
+      onToggle={(event) => setExpanded(event.currentTarget.open)}
+    >
+      <summary>Routing map</summary>
+      {expanded ? (
+        <Suspense fallback={<p role="status">Loading routing map…</p>}>
+          <ModelRoutingGraph
+            roles={roles}
+            models={models}
+            onChange={onChange}
+            disabled={disabled}
+          />
+        </Suspense>
+      ) : null}
+    </details>
+  );
+}
diff --git a/apps/desktop/src/components/OperationsSurface.test.ts b/apps/desktop/src/components/OperationsSurface.test.ts
index 5cefad5a1..2eeed9756 100644
--- a/apps/desktop/src/components/OperationsSurface.test.ts
+++ b/apps/desktop/src/components/OperationsSurface.test.ts
@@ -84,7 +84,7 @@ function desktop(overrides: Partial<DesktopStatus> = {}): DesktopStatus {
 }
 
 function renderSurface(
-  surface: "fleet" | "settings",
+  surface: "fleet" | "settings" | "connections",
   status = desktop(),
 ): string {
   return renderToStaticMarkup(
@@ -101,6 +101,8 @@ function renderSurface(
       workNavigationOpen: false,
       onOpenWorkNavigation: vi.fn(),
       onConnect: vi.fn(),
+      onManageControlPlaneWorkspace: vi.fn(),
+      onManageControlPlaneProfiles: vi.fn(),
       onOpenRun: vi.fn(),
       onSelectTarget: vi.fn(),
       onAddExternalTarget: vi.fn(),
@@ -130,6 +132,14 @@ function openingButtonTag(markup: string, label: string): string {
 }
 
 describe("OperationsSurface runtime targets", () => {
+  it("retains local and external routing while loading a separate Control Plane inventory", () => {
+    const markup = renderSurface("connections");
+    expect(markup).toContain("Folder-backed runtimes");
+    expect(markup).toContain("External daemons");
+    expect(markup).toContain("Lab fleet");
+    expect(markup).toContain('aria-label="Control Plane connections"');
+    expect(markup).toContain("Reading Control Plane enrollment status");
+  });
   it("keeps Workspace navigation reachable from every responsive operations view", () => {
     const markup = renderSurface("fleet");
 
diff --git a/apps/desktop/src/components/OperationsSurface.tsx b/apps/desktop/src/components/OperationsSurface.tsx
index 14dce6623..58e117220 100644
--- a/apps/desktop/src/components/OperationsSurface.tsx
+++ b/apps/desktop/src/components/OperationsSurface.tsx
@@ -28,6 +28,7 @@ import type {
 import type { AgentParticipant } from "./AgentFlow";
 import { AgentFlow } from "./AgentFlow";
 import { ManagedSettingsPane } from "./ManagedSettingsPane";
+import { ControlPlaneConnections } from "./ControlPlaneConnections";
 import { PluginsSurface } from "./PluginsSurface";
 import { WorkflowsSurface } from "./WorkflowsSurface";
 import { SchedulesSurface } from "./SchedulesSurface";
@@ -37,7 +38,18 @@ interface OperationsSurfaceProps {
   scheduleInspection?:
     { scheduleId: string; showRun: boolean } | null | undefined;
   initialSettingsTab?:
-    "runtime" | "providers" | "plugins" | "terminal" | "dictation" | undefined;
+    | "runtime"
+    | "providers"
+    | "models"
+    | "plugins"
+    | "terminal"
+    | "dictation"
+    | "cloud"
+    | "control-plane"
+    | undefined;
+  initialSettingsSpaceId?: string | undefined;
+  onManageControlPlaneWorkspace: (spaceId: string) => void;
+  onManageControlPlaneProfiles: () => void;
   onConfigurePluginConnection?: () => void;
   pluginSelections?: readonly string[];
   onUsePluginSkill?: (id: string) => void;
@@ -372,6 +384,8 @@ function ConnectionsView({
   onSelectTarget,
   onAddExternalTarget,
   onRemoveExternalTarget,
+  onManageControlPlaneWorkspace,
+  onManageControlPlaneProfiles,
 }: Pick<
   OperationsSurfaceProps,
   | "desktop"
@@ -379,6 +393,8 @@ function ConnectionsView({
   | "onSelectTarget"
   | "onAddExternalTarget"
   | "onRemoveExternalTarget"
+  | "onManageControlPlaneWorkspace"
+  | "onManageControlPlaneProfiles"
 >) {
   const externalTargets = desktop.targets.filter(
     (target) => target.kind === "external_daemon",
@@ -428,6 +444,12 @@ function ConnectionsView({
               ))}
           </div>
         </section>
+        <ControlPlaneConnections
+          spaces={desktop.spaces}
+          disabled={connecting}
+          onManageWorkspace={onManageControlPlaneWorkspace}
+          onManageProfiles={onManageControlPlaneProfiles}
+        />
         <section className="overview-section">
           <div className="section-heading">
             <div>
@@ -525,6 +547,7 @@ function effectiveManagedConfiguration(desktop: DesktopStatus): string {
 
 function SettingsView({
   initialSettingsTab,
+  initialSettingsSpaceId,
   onReturnToWork,
   connection,
   desktop,
@@ -550,6 +573,7 @@ function SettingsView({
 }: Pick<
   OperationsSurfaceProps,
   | "initialSettingsTab"
+  | "initialSettingsSpaceId"
   | "onReturnToWork"
   | "connection"
   | "desktop"
@@ -600,6 +624,7 @@ function SettingsView({
       <div className="overview-scroll settings-scroll" tabIndex={0}>
         <ManagedSettingsPane
           initialSpaceTab={initialSettingsTab}
+          initialSpaceId={initialSettingsSpaceId}
           onReturnToWork={onReturnToWork}
           desktop={desktop}
           connecting={connecting}
@@ -1067,6 +1092,7 @@ export function OperationsSurface(props: OperationsSurfaceProps) {
       {props.surface === "settings" ? (
         <SettingsView
           initialSettingsTab={props.initialSettingsTab}
+          initialSettingsSpaceId={props.initialSettingsSpaceId}
           onReturnToWork={props.onReturnToWork}
           connection={props.connection}
           desktop={props.desktop}
diff --git a/apps/desktop/src/components/RunTimeline.test.ts b/apps/desktop/src/components/RunTimeline.test.ts
index 309c9d945..d7ad12577 100644
--- a/apps/desktop/src/components/RunTimeline.test.ts
+++ b/apps/desktop/src/components/RunTimeline.test.ts
@@ -178,8 +178,8 @@ describe("RunTimeline assistant output", () => {
       "complete",
     );
 
-    expect(markup).toContain('class="markdown-content"');
-    expect(markup).toContain('<h3 class="feed-entry-title">Colossus</h3>');
+    expect(markup).toContain('class="shared-markdown markdown-content"');
+    expect(markup).toContain("<strong>Colossus</strong>");
     expect(markup).toContain("<h4>Ready</h4>");
     expect(markup).toContain("<strong>security</strong>");
   });
diff --git a/apps/desktop/src/components/RunTimeline.tsx b/apps/desktop/src/components/RunTimeline.tsx
index d29948cd2..9f3b49689 100644
--- a/apps/desktop/src/components/RunTimeline.tsx
+++ b/apps/desktop/src/components/RunTimeline.tsx
@@ -1,3 +1,7 @@
+import {
+  ConversationActivity,
+  ConversationEntry,
+} from "@colossus/ui/conversation";
 import {
   IconAlertTriangle,
   IconArrowRight,
@@ -13,7 +17,6 @@ import {
   IconInfoCircle,
   IconListDetails,
   IconLoader2,
-  IconMessageCircle,
   IconPencil,
   IconPlayerPlay,
   IconPlayerStop,
@@ -28,7 +31,6 @@ import type { ReactNode } from "react";
 
 import { RetryStatus, currentProviderRetry } from "./RetryStatus";
 
-import colossusMark from "@colossus/ui/assets/colossus-mark.svg";
 import {
   presentNotice,
   presentToolActivity,
@@ -281,29 +283,19 @@ function Message({ message }: { message: SessionMessage }) {
   if (message.role === "assistant") {
     return null;
   }
-  const label = message.role === "user" ? "You" : readable(message.role);
   return (
-    <article className={`feed-entry message message-${message.role}`}>
-      <div className="feed-marker" aria-hidden="true">
-        <IconMessageCircle size={17} stroke={1.7} />
-      </div>
-      <div className="feed-entry-content">
-        <header className="feed-entry-heading">
-          <strong>{label}</strong>
-          <time dateTime={message.createdAt}>
-            {compactTime(message.createdAt)}
-          </time>
-        </header>
-        <div className="message-body" data-aside-selectable="true">
-          {message.content.map((part, index) => (
-            <ContentPart key={`${message.sequence}-${index}`} part={part} />
-          ))}
-        </div>
-        <div className="message-actions">
-          <MessageCopyButton text={messageCopyText(message)} label="message" />
-        </div>
-      </div>
-    </article>
+    <ConversationEntry
+      role={message.role}
+      author={message.role === "user" ? "You" : readable(message.role)}
+      createdAt={message.createdAt}
+      actions={
+        <MessageCopyButton text={messageCopyText(message)} label="message" />
+      }
+    >
+      {message.content.map((part, index) => (
+        <ContentPart key={`${message.sequence}-${index}`} part={part} />
+      ))}
+    </ConversationEntry>
   );
 }
 
@@ -710,50 +702,26 @@ function RunActivity({
   ].filter((part): part is string => part !== null);
 
   return (
-    <details
-      className={`run-activity run-activity-thread run-state-${view.run.status}`}
+    <ConversationActivity
+      className={`run-state-${view.run.status}`}
+      description={summaryParts.join(" · ")}
+      statusLabel={status.label}
+      tone={status.tone}
+      exceptionCount={failedActionCount}
       open={comparison || active || failedActionCount > 0}
     >
-      <summary className="run-activity-summary">
-        <span className="run-activity-chevron" aria-hidden="true">
-          <IconChevronDown size={16} stroke={1.9} />
-        </span>
-        <span className="run-activity-mark" aria-hidden="true">
-          <img src={colossusMark} alt="" />
-        </span>
-        <span className="run-activity-title">
-          <strong>Colossus</strong>
-          <small>{summaryParts.join(" · ")}</small>
-        </span>
-        <span className={`run-activity-status tone-${status.tone}`}>
-          {status.tone === "success" ? (
-            <IconCheck size={15} stroke={2} aria-hidden="true" />
-          ) : status.tone === "danger" ? (
-            <IconAlertTriangle size={15} stroke={1.9} aria-hidden="true" />
-          ) : null}
-          {status.label}
-        </span>
-        {failedActionCount > 0 ? (
-          <span className="run-activity-exceptions">
-            <IconAlertTriangle size={14} stroke={1.8} aria-hidden="true" />
-            {failedActionCount}
-          </span>
-        ) : null}
-      </summary>
-      <div className="run-activity-body">
-        {items.map((item) => (
-          <ActivityItem
-            onInspectSchedule={onInspectSchedule}
-            item={item}
-            key={
-              item.type === "tool_activity"
-                ? `tool-${item.group.key}`
-                : item.update.sequence
-            }
-          />
-        ))}
-      </div>
-    </details>
+      {items.map((item) => (
+        <ActivityItem
+          onInspectSchedule={onInspectSchedule}
+          item={item}
+          key={
+            item.type === "tool_activity"
+              ? `tool-${item.group.key}`
+              : item.update.sequence
+          }
+        />
+      ))}
+    </ConversationActivity>
   );
 }
 
@@ -1217,25 +1185,14 @@ export function RunTimeline({
             : `Run ${readable(view.run.status)}.`}
       </p>
       {view.localPrompt !== null && !hasDurableUserMessage ? (
-        <article className="feed-entry message message-user">
-          <div className="feed-marker" aria-hidden="true">
-            <IconMessageCircle size={17} stroke={1.7} />
-          </div>
-          <div className="feed-entry-content">
-            <header className="feed-entry-heading">
-              <strong>You</strong>
-            </header>
-            <div
-              className="message-body preserve-lines"
-              data-aside-selectable="true"
-            >
-              {view.localPrompt}
-            </div>
-            <div className="message-actions">
-              <MessageCopyButton text={view.localPrompt} label="message" />
-            </div>
-          </div>
-        </article>
+        <ConversationEntry
+          role="user"
+          content={view.localPrompt}
+          markdown={false}
+          actions={
+            <MessageCopyButton text={view.localPrompt} label="message" />
+          }
+        />
       ) : null}
       {userTimelineItems.map((item) =>
         item.type === "update" ? (
@@ -1252,41 +1209,31 @@ export function RunTimeline({
       ) : null}
       {showLiveStatus ? <LiveRunStatus view={view} /> : null}
       {view.output !== "" ? (
-        <article className="feed-entry message message-assistant">
-          <div className="feed-marker assistant-marker" aria-hidden="true">
-            <img src={colossusMark} alt="" />
-          </div>
-          <div className="feed-entry-content">
-            <header className="feed-entry-heading">
-              <h3 className="feed-entry-title">Colossus</h3>
-              <span>
-                {isGenerating
-                  ? "Working"
-                  : partialResponse
-                    ? "Partial response"
-                    : "Response"}
-              </span>
-            </header>
-            <div
-              className={`message-body${isGenerating ? " preserve-lines" : ""}`}
-              data-aside-selectable="true"
-            >
-              {isGenerating ? (
-                view.output
-              ) : view.run.mode === "research" ? (
-                <ResearchResponse
-                  output={view.output}
-                  onOpenSources={onOpenResearchSources}
-                />
-              ) : (
-                <MarkdownContent content={view.output} />
-              )}
-              {isGenerating ? (
-                <span className="stream-caret" aria-hidden="true" />
-              ) : null}
+        <ConversationEntry
+          role="assistant"
+          streaming={isGenerating}
+          status={
+            isGenerating
+              ? "Working"
+              : partialResponse
+                ? "Partial response"
+                : "Response"
+          }
+        >
+          {isGenerating ? (
+            <div className="preserve-lines">
+              {view.output}
+              <span className="stream-caret" aria-hidden="true" />
             </div>
-          </div>
-        </article>
+          ) : view.run.mode === "research" ? (
+            <ResearchResponse
+              output={view.output}
+              onOpenSources={onOpenResearchSources}
+            />
+          ) : (
+            <MarkdownContent content={view.output} />
+          )}
+        </ConversationEntry>
       ) : null}
       {!hasTerminalFeedItem && view.run.terminal !== null ? (
         <TerminalSummary terminal={view.run.terminal} />
diff --git a/apps/desktop/src/components/SessionWorkspace.test.ts b/apps/desktop/src/components/SessionWorkspace.test.ts
index cd76fedb5..197ce82ee 100644
--- a/apps/desktop/src/components/SessionWorkspace.test.ts
+++ b/apps/desktop/src/components/SessionWorkspace.test.ts
@@ -15,6 +15,12 @@ import {
   SessionWorkspaceTabs,
 } from "./SessionWorkspace";
 
+function classTokens(markup: string): string[][] {
+  return [...markup.matchAll(/class="([^"]*)"/g)].map((match) =>
+    match[1]!.split(/\s+/),
+  );
+}
+
 function runView(runId: string, title: string, minute: number): RunView {
   const run: Run = {
     runId,
@@ -156,7 +162,9 @@ describe("SessionWorkspace", () => {
     expect(markup).toContain(
       '<button class="session-plan-title" type="button">make me a simple plan</button>',
     );
-    expect(markup).toContain('class="markdown-content session-plan-preview"');
+    expect(classTokens(markup)).toContainEqual(
+      expect.arrayContaining(["markdown-content", "session-plan-preview"]),
+    );
     expect(markup).toContain("<h4>Simple repository orientation plan</h4>");
     expect(markup).toContain("<strong>Review project foundations</strong>");
     expect(markup).not.toContain("### Simple repository orientation plan");
@@ -178,8 +186,8 @@ describe("SessionWorkspace", () => {
     expect(markup).toContain(
       `Messages ${snapshot.sourceStartSequence}–${snapshot.sourceEndSequence}`,
     );
-    expect(markup).toContain(
-      'class="markdown-content session-snapshot-preview"',
+    expect(classTokens(markup)).toContainEqual(
+      expect.arrayContaining(["markdown-content", "session-snapshot-preview"]),
     );
     expect(markup).toContain("<h4>Session context</h4>");
     expect(markup).toContain(
@@ -199,8 +207,8 @@ describe("SessionWorkspace", () => {
     expect(detail).toContain(
       `<h3 id="session-map-detail-title">Messages ${snapshot.sourceStartSequence}–${snapshot.sourceEndSequence}</h3>`,
     );
-    expect(detail).toContain(
-      'class="markdown-content session-snapshot-summary"',
+    expect(classTokens(detail)).toContainEqual(
+      expect.arrayContaining(["markdown-content", "session-snapshot-summary"]),
     );
     expect(detail).toContain("<h4>Session context</h4>");
     expect(detail).not.toContain("## Session context");
diff --git a/apps/desktop/src/components/ThreadActionsMenu.tsx b/apps/desktop/src/components/ThreadActionsMenu.tsx
new file mode 100644
index 000000000..441c19e77
--- /dev/null
+++ b/apps/desktop/src/components/ThreadActionsMenu.tsx
@@ -0,0 +1,128 @@
+import { useRef } from "react";
+import {
+  IconArchive,
+  IconDots,
+  IconGitFork,
+  IconLoader2,
+  IconPencil,
+  IconPin,
+} from "@tabler/icons-react";
+import {
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@colossus/ui/components/ui/dropdown-menu";
+import type { Run } from "../types";
+import { isTerminalStatus } from "../types";
+import { canForkThread, isThreadForkDraft } from "../thread-fork";
+import "./thread-fork.css";
+
+export function ThreadActionsMenu({
+  run,
+  title,
+  pinned,
+  disabled,
+  localDisabled,
+  archiving,
+  onRename,
+  onPin,
+  onArchive,
+  onFork,
+}: {
+  run: Run;
+  title: string;
+  pinned: boolean;
+  disabled: boolean;
+  localDisabled: boolean;
+  archiving: boolean;
+  onRename: () => void;
+  onPin: () => void;
+  onArchive: () => void;
+  onFork?: (() => void) | undefined;
+}) {
+  const forkSelected = useRef(false);
+  return (
+    <DropdownMenu modal={false}>
+      <DropdownMenuTrigger asChild>
+        <button
+          type="button"
+          className="work-item-action thread-actions-trigger"
+          aria-label={`Thread actions for ${title}`}
+          title="Thread actions"
+        >
+          <IconDots size={17} stroke={1.9} aria-hidden="true" />
+        </button>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent
+        align="end"
+        aria-label={`Actions for ${title}`}
+        onCloseAutoFocus={(event) => {
+          if (forkSelected.current) {
+            event.preventDefault();
+            forkSelected.current = false;
+          }
+        }}
+      >
+        <DropdownMenuItem
+          disabled={localDisabled}
+          onSelect={onRename}
+          aria-label={`Rename ${title}`}
+        >
+          <span className="thread-action-label">
+            <IconPencil size={15} aria-hidden="true" /> Rename
+          </span>
+        </DropdownMenuItem>
+        <DropdownMenuItem
+          disabled={disabled || onFork === undefined || !canForkThread(run)}
+          onSelect={() => {
+            forkSelected.current = true;
+            onFork?.();
+          }}
+          aria-label={`Fork ${title}`}
+          title={
+            isThreadForkDraft(run)
+              ? "Send a message in this fork before forking it again"
+              : !canForkThread(run)
+                ? "Finish or cancel this thread before forking"
+                : undefined
+          }
+        >
+          <span className="thread-action-label">
+            <IconGitFork size={15} aria-hidden="true" /> Fork thread
+          </span>
+        </DropdownMenuItem>
+        <DropdownMenuCheckboxItem
+          checked={pinned}
+          disabled={localDisabled}
+          onSelect={onPin}
+          aria-label={`${pinned ? "Unpin" : "Pin"} ${title}`}
+        >
+          <span className="thread-action-label">
+            <IconPin size={15} aria-hidden="true" />
+            {pinned ? "Unpin" : "Pin"}
+          </span>
+        </DropdownMenuCheckboxItem>
+        <DropdownMenuItem
+          disabled={disabled || archiving || !isTerminalStatus(run.status)}
+          onSelect={onArchive}
+          aria-label={`${isThreadForkDraft(run) ? "Discard draft" : "Archive"} ${title}`}
+        >
+          <span className="thread-action-label">
+            {archiving ? (
+              <IconLoader2 size={15} className="spin-icon" aria-hidden="true" />
+            ) : (
+              <IconArchive size={15} aria-hidden="true" />
+            )}
+            {archiving
+              ? "Archiving…"
+              : isThreadForkDraft(run)
+                ? "Discard draft"
+                : "Archive"}
+          </span>
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+}
diff --git a/apps/desktop/src/components/WorkComposer.tsx b/apps/desktop/src/components/WorkComposer.tsx
index 43a563972..39263f30c 100644
--- a/apps/desktop/src/components/WorkComposer.tsx
+++ b/apps/desktop/src/components/WorkComposer.tsx
@@ -15,6 +15,7 @@ import {
   IconWorld,
   IconX,
 } from "@tabler/icons-react";
+import { ConversationComposerFrame } from "@colossus/ui/conversation";
 import { lazy, Suspense, useEffect, useRef, useState } from "react";
 import type { FormEvent, KeyboardEvent, ReactNode, RefObject } from "react";
 
@@ -338,7 +339,7 @@ export function WorkComposer({
   }
 
   return (
-    <form
+    <ConversationComposerFrame
       ref={formRef}
       className={`work-composer${mode === "plan" ? " is-plan-mode" : ""}${mode === "research" ? " is-research-mode" : ""}`}
       id="work-composer"
@@ -1049,6 +1050,6 @@ export function WorkComposer({
           ) : null}
         </div>
       ) : null}
-    </form>
+    </ConversationComposerFrame>
   );
 }
diff --git a/apps/desktop/src/components/WorkSidebar.test.ts b/apps/desktop/src/components/WorkSidebar.test.ts
index 769403d37..28bb50043 100644
--- a/apps/desktop/src/components/WorkSidebar.test.ts
+++ b/apps/desktop/src/components/WorkSidebar.test.ts
@@ -388,13 +388,11 @@ describe("WorkSidebar", () => {
     expect(markup.indexOf(">Pinned<")).toBeLessThan(
       markup.indexOf("Needs attention"),
     );
-    expect(markup).toContain('aria-label="Unpin Improve the Work sidebar"');
-    expect(markup).toContain('aria-pressed="true"');
-    expect(markup).toContain('aria-label="Pin Needs attention"');
+    expect(markup).toContain('aria-label="Thread actions for Needs attention"');
     expect(markup).toContain(
       'aria-label="Thread actions for Improve the Work sidebar"',
     );
-    expect(markup).toContain('aria-label="Rename Improve the Work sidebar"');
+    expect(markup).toContain('aria-haspopup="menu"');
   });
 
   it("uses a saved thread name throughout the sidebar", () => {
@@ -435,38 +433,16 @@ describe("WorkSidebar", () => {
     });
 
     expect(markup).toContain("Desktop naming polish");
-    expect(markup).toContain('aria-label="Rename Desktop naming polish"');
+    expect(markup).toContain(
+      'aria-label="Thread actions for Desktop naming polish"',
+    );
   });
 
-  it("keeps local pin controls available while the app connects", () => {
+  it("keeps thread actions represented while the runtime connects", () => {
     const markup = renderSidebar({ disabled: true });
-
-    expect(
-      openingButtonTag(markup, "Pin Improve the Work sidebar"),
-    ).not.toContain("disabled");
-    expect(
-      openingButtonTag(markup, "Archive Improve the Work sidebar"),
-    ).toContain("disabled");
-  });
-
-  it("offers archiving only after a thread reaches a terminal state", () => {
-    const running = renderSidebar();
-    expect(
-      openingButtonTag(running, "Archive Improve the Work sidebar"),
-    ).toContain("disabled");
-
-    const completed = renderSidebar({
-      runs: [
-        {
-          ...RUN,
-          status: "completed",
-          finishedAt: RUN.updatedAt,
-        },
-      ],
-    });
     expect(
-      openingButtonTag(completed, "Archive Improve the Work sidebar"),
-    ).not.toContain("disabled");
+      openingButtonTag(markup, "Thread actions for Improve the Work sidebar"),
+    ).toBeDefined();
   });
 
   it("shows archived threads in global search with an explicit restore action", () => {
diff --git a/apps/desktop/src/components/WorkSidebar.tsx b/apps/desktop/src/components/WorkSidebar.tsx
index 86cb2a965..25da763a1 100644
--- a/apps/desktop/src/components/WorkSidebar.tsx
+++ b/apps/desktop/src/components/WorkSidebar.tsx
@@ -7,6 +7,7 @@ import {
   IconCheck,
   IconChevronDown,
   IconFolder,
+  IconGitFork,
   IconLibrary,
   IconLoader2,
   IconDots,
@@ -17,14 +18,20 @@ import {
   IconPlus,
   IconPointFilled,
   IconRestore,
-  IconSearch,
   IconSettings,
   IconTerminal2,
   IconTopologyStar3,
-  IconWorld,
   IconX,
 } from "@tabler/icons-react";
-import { useEffect, useMemo, useRef, useState } from "react";
+import { lazy, Suspense, useEffect, useMemo, useRef, useState } from "react";
+import {
+  WorkspaceSidebarGroupHeading,
+  WorkspaceSidebarHeading,
+  WorkspaceSidebarScope,
+  WorkspaceSidebarSearch,
+  WorkspaceSidebarThreadContent,
+  WorkspaceSidebarWorkspace,
+} from "@colossus/ui";
 
 import {
   presentRunStatus,
@@ -49,7 +56,12 @@ import type {
   SpaceSearchResult,
   SpaceSummary,
 } from "../types";
-import { isTerminalStatus } from "../types";
+import { isThreadForkDraft } from "../thread-fork";
+const ThreadActionsMenu = lazy(() =>
+  import("./ThreadActionsMenu").then((module) => ({
+    default: module.ThreadActionsMenu,
+  })),
+);
 import { ObscurityLabsMark } from "./ObscurityLabsMark";
 import type { WorkspaceSurface } from "./ProductRail";
 
@@ -116,6 +128,7 @@ interface WorkSidebarProps {
   onArchiveSpace: (spaceId: string) => void;
   onRestoreSpace: (spaceId: string) => void;
   onArchiveThread: (run: Run) => void;
+  onForkThread?: ((run: Run) => void) | undefined;
   onRenameThread: (run: Run, name: string) => void;
   onToggleThreadPinned: (run: Run) => void;
   onRestoreThread: (result: SpaceSearchResult) => void;
@@ -223,6 +236,7 @@ export function WorkSidebar({
   onArchiveSpace,
   onRestoreSpace,
   onArchiveThread,
+  onForkThread,
   onRenameThread,
   onToggleThreadPinned,
   onRestoreThread,
@@ -564,124 +578,133 @@ export function WorkSidebar({
       </button>
 
       <section className="space-shelves" aria-labelledby="spaces-heading">
-        <div className="space-shelves-heading">
-          <span id="spaces-heading">Workspaces</span>
-          <details
-            className="space-library-menu"
-            onBlur={(event) => {
-              if (!event.currentTarget.contains(event.relatedTarget)) {
-                event.currentTarget.removeAttribute("open");
-              }
-            }}
-          >
-            <summary
-              aria-label="Manage Workspaces"
-              title="Manage Workspaces"
-              role="button"
+        <WorkspaceSidebarHeading
+          id="spaces-heading"
+          className="space-shelves-heading"
+          actions={
+            <details
+              className="space-library-menu"
+              onBlur={(event) => {
+                if (!event.currentTarget.contains(event.relatedTarget)) {
+                  event.currentTarget.removeAttribute("open");
+                }
+              }}
             >
-              <IconDots size={16} stroke={1.9} aria-hidden="true" />
-            </summary>
-            <div className="space-library-popover">
-              <button
-                type="button"
-                disabled={actionsDisabled}
-                onClick={(event) => {
-                  event.currentTarget
-                    .closest("details")
-                    ?.removeAttribute("open");
-                  onCreateSpace();
-                }}
+              <summary
+                aria-label="Manage Workspaces"
+                title="Manage Workspaces"
+                role="button"
               >
-                <IconPlus size={15} stroke={1.8} aria-hidden="true" />
-                Add Workspace from folder
-              </button>
-              {selectedSpace !== undefined ? (
-                <>
-                  <div className="space-library-separator" />
-                  <span className="space-library-label">Current Workspace</span>
-                  <button
-                    type="button"
-                    disabled={actionsDisabled}
-                    onClick={(event) => {
-                      event.currentTarget
-                        .closest("details")
-                        ?.removeAttribute("open");
-                      beginRename(selectedSpace);
-                    }}
-                  >
-                    <IconPencil size={15} stroke={1.8} aria-hidden="true" />
-                    Rename {selectedSpace.displayName}
-                  </button>
-                  <button
-                    type="button"
-                    disabled={actionsDisabled}
-                    onClick={(event) => {
-                      event.currentTarget
-                        .closest("details")
-                        ?.removeAttribute("open");
-                      onArchiveSpace(selectedSpace.spaceId);
-                    }}
-                  >
-                    <IconArchive size={15} stroke={1.8} aria-hidden="true" />
-                    Archive {selectedSpace.displayName}
-                  </button>
-                  {capabilities.tui ? (
-                    <button
-                      type="button"
-                      disabled={
-                        actionsDisabled ||
-                        !terminalAvailable ||
-                        (!terminalEnabled && !terminalConsentPending)
-                      }
-                      onClick={onOpenTerminal}
-                    >
-                      <IconTerminal2
-                        size={15}
-                        stroke={1.8}
-                        aria-hidden="true"
-                      />
-                      Open Colossus TUI
-                    </button>
-                  ) : null}
-                  {capabilities.shellTerminal ? (
+                <IconDots size={16} stroke={1.9} aria-hidden="true" />
+              </summary>
+              <div className="space-library-popover">
+                <button
+                  type="button"
+                  disabled={actionsDisabled}
+                  onClick={(event) => {
+                    event.currentTarget
+                      .closest("details")
+                      ?.removeAttribute("open");
+                    onCreateSpace();
+                  }}
+                >
+                  <IconPlus size={15} stroke={1.8} aria-hidden="true" />
+                  Add Workspace from folder
+                </button>
+                {selectedSpace !== undefined ? (
+                  <>
+                    <div className="space-library-separator" />
+                    <span className="space-library-label">
+                      Current Workspace
+                    </span>
                     <button
                       type="button"
-                      disabled={
-                        actionsDisabled ||
-                        (!terminalEnabled && !terminalConsentPending)
-                      }
-                      onClick={onOpenShell}
+                      disabled={actionsDisabled}
+                      onClick={(event) => {
+                        event.currentTarget
+                          .closest("details")
+                          ?.removeAttribute("open");
+                        beginRename(selectedSpace);
+                      }}
                     >
-                      <IconTerminal2
-                        size={15}
-                        stroke={1.8}
-                        aria-hidden="true"
-                      />
-                      Open Shell
+                      <IconPencil size={15} stroke={1.8} aria-hidden="true" />
+                      Rename {selectedSpace.displayName}
                     </button>
-                  ) : null}
-                </>
-              ) : null}
-              {archivedSpaces.length > 0 ? (
-                <>
-                  <div className="space-library-separator" />
-                  <span className="space-library-label">Archived</span>
-                  {archivedSpaces.map((space) => (
                     <button
                       type="button"
-                      key={space.spaceId}
                       disabled={actionsDisabled}
-                      onClick={() => onRestoreSpace(space.spaceId)}
+                      onClick={(event) => {
+                        event.currentTarget
+                          .closest("details")
+                          ?.removeAttribute("open");
+                        onArchiveSpace(selectedSpace.spaceId);
+                      }}
                     >
-                      <IconRestore size={15} stroke={1.8} aria-hidden="true" />
-                      Restore {space.displayName}
+                      <IconArchive size={15} stroke={1.8} aria-hidden="true" />
+                      Archive {selectedSpace.displayName}
                     </button>
-                  ))}
-                </>
-              ) : null}
-            </div>
-          </details>
-        </div>
+                    {capabilities.tui ? (
+                      <button
+                        type="button"
+                        disabled={
+                          actionsDisabled ||
+                          !terminalAvailable ||
+                          (!terminalEnabled && !terminalConsentPending)
+                        }
+                        onClick={onOpenTerminal}
+                      >
+                        <IconTerminal2
+                          size={15}
+                          stroke={1.8}
+                          aria-hidden="true"
+                        />
+                        Open Colossus TUI
+                      </button>
+                    ) : null}
+                    {capabilities.shellTerminal ? (
+                      <button
+                        type="button"
+                        disabled={
+                          actionsDisabled ||
+                          (!terminalEnabled && !terminalConsentPending)
+                        }
+                        onClick={onOpenShell}
+                      >
+                        <IconTerminal2
+                          size={15}
+                          stroke={1.8}
+                          aria-hidden="true"
+                        />
+                        Open Shell
+                      </button>
+                    ) : null}
+                  </>
+                ) : null}
+                {archivedSpaces.length > 0 ? (
+                  <>
+                    <div className="space-library-separator" />
+                    <span className="space-library-label">Archived</span>
+                    {archivedSpaces.map((space) => (
+                      <button
+                        type="button"
+                        key={space.spaceId}
+                        disabled={actionsDisabled}
+                        onClick={() => onRestoreSpace(space.spaceId)}
+                      >
+                        <IconRestore
+                          size={15}
+                          stroke={1.8}
+                          aria-hidden="true"
+                        />
+                        Restore {space.displayName}
+                      </button>
+                    ))}
+                  </>
+                ) : null}
+              </div>
+            </details>
+          }
+        />
 
         {spaceActionFeedback !== null ? (
           <p
@@ -704,37 +727,21 @@ export function WorkSidebar({
           </p>
         ) : null}
 
-        <div className="work-search">
-          <IconSearch size={17} stroke={1.7} aria-hidden="true" />
-          <input
-            ref={searchRef}
-            type="search"
-            aria-label="Search threads"
-            value={query}
-            placeholder="Search threads"
-            onChange={(event) => onQueryChange(event.target.value)}
-          />
-          <kbd aria-hidden="true">⌘K</kbd>
-        </div>
-        <div className="search-scope-switcher" aria-label="Thread search scope">
-          <button
-            type="button"
-            aria-pressed={searchScope === "all"}
-            onClick={() => chooseSearchScope("all")}
-          >
-            <IconWorld size={13} stroke={1.8} aria-hidden="true" />
-            All Workspaces
-          </button>
-          <button
-            type="button"
-            aria-pressed={searchScope === "space"}
-            disabled={selectedSpaceId === null}
-            onClick={() => chooseSearchScope("space")}
-          >
-            <IconFolder size={13} stroke={1.8} aria-hidden="true" />
-            This Workspace
-          </button>
-        </div>
+        <WorkspaceSidebarSearch
+          className="work-search"
+          inputRef={searchRef}
+          value={query}
+          onChange={onQueryChange}
+          shortcut="⌘K"
+        />
+        <WorkspaceSidebarScope
+          className="search-scope-switcher"
+          value={searchScope === "all" ? "all" : "workspace"}
+          workspaceDisabled={selectedSpaceId === null}
+          onChange={(scope) =>
+            chooseSearchScope(scope === "all" ? "all" : "space")
+          }
+        />
         {searchScope === "all" ? (
           <label className="include-archived-search">
             <input
@@ -765,61 +772,78 @@ export function WorkSidebar({
             className={`space-shelf is-active${spaceStartup !== null ? " is-starting" : ""}`}
             aria-busy={spaceStartup !== null}
           >
-            <div className="space-shelf-row">
-              <button
-                type="button"
-                className="space-shelf-identity"
-                aria-current="page"
-                title={displayedSpace.displayPath}
-                onClick={() => setThreadShelfOpen(true)}
-              >
-                <span className="space-shelf-folder" aria-hidden="true">
-                  {spaceStartup === null ? (
-                    <IconFolder size={17} stroke={1.7} />
-                  ) : (
-                    <IconLoader2 className="spin-icon" size={17} stroke={1.8} />
-                  )}
-                </span>
-                <strong>{displayedSpace.displayName}</strong>
-              </button>
-              <span className="space-shelf-state">
-                <i
-                  className={`space-health ${
-                    spaceStartup !== null
-                      ? "space-health-loading"
-                      : `space-health-${displayedSpace.state}`
-                  }`}
-                  aria-hidden="true"
-                />
-                {spaceStartup !== null
-                  ? "Starting"
-                  : runtimeLabel(displayedSpace)}
-              </span>
-              {displayedSpace.attentionCount > 0 ? (
-                <span className="space-attention-badge">
-                  {Math.min(displayedSpace.attentionCount, 99)}
+            <WorkspaceSidebarWorkspace
+              className="space-shelf-row"
+              identity={
+                <button
+                  type="button"
+                  className="space-shelf-identity"
+                  aria-current="page"
+                  title={displayedSpace.displayPath}
+                  onClick={() => setThreadShelfOpen(true)}
+                >
+                  <span className="space-shelf-folder" aria-hidden="true">
+                    {spaceStartup === null ? (
+                      <IconFolder size={17} stroke={1.7} />
+                    ) : (
+                      <IconLoader2
+                        className="spin-icon"
+                        size={17}
+                        stroke={1.8}
+                      />
+                    )}
+                  </span>
+                  <strong>{displayedSpace.displayName}</strong>
+                </button>
+              }
+              state={
+                <span className="space-shelf-state">
+                  <i
+                    className={`space-health ${
+                      spaceStartup !== null
+                        ? "space-health-loading"
+                        : `space-health-${displayedSpace.state}`
+                    }`}
+                    aria-hidden="true"
+                  />
+                  {spaceStartup !== null
+                    ? "Starting"
+                    : runtimeLabel(displayedSpace)}
                 </span>
-              ) : null}
-              <button
-                className="space-shelf-chevron"
-                type="button"
-                aria-label={`${threadShelfOpen ? "Collapse" : "Expand"} ${displayedSpace.displayName} threads`}
-                aria-expanded={threadShelfOpen}
-                onClick={() => setThreadShelfOpen((open) => !open)}
-              >
-                <IconChevronDown size={16} stroke={1.8} aria-hidden="true" />
-              </button>
-              <button
-                className="space-compose-action"
-                type="button"
-                aria-label={`New thread in ${displayedSpace.displayName}`}
-                title={`New thread in ${displayedSpace.displayName}`}
-                disabled={actionsDisabled || selectedSpace === undefined}
-                onClick={onNewWork}
-              >
-                <IconPencilPlus size={17} stroke={1.8} aria-hidden="true" />
-              </button>
-            </div>
+              }
+              actions={
+                <>
+                  {displayedSpace.attentionCount > 0 ? (
+                    <span className="space-attention-badge">
+                      {Math.min(displayedSpace.attentionCount, 99)}
+                    </span>
+                  ) : null}
+                  <button
+                    className="space-shelf-chevron"
+                    type="button"
+                    aria-label={`${threadShelfOpen ? "Collapse" : "Expand"} ${displayedSpace.displayName} threads`}
+                    aria-expanded={threadShelfOpen}
+                    onClick={() => setThreadShelfOpen((open) => !open)}
+                  >
+                    <IconChevronDown
+                      size={16}
+                      stroke={1.8}
+                      aria-hidden="true"
+                    />
+                  </button>
+                  <button
+                    className="space-compose-action"
+                    type="button"
+                    aria-label={`New thread in ${displayedSpace.displayName}`}
+                    title={`New thread in ${displayedSpace.displayName}`}
+                    disabled={actionsDisabled || selectedSpace === undefined}
+                    onClick={onNewWork}
+                  >
+                    <IconPencilPlus size={17} stroke={1.8} aria-hidden="true" />
+                  </button>
+                </>
+              }
+            />
             {renameSpaceId === displayedSpace.spaceId ? (
               <form
                 className="space-rename-form"
@@ -887,22 +911,26 @@ export function WorkSidebar({
                         disabled={actionsDisabled || result.threadArchived}
                         onClick={() => onSelectSearchResult(result)}
                       >
-                        <span className="work-item-copy">
-                          <strong>{title}</strong>
-                          <span>
-                            {result.spaceName} · {runModeLabel(result.mode)} ·{" "}
-                            {result.threadArchived
-                              ? "Archived"
-                              : shortDateLabel(result.updatedAt)}
-                          </span>
-                        </span>
-                        <span
-                          className={`work-item-state tone-${searchResultTone(result)}`}
-                          title={status.copy}
-                        >
-                          {statusIcon(status.tone)}
-                          <span className="sr-only">{status.label}</span>
-                        </span>
+                        <WorkspaceSidebarThreadContent
+                          title={title}
+                          metadata={
+                            <>
+                              {result.spaceName} · {runModeLabel(result.mode)} ·{" "}
+                              {result.threadArchived
+                                ? "Archived"
+                                : shortDateLabel(result.updatedAt)}
+                            </>
+                          }
+                          status={
+                            <span
+                              className={`work-item-state tone-${searchResultTone(result)}`}
+                              title={status.copy}
+                            >
+                              {statusIcon(status.tone)}
+                              <span className="sr-only">{status.label}</span>
+                            </span>
+                          }
+                        />
                       </button>
                       {result.threadArchived ? (
                         <button
@@ -925,9 +953,13 @@ export function WorkSidebar({
                 })
               : groups.map((group) => (
                   <section className="work-group" key={group.key}>
-                    <div className="work-group-heading">
-                      <h2>
-                        {group.key === "pinned" ? (
+                    <WorkspaceSidebarGroupHeading
+                      className="work-group-heading"
+                      headingLevel={2}
+                      label={group.label}
+                      count={group.items.length}
+                      icon={
+                        group.key === "pinned" ? (
                           <IconPin size={12} stroke={1.8} aria-hidden="true" />
                         ) : group.key === "attention" ? (
                           <IconAlertCircle
@@ -947,11 +979,9 @@ export function WorkSidebar({
                             stroke={1.8}
                             aria-hidden="true"
                           />
-                        )}
-                        {group.label}
-                      </h2>
-                      <span>{group.items.length}</span>
-                    </div>
+                        )
+                      }
+                    />
                     <div className="work-group-items">
                       {(group.key === "recent" && !showAllRecent
                         ? group.items.slice(0, 3)
@@ -962,6 +992,7 @@ export function WorkSidebar({
                           return null;
                         }
                         const pinned = pinnedSessionIds.has(run.sessionId);
+                        const forkDraft = isThreadForkDraft(run);
                         const archiving =
                           threadLifecycleBusySessionId === run.sessionId;
                         const renaming =
@@ -1045,137 +1076,74 @@ export function WorkSidebar({
                                   disabled={actionsDisabled}
                                   onClick={() => onSelect(run)}
                                 >
-                                  <span className="work-item-copy">
-                                    <strong>{item.title}</strong>
-                                    <span>
-                                      {item.modeLabel} · {item.updatedLabel}
-                                    </span>
-                                  </span>
-                                  <span
-                                    className={`work-item-state tone-${item.statusTone}`}
-                                    title={item.statusCopy}
-                                  >
-                                    {statusIcon(item.statusTone)}
-                                    <span className="sr-only">
-                                      {item.statusLabel}
-                                    </span>
-                                  </span>
-                                </button>
-                                <details
-                                  className="thread-actions-menu"
-                                  onBlur={(event) => {
-                                    const menu = event.currentTarget;
-                                    const nextFocus = event.relatedTarget;
-                                    if (
-                                      !(nextFocus instanceof Node) ||
-                                      !menu.contains(nextFocus)
-                                    ) {
-                                      menu.removeAttribute("open");
+                                  <WorkspaceSidebarThreadContent
+                                    title={item.title}
+                                    metadata={
+                                      <>
+                                        {forkDraft ? "Draft" : item.modeLabel} ·{" "}
+                                        {item.updatedLabel}
+                                      </>
                                     }
-                                  }}
-                                  onKeyDown={(event) => {
-                                    if (event.key === "Escape") {
-                                      event.preventDefault();
-                                      event.currentTarget.removeAttribute(
-                                        "open",
-                                      );
-                                      event.currentTarget
-                                        .querySelector("summary")
-                                        ?.focus();
+                                    status={
+                                      <span
+                                        className={`work-item-state tone-${item.statusTone}`}
+                                        title={
+                                          forkDraft
+                                            ? "Ready for your first message"
+                                            : item.statusCopy
+                                        }
+                                      >
+                                        {forkDraft ? (
+                                          <IconGitFork
+                                            size={14}
+                                            aria-hidden="true"
+                                          />
+                                        ) : (
+                                          statusIcon(item.statusTone)
+                                        )}
+                                        <span className="sr-only">
+                                          {forkDraft
+                                            ? "Fork draft"
+                                            : item.statusLabel}
+                                        </span>
+                                      </span>
                                     }
-                                  }}
-                                >
-                                  <summary
-                                    className="work-item-action"
-                                    role="button"
-                                    aria-haspopup="menu"
-                                    aria-label={`Thread actions for ${item.title}`}
-                                    title="Thread actions"
-                                  >
-                                    <IconDots
-                                      size={17}
-                                      stroke={1.9}
-                                      aria-hidden="true"
-                                    />
-                                  </summary>
-                                  <div
-                                    className="thread-actions-popover"
-                                    aria-label={`Actions for ${item.title}`}
-                                  >
-                                    <button
-                                      type="button"
-                                      aria-label={`Rename ${item.title}`}
-                                      disabled={spaceStartup !== null}
-                                      onClick={(event) => {
-                                        event.currentTarget
-                                          .closest("details")
-                                          ?.removeAttribute("open");
-                                        beginThreadRename(run, item.title);
-                                      }}
-                                    >
-                                      <IconPencil
-                                        size={15}
-                                        stroke={1.8}
-                                        aria-hidden="true"
-                                      />
-                                      Rename
-                                    </button>
-                                    <button
-                                      type="button"
-                                      aria-label={`${pinned ? "Unpin" : "Pin"} ${item.title}`}
-                                      aria-pressed={pinned}
-                                      disabled={spaceStartup !== null}
-                                      onClick={(event) => {
-                                        event.currentTarget
-                                          .closest("details")
-                                          ?.removeAttribute("open");
-                                        onToggleThreadPinned(run);
-                                      }}
-                                    >
-                                      <IconPin
-                                        size={15}
-                                        stroke={1.8}
-                                        fill={pinned ? "currentColor" : "none"}
-                                        aria-hidden="true"
-                                      />
-                                      {pinned ? "Unpin" : "Pin"}
-                                    </button>
+                                  />
+                                </button>
+                                <Suspense
+                                  fallback={
                                     <button
                                       type="button"
-                                      aria-label={`Archive ${item.title}`}
-                                      title={
-                                        isTerminalStatus(run.status)
-                                          ? "Archive thread"
-                                          : "Finish or cancel this thread before archiving"
-                                      }
-                                      disabled={
-                                        actionsDisabled ||
-                                        archiving ||
-                                        !isTerminalStatus(run.status)
-                                      }
-                                      onClick={(event) => {
-                                        event.currentTarget
-                                          .closest("details")
-                                          ?.removeAttribute("open");
-                                        onArchiveThread(run);
-                                      }}
+                                      className="work-item-action thread-actions-trigger"
+                                      aria-label={`Thread actions for ${item.title}`}
+                                      aria-haspopup="menu"
+                                      aria-expanded="false"
+                                      aria-busy="true"
+                                      disabled
                                     >
-                                      {archiving ? (
-                                        <IconLoader2
-                                          className="spin-icon"
-                                          size={15}
-                                        />
-                                      ) : (
-                                        <IconArchive
-                                          size={15}
-                                          stroke={1.8}
-                                          aria-hidden="true"
-                                        />
-                                      )}
-                                      {archiving ? "Archiving…" : "Archive"}
+                                      <IconDots size={17} aria-hidden="true" />
                                     </button>
-                                  </div>
-                                </details>
+                                  }
+                                >
+                                  <ThreadActionsMenu
+                                    run={run}
+                                    title={item.title}
+                                    pinned={pinned}
+                                    disabled={actionsDisabled}
+                                    localDisabled={spaceStartup !== null}
+                                    archiving={archiving}
+                                    onRename={() =>
+                                      beginThreadRename(run, item.title)
+                                    }
+                                    onPin={() => onToggleThreadPinned(run)}
+                                    onArchive={() => onArchiveThread(run)}
+                                    onFork={
+                                      onForkThread === undefined
+                                        ? undefined
+                                        : () => onForkThread(run)
+                                    }
+                                  />
+                                </Suspense>
                               </>
                             )}
                           </div>
diff --git a/apps/desktop/src/components/WorkSurface.test.ts b/apps/desktop/src/components/WorkSurface.test.ts
index 39824f51f..85020ca34 100644
--- a/apps/desktop/src/components/WorkSurface.test.ts
+++ b/apps/desktop/src/components/WorkSurface.test.ts
@@ -163,7 +163,8 @@ describe("WorkSurface side panels", () => {
     const markup = renderSurface([]);
 
     expect(markup).toContain('<main class="work-surface is-new-work"');
-    expect(markup).toContain('<section class="work-welcome">');
+    expect(markup).toContain('class="shared-work-welcome"');
+    expect(markup).toContain('aria-label="Start new work"');
     expect(markup).toContain("Orient yourself in this repo");
     expect(markup).not.toContain(
       "Review this workspace and identify the safest high-impact next task",
diff --git a/apps/desktop/src/components/WorkSurface.tsx b/apps/desktop/src/components/WorkSurface.tsx
index 888fb799a..81f5c2c5b 100644
--- a/apps/desktop/src/components/WorkSurface.tsx
+++ b/apps/desktop/src/components/WorkSurface.tsx
@@ -15,7 +15,6 @@ import {
   IconPlugConnected,
   IconRefresh,
   IconShieldLock,
-  IconSparkles,
   IconX,
 } from "@tabler/icons-react";
 import {
@@ -32,7 +31,7 @@ import type { CSSProperties, ReactNode } from "react";
 import { ActiveShells } from "./tools/ActiveShells";
 import { useShellSessions, shellIsActive } from "../shellSessions";
 
-import colossusMark from "@colossus/ui/assets/colossus-mark.svg";
+import { WorkWelcome } from "@colossus/ui";
 import {
   MAX_ASIDE_PANE_WIDTH,
   MIN_ASIDE_PANE_WIDTH,
@@ -118,6 +117,8 @@ interface WorkSurfaceProps {
   onOpenGenericTerminal?: () => void;
   title: string;
   view: RunView | undefined;
+  forkDraft?: boolean;
+  inheritedViews?: readonly RunView[];
   conversationViews: readonly RunView[];
   connection: ConnectionStatus;
   connecting: boolean;
@@ -192,18 +193,14 @@ interface WorkSurfaceProps {
   onCloseAside: (view: RunView | undefined) => Promise<boolean>;
 }
 
-const STARTERS = [
-  "Orient yourself in this repo",
-  "Plan a secure migration without making external changes",
-  "Coordinate an implementation and security review",
-];
-
 const IGNORE_SESSION_WORKSPACE_VIEW = () => undefined;
 
 export function WorkSurface({
   onInspectSchedule,
   gitWorkspaceId = null,
   gitAvailable = false,
+  forkDraft = false,
+  inheritedViews = [],
   title,
   view,
   conversationViews,
@@ -1075,7 +1072,9 @@ export function WorkSurface({
           <p className="surface-breadcrumb">
             <span>Work</span>
             <span aria-hidden="true">/</span>
-            <span>{status?.label ?? "New work"}</span>
+            <span>
+              {forkDraft ? "Fork draft" : (status?.label ?? "New work")}
+            </span>
             {!composerVisible ? gitControl : null}
           </p>
           <h2>{title}</h2>
@@ -1286,32 +1285,17 @@ export function WorkSurface({
                     </button>
                   </div>
                 </section>
+              ) : forkDraft ? (
+                <div className="conversation-timeline" id="work-activity">
+                  {conversationViews.map((contextView) => (
+                    <RunTimeline
+                      key={contextView.run.runId}
+                      view={contextView}
+                    />
+                  ))}
+                </div>
               ) : view === undefined ? (
-                <section className="work-welcome">
-                  <img src={colossusMark} alt="" />
-                  <p className="eyebrow">Local-first agent workspace</p>
-                  <h3>Give Colossus a goal. Keep control of every effect.</h3>
-                  <p>
-                    Start a task, switch to plan mode, or coordinate specialist
-                    work through one policy-bound local connection.
-                  </p>
-                  <div className="starter-list" aria-label="Example prompts">
-                    {STARTERS.map((suggestion) => (
-                      <button
-                        type="button"
-                        key={suggestion}
-                        onClick={() => onSuggestion(suggestion)}
-                      >
-                        <IconSparkles
-                          size={17}
-                          stroke={1.6}
-                          aria-hidden="true"
-                        />
-                        <span>{suggestion}</span>
-                      </button>
-                    ))}
-                  </div>
-                </section>
+                <WorkWelcome onSuggestion={onSuggestion} />
               ) : sessionWorkspaceView === "topology" ? (
                 <SessionTopology
                   views={conversationViews}
@@ -1364,6 +1348,12 @@ export function WorkSurface({
               ) : (
                 <>
                   <div className="conversation-timeline" id="work-activity">
+                    {inheritedViews.map((contextView) => (
+                      <RunTimeline
+                        key={`inherited-${contextView.run.runId}`}
+                        view={contextView}
+                      />
+                    ))}
                     {conversationViews.map((conversationView) => (
                       <div
                         data-aside-context="true"
diff --git a/apps/desktop/src/components/catalog-inventory.css b/apps/desktop/src/components/catalog-inventory.css
index 5b9bc42d6..22dbd9565 100644
--- a/apps/desktop/src/components/catalog-inventory.css
+++ b/apps/desktop/src/components/catalog-inventory.css
@@ -1,430 +1,2 @@
-.catalog-settings {
-  container-type: inline-size;
-}
-
-.catalog-heading {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 12px;
-}
-
-.catalog-heading h3 {
-  margin: 0;
-  color: var(--text-strong);
-  font-size: var(--font-size-heading);
-  line-height: 1.25;
-}
-
-.catalog-heading p,
-.catalog-summary,
-.catalog-hint {
-  margin: 4px 0 0;
-  color: var(--muted);
-  font-size: var(--font-size-body-sm);
-  line-height: 1.5;
-}
-
-.catalog-heading > .button {
-  flex-shrink: 0;
-}
-
-.catalog-summary {
-  margin: 12px 0 8px;
-}
-
-.catalog-search {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  min-height: 32px;
-  padding: 0 10px;
-  margin-bottom: 10px;
-  border: 1px solid var(--border-strong);
-  border-radius: var(--radius-sm);
-  background: var(--surface-inset);
-  color: var(--muted);
-}
-
-.catalog-search:focus-within {
-  outline: 2px solid var(--cyan);
-  outline-offset: 2px;
-}
-
-.catalog-search > svg {
-  flex-shrink: 0;
-}
-.catalog-search input {
-  flex: 1;
-  min-width: 0;
-  width: 100%;
-  padding: 6px 0;
-  border: 0;
-  outline: none;
-  background: transparent;
-  color: var(--text);
-  font-size: var(--font-size-body-sm);
-}
-.catalog-search input::placeholder {
-  color: var(--muted);
-}
-
-.catalog-table-container {
-  border: 1px solid var(--border);
-  border-radius: var(--radius-sm);
-  background: var(--surface-inset);
-}
-.catalog-table {
-  width: 100%;
-  table-layout: fixed;
-  border-spacing: 0;
-  font-size: var(--font-size-body-sm);
-  text-align: left;
-}
-.catalog-name-column {
-  width: 40%;
-}
-.catalog-actions-column {
-  width: 104px;
-}
-.catalog-table th,
-.catalog-table td {
-  padding: var(--settings-row-padding, 10px 12px);
-  vertical-align: middle;
-  overflow-wrap: anywhere;
-}
-.catalog-table thead th {
-  padding-block: 8px;
-  color: var(--muted);
-  background: var(--surface-panel);
-  font-size: var(--font-size-body-sm);
-  font-weight: 600;
-}
-.catalog-table thead th:first-child {
-  border-top-left-radius: var(--radius-sm);
-}
-.catalog-table thead th:last-child {
-  border-top-right-radius: var(--radius-sm);
-}
-.catalog-inventory-row > * {
-  border-top: 1px solid var(--border);
-}
-.catalog-inventory-row:hover {
-  background: var(--surface-hover);
-}
-.catalog-inventory-row[data-expanded="true"] {
-  background: var(--surface-selected);
-}
-.catalog-identity {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-}
-.catalog-identity > div {
-  min-width: 0;
-}
-.catalog-identity .resource-icon {
-  width: 28px;
-  height: 28px;
-  flex: 0 0 28px;
-}
-.catalog-identity .resource-icon > svg {
-  width: 16px;
-  height: 16px;
-}
-.catalog-provider-icon {
-  display: grid;
-  flex: none;
-  width: 28px;
-  height: 28px;
-  place-items: center;
-}
-.catalog-identity small {
-  display: block;
-  margin-top: 2px;
-  color: var(--muted);
-  font-weight: 400;
-  font-size: var(--font-size-caption);
-  line-height: 1.35;
-}
-.catalog-name {
-  padding: 0;
-  border: 0;
-  background: transparent;
-  color: var(--text-strong);
-  font-size: var(--font-size-body-sm);
-  font-weight: 600;
-  line-height: 1.35;
-  text-align: left;
-  overflow-wrap: anywhere;
-}
-.catalog-name:hover {
-  text-decoration: underline;
-}
-.catalog-connection {
-  display: flex;
-  align-items: center;
-  gap: 9px;
-  color: var(--muted);
-}
-.catalog-connection > svg {
-  flex-shrink: 0;
-}
-.catalog-text-button {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  gap: 6px;
-  min-height: 28px;
-  padding: 4px;
-  border: 0;
-  border-radius: 4px;
-  background: transparent;
-  color: var(--blue-strong);
-  font-weight: 600;
-  text-align: left;
-}
-.catalog-text-button:hover {
-  background: var(--blue-soft);
-}
-.catalog-usage {
-  justify-content: flex-start;
-}
-.catalog-usage svg {
-  flex-shrink: 0;
-}
-.catalog-usage[aria-expanded="true"] svg {
-  transform: rotate(90deg);
-}
-.catalog-table .catalog-row-actions {
-  white-space: nowrap;
-  padding-inline: 12px;
-  text-align: right;
-}
-.catalog-action-group {
-  display: flex;
-  align-items: center;
-  justify-content: flex-end;
-  gap: 4px;
-}
-.catalog-action-group > *,
-.catalog-action-group .icon-button {
-  flex: none;
-}
-.catalog-action-group .icon-button {
-  width: 28px;
-  height: 28px;
-}
-.catalog-actions-menu {
-  display: inline-flex;
-  position: relative;
-  vertical-align: middle;
-}
-.catalog-actions-popup {
-  position: absolute;
-  right: 0;
-  top: calc(100% + 4px);
-  z-index: 15;
-  min-width: 164px;
-  padding: 5px;
-  border: 1px solid var(--border-strong);
-  border-radius: var(--radius-sm);
-  background: var(--surface);
-  box-shadow: var(--shadow);
-}
-.catalog-actions-popup > button {
-  display: flex;
-  align-items: center;
-  gap: 9px;
-  width: 100%;
-  min-height: 38px;
-  padding: 8px 10px;
-  border: 0;
-  border-radius: 4px;
-  background: transparent;
-  text-align: left;
-}
-.catalog-actions-popup > button:hover,
-.catalog-actions-popup > button:focus-visible {
-  background: var(--surface-hover);
-}
-.catalog-actions-popup .catalog-delete-action {
-  color: var(--red-text);
-}
-.catalog-detail-row[hidden] {
-  display: none;
-}
-.catalog-detail-row > td {
-  border-top: 1px solid var(--border);
-  background: var(--surface-panel);
-}
-.catalog-details {
-  display: grid;
-  grid-template-columns: 1fr 1fr;
-  gap: 16px;
-}
-.catalog-details h4 {
-  margin: 0 0 8px;
-  font-size: var(--font-size-body-sm);
-}
-.catalog-details dl {
-  margin: 0;
-  display: grid;
-  grid-template-columns: auto minmax(0, 1fr);
-  gap: 6px 16px;
-}
-.catalog-details dt {
-  color: var(--muted);
-}
-.catalog-details dd {
-  margin: 0;
-  overflow-wrap: anywhere;
-}
-.catalog-details ul {
-  margin: 0;
-  padding-left: 18px;
-}
-.catalog-details li + li {
-  margin-top: 4px;
-}
-.catalog-details p {
-  margin: 0;
-  color: var(--muted);
-  line-height: 1.5;
-}
-.catalog-details small {
-  display: block;
-  color: var(--muted);
-  margin-top: 3px;
-  font-size: var(--font-size-body-sm);
-}
-.catalog-table .catalog-empty {
-  padding: 24px 12px;
-  text-align: center;
-}
-.catalog-empty p {
-  color: var(--muted);
-}
-.catalog-hint {
-  margin-top: 10px;
-  font-size: var(--font-size-body-sm);
-}
-
-@container (max-width: 640px) {
-  .catalog-heading {
-    flex-wrap: wrap;
-    gap: 12px;
-  }
-  .catalog-table,
-  .catalog-table tbody {
-    display: block;
-  }
-  .catalog-table colgroup {
-    display: none;
-  }
-  .catalog-table thead {
-    position: absolute;
-    width: 1px;
-    height: 1px;
-    overflow: hidden;
-    clip-path: inset(50%);
-    white-space: nowrap;
-  }
-  .catalog-inventory-row {
-    display: grid;
-    grid-template-columns: minmax(0, 1fr) auto;
-    padding: 10px 12px;
-    gap: 4px 10px;
-    border-top: 1px solid var(--border);
-  }
-  .catalog-inventory-row:first-child {
-    border-top: 0;
-  }
-  .catalog-table .catalog-inventory-row > * {
-    border: 0;
-    padding: 0;
-    min-width: 0;
-  }
-  .catalog-inventory-row > th {
-    grid-column: 1;
-  }
-  .catalog-inventory-row > td[data-label] {
-    grid-column: 1 / -1;
-    display: flex;
-    align-items: center;
-    gap: 10px;
-    padding-left: 38px;
-  }
-  .catalog-inventory-row > td[data-label]::before {
-    content: attr(data-label);
-    color: var(--muted);
-    font-size: var(--font-size-caption);
-    min-width: 100px;
-  }
-  .catalog-table .catalog-row-actions {
-    grid-column: 2;
-    grid-row: 1;
-    padding: 0;
-  }
-  .catalog-detail-row,
-  .catalog-detail-row > td {
-    display: block;
-  }
-  .catalog-details {
-    grid-template-columns: 1fr;
-  }
-}
-
-@container (max-width: 390px) {
-  .catalog-inventory-row > td[data-label] {
-    padding-left: 0;
-    flex-wrap: wrap;
-  }
-  .catalog-identity {
-    gap: 9px;
-  }
-  .catalog-table .catalog-row-actions {
-    grid-column: 1 / -1;
-    grid-row: auto;
-    justify-self: end;
-  }
-}
-
-.credentials-settings .catalog-actions-column {
-  width: 144px;
-}
-
-.credential-status {
-  display: flex;
-  align-items: center;
-  gap: 7px;
-}
-.credential-status > svg {
-  flex-shrink: 0;
-}
-.catalog-details .credential-rotation-note {
-  margin-top: 10px;
-  font-size: var(--font-size-body-sm);
-}
-.credential-status.tone-warning-text {
-  color: var(--amber-text);
-}
-
-.catalog-heading > .button {
-  min-height: 32px;
-  padding: 6px 10px;
-}
-.catalog-provider-icon .provider-icon {
-  width: 24px;
-  height: 24px;
-}
-
-.catalog-connection-copy small {
-  display: block;
-  margin-top: 2px;
-  font-size: var(--font-size-caption);
-  line-height: 1.35;
-}
-.catalog-sensitive-content {
-  color: var(--amber-text);
-}
+@import "@colossus/ui/styles/controls.css";
+@import "@colossus/ui/styles/catalog.css";
diff --git a/apps/desktop/src/components/cloud-connection.css b/apps/desktop/src/components/cloud-connection.css
new file mode 100644
index 000000000..52e185ffb
--- /dev/null
+++ b/apps/desktop/src/components/cloud-connection.css
@@ -0,0 +1,162 @@
+.cloud-settings {
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+}
+.cloud-settings-state {
+  display: flex;
+  min-width: 0;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  padding: var(--settings-row-padding, 10px 12px);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-muted);
+}
+.cloud-settings-state > span:last-child:not(.cloud-state-dot) {
+  min-width: 0;
+  margin-left: auto;
+  overflow-wrap: anywhere;
+  color: var(--muted);
+}
+.cloud-state-dot {
+  width: 7px;
+  height: 7px;
+  flex: none;
+  border-radius: 50%;
+  background: var(--faint);
+}
+.cloud-state-dot.connected {
+  background: var(--green);
+}
+.cloud-settings dl {
+  display: grid;
+  grid-template-columns: 150px minmax(0, 1fr);
+  gap: 8px 16px;
+  margin: 16px 0;
+}
+.cloud-settings dt {
+  color: var(--muted);
+}
+.cloud-settings dd {
+  min-width: 0;
+  margin: 0;
+  overflow-wrap: anywhere;
+  font-family: var(--font-mono);
+  font-size: var(--font-size-caption);
+}
+.cloud-settings-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-bottom: 10px;
+}
+.cloud-settings-note {
+  margin: 0;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+}
+.cloud-settings-control-column {
+  width: 100%;
+  max-width: 620px;
+  min-width: 0;
+}
+.cloud-settings-enrollment {
+  display: grid;
+  gap: 12px;
+  margin-top: 16px;
+}
+.cloud-settings-enrollment label {
+  display: grid;
+  gap: 6px;
+  font-size: var(--font-size-control);
+  font-weight: 500;
+}
+.cloud-settings form > .ui-button {
+  justify-self: start;
+}
+.cloud-settings-sharing {
+  display: grid;
+  gap: 10px;
+  margin-top: var(--settings-section-gap);
+  padding-top: var(--settings-section-gap);
+  border-top: 1px solid var(--border);
+}
+.cloud-settings-sharing h4,
+.control-plane-workspaces h4 {
+  margin: 0 0 8px;
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-tight);
+  font-weight: 600;
+}
+.cloud-settings-sharing > .cloud-settings-note {
+  max-width: 620px;
+}
+.cloud-settings-policy {
+  display: flex;
+  min-width: 0;
+  align-items: flex-start;
+  gap: 8px;
+  padding: var(--settings-row-padding, 10px 12px);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-muted);
+  color: var(--muted);
+  margin-top: var(--settings-section-gap);
+}
+.cloud-settings-policy svg {
+  flex: none;
+  margin-top: 1px;
+}
+.cloud-settings-policy p {
+  margin: 0;
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+}
+.cloud-settings-error {
+  margin: 0 0 12px;
+  padding: var(--settings-row-padding, 10px 12px);
+  border: 1px solid var(--red-border);
+  border-radius: var(--radius-sm);
+  background: var(--red-soft);
+  color: var(--red-text);
+  font-size: var(--font-size-body-sm);
+}
+.control-plane-workspaces {
+  margin-top: var(--settings-section-gap);
+  padding-top: var(--settings-section-gap);
+  border-top: 1px solid var(--border);
+}
+.control-plane-workspace-list {
+  display: grid;
+  gap: 8px;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+.control-plane-workspace-list li {
+  display: flex;
+  min-width: 0;
+  flex-wrap: wrap;
+  gap: 4px 16px;
+  justify-content: space-between;
+  font-size: var(--font-size-body-sm);
+}
+.control-plane-workspace-list :is(strong, span) {
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+.control-plane-workspace-list span {
+  color: var(--muted);
+}
+@media (max-width: 520px) {
+  .cloud-settings dl {
+    grid-template-columns: minmax(0, 1fr);
+    gap: 4px;
+  }
+  .cloud-settings dd + dt {
+    margin-top: 8px;
+  }
+}
diff --git a/apps/desktop/src/components/control-plane-connections.css b/apps/desktop/src/components/control-plane-connections.css
new file mode 100644
index 000000000..283e453ea
--- /dev/null
+++ b/apps/desktop/src/components/control-plane-connections.css
@@ -0,0 +1,79 @@
+.control-plane-connection-list {
+  display: grid;
+  gap: 8px;
+}
+.control-plane-connection-row {
+  min-width: 0;
+  padding: var(--settings-row-padding, 10px 12px);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-panel);
+}
+.control-plane-connection-heading {
+  display: flex;
+  min-width: 0;
+  flex-wrap: wrap;
+  gap: 8px;
+  align-items: center;
+  font-size: var(--font-size-body-sm);
+}
+.control-plane-connection-heading > strong {
+  min-width: 0;
+  flex: 1;
+  overflow-wrap: anywhere;
+}
+.control-plane-connection-heading > svg {
+  flex: none;
+  color: var(--muted);
+}
+.control-plane-connection-row dl {
+  display: grid;
+  grid-template-columns: 80px minmax(0, 1fr);
+  gap: 4px 10px;
+  margin: 10px 0 0;
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+}
+.control-plane-connection-row dt,
+.control-plane-connection-note {
+  color: var(--muted);
+}
+.control-plane-connection-row dd {
+  min-width: 0;
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.control-plane-connection-note {
+  margin: 6px 0 0;
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+}
+.control-plane-bookmarks {
+  margin-top: var(--settings-section-gap);
+  padding-top: var(--settings-section-gap);
+  border-top: 1px solid var(--border);
+}
+.control-plane-bookmarks h4 {
+  margin: 0;
+  font-size: var(--font-size-body-sm);
+}
+.control-plane-bookmarks ul {
+  display: grid;
+  gap: 8px;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+.control-plane-bookmarks li {
+  display: flex;
+  min-width: 0;
+  flex-wrap: wrap;
+  gap: 4px 12px;
+  align-items: center;
+  font-size: var(--font-size-body-sm);
+}
+.control-plane-bookmarks li > span:not(.status-chip) {
+  min-width: 0;
+  overflow-wrap: anywhere;
+  color: var(--muted);
+}
diff --git a/apps/desktop/src/components/model-role-routing.css b/apps/desktop/src/components/model-role-routing.css
index 6072a8545..89c3932a9 100644
--- a/apps/desktop/src/components/model-role-routing.css
+++ b/apps/desktop/src/components/model-role-routing.css
@@ -12,11 +12,11 @@
   margin: 0;
   color: var(--muted);
   font-size: var(--font-size-body-sm);
-  line-height: 1.5;
+  line-height: var(--line-height-body);
 }
 .model-role-list {
   border: 1px solid var(--border);
-  border-radius: 10px;
+  border-radius: var(--radius);
   overflow: hidden;
 }
 .model-role-row {
@@ -50,15 +50,15 @@
 .model-role-purpose code {
   display: block;
   margin-top: 4px;
-  font-size: 11px;
+  font-size: var(--font-size-caption);
   color: var(--muted);
   overflow-wrap: anywhere;
 }
 .model-role-required {
   border: 1px solid var(--border);
-  border-radius: 5px;
+  border-radius: var(--radius-sm);
   padding: 1px 6px;
-  font-size: 10px;
+  font-size: var(--font-size-overline);
   font-weight: 600;
   color: var(--muted);
 }
@@ -69,8 +69,8 @@
   display: block;
   margin-top: 6px;
   color: var(--muted);
-  font-size: 11px;
-  line-height: 1.5;
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
   overflow-wrap: anywhere;
 }
 .model-role-routing .model-role-empty {
diff --git a/apps/desktop/src/components/model-routing-map.ts b/apps/desktop/src/components/model-routing-map.ts
new file mode 100644
index 000000000..5e1e5e880
--- /dev/null
+++ b/apps/desktop/src/components/model-routing-map.ts
@@ -0,0 +1,28 @@
+import { MODEL_ROLES, type RoleModel } from "./ModelRoleRouting";
+
+export function modelRouteGroups(
+  roles: Record<string, string>,
+  models: RoleModel[],
+) {
+  const available = new Map(models.map((model) => [model.profile, model]));
+  const groups = new Map<
+    string,
+    {
+      profile: string;
+      model: RoleModel | undefined;
+      roles: { id: string; label: string; inherited: boolean }[];
+    }
+  >();
+  for (const role of MODEL_ROLES) {
+    const assigned = roles[role.id];
+    const inherited = role.id !== "primary" && !assigned;
+    const profile = assigned || (inherited ? roles.primary : "") || "";
+    let group = groups.get(profile);
+    if (!group) {
+      group = { profile, model: available.get(profile), roles: [] };
+      groups.set(profile, group);
+    }
+    group.roles.push({ id: role.id, label: role.label, inherited });
+  }
+  return [...groups.values()];
+}
diff --git a/apps/desktop/src/components/model-routing-overview.css b/apps/desktop/src/components/model-routing-overview.css
new file mode 100644
index 000000000..cf380d267
--- /dev/null
+++ b/apps/desktop/src/components/model-routing-overview.css
@@ -0,0 +1,46 @@
+.model-routing-overview {
+  margin-bottom: 20px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--surface);
+  overflow: hidden;
+}
+.model-routing-overview > summary {
+  padding: 12px 16px;
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+  font-weight: 650;
+  cursor: pointer;
+}
+.model-routing-overview > summary:focus-visible {
+  outline: 2px solid var(--blue);
+  outline-offset: -3px;
+}
+.routing-flow-node {
+  min-height: 72px;
+  border-radius: var(--radius);
+}
+.routing-flow-node strong {
+  text-transform: none;
+}
+.routing-flow-node[data-highlighted="true"] {
+  border-color: var(--blue);
+  box-shadow: 0 0 0 2px var(--blue);
+}
+.routing-flow-node:not(button) {
+  cursor: default;
+}
+.routing-graph-route-details {
+  margin: 20px 0;
+  font-size: var(--font-size-body-sm);
+}
+.routing-graph-route-details dt {
+  margin-top: 12px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.routing-graph-route-details dd {
+  margin: 4px 0 0;
+  overflow-wrap: anywhere;
+  font-weight: 600;
+}
diff --git a/apps/desktop/src/components/thread-fork.css b/apps/desktop/src/components/thread-fork.css
new file mode 100644
index 000000000..794148744
--- /dev/null
+++ b/apps/desktop/src/components/thread-fork.css
@@ -0,0 +1,18 @@
+.thread-actions-trigger {
+  position: absolute;
+  top: 50%;
+  right: 5px;
+  transform: translateY(-50%);
+}
+.thread-actions-trigger[data-state="open"] {
+  opacity: 1;
+}
+.thread-action-label {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  text-align: left;
+}
+.thread-action-label > svg {
+  flex-shrink: 0;
+}
diff --git a/apps/desktop/src/dev/cloud-connection-preview.tsx b/apps/desktop/src/dev/cloud-connection-preview.tsx
new file mode 100644
index 000000000..3c31f9f81
--- /dev/null
+++ b/apps/desktop/src/dev/cloud-connection-preview.tsx
@@ -0,0 +1,144 @@
+import { CloudConnectionPane } from "../components/CloudConnectionPane";
+import {
+  ControlPlaneSettingsPane,
+  type ControlPlaneProfiles,
+} from "../components/ControlPlaneSettingsPane";
+import { SettingsFrame } from "@colossus/ui";
+import { useState } from "react";
+
+/** Visual fixture only: never replaces a native bridge or proves enrollment. */
+export default function CloudPreview() {
+  const host = window as unknown as { __TAURI_INTERNALS__?: unknown };
+  const parameters = new URLSearchParams(location.search);
+  const [scope, setScope] = useState<"global" | "space">(
+    parameters.get("pane") === "global" ? "global" : "space",
+  );
+  if (
+    import.meta.env.DEV &&
+    parameters.get("fixture") === "cloud" &&
+    !host.__TAURI_INTERNALS__
+  ) {
+    let enrolled = parameters.get("state") !== "new";
+    let status = parameters.get("state") ?? "connected";
+    let sharedSessions = false;
+    let sharedContinuation = false;
+    let sharingRecoveryRequired = parameters.get("recovery") === "1";
+    const sharingRestartRequired = parameters.get("restart") === "1";
+    let catalog: ControlPlaneProfiles = {
+      revision: 0,
+      profiles: [],
+      defaultProfile: null,
+      connections: enrolled
+        ? [
+            {
+              targetId: "preview-workspace",
+              status,
+              projectId: "Example project",
+              endpoint: "https://control-plane.example.com",
+              sharedSessions: false,
+              sharingRecoveryRequired,
+              sharingRestartRequired,
+            },
+          ]
+        : [],
+    };
+    const snapshot = () => ({
+      targetId: "preview-workspace",
+      status,
+      nodeId: enrolled ? "01a10a7f40fb779191d88fe3e4f2f1b6" : null,
+      projectId: enrolled ? "Example project" : null,
+      endpoint: enrolled ? "https://cloud.example.com:443" : null,
+      hostId: enrolled ? "host-preview" : null,
+      workspaceId: "workspace-preview",
+      sharingSupported: true,
+      sharedSessions,
+      sharedContinuation,
+      sharingRecoveryRequired,
+      sharingRestartRequired,
+    });
+    host.__TAURI_INTERNALS__ = {
+      invoke: async (
+        command: string,
+        arguments_: {
+          enabled?: boolean;
+          allowContinuation?: boolean;
+          catalog?: ControlPlaneProfiles;
+        } = {},
+      ) => {
+        switch (command) {
+          case "control_plane_profiles":
+            return catalog;
+          case "save_control_plane_profiles":
+            if (!arguments_.catalog) throw new Error("Missing visual catalog");
+            catalog = {
+              ...arguments_.catalog,
+              revision: catalog.revision + 1,
+              connections: catalog.connections,
+            };
+            return catalog;
+          case "cloud_status":
+            break;
+          case "cloud_set_workspace_sharing":
+            sharedSessions = arguments_.enabled ?? false;
+            sharedContinuation = arguments_.allowContinuation ?? false;
+            sharingRecoveryRequired = false;
+            break;
+          case "cloud_enroll":
+            enrolled = true;
+            status = "connected";
+            break;
+          case "cloud_connect":
+            status = "connected";
+            sharingRecoveryRequired = false;
+            break;
+          case "cloud_disconnect":
+            status = "disconnected";
+            break;
+          case "cloud_revoke":
+            status = "revoked";
+            break;
+          case "cloud_forget":
+            enrolled = false;
+            status = "disconnected";
+            break;
+          default:
+            throw new Error("Unsupported visual fixture command");
+        }
+        return snapshot();
+      },
+    };
+    if (!enrolled) status = "disconnected";
+  }
+  return (
+    <div className="app-shell app-shell--settings">
+      <div className="settings-scroll">
+        <SettingsFrame
+          scope={scope}
+          onScopeChange={setScope}
+          query=""
+          onQueryChange={() => undefined}
+          tabs={[{ id: "control-plane", label: "Control Plane" }]}
+          activeTab="control-plane"
+          onTabChange={() => undefined}
+          workspaceContext={
+            <div className="space-settings-context">
+              <strong>Preview workspace</strong>
+              <small>Sample connection</small>
+            </div>
+          }
+        >
+          <div className="settings-page-context">
+            <p className="muted">
+              Desktop visual preview · Native enrollment is tested separately.
+            </p>
+          </div>
+          {scope === "global" ? (
+            <ControlPlaneSettingsPane />
+          ) : (
+            <CloudConnectionPane targetId="preview-workspace" />
+          )}
+        </SettingsFrame>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/desktop/src/main.tsx b/apps/desktop/src/main.tsx
index a1504cce4..5babed342 100644
--- a/apps/desktop/src/main.tsx
+++ b/apps/desktop/src/main.tsx
@@ -10,6 +10,10 @@ import {
   initializeAppearance,
 } from "./theme/AppearanceProvider";
 import "@colossus/ui/styles/theme.css";
+import "@colossus/ui/styles/shadcn.css";
+import "@colossus/ui/styles/conversation.css";
+import "@colossus/ui/styles/workspace-sidebar.css";
+import "@colossus/ui/styles/work-welcome.css";
 import "./styles.css";
 import "@colossus/ui/styles/composer.css";
 import "@colossus/ui/styles/select.css";
@@ -46,6 +50,19 @@ if (
       );
     },
   );
+} else if (
+  import.meta.env.DEV &&
+  new URLSearchParams(window.location.search).get("fixture") === "cloud"
+) {
+  void import("./dev/cloud-connection-preview").then(
+    ({ default: CloudPreview }) => {
+      createRoot(root).render(
+        <AppearanceProvider initialPreference={initialAppearance}>
+          <CloudPreview />
+        </AppearanceProvider>,
+      );
+    },
+  );
 } else if (
   import.meta.env.DEV &&
   new URLSearchParams(window.location.search).get("fixture") === "plugin-studio"
diff --git a/apps/desktop/src/styles.css b/apps/desktop/src/styles.css
index 88fb59482..53708f4c0 100644
--- a/apps/desktop/src/styles.css
+++ b/apps/desktop/src/styles.css
@@ -5107,149 +5107,6 @@ p {
   color: var(--red);
 }
 
-.run-activity {
-  min-width: 0;
-}
-
-.run-activity > summary {
-  list-style: none;
-  cursor: pointer;
-}
-
-.run-activity > summary::-webkit-details-marker {
-  display: none;
-}
-
-.run-activity-summary {
-  display: grid;
-  min-width: 0;
-  grid-template-columns: auto auto minmax(0, 1fr) auto auto;
-  gap: 9px;
-  align-items: center;
-}
-
-.run-activity-chevron {
-  display: grid;
-  color: var(--muted);
-  transition: transform 160ms ease;
-}
-
-.run-activity:not([open]) .run-activity-chevron {
-  transform: rotate(-90deg);
-}
-
-.run-activity-mark {
-  display: grid;
-  width: 28px;
-  height: 28px;
-  place-items: center;
-  border: 1px solid var(--border);
-  border-radius: 7px;
-  background: var(--surface-raised);
-  color: var(--icon-text);
-}
-
-.run-activity-mark img {
-  width: 17px;
-  height: 17px;
-}
-
-.run-activity.run-state-completed .run-activity-mark {
-  border-color: var(--green-border);
-  background: var(--green-soft);
-  box-shadow:
-    0 0 0 1px rgb(72 199 142 / 5%),
-    0 0 8px rgb(72 199 142 / 10%);
-}
-
-.run-activity.run-state-queued .run-activity-mark,
-.run-activity.run-state-running .run-activity-mark {
-  border-color: color-mix(in srgb, var(--cyan) 48%, var(--border));
-  background: color-mix(in srgb, var(--cyan) 12%, var(--surface));
-  box-shadow:
-    0 0 0 1px rgb(69 200 237 / 5%),
-    0 0 8px rgb(69 200 237 / 10%);
-}
-
-.run-activity-title {
-  display: flex;
-  min-width: 0;
-  align-items: baseline;
-  gap: 8px;
-}
-
-.run-activity-title strong {
-  overflow: hidden;
-  color: var(--text);
-  font-size: 0.76rem;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.run-activity-title small {
-  flex: 0 0 auto;
-  color: var(--muted);
-  font-size: var(--font-size-caption);
-}
-
-.run-activity-status,
-.run-activity-exceptions {
-  display: inline-flex;
-  align-items: center;
-  gap: 5px;
-  color: var(--muted);
-  font-size: var(--font-size-body-sm);
-  font-weight: 680;
-}
-
-.run-activity-status.tone-success {
-  color: var(--green);
-}
-
-.run-activity-status.tone-danger,
-.run-activity-exceptions {
-  color: var(--red);
-}
-
-.run-activity-status.tone-warning {
-  color: var(--amber);
-}
-
-.run-activity-status.tone-active {
-  color: var(--cyan);
-}
-
-.run-activity-body {
-  min-width: 0;
-}
-
-.run-activity-thread {
-  padding: 2px 0 12px;
-  border-bottom: 1px solid var(--border);
-}
-
-.run-activity-thread .run-activity-summary {
-  grid-template-columns: auto auto minmax(0, 1fr) auto auto;
-  padding-bottom: 8px;
-}
-
-.run-activity-thread .run-activity-body {
-  position: relative;
-  display: grid;
-  gap: 6px;
-  padding: 6px 0 0 74px;
-}
-
-.run-activity-thread .run-activity-body::before {
-  position: absolute;
-  top: 8px;
-  bottom: 8px;
-  left: 38px;
-  width: 2px;
-  background: var(--border-strong);
-  content: "";
-}
-
 .run-activity-thread .compact-tool-activity,
 .run-activity-thread .activity-thought,
 .run-activity-thread .feed-entry {
@@ -5841,7 +5698,6 @@ p {
 
 .interaction-heading h3,
 .connection-panel h3,
-.work-welcome h3,
 .overview-section h3,
 .settings-card h3 {
   margin: 0;
@@ -8399,8 +8255,7 @@ textarea {
   text-align: center;
 }
 
-.connection-panel,
-.work-welcome {
+.connection-panel {
   max-width: 650px;
   margin: clamp(16px, 7vh, 70px) auto 0;
 }
@@ -8415,13 +8270,11 @@ textarea {
   background: var(--surface);
 }
 
-.connection-panel h3,
-.work-welcome h3 {
+.connection-panel h3 {
   font-size: 1.16rem;
 }
 
-.connection-panel p:not(.eyebrow),
-.work-welcome > p:not(.eyebrow) {
+.connection-panel p:not(.eyebrow) {
   margin: 8px 0 12px;
   color: var(--muted);
   font-size: 0.77rem;
@@ -8436,60 +8289,6 @@ textarea {
   font-size: var(--font-size-body-sm);
 }
 
-.work-welcome {
-  text-align: center;
-}
-
-.work-welcome > img {
-  width: 56px;
-  height: 56px;
-  margin-bottom: 14px;
-}
-
-.starter-list {
-  display: grid;
-  gap: 7px;
-  margin-top: 18px;
-  text-align: left;
-}
-
-.starter-list button {
-  display: flex;
-  align-items: center;
-  gap: 9px;
-  padding: 10px 12px;
-  border: 1px solid var(--border);
-  border-radius: 8px;
-  background: var(--surface);
-  color: var(--text);
-  font-size: 0.72rem;
-  transition:
-    border-color 140ms ease,
-    background-color 140ms ease,
-    color 140ms ease;
-}
-
-.starter-list button svg {
-  color: var(--icon-text);
-  filter: drop-shadow(0 0 0 transparent);
-  transition:
-    color 140ms ease,
-    filter 140ms ease;
-}
-
-.starter-list button:hover,
-.starter-list button:focus-visible {
-  border-color: var(--accent-border);
-  background: var(--surface-hover);
-  color: var(--text-strong);
-}
-
-.starter-list button:hover svg,
-.starter-list button:focus-visible svg {
-  color: var(--blue-strong);
-  filter: drop-shadow(0 0 5px var(--focus-ring));
-}
-
 .context-sidebar {
   padding: 25px 19px 18px;
 }
@@ -10526,30 +10325,6 @@ textarea {
     flex-wrap: wrap;
   }
 
-  .run-activity-summary,
-  .run-activity-thread .run-activity-summary {
-    grid-template-columns: auto auto minmax(0, 1fr) auto;
-  }
-
-  .run-activity-title {
-    display: grid;
-    gap: 1px;
-  }
-
-  .run-activity-title small {
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-  }
-
-  .run-activity-exceptions {
-    display: none;
-  }
-
-  .run-activity-thread .run-activity-body {
-    padding-left: 62px;
-  }
-
   .run-activity-thread .compact-tool-activity::before,
   .run-activity-thread .activity-thought::before,
   .run-activity-thread .feed-entry::before {
@@ -13508,3 +13283,12 @@ textarea {
   color: var(--muted);
   font-size: var(--font-size-body-sm);
 }
+
+/* The shared frame owns composer chrome; Desktop retains its rich native slots. */
+.work-composer .shared-composer-body {
+  padding: 0;
+}
+.work-composer .shared-composer-body > .prompt-limit-error,
+.work-composer .shared-composer-body > .composer-error {
+  margin-inline: var(--space-3, 12px);
+}
diff --git a/apps/desktop/src/thread-fork.test.ts b/apps/desktop/src/thread-fork.test.ts
new file mode 100644
index 000000000..307b0c5ed
--- /dev/null
+++ b/apps/desktop/src/thread-fork.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from "vitest";
+import {
+  canForkThread,
+  createThreadForkDraft,
+  defaultForkTitle,
+  parseThreadForkDrafts,
+  threadForkBranch,
+  threadForkDraftRun,
+} from "./thread-fork";
+import type { Run } from "./types";
+
+const source: Run = {
+  runId: "owned-source-run",
+  sessionId: "parent-session",
+  role: "primary",
+  title: "Parent",
+  mode: "plan",
+  status: "completed",
+  archived: false,
+  createdAt: "2026-10-06T00:00:00Z",
+  updatedAt: "2026-10-06T00:00:00Z",
+  startedAt: null,
+  finishedAt: null,
+  lastSequence: 0,
+  pendingInteractionCount: 0,
+  terminal: null,
+  etag: "source",
+};
+describe("thread forking", () => {
+  it("creates only local metadata until the full composer sends", () => {
+    const draft = createThreadForkDraft(
+      source,
+      "workspace",
+      "  Another approach  ",
+    );
+    expect(draft.title).toBe("Another approach");
+    expect(draft).not.toHaveProperty("prompt");
+    expect(draft).not.toHaveProperty("transcript");
+    expect(threadForkBranch(draft)).toEqual({
+      sourceRunId: "owned-source-run",
+      kind: "thread",
+    });
+    const summary = threadForkDraftRun(draft);
+    expect(summary.sessionId).not.toBe(source.sessionId);
+    expect(summary.terminal).toBeNull();
+    expect(canForkThread(summary)).toBe(false);
+    expect(source.sessionId).toBe("parent-session");
+  });
+  it("rejects unfinished/archived sources and invalid titles", () => {
+    for (const status of ["running", "queued", "waiting"] as const) {
+      expect(canForkThread({ ...source, status })).toBe(false);
+      expect(() =>
+        createThreadForkDraft({ ...source, status }, "workspace", "Fork"),
+      ).toThrow();
+    }
+    expect(canForkThread({ ...source, archived: true })).toBe(false);
+    expect(() => createThreadForkDraft(source, "workspace", "  ")).toThrow();
+    expect([...defaultForkTitle("x".repeat(160))]).toHaveLength(80);
+  });
+  it("restores bounded metadata without trusting extra transcript or request fields", () => {
+    const draft = createThreadForkDraft(source, "workspace", "Fork");
+    expect(
+      parseThreadForkDrafts(
+        JSON.stringify([
+          { ...draft, prompt: "must not send", transcript: "untrusted" },
+          draft,
+        ]),
+      ),
+    ).toEqual([draft]);
+    expect(
+      parseThreadForkDrafts(
+        JSON.stringify([{ ...draft, spaceId: "bad\nworkspace" }]),
+      ),
+    ).toEqual([]);
+    expect(parseThreadForkDrafts("x".repeat(65_537))).toEqual([]);
+    const materialized = {
+      ...draft,
+      materializedSessionId: "separate-session",
+    };
+    expect(parseThreadForkDrafts(JSON.stringify([materialized]))).toEqual([
+      materialized,
+    ]);
+  });
+});
diff --git a/apps/desktop/src/thread-fork.ts b/apps/desktop/src/thread-fork.ts
new file mode 100644
index 000000000..98d2ee52c
--- /dev/null
+++ b/apps/desktop/src/thread-fork.ts
@@ -0,0 +1,174 @@
+import { isTerminalStatus } from "./types";
+import type { CreateRunRequest, Run } from "./types";
+import {
+  MAX_THREAD_NAME_CHARACTERS,
+  normalizeThreadName,
+} from "./thread-names";
+
+const STORAGE_KEY = "colossus.thread-forks:v1";
+const DRAFT_PREFIX = "desktop-fork-draft-";
+const MAX_DRAFTS = 64;
+
+/** Local metadata only. The runtime resolves context when the operator sends. */
+export interface ThreadForkDraft {
+  id: string;
+  spaceId: string;
+  sourceRunId: string;
+  sourceSessionId: string;
+  sourceCreatedAt: string;
+  role: string;
+  title: string;
+  createdAt: string;
+  materializedSessionId?: string;
+}
+
+export function isThreadForkDraft(run: Run): boolean {
+  return run.runId.startsWith(DRAFT_PREFIX);
+}
+
+export function canForkThread(run: Run): boolean {
+  return (
+    !isThreadForkDraft(run) && !run.archived && isTerminalStatus(run.status)
+  );
+}
+
+export function defaultForkTitle(title: string): string {
+  return `${[...title].slice(0, MAX_THREAD_NAME_CHARACTERS - 7).join("")} (fork)`;
+}
+
+export function createThreadForkDraft(
+  source: Run,
+  spaceId: string,
+  title: string,
+): ThreadForkDraft {
+  const name = normalizeThreadName(title);
+  if (!canForkThread(source) || name === null)
+    throw new Error("Enter a valid title for this fork.");
+  return {
+    id: `${DRAFT_PREFIX}${crypto.randomUUID()}`,
+    spaceId,
+    sourceRunId: source.runId,
+    sourceSessionId: source.sessionId,
+    sourceCreatedAt: source.createdAt,
+    role: source.role,
+    title: name,
+    createdAt: new Date().toISOString(),
+  };
+}
+
+/** Sidebar presentation only; this identifier is never sent as a runtime session. */
+export function threadForkDraftRun(draft: ThreadForkDraft): Run {
+  return {
+    runId: draft.id,
+    sessionId: draft.id,
+    title: draft.title,
+    role: draft.role,
+    mode: "execute",
+    status: "completed",
+    createdAt: draft.createdAt,
+    updatedAt: draft.createdAt,
+    startedAt: null,
+    finishedAt: null,
+    lastSequence: 0,
+    pendingInteractionCount: 0,
+    terminal: null,
+    archived: false,
+    etag: draft.id,
+  };
+}
+
+/** Only a source ID crosses the native boundary; never a renderer transcript. */
+export function threadForkBranch(
+  draft: ThreadForkDraft,
+): NonNullable<CreateRunRequest["branch"]> {
+  return { sourceRunId: draft.sourceRunId, kind: "thread" };
+}
+
+export function parseThreadForkDrafts(
+  serialized: string | null,
+): readonly ThreadForkDraft[] {
+  if (serialized === null || serialized.length > 65_536) return [];
+  try {
+    const value: unknown = JSON.parse(serialized);
+    if (!Array.isArray(value)) return [];
+    const seen = new Set<string>();
+    return value.slice(0, MAX_DRAFTS).flatMap((entry: unknown) => {
+      if (entry === null || typeof entry !== "object") return [];
+      const item = entry as Record<string, unknown>;
+      const fields = [
+        "id",
+        "spaceId",
+        "sourceRunId",
+        "sourceSessionId",
+        "role",
+        "sourceCreatedAt",
+        "createdAt",
+      ] as const;
+      if (
+        fields.some(
+          (field) =>
+            typeof item[field] !== "string" ||
+            !item[field] ||
+            item[field].length > 256 ||
+            /[\u0000-\u001f\u007f]/u.test(item[field]),
+        )
+      )
+        return [];
+      const title = normalizeThreadName(item.title);
+      const id = item.id as string;
+      const sessionId = item.materializedSessionId;
+      if (
+        title === null ||
+        !id.startsWith(DRAFT_PREFIX) ||
+        seen.has(id) ||
+        !Number.isFinite(Date.parse(item.createdAt as string)) ||
+        !Number.isFinite(Date.parse(item.sourceCreatedAt as string)) ||
+        (sessionId !== undefined &&
+          (typeof sessionId !== "string" ||
+            !sessionId ||
+            sessionId.length > 256 ||
+            /[\u0000-\u001f\u007f]/u.test(sessionId)))
+      )
+        return [];
+      seen.add(id);
+      return [
+        {
+          id,
+          spaceId: item.spaceId as string,
+          sourceRunId: item.sourceRunId as string,
+          sourceSessionId: item.sourceSessionId as string,
+          role: item.role as string,
+          sourceCreatedAt: item.sourceCreatedAt as string,
+          createdAt: item.createdAt as string,
+          title,
+          ...(sessionId === undefined
+            ? {}
+            : { materializedSessionId: sessionId as string }),
+        },
+      ];
+    });
+  } catch {
+    return [];
+  }
+}
+
+export function readThreadForkDrafts(): readonly ThreadForkDraft[] {
+  try {
+    return parseThreadForkDrafts(window.localStorage.getItem(STORAGE_KEY));
+  } catch {
+    return [];
+  }
+}
+
+export function storeThreadForkDrafts(
+  drafts: readonly ThreadForkDraft[],
+): void {
+  try {
+    window.localStorage.setItem(
+      STORAGE_KEY,
+      JSON.stringify(drafts.slice(0, MAX_DRAFTS)),
+    );
+  } catch {
+    /* The draft remains usable in this app session when storage is unavailable. */
+  }
+}
diff --git a/apps/desktop/src/types.ts b/apps/desktop/src/types.ts
index 7fc7b2dce..3e3f47cff 100644
--- a/apps/desktop/src/types.ts
+++ b/apps/desktop/src/types.ts
@@ -246,6 +246,31 @@ export interface DesktopStatus {
   capabilities: DesktopCapabilities;
 }
 
+export interface ControlPlaneProfile {
+  id: string;
+  label: string;
+  endpoint: string;
+}
+
+/** Public native enrollment metadata; contains no runtime credentials. */
+export interface ControlPlaneEnrollmentStatus {
+  targetId: string;
+  status: string;
+  projectId: string | null;
+  endpoint: string | null;
+  sharedSessions: boolean;
+  sharingRecoveryRequired?: boolean;
+  sharingRestartRequired?: boolean;
+}
+
+export interface ControlPlaneProfiles {
+  revision: number;
+  profiles: ControlPlaneProfile[];
+  defaultProfile: string | null;
+  connections: ControlPlaneEnrollmentStatus[];
+  connectionStatusUnavailable?: boolean;
+}
+
 export type ApprovalMode = "deny" | "ask" | "risk_auto" | "full_access";
 export type AccessProfile = "minimal" | "pinned" | "development" | "allow_all";
 export type ExecutionBoundary =
@@ -1227,6 +1252,8 @@ export interface CreateRunRequest {
   planAction?: PlanRunAction;
   branch?: {
     sourceRunId: string;
+    /** Desktop presentation only; canonical history is resolved natively. */
+    kind?: "aside" | "thread";
   };
   /** Positive override, or USE_CONFIGURED_MAX_TURNS for the server default. */
   maxTurns: number;
diff --git a/apps/desktop/tests/browser/composer-model.spec.ts b/apps/desktop/tests/browser/composer-model.spec.ts
index a3f181084..36c6b5bd7 100644
--- a/apps/desktop/tests/browser/composer-model.spec.ts
+++ b/apps/desktop/tests/browser/composer-model.spec.ts
@@ -20,13 +20,13 @@ test("model settings opens the workspace route and preserves an unsent draft", a
   ).toBeVisible();
   await model.click();
   await expect(
-    page.getByRole("heading", { name: "Providers and models", exact: true }),
+    page.getByRole("heading", { name: "Models", exact: true }),
   ).toBeVisible();
   await expect(
     page.getByRole("button", { name: "Workspace", exact: true }),
   ).toHaveAttribute("aria-pressed", "true");
   await expect(
-    page.getByRole("button", { name: "Providers", exact: true }),
+    page.getByRole("button", { name: "Models", exact: true }),
   ).toHaveAttribute("aria-current", "page");
   await page.getByRole("button", { name: "Back to work", exact: true }).click();
   await expect(
@@ -34,7 +34,7 @@ test("model settings opens the workspace route and preserves an unsent draft", a
   ).toHaveValue(draft);
   await model.press("Enter");
   await expect(
-    page.getByRole("heading", { name: "Providers and models", exact: true }),
+    page.getByRole("heading", { name: "Models", exact: true }),
   ).toBeVisible();
 });
 
diff --git a/apps/desktop/tests/browser/composer-paste.spec.ts b/apps/desktop/tests/browser/composer-paste.spec.ts
index 829616c2c..e22139ef7 100644
--- a/apps/desktop/tests/browser/composer-paste.spec.ts
+++ b/apps/desktop/tests/browser/composer-paste.spec.ts
@@ -53,9 +53,9 @@ test("large pasted text stays compact and the full text is sent", async ({
   expect((await prompt.boundingBox())!.height).toBeLessThan(100);
 
   await prompt.press("Enter");
-  await expect(page.locator(".message-user .message-body")).toHaveText(
-    `Before ${normalized} after`,
-  );
+  await expect(
+    page.locator('article[data-role="user"] .shared-message-body'),
+  ).toHaveText(`Before ${normalized} after`);
   await expect(prompt).toHaveValue("");
   await expect(page.locator(".composer-paste-summary")).toHaveCount(0);
 });
@@ -76,9 +76,9 @@ test("the byte limit uses hidden text and removing a marker drops its payload",
   await expect(page.locator(".composer-paste-summary")).toHaveCount(0);
   await expect(page.getByRole("button", { name: "Send prompt" })).toBeEnabled();
   await prompt.press("Enter");
-  await expect(page.locator(".message-user .message-body")).toHaveText(
-    "Short message",
-  );
+  await expect(
+    page.locator('article[data-role="user"] .shared-message-body'),
+  ).toHaveText("Short message");
 });
 
 test("backspacing the marker edge detaches the hidden paste", async ({
diff --git a/apps/desktop/tests/browser/control-plane-settings.spec.ts b/apps/desktop/tests/browser/control-plane-settings.spec.ts
new file mode 100644
index 000000000..bfd77fcd6
--- /dev/null
+++ b/apps/desktop/tests/browser/control-plane-settings.spec.ts
@@ -0,0 +1,439 @@
+import AxeBuilder from "@axe-core/playwright";
+import { expect, test } from "@playwright/test";
+
+test("uncertain sharing requires restart instead of another mutation", async ({
+  page,
+}) => {
+  await page.goto("/?fixture=cloud&state=disconnected&recovery=1&restart=1");
+  const notice = page
+    .getByRole("alert")
+    .filter({ hasText: "Sharing needs reconciliation" });
+  await expect(notice).toContainText(
+    "Restart Desktop before changing sharing or reconnecting.",
+  );
+  await expect(notice).not.toContainText("Save your choice again");
+  for (const name of [
+    "Reconnect runtime",
+    "Revoke enrollment",
+    "Forget enrollment",
+    "Save conversation sharing",
+  ]) {
+    await expect(
+      page.getByRole("button", { name, exact: true }),
+    ).toBeDisabled();
+  }
+  await expect(
+    page.getByRole("radio", {
+      name: "Control Plane conversations only",
+      exact: true,
+    }),
+  ).toBeDisabled();
+  await page.getByRole("button", { name: "Global", exact: true }).click();
+  await expect(page.locator(".control-plane-workspace-list")).toContainText(
+    "Restart Desktop to reconcile sharing",
+  );
+});
+
+test("sharing recovery stays visible until an explicit saved choice succeeds", async ({
+  page,
+}) => {
+  await page.setViewportSize({ width: 700, height: 850 });
+  await page.goto("/?fixture=cloud&state=disconnected&recovery=1");
+  await page.evaluate(() => {
+    document.documentElement.dataset.theme = "dark";
+    document.documentElement.dataset.palette = "neutral";
+    document.documentElement.dataset.textSize = "large";
+    const host = window as unknown as {
+      __TAURI_INTERNALS__: {
+        invoke: (command: string, parameters: unknown) => Promise<unknown>;
+      };
+      sharingCalls: unknown[];
+    };
+    host.sharingCalls = [];
+    const invoke = host.__TAURI_INTERNALS__.invoke;
+    host.__TAURI_INTERNALS__.invoke = (command, parameters) => {
+      if (
+        command === "cloud_set_workspace_sharing" ||
+        command === "cloud_connect"
+      )
+        host.sharingCalls.push({ command, parameters });
+      return invoke(command, parameters);
+    };
+  });
+  const notice = page.getByRole("alert").filter({
+    hasText: "Sharing needs reconciliation",
+  });
+  await expect(notice).toBeVisible();
+  await expect(notice).toContainText("Synchronization is paused");
+  await page.getByRole("button", { name: "Global", exact: true }).click();
+  await expect(page.locator(".control-plane-workspace-list")).toContainText(
+    "Sharing needs reconciliation",
+  );
+  await expect(page.locator(".control-plane-workspace-list")).not.toContainText(
+    "Local history private",
+  );
+  await page.getByRole("button", { name: "Workspace", exact: true }).click();
+  await expect(notice).toBeVisible();
+  await page
+    .getByRole("radio", { name: "Share Desktop history for viewing" })
+    .click();
+  expect(
+    await page.evaluate(
+      () => (window as unknown as { sharingCalls: unknown[] }).sharingCalls,
+    ),
+  ).toEqual([]);
+  await expect(notice).toBeVisible();
+  const result = await new AxeBuilder({ page })
+    .include(".managed-settings-shell")
+    .analyze();
+  expect(result.violations).toEqual([]);
+  expect(
+    await page
+      .locator(".cloud-settings")
+      .evaluate((body) => body.scrollWidth <= body.clientWidth),
+  ).toBe(true);
+  await page.screenshot({
+    path: "output/playwright/control-plane-sharing-recovery.png",
+  });
+  await page.getByRole("button", { name: "Save conversation sharing" }).click();
+  await expect(notice).toHaveCount(0);
+  expect(
+    await page.evaluate(
+      () => (window as unknown as { sharingCalls: unknown[] }).sharingCalls,
+    ),
+  ).toEqual([
+    {
+      command: "cloud_set_workspace_sharing",
+      parameters: {
+        targetId: "preview-workspace",
+        enabled: true,
+        allowContinuation: false,
+      },
+    },
+  ]);
+});
+
+test("workspace Control Plane uses compact settings geometry and defers sharing to Save", async ({
+  page,
+}) => {
+  await page.setViewportSize({ width: 1180, height: 850 });
+  await page.emulateMedia({ colorScheme: "light" });
+  await page.goto("/?fixture=cloud&state=connected");
+  await expect(
+    page.getByRole("radio", { name: "Control Plane conversations only" }),
+  ).toBeChecked();
+  const geometry = await page.locator(".cloud-settings").evaluate((body) => {
+    const group = body.querySelector('[role="radiogroup"]')!;
+    return {
+      gutter: Number.parseFloat(getComputedStyle(body).paddingLeft),
+      groupWidth: group.getBoundingClientRect().width,
+      rows: [...group.querySelectorAll("button")].map((button) => ({
+        width: button.getBoundingClientRect().width,
+        height: button.getBoundingClientRect().height,
+      })),
+    };
+  });
+  expect(geometry.gutter).toBeGreaterThanOrEqual(20);
+  for (const row of geometry.rows) {
+    expect(row.height).toBeLessThanOrEqual(40);
+    expect(row.width).toBeLessThan(geometry.groupWidth);
+  }
+  await page.evaluate(() => {
+    const host = window as unknown as {
+      __TAURI_INTERNALS__: {
+        invoke: (command: string, parameters: unknown) => Promise<unknown>;
+      };
+      sharingCalls: unknown[];
+    };
+    host.sharingCalls = [];
+    const invoke = host.__TAURI_INTERNALS__.invoke;
+    host.__TAURI_INTERNALS__.invoke = (command, parameters) => {
+      if (command === "cloud_set_workspace_sharing")
+        host.sharingCalls.push(parameters);
+      return invoke(command, parameters);
+    };
+  });
+  const first = page.getByRole("radio", {
+    name: "Control Plane conversations only",
+  });
+  await first.focus();
+  await page.keyboard.press("End");
+  await expect(
+    page.getByRole("radio", { name: "Share history and allow continuation" }),
+  ).toBeFocused();
+  await expect(
+    page.getByRole("radio", { name: "Share history and allow continuation" }),
+  ).toBeChecked();
+  expect(
+    await page.evaluate(
+      () => (window as unknown as { sharingCalls: unknown[] }).sharingCalls,
+    ),
+  ).toEqual([]);
+  await page.getByRole("button", { name: "Save conversation sharing" }).click();
+  expect(
+    await page.evaluate(
+      () => (window as unknown as { sharingCalls: unknown[] }).sharingCalls,
+    ),
+  ).toEqual([
+    { targetId: "preview-workspace", enabled: true, allowContinuation: true },
+  ]);
+  const result = await new AxeBuilder({ page })
+    .include(".managed-settings-shell")
+    .analyze();
+  expect(result.violations).toEqual([]);
+  await page.screenshot({
+    path: "output/playwright/control-plane-settings-light.png",
+  });
+});
+
+test("compact Large settings keep enrollment and global connection editing inside shared gutters", async ({
+  page,
+}) => {
+  await page.setViewportSize({ width: 700, height: 850 });
+  await page.goto("/?fixture=cloud&state=new");
+  await page.evaluate(() => {
+    document.documentElement.dataset.theme = "dark";
+    document.documentElement.dataset.palette = "neutral";
+    document.documentElement.dataset.textSize = "large";
+  });
+  await expect(
+    page.getByLabel("Enrollment URL", { exact: true }),
+  ).toBeVisible();
+  expect(
+    await page
+      .locator(".cloud-settings")
+      .evaluate((body) => body.scrollWidth <= body.clientWidth),
+  ).toBe(true);
+  const input = await page
+    .getByLabel("Enrollment URL", { exact: true })
+    .boundingBox();
+  const content = await page.locator(".settings-main").boundingBox();
+  expect(input!.x).toBeGreaterThan(content!.x);
+  expect(input!.x + input!.width).toBeLessThanOrEqual(
+    content!.x + content!.width,
+  );
+  await page.screenshot({
+    path: "output/playwright/control-plane-enrollment-compact-large.png",
+  });
+  await page.goto("/?fixture=cloud&state=connected");
+  await page.evaluate(() => {
+    document.documentElement.dataset.theme = "dark";
+    document.documentElement.dataset.palette = "neutral";
+    document.documentElement.dataset.textSize = "large";
+  });
+  await expect(
+    page.getByRole("radio", { name: "Control Plane conversations only" }),
+  ).toBeChecked();
+  expect(
+    await page
+      .locator(".cloud-settings")
+      .evaluate((body) => body.scrollWidth <= body.clientWidth),
+  ).toBe(true);
+  await page.screenshot({
+    path: "output/playwright/control-plane-sharing-compact-large.png",
+  });
+  await page.getByRole("button", { name: "Global", exact: true }).click();
+  await page
+    .getByRole("button", { name: "Add connection", exact: true })
+    .click();
+  await page
+    .getByLabel("Connection name", { exact: true })
+    .fill("Preview team");
+  await page
+    .getByLabel("Web endpoint", { exact: true })
+    .fill("https://control-plane.example.com");
+  await page
+    .getByRole("button", { name: "Save connection", exact: true })
+    .click();
+  await expect(
+    page.getByRole("button", { name: "Edit Preview team", exact: true }),
+  ).toBeVisible();
+  expect(
+    await page
+      .locator(".control-plane-settings")
+      .evaluate((body) => body.scrollWidth <= body.clientWidth),
+  ).toBe(true);
+  await expect(
+    page.getByRole("heading", {
+      name: "Enrolled workspace runtimes",
+      exact: true,
+    }),
+  ).toBeVisible();
+  await page.screenshot({
+    path: "output/playwright/control-plane-settings-compact-large.png",
+  });
+});
+
+test("Connections reports enrolled states, treats bookmarks separately, and manages the exact workspace without activation", async ({
+  page,
+}) => {
+  await page.setViewportSize({ width: 1280, height: 950 });
+  await page.goto("/?fixture=operations-studio");
+  await expect(
+    page.getByRole("heading", { name: "Harden desktop agent bootstrap" }),
+  ).toBeVisible();
+  await page.evaluate(async () => {
+    const modulePath = "/src/components/ManagedSettingsPane.tsx";
+    const { buildManagedSettingsFixture } = await import(modulePath);
+    const snapshot = buildManagedSettingsFixture({
+      selectedSpaceId: "fixture-managed-local",
+      spaces: [
+        {
+          spaceId: "fixture-managed-local",
+          displayName: "Colossus",
+          displayPath: "~/tools/Colossus",
+          archived: false,
+        },
+        {
+          spaceId: "fixture-research",
+          displayName: "Research Lab",
+          displayPath: "~/tools/research-lab",
+          archived: false,
+        },
+      ],
+      managedModelConfiguration: { providers: [], models: [], roles: {} },
+      accessProfile: "minimal",
+      executionBoundary: "offline_isolated",
+    });
+    const catalog = {
+      revision: 1,
+      profiles: [
+        {
+          id: "sample",
+          label: "Saved team endpoint",
+          endpoint: "https://bookmark.example.test",
+        },
+      ],
+      defaultProfile: "sample",
+      connections: [
+        {
+          targetId: "fixture-managed-local",
+          status: "connected",
+          projectId: "sample-project",
+          endpoint: "https://control-plane.example.test",
+          sharedSessions: false,
+        },
+        {
+          targetId: "fixture-research",
+          status: "disconnected",
+          projectId: "sample-project",
+          endpoint: "https://control-plane.example.test",
+          sharedSessions: false,
+        },
+      ],
+    };
+    const host = window as unknown as {
+      __TAURI_INTERNALS__: unknown;
+      controlPlaneFixture: {
+        fail: boolean;
+        calls: { command: string; parameters: unknown }[];
+      };
+    };
+    host.controlPlaneFixture = { fail: false, calls: [] };
+    host.__TAURI_INTERNALS__ = {
+      invoke: async (
+        command: string,
+        parameters: { targetId?: string } = {},
+      ) => {
+        host.controlPlaneFixture.calls.push({ command, parameters });
+        if (command === "control_plane_profiles") {
+          if (host.controlPlaneFixture.fail)
+            throw new Error("Synthetic status unavailable");
+          return catalog;
+        }
+        if (command === "get_managed_configuration") return snapshot;
+        if (command === "list_setup_packages") return [];
+        if (command === "cloud_status")
+          return {
+            ...catalog.connections[1],
+            targetId: parameters.targetId,
+            nodeId: "sample-node",
+            hostId: "sample-host",
+            sharingSupported: true,
+            sharedContinuation: false,
+          };
+        throw new Error("Unsupported read-only fixture command");
+      },
+    };
+  });
+  await page.getByRole("button", { name: "Connections", exact: true }).click();
+  const plane = page.getByRole("region", {
+    name: "Control Plane connections",
+    exact: true,
+  });
+  await expect(plane.getByText("Connected", { exact: true })).toBeVisible();
+  await expect(plane.getByText("Disconnected", { exact: true })).toBeVisible();
+  await expect(
+    plane.getByText("Default bookmark", { exact: true }),
+  ).toBeVisible();
+  await expect(
+    plane
+      .locator(".control-plane-bookmarks")
+      .getByText("Connected", { exact: true }),
+  ).toHaveCount(0);
+  await page.screenshot({
+    path: "output/playwright/control-plane-connections.png",
+  });
+  await page.evaluate(() => {
+    (
+      window as unknown as { controlPlaneFixture: { fail: boolean } }
+    ).controlPlaneFixture.fail = true;
+  });
+  await plane
+    .getByRole("button", { name: "Refresh status", exact: true })
+    .click();
+  await expect(plane.getByText("Unknown", { exact: true })).toHaveCount(2);
+  await expect(plane.getByText("Connected", { exact: true })).toHaveCount(0);
+  await page.evaluate(() => {
+    (
+      window as unknown as { controlPlaneFixture: { fail: boolean } }
+    ).controlPlaneFixture.fail = false;
+  });
+  await plane
+    .getByRole("button", { name: "Refresh status", exact: true })
+    .click();
+  await expect(plane.getByText("Connected", { exact: true })).toBeVisible();
+  await plane
+    .getByRole("button", {
+      name: "Manage Control Plane for Research Lab",
+      exact: true,
+    })
+    .click();
+  await expect(
+    page.getByRole("radio", {
+      name: "Control Plane conversations only",
+      exact: true,
+    }),
+  ).toBeVisible();
+  await expect(
+    page.locator(".space-settings-context .app-select-trigger"),
+  ).toContainText("Research Lab");
+  const calls = await page.evaluate(
+    () =>
+      (
+        window as unknown as {
+          controlPlaneFixture: {
+            calls: { command: string; parameters: { targetId?: string } }[];
+          };
+        }
+      ).controlPlaneFixture.calls,
+  );
+  expect(
+    calls.some(
+      (call) =>
+        call.command === "cloud_status" &&
+        call.parameters.targetId === "fixture-research",
+    ),
+  ).toBe(true);
+  expect(
+    calls.some((call) =>
+      [
+        "select_target",
+        "select_space",
+        "cloud_connect",
+        "cloud_enroll",
+        "cloud_set_workspace_sharing",
+      ].includes(call.command),
+    ),
+  ).toBe(false);
+});
diff --git a/apps/desktop/tests/browser/model-role-routing.spec.ts b/apps/desktop/tests/browser/model-role-routing.spec.ts
index cf8bdb484..8dd2c9d10 100644
--- a/apps/desktop/tests/browser/model-role-routing.spec.ts
+++ b/apps/desktop/tests/browser/model-role-routing.spec.ts
@@ -1,7 +1,11 @@
 import AxeBuilder from "@axe-core/playwright";
 import { expect, test, type Page } from "@playwright/test";
 
-async function openRouting(page: Page, unconfiguredModel = false) {
+async function openRouting(
+  page: Page,
+  unconfiguredModel = false,
+  section: "Providers" | "Models" | "Routing" = "Routing",
+) {
   await page.setViewportSize({ width: 1440, height: 1000 });
   await page.goto("/?fixture=operations-studio");
   await page.evaluate(async (unconfiguredModel) => {
@@ -136,7 +140,7 @@ async function openRouting(page: Page, unconfiguredModel = false) {
   await page.getByRole("button", { name: "Settings", exact: true }).click();
   await page
     .getByRole("navigation", { name: "Settings sections" })
-    .getByRole("button", { name: "Providers", exact: true })
+    .getByRole("button", { name: section, exact: true })
     .click();
   return page.getByRole("region", { name: "Role routing" });
 }
@@ -144,7 +148,7 @@ async function openRouting(page: Page, unconfiguredModel = false) {
 test("provider and model tests stay in their rows through progress, failure, and retry", async ({
   page,
 }, testInfo) => {
-  await openRouting(page);
+  await openRouting(page, false, "Providers");
   const provider = page.getByRole("group", {
     name: "Provider company",
     exact: true,
@@ -157,12 +161,10 @@ test("provider and model tests stay in their rows through progress, failure, and
   await expect(
     provider.getByRole("button", { name: "Test provider company" }),
   ).toBeEnabled();
-  await expect(
-    general.getByRole("button", { name: "Test model general" }),
-  ).toBeEnabled();
-  await expect(
-    fast.getByRole("button", { name: "Test model fast" }),
-  ).toBeEnabled();
+  await expect(general).toHaveCount(0);
+  await expect(page.getByRole("region", { name: "Role routing" })).toHaveCount(
+    0,
+  );
   await expect(page.locator(".managed-diagnostic-actions")).toHaveCount(0);
   await provider.getByRole("button", { name: "Test provider company" }).click();
   await expect(provider.getByRole("status")).toHaveText("Testing company…");
@@ -172,21 +174,37 @@ test("provider and model tests stay in their rows through progress, failure, and
   await expect(
     provider.getByText("Test passed", { exact: true }),
   ).toBeVisible();
-  await expect(general.getByText("Test passed", { exact: true })).toHaveCount(
-    0,
-  );
   await provider.getByText("Test details", { exact: true }).click();
   await expect(
     provider.getByText("Endpoint responded successfully."),
   ).toBeVisible();
+  await page
+    .getByRole("navigation", { name: "Settings sections" })
+    .getByRole("button", { name: "Models", exact: true })
+    .click();
+  await expect(provider).toHaveCount(0);
+  await expect(
+    general.getByRole("button", { name: "Test model general" }),
+  ).toBeEnabled();
+  await expect(
+    fast.getByRole("button", { name: "Test model fast" }),
+  ).toBeEnabled();
   await general.getByRole("button", { name: "Test model general" }).click();
   await page.evaluate(() => (window as any).rejectProfileTest());
   await expect(general.getByRole("alert")).toContainText(
     "Connection timed out",
   );
+  await page
+    .getByRole("navigation", { name: "Settings sections" })
+    .getByRole("button", { name: "Providers", exact: true })
+    .click();
   await expect(
     provider.getByText("Test passed", { exact: true }),
   ).toBeVisible();
+  await page
+    .getByRole("navigation", { name: "Settings sections" })
+    .getByRole("button", { name: "Models", exact: true })
+    .click();
   await general.getByRole("button", { name: "Test model general" }).click();
   await expect(general.getByRole("alert")).toHaveCount(0);
   await page.evaluate(() => (window as any).finishProfileTest(false));
@@ -209,7 +227,6 @@ test("provider and model tests stay in their rows through progress, failure, and
       request: { spaceId: "fixture-managed-local", profile: "general" },
     })),
   ]);
-  await provider.getByText("Test details", { exact: true }).click();
   await page
     .locator(".settings-main")
     .evaluate((element) => element.scrollTo(0, 0));
@@ -238,7 +255,7 @@ test("provider and model tests stay in their rows through progress, failure, and
 test("newly selected models must be applied before testing", async ({
   page,
 }) => {
-  await openRouting(page, true);
+  await openRouting(page, true, "Models");
   const fast = page.getByRole("group", { name: "Model fast", exact: true });
   await expect(
     fast.getByRole("button", { name: "Test model fast" }),
@@ -277,10 +294,29 @@ test("all seven routes show their purpose and persist optional research assignme
   await expect(
     routing.getByText("Uses general-model · company", { exact: true }),
   ).toHaveCount(7);
-  await planner.click();
+  const map = page.locator(".model-routing-overview");
+  await map.getByText("Routing map", { exact: true }).click();
+  await map
+    .getByRole("button", {
+      name: "role: Research planner. Inherits Primary",
+      exact: true,
+    })
+    .click();
+  await expect(
+    map.getByRole("heading", { name: "Research planner" }),
+  ).toBeVisible();
+  await map
+    .getByRole("combobox", { name: "Research planner assignment", exact: true })
+    .click();
   await page
     .getByRole("option", { name: "fast · fast-model", exact: true })
     .click();
+  await expect(planner).toHaveText("fast · fast-model");
+  await expect(
+    map.locator(".react-flow__node-route").filter({ hasText: "Model" }),
+  ).toHaveCount(2);
+  await expect(map).toContainText("general-model");
+  await expect(map).toContainText("fast-model");
   await page
     .getByRole("button", { name: "Apply Workspace changes", exact: true })
     .click();
@@ -302,6 +338,9 @@ test("all seven routes show their purpose and persist optional research assignme
   await expect(
     routing.getByText("Uses fast-model · company", { exact: true }),
   ).toHaveCount(7);
+  await expect(
+    map.locator(".react-flow__node-route").filter({ hasText: "Model" }),
+  ).toHaveCount(1);
   await planner.click();
   await page.getByRole("option", { name: "Use primary", exact: true }).click();
   await page
@@ -313,7 +352,15 @@ test("all seven routes show their purpose and persist optional research assignme
     )
     .toEqual({ primary: "fast" });
   // Removing primary must expose an explicit choice, not an apparent self-fallback.
+  await page
+    .getByRole("navigation", { name: "Settings sections" })
+    .getByRole("button", { name: "Models", exact: true })
+    .click();
   await page.getByRole("switch", { name: "Select fast", exact: true }).click();
+  await page
+    .getByRole("navigation", { name: "Settings sections" })
+    .getByRole("button", { name: "Routing", exact: true })
+    .click();
   await expect(
     routing.getByRole("combobox", { name: "Primary model", exact: true }),
   ).toHaveText("Choose a model");
@@ -336,6 +383,15 @@ for (const colorScheme of ["light", "dark"] as const) {
       (await new AxeBuilder({ page }).include(".model-role-routing").analyze())
         .violations,
     ).toEqual([]);
+    const map = page.locator(".model-routing-overview");
+    await map.getByText("Routing map", { exact: true }).click();
+    expect(
+      (
+        await new AxeBuilder({ page })
+          .include(".model-routing-overview")
+          .analyze()
+      ).violations,
+    ).toEqual([]);
     await page.setViewportSize({ width: 700, height: 900 });
     await routing
       .getByRole("combobox", {
diff --git a/apps/desktop/tests/browser/operations-studio.spec.ts b/apps/desktop/tests/browser/operations-studio.spec.ts
index f97df0812..7ec7ed9f4 100644
--- a/apps/desktop/tests/browser/operations-studio.spec.ts
+++ b/apps/desktop/tests/browser/operations-studio.spec.ts
@@ -2930,7 +2930,7 @@ test("terminal threads can be archived from the Workspace sidebar", async ({
       name: "Thread actions for Audit ipc boundary",
     })
     .click();
-  const archive = page.getByRole("button", {
+  const archive = page.getByRole("menuitem", {
     name: "Archive Audit ipc boundary",
   });
   await expect(archive).toBeEnabled();
@@ -2964,7 +2964,9 @@ test("threads can be pinned, persisted, and returned to their normal group", asy
       name: "Thread actions for Audit ipc boundary",
     })
     .click();
-  await page.getByRole("button", { name: "Pin Audit ipc boundary" }).click();
+  await page
+    .getByRole("menuitemcheckbox", { name: "Pin Audit ipc boundary" })
+    .click();
 
   const pinned = page.locator(".work-group").filter({
     has: page.getByRole("heading", { name: "Pinned", exact: true }),
@@ -2976,8 +2978,8 @@ test("threads can be pinned, persisted, and returned to their normal group", asy
     })
     .click();
   await expect(
-    page.getByRole("button", { name: "Unpin Audit ipc boundary" }),
-  ).toHaveAttribute("aria-pressed", "true");
+    page.getByRole("menuitemcheckbox", { name: "Unpin Audit ipc boundary" }),
+  ).toHaveAttribute("aria-checked", "true");
 
   await page.reload();
   await page
@@ -2986,10 +2988,12 @@ test("threads can be pinned, persisted, and returned to their normal group", asy
     })
     .click();
   await expect(
-    page.getByRole("button", { name: "Unpin Audit ipc boundary" }),
+    page.getByRole("menuitemcheckbox", { name: "Unpin Audit ipc boundary" }),
   ).toBeAttached();
 
-  await page.getByRole("button", { name: "Unpin Audit ipc boundary" }).click();
+  await page
+    .getByRole("menuitemcheckbox", { name: "Unpin Audit ipc boundary" })
+    .click();
   await expect(pinned).toContainText("Harden desktop agent bootstrap");
   await expect(pinned).not.toContainText("Audit ipc boundary");
 
@@ -2999,7 +3003,9 @@ test("threads can be pinned, persisted, and returned to their normal group", asy
     })
     .click();
   await page
-    .getByRole("button", { name: "Unpin Harden desktop agent bootstrap" })
+    .getByRole("menuitemcheckbox", {
+      name: "Unpin Harden desktop agent bootstrap",
+    })
     .click();
   await expect(pinned).toHaveCount(0);
 
@@ -3020,7 +3026,9 @@ test("pinning remains available while the startup connection settles", async ({
       name: "Thread actions for Audit ipc boundary",
     })
     .click();
-  const pin = page.getByRole("button", { name: "Pin Audit ipc boundary" });
+  const pin = page.getByRole("menuitemcheckbox", {
+    name: "Pin Audit ipc boundary",
+  });
   await expect(pin).toBeEnabled();
   await pin.click();
 
@@ -3030,7 +3038,7 @@ test("pinning remains available while the startup connection settles", async ({
   await expect(pinned).toContainText("Audit ipc boundary");
 });
 
-test("thread actions survive a WebKit blur without a related target", async ({
+test("thread actions support keyboard navigation and restore focus", async ({
   page,
 }) => {
   await page.setViewportSize({ width: 1280, height: 760 });
@@ -3038,30 +3046,254 @@ test("thread actions survive a WebKit blur without a related target", async ({
   const actions = page.getByRole("button", {
     name: "Thread actions for Audit ipc boundary",
   });
-  await actions.click();
-  const pin = page.getByRole("button", { name: "Pin Audit ipc boundary" });
-  await pin.evaluate((button) => {
-    const menu = button.closest("details");
-    const summary = menu?.querySelector("summary") ?? null;
-    if (menu === null || summary === null) {
-      throw new Error("thread actions menu is unavailable");
-    }
-    summary.dispatchEvent(
-      new FocusEvent("blur", { bubbles: true, relatedTarget: null }),
-    );
-    button.focus();
+  await expect(actions).toBeEnabled();
+  await actions.press("ArrowDown");
+  const rename = page.getByRole("menuitem", {
+    name: "Rename Audit ipc boundary",
   });
-  await page.evaluate(
-    () =>
-      new Promise<void>((resolve) => requestAnimationFrame(() => resolve())),
-  );
+  const fork = page.getByRole("menuitem", {
+    name: "Fork Audit ipc boundary",
+  });
+  await expect(rename).toBeFocused();
+  await rename.press("ArrowDown");
+  await expect(fork).toBeFocused();
+  await page
+    .getByRole("menu", { name: "Actions for Audit ipc boundary" })
+    .screenshot({ path: "output/playwright/thread-actions-menu.png" });
+  await fork.press("Escape");
+  await expect(actions).toBeFocused();
+  await expect(fork).toBeHidden();
+});
 
-  await expect(pin).toBeVisible();
-  await pin.click();
-  const pinned = page.locator(".work-group").filter({
-    has: page.getByRole("heading", { name: "Pinned", exact: true }),
+test("forking opens a saved draft without sending until the full composer is used", async ({
+  page,
+}) => {
+  await page.setViewportSize({ width: 1280, height: 760 });
+  const original = page.getByRole("button", {
+    name: /^Audit ipc boundary Execute/u,
   });
-  await expect(pinned).toContainText("Audit ipc boundary");
+  const actions = page.getByRole("button", {
+    name: "Thread actions for Audit ipc boundary",
+  });
+  await actions.click();
+  await page
+    .getByRole("menuitem", { name: "Fork Audit ipc boundary" })
+    .press("Enter");
+  await expect(page.getByRole("dialog", { name: "Fork thread" })).toHaveCount(
+    0,
+  );
+  await expect(
+    page.getByRole("heading", {
+      name: "Audit ipc boundary (fork)",
+      exact: true,
+    }),
+  ).toBeVisible();
+  await expect(original).toBeVisible();
+  await expect(
+    page.getByRole("button", { name: /^Audit ipc boundary \(fork\) Draft/u }),
+  ).toHaveAttribute("aria-current", "page");
+  const prompt = page.getByRole("textbox", { name: "Prompt", exact: true });
+  await expect(prompt).toBeFocused();
+  await expect(prompt).toHaveValue("");
+  await page
+    .getByRole("button", {
+      name: "Thread actions for Audit ipc boundary (fork)",
+    })
+    .click();
+  await page
+    .getByRole("menuitem", { name: "Rename Audit ipc boundary (fork)" })
+    .click();
+  await page
+    .getByRole("textbox", { name: "Thread name" })
+    .fill("Alternative approach");
+  await page.getByRole("button", { name: "Save thread name" }).click();
+  await expect(
+    page.getByRole("heading", { name: "Alternative approach", exact: true }),
+  ).toBeVisible();
+  await expect(page.getByText("Run controls", { exact: true })).toBeVisible();
+  await expect(
+    page.getByRole("button", { name: "Send prompt" }),
+  ).toBeDisabled();
+  await expect(
+    page.getByText("Fork draft", { exact: true }).first(),
+  ).toBeVisible();
+  await page.reload();
+  await page
+    .getByRole("button", { name: /^Alternative approach Draft/u })
+    .click();
+  await expect(
+    page.getByRole("heading", { name: "Alternative approach", exact: true }),
+  ).toBeVisible();
+  await prompt.fill("Explore another approach.");
+  await page.getByRole("button", { name: "Send prompt" }).click();
+  await expect(page.getByText("Fork draft", { exact: true })).toHaveCount(0);
+  await expect(
+    page.getByRole("heading", { name: "Alternative approach", exact: true }),
+  ).toBeVisible();
+  await expect(
+    page.getByText("Explore another approach.", { exact: true }),
+  ).toBeVisible();
+  await expect(original).toBeVisible();
+});
+
+test("unfinished threads cannot be forked or archived", async ({ page }) => {
+  await page.setViewportSize({ width: 1280, height: 760 });
+  await page
+    .getByRole("button", {
+      name: "Thread actions for Harden desktop agent bootstrap",
+    })
+    .click();
+  await expect(
+    page.getByRole("menuitem", { name: "Fork Harden desktop agent bootstrap" }),
+  ).toHaveAttribute("aria-disabled", "true");
+  await expect(
+    page.getByRole("menuitem", {
+      name: "Archive Harden desktop agent bootstrap",
+    }),
+  ).toHaveAttribute("aria-disabled", "true");
+  await expect(
+    page.getByRole("menuitemcheckbox", {
+      name: "Unpin Harden desktop agent bootstrap",
+    }),
+  ).toBeEnabled();
+});
+
+test("fork retains visible source context after the first message is sent", async ({
+  page,
+}) => {
+  await page.setViewportSize({ width: 1280, height: 760 });
+  await page.goto("/?fixture=activity-comparison");
+  await expect(
+    page.getByRole("heading", {
+      name: "Review workspace readiness",
+      exact: true,
+    }),
+  ).toBeVisible();
+  await page
+    .getByRole("button", {
+      name: "Thread actions for Review workspace readiness",
+      exact: true,
+    })
+    .click();
+  await page
+    .getByRole("menuitem", {
+      name: "Fork Review workspace readiness",
+      exact: true,
+    })
+    .click();
+  await expect(page.getByRole("dialog", { name: "Fork thread" })).toHaveCount(
+    0,
+  );
+  const context = page.getByText(
+    "Review this workspace and identify the safest high-impact next task",
+    { exact: true },
+  );
+  await expect(context).toBeVisible();
+  await page
+    .getByRole("textbox", { name: "Prompt", exact: true })
+    .fill("Consider another approach.");
+  await page.getByRole("button", { name: "Send prompt", exact: true }).click();
+  await expect(context).toBeVisible();
+  await expect(
+    page.getByText("Consider another approach.", { exact: true }),
+  ).toBeVisible();
+  await expect(
+    page.getByRole("heading", {
+      name: "Review workspace readiness (fork)",
+      exact: true,
+    }),
+  ).toBeVisible();
+  await page
+    .getByRole("button", { name: /^Review workspace readiness Execute/u })
+    .click();
+  await expect(
+    page.getByText("Consider another approach.", { exact: true }),
+  ).toHaveCount(0);
+  await expect(context).toBeVisible();
+});
+
+test("fork draft opens the full composer at minimum size with Large text", async ({
+  page,
+}) => {
+  for (const [colorTheme, darkPalette] of [
+    ["light", "colossus"],
+    ["dark", "colossus"],
+    ["dark", "neutral"],
+    ["dark", "hacker"],
+  ]) {
+    await page.addInitScript(
+      ({ colorTheme, darkPalette }) => {
+        localStorage.removeItem("colossus.thread-forks:v1");
+        localStorage.setItem(
+          "colossus.desktop.appearance.v1",
+          JSON.stringify({ colorTheme, darkPalette, textSize: "large" }),
+        );
+      },
+      { colorTheme, darkPalette },
+    );
+    await page.goto(FIXTURE);
+    await expect(
+      page.getByRole("heading", { name: "Harden desktop agent bootstrap" }),
+    ).toBeVisible();
+    await page.getByRole("button", { name: "Open work navigation" }).click();
+    await page
+      .getByRole("button", {
+        name: "Thread actions for Audit ipc boundary",
+        exact: true,
+      })
+      .click();
+    const actions = page.getByRole("menu", {
+      name: "Actions for Audit ipc boundary",
+    });
+    await expect(actions).toBeVisible();
+    await expect(actions).toBeInViewport();
+    // Capture the visible popup without an element screenshot's automatic scrolling.
+    await page.screenshot({
+      path: `output/playwright/thread-actions-${colorTheme}-${darkPalette}.png`,
+    });
+    await page
+      .getByRole("menuitem", { name: "Fork Audit ipc boundary", exact: true })
+      .click();
+    await expect(page.getByRole("dialog", { name: "Fork thread" })).toHaveCount(
+      0,
+    );
+    await expect(
+      page.getByRole("dialog", { name: "Workspace navigation" }),
+    ).toHaveCount(0);
+    await expect(
+      page.getByRole("heading", {
+        name: "Audit ipc boundary (fork)",
+        exact: true,
+      }),
+    ).toBeVisible();
+    await expect(
+      page.getByRole("textbox", { name: "Prompt", exact: true }),
+    ).toBeFocused();
+    await expect(page.locator("html")).toHaveAttribute(
+      "data-theme",
+      colorTheme!,
+    );
+    await expect(page.locator("html")).toHaveAttribute(
+      "data-text-size",
+      "large",
+    );
+    const box = await page.locator(".work-composer").boundingBox();
+    expect(box).not.toBeNull();
+    expect(box!.x).toBeGreaterThanOrEqual(0);
+    expect(box!.x + box!.width).toBeLessThanOrEqual(880);
+    expect(box!.y + box!.height).toBeLessThanOrEqual(640);
+    const accessibility = await new AxeBuilder({ page })
+      .include(".work-composer")
+      .analyze();
+    expect(
+      accessibility.violations.filter((violation) =>
+        ["critical", "serious"].includes(violation.impact ?? ""),
+      ),
+    ).toEqual([]);
+    await page.screenshot({
+      path: `output/playwright/thread-fork-${colorTheme}-${darkPalette}.png`,
+    });
+  }
 });
 
 test("search scope is part of the search control", async ({ page }) => {
@@ -3160,20 +3392,22 @@ test("follow-up prompts remain in the same work conversation", async ({
   const followUp = "Now check the Windows preview path";
   await prompt.fill(opening);
   await prompt.press("Enter");
-  await expect(page.locator(".message-user .message-body")).toContainText(
-    opening,
-  );
+  await expect(
+    page.locator('article[data-role="user"] .shared-message-body'),
+  ).toContainText(opening);
 
   await prompt.fill(followUp);
   await prompt.press("Enter");
-  await expect(page.locator(".message-user .message-body")).toHaveCount(2);
   await expect(
-    page.locator(".message-user .message-body").nth(0),
+    page.locator('article[data-role="user"] .shared-message-body'),
+  ).toHaveCount(2);
+  await expect(
+    page.locator('article[data-role="user"] .shared-message-body').nth(0),
   ).toContainText(opening);
   await expect(
-    page.locator(".message-user .message-body").nth(1),
+    page.locator('article[data-role="user"] .shared-message-body').nth(1),
   ).toContainText(followUp);
-  await expect(page.locator(".message-assistant")).toHaveCount(2);
+  await expect(page.locator('article[data-role="assistant"]')).toHaveCount(2);
   await expect(page.getByRole("heading", { name: opening })).toBeVisible();
 
   await page.getByRole("button", { name: "Open work navigation" }).click();
diff --git a/apps/desktop/tests/browser/settings-navigation.spec.ts b/apps/desktop/tests/browser/settings-navigation.spec.ts
index 657783182..3335bab39 100644
--- a/apps/desktop/tests/browser/settings-navigation.spec.ts
+++ b/apps/desktop/tests/browser/settings-navigation.spec.ts
@@ -82,8 +82,16 @@ for (const width of [1586, 880, 700]) {
         }),
       );
     for (const style of sectionStyles) {
-      expect(style, "Settings navigation matches the main sidebar").toEqual(
-        navigationStyle,
+      const { iconWidth, ...sectionStyle } = style;
+      const { iconWidth: navigationIconWidth, ...sidebarStyle } =
+        navigationStyle;
+      expect(
+        sectionStyle,
+        "Settings navigation matches the main sidebar",
+      ).toEqual(sidebarStyle);
+      expect(iconWidth, "Settings icons match the main sidebar").toBeCloseTo(
+        navigationIconWidth,
+        4,
       );
     }
     const pageStyle = async () => {
diff --git a/apps/desktop/vite.config.ts b/apps/desktop/vite.config.ts
index bfd37d3f9..87a81e336 100644
--- a/apps/desktop/vite.config.ts
+++ b/apps/desktop/vite.config.ts
@@ -1,3 +1,5 @@
+import { readFileSync } from "node:fs";
+import tailwindcss from "@tailwindcss/vite";
 import react from "@vitejs/plugin-react";
 import { defineConfig } from "vitest/config";
 
@@ -7,12 +9,30 @@ import { shikiGrammarLiterals } from "./build/shiki-grammar-literals";
 
 export default defineConfig({
   plugins: [
+    {
+      name: "shared-ui-attribution",
+      generateBundle() {
+        this.emitFile({
+          type: "asset",
+          fileName: "shadcn-LICENSE.txt",
+          source: readFileSync(
+            new URL("../ui/assets/shadcn-LICENSE.txt", import.meta.url),
+            "utf8",
+          ),
+        });
+      },
+    },
+    tailwindcss(),
     d3ColorFrozenPrototypeCompatibility(),
     xtermFrozenPrototypeCompatibility(),
     shikiGrammarLiterals(),
     react(),
   ],
   optimizeDeps: {
+    include: [
+      "use-sync-external-store/shim",
+      "use-sync-external-store/shim/with-selector",
+    ],
     // Dependency pre-bundling bypasses the compatibility transform above.
     exclude: [
       "@xterm/xterm",
@@ -49,6 +69,8 @@ export default defineConfig({
         ".npmrc",
         ".yarnrc.yml",
         "**/.git/**",
+        "**/development-credentials/**",
+        "**/.authority-key.env",
         "**/src-tauri/**",
       ],
     },
diff --git a/apps/ui/README.md b/apps/ui/README.md
index c03077efd..5357c93a9 100644
--- a/apps/ui/README.md
+++ b/apps/ui/README.md
@@ -1,25 +1,27 @@
 # Colossus shared UI
 
-`@colossus/ui` is a private source package consumed by Desktop and the VS Code
-webviews from the same checkout. It owns the theme tokens (Colossus blue, light,
-neutral dark, and Hacker), brand mark, settings frame, composer input and controls,
-composer sizing/keyboard behavior, and the accessible dropdown control. Both hosts
-compile this source into their own renderer bundles; this package is not independently
+`@colossus/ui` is a private source package consumed by Desktop, the VS Code
+webviews, and the web control plane from the same checkout. It owns theme tokens
+(Colossus blue, light, neutral dark, and Hacker), the brand mark, application and
+settings frames, compact catalog inventories, shadcn foundations, data tables, composer sizing and
+keyboard behavior, and the accessible dropdown control. Each host compiles this
+source into its own renderer bundle; this package is not independently
 published or versioned for release.
 
 Desktop keeps Tauri commands, appearance persistence, workspace/session orchestration,
 queues, plugins, and capability decisions. VS Code keeps its native extension host,
 worker SDK, credential handling, validated message protocol, and view projections.
 Shared components take presentation props and callbacks only. They cannot import a
-host bridge or transport. A future browser frontend can consume this package while
-its Python backend owns the SDK connection and authentication.
+host bridge or transport. The web host keeps browser appearance persistence, project
+state, authentication, and control-plane requests; the Rust cloud server owns authorization and runtime connections.
 
 The app build and lockfiles remain separate. After changing this package, refresh
-both local file dependencies with `npm ci --ignore-scripts` in `apps/desktop` and
-`apps/vscode`, then run their `check`, `build`, and affected `test:browser` commands.
-CI installs the shared source afresh and runs both app gates when `apps/ui` changes.
+all local file dependencies with `npm ci --ignore-scripts` in `apps/desktop`,
+`apps/vscode`, and `apps/web`, then run their `check`, `build`, and affected browser
+checks. CI installs the shared source afresh and selects the host gates when
+`apps/ui` changes.
 No generated UI bundle needs committing. React is pinned to the same peer version
-in both consumers so each renderer has one React instance.
+in all consumers so each renderer has one React instance.
 
 Neutral dark is the VS Code default. Desktop keeps Colossus blue by default and
 offers neutral dark and Hacker in Global → Appearance → Dark palette. Desktop keeps saved
@@ -27,6 +29,83 @@ custom palette colors while neutral dark or Hacker is selected. Hacker translate
 the TUI palette from `crates/colossus-presentation/src/palette.rs`: green prompts
 and success, pale-green messages, cyan tools, amber warnings, and red errors.
 The shared CSS adds near-black graphical surfaces and retains Colossus typography
-and branding. It is selectable in both apps; preferences remain local to each host.
+and branding. It is selectable in all three apps; preferences remain local to each host.
 Light and high contrast keep their respective token families. The native activity bar, left workspace view, and
 right chat view stay owned by VS Code.
+
+## shadcn foundations
+
+New foundations live in `src/components/ui`, with a `radix-nova` shadcn CLI
+configuration, Tabler icons, Radix composition, and Tailwind v4 utilities. Colossus
+owns the component source and its styling. Buttons and inputs retain native HTML
+behavior for ordinary actions; composed buttons and menus use Radix. Existing
+`Button` variants remain compatible with the compact settings controls.
+
+Import larger components through their own entry point:
+
+```tsx
+import { DataTable, type DataTableColumn } from "@colossus/ui/data-table";
+```
+
+This keeps table and menu dependencies out of hosts that do not use them. The table
+supports sorting, search, column filters, pagination, and column visibility. Hosts
+supply records, row IDs, cells, filter predicates, and action callbacks. It preserves
+the current page during live refresh, clamps pages when records disappear, and resets
+pagination when filters change. Key the component by project or inventory scope.
+Server cursors and history loading remain host decisions; client sorting and filters
+apply to the loaded records, so hosts must explain when more history is available.
+
+`styles/shadcn.css` compiles `ui:` utilities from shared source only, without Tailwind
+Preflight. Its inline token aliases reuse the existing surface, color, typography,
+radius, and focus tokens. Avoid literal palette or text-size utilities in generated
+components. Vite hosts use the Tailwind plugin; VS Code compiles the same stylesheet
+with the pinned Node compiler and Oxide scanner and serves it under its existing CSP. Import the shared stylesheet
+in a new renderer alongside `theme.css` and `select.css`.
+
+Run the pinned CLI from the repository root to inspect the foundation:
+
+```bash
+npx shadcn@4.21.2 info --cwd apps/ui
+```
+
+Add future components in `apps/ui`, then review generated imports, styles, and new
+dependencies against these boundaries. Keep adapters relative within shared source;
+refresh all consumer lockfiles when dependency declarations change. Do not overwrite
+Colossus token adaptations while updating upstream components. The retained MIT
+license is in `assets/shadcn-LICENSE.txt` and accompanies renderer builds.
+
+## Shared conversations
+
+Import conversation components from `@colossus/ui/conversation` to keep Markdown
+parser dependencies outside unrelated settings bundles. `ConversationEntry` owns
+message geometry, avatar, typography, timestamps, and bounded Markdown rendering.
+`ConversationTimeline` provides a common feed container. Hosts supply only released
+content and retain event cursors, ordering, scrolling, tools, and interaction authority.
+
+`ConversationComposer` is a controlled composer with context, controls, queue, notice,
+and stop callbacks. Rich native editors can use `ConversationComposerFrame` around
+host inputs and controls without replacing attachments, dictation, workspace state,
+or submission logic. Buttons inside a composer form must declare their intended type.
+The shared frame never selects models, grants capabilities, invokes tools, or persists
+a draft. Send shortcuts and autosizing reuse the existing shared composer behavior.
+
+`MarkdownContent` sanitizes generated content, omits remote images, and bounds parser
+work by character count, tree depth, and node count. Links are inert by default; hosts
+can supply a `linkComponent` that validates navigation through their own authority.
+Desktop uses its browser controller. VS Code keeps generated links inert. Shared
+styles respond to the same palette and text-size preferences as settings controls.
+
+`ControlPlaneFrame` supplies the web primary rail, an optional scoped sidebar, content
+header, and configurable classification banner. Navigation, authentication, projects,
+and settings remain web/server decisions. It exposes no transport or persistence.
+
+## Charts
+
+Import charts through `@colossus/ui/charts`. The owned shadcn chart foundation
+composes Recharts v3 with scoped semantic color tokens, tooltip content, and legends;
+see the [official shadcn chart documentation](https://ui.shadcn.com/docs/components/radix/chart).
+`ActivityLineChart` uses linear series for supplied daily UTC outcomes. It never fills
+missing days or turns unknown values into zero, and exposes the same data in a table.
+Its accessible Recharts layer supports keyboard inspection. Date-window selection,
+authorization, querying, and coverage remain host decisions. The separate entry point
+keeps chart code out of Desktop and editor renderers that do not use it.
diff --git a/apps/ui/assets/shadcn-LICENSE.txt b/apps/ui/assets/shadcn-LICENSE.txt
new file mode 100644
index 000000000..fad4d887a
--- /dev/null
+++ b/apps/ui/assets/shadcn-LICENSE.txt
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 shadcn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/apps/ui/components.json b/apps/ui/components.json
new file mode 100644
index 000000000..b880ae4d2
--- /dev/null
+++ b/apps/ui/components.json
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://ui.shadcn.com/schema.json",
+  "style": "radix-nova",
+  "rsc": false,
+  "tsx": true,
+  "tailwind": {
+    "config": "",
+    "css": "styles/shadcn.css",
+    "baseColor": "neutral",
+    "cssVariables": true,
+    "prefix": "ui"
+  },
+  "iconLibrary": "tabler",
+  "aliases": {
+    "components": "@colossus/ui/components",
+    "ui": "@colossus/ui/components/ui",
+    "utils": "@colossus/ui/lib/utils",
+    "lib": "@colossus/ui/lib",
+    "hooks": "@colossus/ui/hooks"
+  }
+}
diff --git a/apps/ui/package.json b/apps/ui/package.json
index 1560eff2e..bd20631b9 100644
--- a/apps/ui/package.json
+++ b/apps/ui/package.json
@@ -12,13 +12,30 @@
   "exports": {
     ".": "./src/index.ts",
     "./styles/*": "./styles/*",
-    "./assets/*": "./assets/*"
+    "./assets/*": "./assets/*",
+    "./components/*": "./src/components/*.tsx",
+    "./lib/*": "./src/lib/*.ts",
+    "./hooks/*": "./src/hooks/*.ts",
+    "./data-table": "./src/components/DataTable.tsx",
+    "./conversation": "./src/conversation.ts",
+    "./charts": "./src/charts.ts"
   },
   "peerDependencies": {
     "react": "19.2.7",
     "react-dom": "19.2.7"
   },
   "dependencies": {
-    "@tabler/icons-react": "3.45.0"
+    "@tabler/icons-react": "3.45.0",
+    "@tanstack/react-table": "9.2.6",
+    "class-variance-authority": "0.7.1",
+    "clsx": "2.1.1",
+    "tailwind-merge": "3.7.0",
+    "@radix-ui/react-dropdown-menu": "2.1.24",
+    "@radix-ui/react-slot": "1.3.3",
+    "react-markdown": "10.1.0",
+    "rehype-sanitize": "6.0.0",
+    "remark-gfm": "4.0.1",
+    "recharts": "3.10.1",
+    "react-is": "19.2.7"
   }
 }
diff --git a/apps/ui/src/charts.ts b/apps/ui/src/charts.ts
new file mode 100644
index 000000000..61f945a55
--- /dev/null
+++ b/apps/ui/src/charts.ts
@@ -0,0 +1,14 @@
+export {
+  ActivityLineChart,
+  activityDate,
+  type ActivityPoint,
+} from "./components/ActivityLineChart.js";
+export {
+  ChartContainer,
+  ChartTooltip,
+  ChartTooltipContent,
+  ChartLegend,
+  ChartLegendContent,
+  type ChartConfig,
+  type ChartSeries,
+} from "./components/ui/chart.js";
diff --git a/apps/ui/src/components/ActivityLineChart.tsx b/apps/ui/src/components/ActivityLineChart.tsx
new file mode 100644
index 000000000..5cbab97f7
--- /dev/null
+++ b/apps/ui/src/components/ActivityLineChart.tsx
@@ -0,0 +1,173 @@
+import { useId } from "react";
+import { CartesianGrid, Line, LineChart, XAxis, YAxis } from "recharts";
+import {
+  ChartContainer,
+  ChartTooltip,
+  ChartTooltipContent,
+  ChartLegend,
+  ChartLegendContent,
+  type ChartConfig,
+} from "./ui/chart.js";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "./ui/table.js";
+export interface ActivityPoint {
+  date: string;
+  runs: number | null;
+  completed: number | null;
+  failed: number | null;
+}
+const config = {
+  runs: { label: "Total runs", color: "var(--blue-strong)" },
+  completed: { label: "Completed", color: "var(--green)", dashed: true },
+  failed: { label: "Failed", color: "var(--red)", dashed: true },
+} satisfies ChartConfig;
+const shortDate = new Intl.DateTimeFormat(undefined, {
+  month: "short",
+  day: "numeric",
+  timeZone: "UTC",
+});
+const longDate = new Intl.DateTimeFormat(undefined, {
+  month: "long",
+  day: "numeric",
+  year: "numeric",
+  timeZone: "UTC",
+});
+export function activityDate(value: string, full = false) {
+  const date = new Date(`${value}T00:00:00Z`);
+  return Number.isNaN(date.getTime())
+    ? value
+    : (full ? longDate : shortDate).format(date);
+}
+/** Display only supplied daily outcomes. Unknown values stay gaps; no synthetic days or interpolation. */
+export function ActivityLineChart({
+  data,
+  title = "Daily run activity",
+}: {
+  data: ActivityPoint[];
+  title?: string;
+}) {
+  const tableId = useId();
+  if (!data.length)
+    return (
+      <p className="shared-chart-empty">
+        No released run activity in this period.
+      </p>
+    );
+  return (
+    <div className="shared-activity-plot">
+      <ChartContainer config={config} aria-label={title} role="group">
+        <LineChart
+          accessibilityLayer
+          data={data}
+          margin={{ top: 12, right: 12, bottom: 4, left: 4 }}
+          title={`${title}. Daily UTC buckets; press arrow keys to inspect values.`}
+        >
+          <CartesianGrid
+            vertical={false}
+            stroke="var(--border)"
+            strokeDasharray="3 3"
+          />
+          <XAxis
+            dataKey="date"
+            tickLine={false}
+            axisLine={false}
+            minTickGap={32}
+            tickMargin={12}
+            tickFormatter={(value) => activityDate(String(value))}
+          />
+          <YAxis
+            tickLine={false}
+            axisLine={false}
+            allowDecimals={false}
+            width={40}
+            tickMargin={8}
+            domain={[0, "auto"]}
+          />
+          <ChartTooltip
+            cursor={{ stroke: "var(--border-strong)", strokeDasharray: "3 3" }}
+            content={
+              <ChartTooltipContent
+                labelFormatter={(value) => activityDate(String(value), true)}
+              />
+            }
+          />
+          <ChartLegend content={<ChartLegendContent />} />
+          <Line
+            type="linear"
+            dataKey="runs"
+            name="Total runs"
+            stroke="var(--color-runs)"
+            strokeWidth={2.5}
+            dot={data.length <= 7 ? { r: 3, strokeWidth: 0 } : false}
+            activeDot={{ r: 4, strokeWidth: 2, stroke: "var(--surface)" }}
+            connectNulls={false}
+            isAnimationActive={false}
+          />
+          <Line
+            type="linear"
+            dataKey="completed"
+            name="Completed"
+            stroke="var(--color-completed)"
+            strokeWidth={2}
+            strokeDasharray="6 3"
+            dot={false}
+            activeDot={{ r: 4 }}
+            connectNulls={false}
+            isAnimationActive={false}
+          />
+          <Line
+            type="linear"
+            dataKey="failed"
+            name="Failed"
+            stroke="var(--color-failed)"
+            strokeWidth={2}
+            strokeDasharray="2 3"
+            dot={false}
+            activeDot={{ r: 4 }}
+            connectNulls={false}
+            isAnimationActive={false}
+          />
+        </LineChart>
+      </ChartContainer>
+      <div className="shared-chart-footer">
+        <span>Daily execution outcomes · UTC</span>
+        <details className="shared-chart-data">
+          <summary aria-controls={tableId}>View data table</summary>
+          <div className="shared-chart-table" id={tableId}>
+            <Table>
+              <caption>{title} · supplied daily UTC outcomes</caption>
+              <TableHeader>
+                <TableRow>
+                  <TableHead scope="col">Date</TableHead>
+                  <TableHead scope="col">Total runs</TableHead>
+                  <TableHead scope="col">Completed</TableHead>
+                  <TableHead scope="col">Failed</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {data.map((day) => (
+                  <TableRow key={day.date}>
+                    <TableHead scope="row">
+                      <time dateTime={day.date}>
+                        {activityDate(day.date, true)}
+                      </time>
+                    </TableHead>
+                    <TableCell>{day.runs ?? "Unavailable"}</TableCell>
+                    <TableCell>{day.completed ?? "Unavailable"}</TableCell>
+                    <TableCell>{day.failed ?? "Unavailable"}</TableCell>
+                  </TableRow>
+                ))}
+              </TableBody>
+            </Table>
+          </div>
+        </details>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/ApplicationFrame.tsx b/apps/ui/src/components/ApplicationFrame.tsx
new file mode 100644
index 000000000..356db78fe
--- /dev/null
+++ b/apps/ui/src/components/ApplicationFrame.tsx
@@ -0,0 +1,74 @@
+import type { ReactNode } from "react";
+import colossusMark from "../../assets/colossus-mark.svg";
+
+/** Application chrome using the same geometry as the shared settings frame. */
+export function ApplicationFrame({
+  title,
+  navigation,
+  current,
+  onNavigate,
+  sidebar,
+  footer,
+  header,
+  children,
+}: {
+  title: string;
+  navigation: readonly {
+    id: string;
+    label: string;
+    icon: ReactNode;
+    badge?: ReactNode;
+  }[];
+  current: string;
+  onNavigate: (id: string) => void;
+  sidebar?: ReactNode;
+  footer?: ReactNode;
+  header?: ReactNode;
+  children: ReactNode;
+}) {
+  return (
+    <div className="managed-settings-shell application-frame">
+      <a className="application-skip-link" href="#main-content">
+        Skip to content
+      </a>
+      <header className="managed-settings-header">
+        <div className="settings-brand">
+          <img src={colossusMark} alt="" />
+          <strong>Colossus</strong>
+          <h1>{title}</h1>
+        </div>
+        <div className="application-header-actions">{header}</div>
+      </header>
+      <div className="settings-frame-layout">
+        <aside className="settings-sidebar">
+          <div className="settings-sidebar-content">
+            {sidebar}
+            <nav className="managed-settings-tabs" aria-label="Main navigation">
+              {navigation.map((item) => (
+                <button
+                  type="button"
+                  key={item.id}
+                  className="sidebar-nav-item"
+                  aria-current={current === item.id ? "page" : undefined}
+                  onClick={() => onNavigate(item.id)}
+                >
+                  {item.icon}
+                  <span>{item.label}</span>
+                  {item.badge ? (
+                    <span className="application-nav-badge">{item.badge}</span>
+                  ) : null}
+                </button>
+              ))}
+            </nav>
+          </div>
+          {footer ? (
+            <div className="settings-sidebar-footer">{footer}</div>
+          ) : null}
+        </aside>
+        <main className="settings-main" id="main-content" tabIndex={-1}>
+          {children}
+        </main>
+      </div>
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/CatalogInventory.tsx b/apps/ui/src/components/CatalogInventory.tsx
new file mode 100644
index 000000000..aaa2ba601
--- /dev/null
+++ b/apps/ui/src/components/CatalogInventory.tsx
@@ -0,0 +1,483 @@
+import {
+  IconActivityHeartbeat,
+  IconChevronRight,
+  IconCloud,
+  IconCpu,
+  IconDots,
+  IconInfoCircle,
+  IconKey,
+  IconPlus,
+  IconSearch,
+  IconTrash,
+  IconX,
+} from "@tabler/icons-react";
+import {
+  Fragment,
+  type ReactNode,
+  useEffect,
+  useId,
+  useRef,
+  useState,
+} from "react";
+import { Button } from "./Controls.js";
+
+export interface CatalogInventoryRow {
+  id: string;
+  label: string;
+  name: string;
+  description: string;
+  icon?: ReactNode;
+  searchText: string;
+  connection: ReactNode;
+  usage: string;
+  details: ReactNode;
+  actionLabel?: string;
+  actionIcon?: ReactNode;
+  actionAriaLabel?: string;
+  mutationDisabled?: boolean;
+  onEdit: () => void;
+  onDelete?: (trigger: HTMLButtonElement) => void;
+}
+
+export interface CatalogInventoryKind {
+  title: string;
+  singular: string;
+  plural: string;
+  column: string;
+  description: string;
+  connectionLabel: string;
+  usageLabel: string;
+  Icon: typeof IconCloud;
+  className: string;
+}
+
+const catalogKinds = {
+  model: {
+    title: "Models",
+    singular: "model",
+    plural: "models",
+    column: "Model",
+    description: "Choose and manage the models your workspaces use.",
+    connectionLabel: "Provider",
+    usageLabel: "Active workspaces",
+    Icon: IconCpu,
+    className: "models-settings",
+  },
+  provider: {
+    title: "Providers",
+    singular: "provider",
+    plural: "providers",
+    column: "Provider",
+    description: "Saved connections for your workspaces.",
+    connectionLabel: "Sign-in",
+    usageLabel: "Configured models",
+    Icon: IconCloud,
+    className: "providers-settings",
+  },
+  credential: {
+    title: "Credentials",
+    singular: "credential",
+    plural: "credentials",
+    column: "Credential",
+    description: "API keys, tokens, and client secrets for your connections.",
+    connectionLabel: "Status",
+    usageLabel: "Used by",
+    Icon: IconKey,
+    className: "credentials-settings",
+  },
+  search: {
+    title: "Search services",
+    singular: "search service",
+    plural: "search services",
+    column: "Service",
+    description:
+      "Saved search services. Enable each service in Workspace settings.",
+    connectionLabel: "Credential",
+    usageLabel: "Active workspaces",
+    Icon: IconSearch,
+    className: "search-settings",
+  },
+  telemetry: {
+    title: "Telemetry connections",
+    singular: "telemetry connection",
+    plural: "telemetry connections",
+    column: "Connection",
+    description: "Manage collectors, exported signals, and audit content.",
+    connectionLabel: "Exported data",
+    usageLabel: "Active workspaces",
+    Icon: IconActivityHeartbeat,
+    className: "telemetry-settings",
+  },
+} as const;
+
+/** Shared presentation only; catalog mutations remain with the host. */
+export function CatalogInventory({
+  kind,
+  summary,
+  rows,
+  busy,
+  editing,
+  onAdd,
+  children,
+  footer,
+  addLabel,
+  emptyDescription,
+  headingLevel = 3,
+}: {
+  kind: keyof typeof catalogKinds | CatalogInventoryKind;
+  summary: string;
+  rows: CatalogInventoryRow[];
+  busy: boolean;
+  editing: boolean;
+  onAdd: () => void;
+  children?: ReactNode;
+  footer?: ReactNode;
+  addLabel?: string;
+  emptyDescription?: string;
+  headingLevel?: 2 | 3;
+}) {
+  const [query, setQuery] = useState("");
+  const search = useRef<HTMLInputElement>(null);
+  const [expanded, setExpanded] = useState<string | null>(null);
+  const id = useId();
+  const {
+    title,
+    singular,
+    plural,
+    column,
+    description,
+    connectionLabel,
+    usageLabel,
+    Icon,
+    className,
+  } = typeof kind === "string" ? catalogKinds[kind] : kind;
+  const Heading = headingLevel === 2 ? "h2" : "h3";
+  const searchLabel =
+    kind === "search" ? "Search services" : `Search ${plural}`;
+  const needle = query.trim().toLocaleLowerCase();
+  const visible = rows.filter((row) =>
+    row.searchText.toLocaleLowerCase().includes(needle),
+  );
+
+  return (
+    <section
+      className={`managed-settings-body ${className} catalog-settings`}
+      aria-labelledby={`${id}-heading`}
+    >
+      <header className="catalog-heading">
+        <div>
+          <Heading id={`${id}-heading`}>{title}</Heading>
+          <p>{description}</p>
+        </div>
+        <Button
+          id={typeof kind === "string" ? `add-${kind}` : undefined}
+          variant="primary"
+          type="button"
+          disabled={busy || editing}
+          onClick={() => {
+            setQuery("");
+            onAdd();
+          }}
+        >
+          <IconPlus size={16} aria-hidden="true" />{" "}
+          {addLabel ?? `Add ${singular}`}
+        </Button>
+      </header>
+      <p className="catalog-summary">{summary}</p>
+      {children}
+      <div className="catalog-search">
+        <IconSearch size={18} aria-hidden="true" />
+        <input
+          ref={search}
+          aria-label={searchLabel}
+          placeholder={searchLabel}
+          value={query}
+          onChange={(event) => setQuery(event.target.value)}
+        />
+        {query ? (
+          <button
+            type="button"
+            className="ui-icon-button"
+            aria-label="Clear search"
+            onClick={() => {
+              setQuery("");
+              search.current?.focus();
+            }}
+          >
+            <IconX size={16} aria-hidden="true" />
+          </button>
+        ) : null}
+      </div>
+      <div className="catalog-table-container">
+        <table className="catalog-table" aria-label={`Configured ${plural}`}>
+          <colgroup>
+            <col className="catalog-name-column" />
+            <col />
+            <col />
+            <col className="catalog-actions-column" />
+          </colgroup>
+          <thead>
+            <tr>
+              <th scope="col">{column}</th>
+              <th scope="col">{connectionLabel}</th>
+              <th scope="col">{usageLabel}</th>
+              <th scope="col">
+                <span className="sr-only">Actions</span>
+              </th>
+            </tr>
+          </thead>
+          <tbody>
+            {visible.map((row) => {
+              const open = expanded === row.id;
+              const detailsId = `${id}-${row.id}-details`;
+              const toggle = () => setExpanded(open ? null : row.id);
+              return (
+                <Fragment key={row.id}>
+                  <tr className="catalog-inventory-row" data-expanded={open}>
+                    <th scope="row">
+                      <div className="catalog-identity">
+                        <span
+                          className={
+                            row.icon ? "catalog-provider-icon" : "resource-icon"
+                          }
+                        >
+                          {row.icon ?? <Icon size={19} aria-hidden="true" />}
+                        </span>
+                        <div>
+                          <button
+                            type="button"
+                            className="catalog-name"
+                            aria-label={`Details for ${row.label}`}
+                            aria-expanded={open}
+                            aria-controls={detailsId}
+                            onClick={toggle}
+                          >
+                            {row.name}
+                          </button>
+                          <small>{row.description}</small>
+                        </div>
+                      </div>
+                    </th>
+                    <td data-label={connectionLabel}>
+                      <span className="catalog-connection">
+                        {row.connection}
+                      </span>
+                    </td>
+                    <td data-label={usageLabel}>
+                      <button
+                        type="button"
+                        className="catalog-text-button catalog-usage"
+                        aria-label={`${kind === "credential" ? "Connections" : usageLabel} for ${row.label}: ${row.usage}`}
+                        aria-expanded={open}
+                        aria-controls={detailsId}
+                        onClick={toggle}
+                      >
+                        {row.usage}
+                        <IconChevronRight size={16} aria-hidden="true" />
+                      </button>
+                    </td>
+                    <td className="catalog-row-actions">
+                      <div className="catalog-action-group">
+                        <button
+                          type="button"
+                          className={
+                            row.actionIcon
+                              ? "ui-icon-button"
+                              : "catalog-text-button"
+                          }
+                          disabled={busy || row.mutationDisabled}
+                          aria-label={
+                            row.actionAriaLabel ?? `Edit ${row.label}`
+                          }
+                          title={row.actionAriaLabel ?? `Edit ${row.label}`}
+                          onClick={row.onEdit}
+                        >
+                          {row.actionIcon ?? row.actionLabel ?? "Edit"}
+                        </button>
+                        {row.onDelete ? (
+                          <CatalogActions
+                            label={row.label}
+                            busy={busy}
+                            deleteDisabled={row.mutationDisabled}
+                            onDetails={() => setExpanded(row.id)}
+                            onDelete={row.onDelete}
+                          />
+                        ) : null}
+                      </div>
+                    </td>
+                  </tr>
+                  <tr
+                    hidden={!open}
+                    className="catalog-detail-row"
+                    id={detailsId}
+                  >
+                    <td colSpan={4}>
+                      <section
+                        className="catalog-details"
+                        aria-label={`Details for ${row.label}`}
+                      >
+                        {row.details}
+                      </section>
+                    </td>
+                  </tr>
+                </Fragment>
+              );
+            })}
+            {!visible.length ? (
+              <tr>
+                <td colSpan={4} className="catalog-empty">
+                  <strong>
+                    {rows.length ? `No matching ${plural}` : `No ${plural} yet`}
+                  </strong>
+                  <p>
+                    {rows.length
+                      ? "Try a different name or clear your search."
+                      : (emptyDescription ??
+                        `Add a ${singular} to get started.`)}
+                  </p>
+                </td>
+              </tr>
+            ) : null}
+          </tbody>
+        </table>
+      </div>
+      <p className={needle ? "catalog-hint" : "sr-only"} role="status">
+        {needle
+          ? `${visible.length} of ${rows.length} ${plural} match your search.`
+          : ""}
+      </p>
+      {footer}
+    </section>
+  );
+}
+
+function CatalogActions({
+  label,
+  busy,
+  onDetails,
+  onDelete,
+  deleteDisabled,
+}: {
+  label: string;
+  busy: boolean;
+  deleteDisabled?: boolean | undefined;
+  onDetails: () => void;
+  onDelete: (trigger: HTMLButtonElement) => void;
+}) {
+  const [open, setOpen] = useState(false);
+  const wrapper = useRef<HTMLDivElement>(null);
+  const trigger = useRef<HTMLButtonElement>(null);
+  const menu = useRef<HTMLDivElement>(null);
+  const id = useId();
+  useEffect(() => {
+    if (!open) return;
+    menu.current?.querySelector<HTMLButtonElement>("button")?.focus();
+    const dismiss = (event: PointerEvent) => {
+      if (
+        event.target instanceof Node &&
+        !wrapper.current?.contains(event.target)
+      )
+        setOpen(false);
+    };
+    document.addEventListener("pointerdown", dismiss);
+    return () => document.removeEventListener("pointerdown", dismiss);
+  }, [open]);
+  const close = () => {
+    setOpen(false);
+    trigger.current?.focus();
+  };
+  return (
+    <div
+      className="catalog-actions-menu"
+      ref={wrapper}
+      onBlur={(event) => {
+        if (!event.currentTarget.contains(event.relatedTarget)) setOpen(false);
+      }}
+    >
+      <button
+        ref={trigger}
+        className="ui-icon-button"
+        type="button"
+        disabled={busy}
+        aria-label={`More actions for ${label}`}
+        aria-haspopup="menu"
+        aria-expanded={open}
+        aria-controls={open ? id : undefined}
+        onClick={() => setOpen(!open)}
+        onKeyDown={(event) => {
+          if (event.key === "ArrowDown" || event.key === "ArrowUp") {
+            event.preventDefault();
+            setOpen(true);
+          }
+        }}
+      >
+        <IconDots size={20} aria-hidden="true" />
+      </button>
+      {open ? (
+        <div
+          ref={menu}
+          id={id}
+          className="catalog-actions-popup"
+          role="menu"
+          aria-label={`Actions for ${label}`}
+          onKeyDown={(event) => {
+            if (event.key === "Escape") {
+              event.preventDefault();
+              event.stopPropagation();
+              close();
+              return;
+            }
+            const items = Array.from(
+              event.currentTarget.querySelectorAll<HTMLButtonElement>(
+                "button:not(:disabled)",
+              ),
+            );
+            const index = items.indexOf(
+              document.activeElement as HTMLButtonElement,
+            );
+            const next =
+              event.key === "ArrowDown"
+                ? (index + 1) % items.length
+                : event.key === "ArrowUp"
+                  ? (index + items.length - 1) % items.length
+                  : event.key === "Home"
+                    ? 0
+                    : event.key === "End"
+                      ? items.length - 1
+                      : null;
+            if (next !== null) {
+              event.preventDefault();
+              items[next]?.focus();
+            }
+          }}
+        >
+          <button
+            type="button"
+            role="menuitem"
+            tabIndex={-1}
+            onClick={() => {
+              close();
+              onDetails();
+            }}
+          >
+            <IconInfoCircle size={16} aria-hidden="true" /> View details
+          </button>
+          <button
+            type="button"
+            role="menuitem"
+            tabIndex={-1}
+            className="catalog-delete-action"
+            disabled={busy || deleteDisabled}
+            aria-label={`Delete ${label}`}
+            onClick={() => {
+              close();
+              onDelete(trigger.current!);
+            }}
+          >
+            <IconTrash size={16} aria-hidden="true" /> Delete
+          </button>
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/ControlPlaneFrame.tsx b/apps/ui/src/components/ControlPlaneFrame.tsx
new file mode 100644
index 000000000..e60fa3b8e
--- /dev/null
+++ b/apps/ui/src/components/ControlPlaneFrame.tsx
@@ -0,0 +1,131 @@
+import type { ReactNode } from "react";
+import colossusMark from "../../assets/colossus-mark.svg";
+export interface ControlPlaneNavigation {
+  id: string;
+  label: string;
+  shortLabel?: string;
+  href?: string;
+  icon: ReactNode;
+  disabled?: boolean;
+}
+export interface ClassificationBanner {
+  enabled: boolean;
+  text: string;
+  tone: "neutral" | "info" | "warning" | "danger";
+  position: "top" | "top_and_bottom";
+}
+export function ControlPlaneFrame({
+  current,
+  navigation,
+  onNavigate,
+  sidebar,
+  header,
+  footer,
+  children,
+  classification,
+  user,
+}: {
+  current: string;
+  navigation: ControlPlaneNavigation[];
+  onNavigate: (id: string) => void;
+  sidebar?: ReactNode;
+  header?: ReactNode;
+  footer?: ReactNode;
+  children: ReactNode;
+  classification?: ClassificationBanner | undefined;
+  user?: ReactNode;
+}) {
+  const banner = classification?.enabled ? (
+    <div
+      className={`control-classification classification-${classification.tone}`}
+      role="note"
+      aria-label="Environment classification"
+    >
+      {classification.text}
+    </div>
+  ) : null;
+  return (
+    <div
+      className={`control-plane-frame ${sidebar ? "has-scope-sidebar" : ""}`}
+    >
+      <a href="#control-main" className="application-skip-link">
+        Skip to content
+      </a>
+      {banner}
+      <div className="control-frame-layout">
+        <aside
+          className="control-primary-rail"
+          aria-label="Control Plane navigation"
+        >
+          <div className="control-brand" title="Colossus Control Plane">
+            <img src={colossusMark} alt="Colossus" />
+          </div>
+          <nav>
+            {navigation.map((item) =>
+              item.href && !item.disabled ? (
+                <a
+                  key={item.id}
+                  href={item.href}
+                  className={current === item.id ? "is-active" : ""}
+                  aria-current={current === item.id ? "page" : undefined}
+                  title={item.label}
+                  aria-label={item.label}
+                  onClick={(event) => {
+                    if (
+                      event.button ||
+                      event.metaKey ||
+                      event.ctrlKey ||
+                      event.shiftKey ||
+                      event.altKey
+                    )
+                      return;
+                    event.preventDefault();
+                    onNavigate(item.id);
+                  }}
+                >
+                  {item.icon}
+                  <span>{item.shortLabel ?? item.label}</span>
+                </a>
+              ) : (
+                <button
+                  key={item.id}
+                  type="button"
+                  className={current === item.id ? "is-active" : ""}
+                  aria-current={current === item.id ? "page" : undefined}
+                  disabled={item.disabled}
+                  onClick={() => onNavigate(item.id)}
+                  title={item.label}
+                  aria-label={item.label}
+                >
+                  {item.icon}
+                  <span>{item.shortLabel ?? item.label}</span>
+                </button>
+              ),
+            )}
+          </nav>
+          <div className="control-rail-footer">
+            {user}
+            {footer}
+          </div>
+        </aside>
+        {sidebar ? (
+          <aside className="control-scope-sidebar" aria-label="Selected scope">
+            {sidebar}
+          </aside>
+        ) : null}
+        <div className="control-frame-main">
+          <header className="control-header">
+            <strong>Control Plane</strong>
+            <div>{header}</div>
+          </header>
+          <main id="control-main" tabIndex={-1}>
+            {children}
+          </main>
+        </div>
+      </div>
+      {classification?.enabled && classification.position === "top_and_bottom"
+        ? banner
+        : null}
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/Controls.tsx b/apps/ui/src/components/Controls.tsx
new file mode 100644
index 000000000..6865d0dd6
--- /dev/null
+++ b/apps/ui/src/components/Controls.tsx
@@ -0,0 +1,30 @@
+import type { ComponentProps } from "react";
+import { buttonVariants } from "./ui/button.js";
+import { Input } from "./ui/input.js";
+
+const variants = {
+  primary: "default",
+  secondary: "outline",
+  tertiary: "ghost",
+  danger: "destructive",
+} as const;
+
+/** Presentation only. Hosts decide whether an action is available. */
+export function Button({
+  variant = "secondary",
+  type = "button",
+  className,
+  ...props
+}: ComponentProps<"button"> & {
+  variant?: keyof typeof variants;
+}) {
+  return (
+    <button
+      {...props}
+      type={type}
+      data-slot="button"
+      className={buttonVariants({ variant: variants[variant], className })}
+    />
+  );
+}
+export const TextInput = Input;
diff --git a/apps/ui/src/components/Conversation.tsx b/apps/ui/src/components/Conversation.tsx
new file mode 100644
index 000000000..8ca1f6ef0
--- /dev/null
+++ b/apps/ui/src/components/Conversation.tsx
@@ -0,0 +1,119 @@
+import {
+  memo,
+  type ReactNode,
+  type RefObject,
+  type HTMLAttributes,
+} from "react";
+import { IconMessageCircle } from "@tabler/icons-react";
+import colossusMark from "../../assets/colossus-mark.svg";
+import { MarkdownContent, type MarkdownLink } from "./MarkdownContent.js";
+
+export interface ConversationEntryProps {
+  role: "user" | "assistant" | "tool" | "system";
+  author?: string;
+  createdAt?: string;
+  content?: string;
+  markdown?: boolean;
+  streaming?: boolean;
+  status?: ReactNode;
+  actions?: ReactNode;
+  children?: ReactNode;
+  linkComponent?: MarkdownLink | undefined;
+  className?: string;
+}
+export const ConversationEntry = /* @__PURE__ */ memo(
+  function ConversationEntry({
+    role,
+    author,
+    createdAt,
+    content,
+    markdown = role === "assistant",
+    streaming = false,
+    status,
+    actions,
+    children,
+    linkComponent,
+    className = "",
+  }: ConversationEntryProps) {
+    const title =
+      author ??
+      (role === "user"
+        ? "You"
+        : role === "assistant"
+          ? "Colossus"
+          : role === "tool"
+            ? "Tool"
+            : "System");
+    const timestamp = createdAt ? new Date(createdAt) : null;
+    return (
+      <article
+        className={`shared-conversation-entry shared-message-${role} ${className}`}
+        data-role={role}
+        aria-busy={streaming}
+      >
+        <div
+          className={`shared-feed-marker ${role === "assistant" ? "shared-assistant-marker" : ""}`}
+          aria-hidden="true"
+        >
+          {role === "assistant" ? (
+            <img src={colossusMark} alt="" width={17} height={17} />
+          ) : (
+            <IconMessageCircle size={17} stroke={1.7} />
+          )}
+        </div>
+        <div className="shared-feed-content">
+          <header className="shared-feed-heading">
+            <strong>{title}</strong>
+            <div>
+              {status}
+              {timestamp && Number.isFinite(timestamp.getTime()) ? (
+                <time dateTime={createdAt}>
+                  {timestamp.toLocaleTimeString([], {
+                    hour: "numeric",
+                    minute: "2-digit",
+                  })}
+                </time>
+              ) : null}
+            </div>
+          </header>
+          <div className="shared-message-body" data-aside-selectable="true">
+            {content !== undefined ? (
+              markdown ? (
+                <MarkdownContent
+                  content={content}
+                  linkComponent={linkComponent}
+                />
+              ) : (
+                <div className="shared-preserve-lines">{content}</div>
+              )
+            ) : null}
+            {children}
+          </div>
+          {actions ? (
+            <div className="shared-message-actions">{actions}</div>
+          ) : null}
+        </div>
+      </article>
+    );
+  },
+);
+
+/** Hosts own cursors, scroll decisions, capabilities, and the released-data projection. */
+export function ConversationTimeline({
+  children,
+  className = "",
+  ref,
+  ...props
+}: HTMLAttributes<HTMLDivElement> & {
+  ref?: RefObject<HTMLDivElement | null>;
+}) {
+  return (
+    <div
+      {...props}
+      ref={ref}
+      className={`shared-conversation-timeline ${className}`}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/ConversationActivity.tsx b/apps/ui/src/components/ConversationActivity.tsx
new file mode 100644
index 000000000..2da38d92d
--- /dev/null
+++ b/apps/ui/src/components/ConversationActivity.tsx
@@ -0,0 +1,73 @@
+import type { ReactNode } from "react";
+import {
+  IconAlertTriangle,
+  IconCheck,
+  IconChevronDown,
+} from "@tabler/icons-react";
+import colossusMark from "../../assets/colossus-mark.svg";
+
+export type ConversationActivityTone =
+  "success" | "warning" | "danger" | "active" | "neutral";
+
+export interface ConversationActivityProps {
+  description: string;
+  statusLabel: string;
+  tone: ConversationActivityTone;
+  open?: boolean | undefined;
+  exceptionCount?: number;
+  ariaLabel?: string;
+  className?: string;
+  children: ReactNode;
+}
+
+/** Hosts retain run identity, released activity, and all interaction authority. */
+export function ConversationActivity({
+  description,
+  statusLabel,
+  tone,
+  open,
+  exceptionCount = 0,
+  ariaLabel = "Run activity",
+  className = "",
+  children,
+}: ConversationActivityProps) {
+  return (
+    <details
+      className={`run-activity run-activity-thread shared-conversation-activity ${className}`}
+      data-tone={tone}
+      aria-label={ariaLabel}
+      open={open}
+    >
+      <summary className="run-activity-summary">
+        <span className="run-activity-chevron" aria-hidden="true">
+          <IconChevronDown size={16} stroke={1.9} />
+        </span>
+        <span className="run-activity-mark" aria-hidden="true">
+          <img src={colossusMark} alt="" width={17} height={17} />
+        </span>
+        <span className="run-activity-title">
+          <strong>Colossus</strong>
+          <small>{description}</small>
+        </span>
+        <span className={`run-activity-status tone-${tone}`}>
+          {tone === "success" ? (
+            <IconCheck size={15} stroke={2} aria-hidden="true" />
+          ) : tone === "danger" ? (
+            <IconAlertTriangle size={15} stroke={1.9} aria-hidden="true" />
+          ) : null}
+          {statusLabel}
+        </span>
+        {exceptionCount > 0 ? (
+          <span
+            className="run-activity-exceptions"
+            aria-label={`${exceptionCount} failed ${exceptionCount === 1 ? "action" : "actions"}`}
+          >
+            <IconAlertTriangle size={14} stroke={1.8} aria-hidden="true" />
+            {exceptionCount}
+          </span>
+        ) : null}
+      </summary>
+      <div className="run-activity-body">{children}</div>
+    </details>
+  );
+}
diff --git a/apps/ui/src/components/ConversationComposer.tsx b/apps/ui/src/components/ConversationComposer.tsx
new file mode 100644
index 000000000..13147b6dc
--- /dev/null
+++ b/apps/ui/src/components/ConversationComposer.tsx
@@ -0,0 +1,171 @@
+import {
+  useId,
+  useRef,
+  type FormEvent,
+  type HTMLAttributes,
+  type ReactNode,
+  type RefObject,
+  type TextareaHTMLAttributes,
+} from "react";
+import { IconLoader2, IconPlayerStop, IconSend2 } from "@tabler/icons-react";
+import { ComposerInput, isComposerSendKey } from "./Composer.js";
+import { Button } from "./Controls.js";
+
+export function ConversationComposerFrame({
+  children,
+  header,
+  footer,
+  queue,
+  className = "",
+  ref,
+  ...props
+}: Omit<HTMLAttributes<HTMLFormElement>, "onSubmit"> & {
+  onSubmit: (event: FormEvent<HTMLFormElement>) => void;
+  header?: ReactNode;
+  footer?: ReactNode;
+  queue?: ReactNode;
+  ref?: RefObject<HTMLFormElement | null>;
+}) {
+  return (
+    <>
+      <form
+        {...props}
+        ref={ref}
+        className={`shared-conversation-composer ${className}`}
+      >
+        {header ? <div className="shared-composer-header">{header}</div> : null}
+        <div className="shared-composer-body">{children}</div>
+        {footer ? <div className="shared-composer-footer">{footer}</div> : null}
+      </form>
+      {queue}
+    </>
+  );
+}
+export function ConversationComposer({
+  value,
+  onChange,
+  onSubmit,
+  disabled = false,
+  busy = false,
+  label = "Message Colossus",
+  placeholder = "What would you like to work on?",
+  action = "Send",
+  textareaRef,
+  formRef,
+  controls,
+  context,
+  queue,
+  notice,
+  children,
+  onStop,
+  stopping = false,
+  shortcut = "modEnter",
+  textareaProps,
+  className = "",
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  onSubmit: (event: FormEvent<HTMLFormElement>) => void;
+  disabled?: boolean;
+  busy?: boolean;
+  label?: string;
+  placeholder?: string;
+  action?: string;
+  textareaRef?: RefObject<HTMLTextAreaElement | null>;
+  formRef?: RefObject<HTMLFormElement | null>;
+  controls?: ReactNode;
+  context?: ReactNode;
+  queue?: ReactNode;
+  notice?: ReactNode;
+  children?: ReactNode;
+  onStop?: () => void;
+  stopping?: boolean;
+  shortcut?: "enter" | "modEnter";
+  textareaProps?: Omit<
+    TextareaHTMLAttributes<HTMLTextAreaElement>,
+    "value" | "onChange" | "disabled" | "placeholder" | "ref"
+  >;
+  className?: string;
+}) {
+  const id = useId(),
+    localForm = useRef<HTMLFormElement>(null);
+  const targetForm = formRef ?? localForm;
+  const inputId = textareaProps?.id ?? id;
+  return (
+    <div className={`shared-composer-dock ${className}`}>
+      <ConversationComposerFrame
+        ref={targetForm}
+        aria-label={label}
+        onSubmit={onSubmit}
+        header={context}
+        queue={queue}
+        footer={
+          <>
+            <div className="shared-composer-controls">{controls}</div>
+            <div className="shared-composer-run-actions">
+              {busy && onStop ? (
+                <Button
+                  variant="tertiary"
+                  aria-label="Stop active run"
+                  disabled={stopping}
+                  onClick={onStop}
+                >
+                  <IconPlayerStop size={16} aria-hidden="true" />
+                  {stopping ? "Stopping…" : "Stop"}
+                </Button>
+              ) : null}
+              <Button
+                type="submit"
+                variant="primary"
+                className="shared-composer-send"
+                disabled={disabled || busy || !value.trim()}
+                aria-label={action}
+              >
+                {busy ? (
+                  <IconLoader2
+                    size={17}
+                    className="shared-spin"
+                    aria-hidden="true"
+                  />
+                ) : (
+                  <IconSend2 size={17} aria-hidden="true" />
+                )}
+                {action}
+              </Button>
+            </div>
+          </>
+        }
+      >
+        <label className="shared-sr-only" htmlFor={inputId}>
+          {label}
+        </label>
+        <ComposerInput
+          {...textareaProps}
+          id={inputId}
+          {...(textareaRef ? { ref: textareaRef } : {})}
+          value={value}
+          onChange={(event) => onChange(event.target.value)}
+          disabled={disabled}
+          placeholder={placeholder}
+          onKeyDown={(event) => {
+            textareaProps?.onKeyDown?.(event);
+            if (
+              !event.defaultPrevented &&
+              isComposerSendKey(event.nativeEvent, shortcut)
+            ) {
+              event.preventDefault();
+              if (!disabled && !busy && value.trim())
+                targetForm.current?.requestSubmit();
+            }
+          }}
+        />
+        {children}
+      </ConversationComposerFrame>
+      {notice ? (
+        <div className="shared-composer-notice" role="status">
+          {notice}
+        </div>
+      ) : null}
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/DataTable.tsx b/apps/ui/src/components/DataTable.tsx
new file mode 100644
index 000000000..c768ccb71
--- /dev/null
+++ b/apps/ui/src/components/DataTable.tsx
@@ -0,0 +1,405 @@
+import { useEffect, useMemo, useState, type ReactNode } from "react";
+import {
+  columnFilteringFeature,
+  columnVisibilityFeature,
+  rowPaginationFeature,
+  rowSortingFeature,
+  createFilteredRowModel,
+  createPaginatedRowModel,
+  createSortedRowModel,
+  createColumnHelper,
+  filterFn_includesString,
+  sortFn_alphanumeric,
+  tableFeatures,
+  useTable,
+  type ColumnFiltersState,
+  type ColumnVisibilityState,
+  type PaginationState,
+  type SortingState,
+} from "@tanstack/react-table";
+import {
+  IconArrowDown,
+  IconArrowUp,
+  IconArrowsSort,
+  IconChevronLeft,
+  IconChevronRight,
+  IconColumns3,
+  IconSearch,
+} from "@tabler/icons-react";
+import { Button, TextInput } from "./Controls.js";
+import { DropdownSelect } from "./DropdownSelect.js";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "./ui/table.js";
+import {
+  DropdownMenu,
+  DropdownMenuCheckboxItem,
+  DropdownMenuContent,
+  DropdownMenuGroup,
+  DropdownMenuLabel,
+  DropdownMenuTrigger,
+} from "./ui/dropdown-menu.js";
+
+const features = /* @__PURE__ */ tableFeatures({
+  columnFilteringFeature,
+  columnVisibilityFeature,
+  rowPaginationFeature,
+  rowSortingFeature,
+  filteredRowModel: /* @__PURE__ */ createFilteredRowModel(),
+  paginatedRowModel: /* @__PURE__ */ createPaginatedRowModel(),
+  sortedRowModel: /* @__PURE__ */ createSortedRowModel(),
+  filterFns: { includesString: filterFn_includesString },
+  sortFns: { alphanumeric: sortFn_alphanumeric },
+});
+
+export interface DataTableColumn<T> {
+  id: string;
+  label: string;
+  value: (row: T) => string | number;
+  cell?: (row: T) => ReactNode;
+  sortable?: boolean;
+  hideable?: boolean;
+  rowHeader?: boolean;
+  className?: string;
+  filter?: {
+    label: string;
+    options: { value: string; label: string }[];
+    matches: (row: T, value: string) => boolean;
+  };
+}
+export interface DataTableProps<T> {
+  data: T[];
+  columns: DataTableColumn<T>[];
+  getRowId: (row: T) => string;
+  label: string;
+  itemLabel?: string;
+  search?: { columnId: string; label: string };
+  initialSorting?: SortingState;
+  empty?: ReactNode;
+  loading?: boolean;
+  footer?: ReactNode;
+}
+
+/** A presentation-only table. Hosts provide data, permissions, and action callbacks. */
+export function DataTable<T extends object>({
+  data,
+  columns,
+  getRowId,
+  label,
+  itemLabel = "rows",
+  search,
+  initialSorting = [],
+  empty = "No results.",
+  loading = false,
+  footer,
+}: DataTableProps<T>) {
+  const [sorting, setSorting] = useState<SortingState>(initialSorting);
+  const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([]);
+  const [columnVisibility, setColumnVisibility] =
+    useState<ColumnVisibilityState>({});
+  const [pagination, setPagination] = useState<PaginationState>({
+    pageIndex: 0,
+    pageSize: 10,
+  });
+  const definitions = useMemo(() => {
+    const helper = createColumnHelper<typeof features, T>();
+    return helper.columns(
+      columns.map((column) =>
+        helper.accessor(column.value, {
+          id: column.id,
+          header: column.label,
+          enableSorting: column.sortable !== false,
+          enableHiding: column.hideable !== false,
+          sortFn: "alphanumeric",
+          filterFn: column.filter
+            ? (row, _columnId, value: string) =>
+                column.filter!.matches(row.original, value)
+            : "includesString",
+        }),
+      ),
+    );
+  }, [columns]);
+  const table = useTable({
+    features,
+    data,
+    columns: definitions,
+    getRowId,
+    autoResetPageIndex: false,
+    state: { sorting, columnFilters, columnVisibility, pagination },
+    onSortingChange: (updater) => {
+      setSorting(updater);
+      setPagination((previous) => ({ ...previous, pageIndex: 0 }));
+    },
+    onColumnFiltersChange: (updater) => {
+      setColumnFilters(updater);
+      setPagination((previous) => ({ ...previous, pageIndex: 0 }));
+    },
+    onColumnVisibilityChange: setColumnVisibility,
+    onPaginationChange: setPagination,
+  });
+  const count = table.getFilteredRowModel().rows.length;
+  const pageCount = Math.max(1, table.getPageCount());
+  useEffect(() => {
+    // Polling must keep the current page; only clamp it when rows disappear.
+    setPagination((previous) =>
+      previous.pageIndex < pageCount
+        ? previous
+        : { ...previous, pageIndex: pageCount - 1 },
+    );
+  }, [pageCount]);
+  const first = count ? pagination.pageIndex * pagination.pageSize + 1 : 0;
+  const last = Math.min(first + pagination.pageSize - 1, count);
+  const filterColumns = columns.filter((column) => column.filter);
+  return (
+    <div className="ui-data-table" aria-busy={loading}>
+      <div className="ui-data-table-toolbar">
+        {search && (
+          <div className="catalog-search">
+            <IconSearch size={16} aria-hidden="true" />
+            <TextInput
+              type="search"
+              aria-label={search.label}
+              placeholder={search.label}
+              value={
+                (table
+                  .getColumn(search.columnId)
+                  ?.getFilterValue() as string) ?? ""
+              }
+              onChange={(event) =>
+                table
+                  .getColumn(search.columnId)
+                  ?.setFilterValue(event.target.value)
+              }
+            />
+          </div>
+        )}
+        {filterColumns.map((column) => (
+          <DropdownSelect
+            key={column.id}
+            aria-label={column.filter!.label}
+            value={
+              (table.getColumn(column.id)?.getFilterValue() as string) ?? ""
+            }
+            onChange={(event) =>
+              table.getColumn(column.id)?.setFilterValue(event.target.value)
+            }
+          >
+            {column.filter!.options.map((option) => (
+              <option key={option.value} value={option.value}>
+                {option.label}
+              </option>
+            ))}
+          </DropdownSelect>
+        ))}
+        {columnFilters.length > 0 && (
+          <Button variant="tertiary" onClick={() => table.resetColumnFilters()}>
+            Clear filters
+          </Button>
+        )}
+        <div className="ui-data-table-columns">
+          <DropdownMenu modal={false}>
+            <DropdownMenuTrigger asChild>
+              <Button>
+                <IconColumns3 size={16} aria-hidden="true" />
+                Columns
+              </Button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align="end" aria-label="Table columns">
+              <DropdownMenuGroup>
+                <DropdownMenuLabel>Visible columns</DropdownMenuLabel>
+                {columns.map((definition) => {
+                  const column = table.getColumn(definition.id)!;
+                  return (
+                    <DropdownMenuCheckboxItem
+                      key={column.id}
+                      checked={column.getIsVisible()}
+                      disabled={!column.getCanHide()}
+                      onSelect={(event) => event.preventDefault()}
+                      onCheckedChange={(checked) =>
+                        column.toggleVisibility(checked === true)
+                      }
+                    >
+                      {definition.label}
+                    </DropdownMenuCheckboxItem>
+                  );
+                })}
+              </DropdownMenuGroup>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        </div>
+      </div>
+      <div className="ui-data-table-mobile-sort">
+        <DropdownSelect
+          aria-label="Sort rows"
+          value={
+            sorting[0]
+              ? `${sorting[0].id}:${sorting[0].desc ? "desc" : "asc"}`
+              : ""
+          }
+          onChange={(event) => {
+            const [id, direction] = event.target.value.split(":");
+            table.setSorting(id ? [{ id, desc: direction === "desc" }] : []);
+          }}
+        >
+          <option value="">Unsorted</option>
+          {columns
+            .filter((column) => column.sortable !== false)
+            .flatMap((column) => [
+              <option key={`${column.id}:asc`} value={`${column.id}:asc`}>
+                {column.label} · ascending
+              </option>,
+              <option key={`${column.id}:desc`} value={`${column.id}:desc`}>
+                {column.label} · descending
+              </option>,
+            ])}
+        </DropdownSelect>
+      </div>
+      <div className="catalog-table-container">
+        <Table className="catalog-table ui-data-table-grid" aria-label={label}>
+          <TableHeader>
+            {table.getHeaderGroups().map((group) => (
+              <TableRow key={group.id}>
+                {group.headers.map((header) => {
+                  const definition = columns.find(
+                    (column) => column.id === header.column.id,
+                  )!;
+                  const order = header.column.getIsSorted();
+                  return (
+                    <TableHead
+                      key={header.id}
+                      scope="col"
+                      className={definition.className}
+                      aria-sort={
+                        header.column.getCanSort()
+                          ? order === "asc"
+                            ? "ascending"
+                            : order === "desc"
+                              ? "descending"
+                              : "none"
+                          : undefined
+                      }
+                    >
+                      {header.column.getCanSort() ? (
+                        <Button
+                          variant="tertiary"
+                          className="ui-data-table-sort"
+                          onClick={header.column.getToggleSortingHandler()}
+                          aria-label={`Sort by ${definition.label}`}
+                        >
+                          {definition.label}
+                          {order === "asc" ? (
+                            <IconArrowUp size={14} aria-hidden="true" />
+                          ) : order === "desc" ? (
+                            <IconArrowDown size={14} aria-hidden="true" />
+                          ) : (
+                            <IconArrowsSort size={14} aria-hidden="true" />
+                          )}
+                        </Button>
+                      ) : (
+                        definition.label
+                      )}
+                    </TableHead>
+                  );
+                })}
+              </TableRow>
+            ))}
+          </TableHeader>
+          <TableBody>
+            {loading || count === 0 ? (
+              <TableRow>
+                <TableCell
+                  colSpan={table.getVisibleLeafColumns().length}
+                  className="ui-data-table-empty"
+                >
+                  {loading ? <p role="status">Loading…</p> : empty}
+                </TableCell>
+              </TableRow>
+            ) : (
+              table.getRowModel().rows.map((row) => (
+                <TableRow key={row.id} className="catalog-inventory-row">
+                  {row.getVisibleCells().map((cell) => {
+                    const definition = columns.find(
+                      (column) => column.id === cell.column.id,
+                    )!;
+                    return definition.rowHeader ? (
+                      <TableHead
+                        key={cell.id}
+                        scope="row"
+                        className={definition.className}
+                      >
+                        {definition.cell?.(row.original) ??
+                          definition.value(row.original)}
+                      </TableHead>
+                    ) : (
+                      <TableCell
+                        key={cell.id}
+                        data-label={
+                          definition.className === "catalog-row-actions"
+                            ? undefined
+                            : definition.label
+                        }
+                        className={definition.className}
+                      >
+                        {definition.cell?.(row.original) ??
+                          definition.value(row.original)}
+                      </TableCell>
+                    );
+                  })}
+                </TableRow>
+              ))
+            )}
+          </TableBody>
+        </Table>
+      </div>
+      <div className="ui-data-table-pagination">
+        <span role="status">
+          {first}–{last} of {count} {itemLabel}
+        </span>
+        <div className="ui-data-table-page-size">
+          <span>Rows per page</span>
+          <DropdownSelect
+            aria-label="Rows per page"
+            value={String(pagination.pageSize)}
+            onChange={(event) =>
+              table.setPagination({
+                pageIndex: 0,
+                pageSize: Number(event.target.value),
+              })
+            }
+          >
+            {[10, 25, 50].map((size) => (
+              <option key={size} value={String(size)}>
+                {size}
+              </option>
+            ))}
+          </DropdownSelect>
+        </div>
+        <div className="ui-data-table-page-buttons">
+          <span>
+            Page {Math.min(pagination.pageIndex + 1, pageCount)} of {pageCount}
+          </span>
+          <Button
+            aria-label="Previous page"
+            disabled={loading || !table.getCanPreviousPage()}
+            onClick={() => table.previousPage()}
+          >
+            <IconChevronLeft size={16} aria-hidden="true" />
+          </Button>
+          <Button
+            aria-label="Next page"
+            disabled={loading || !table.getCanNextPage()}
+            onClick={() => table.nextPage()}
+          >
+            <IconChevronRight size={16} aria-hidden="true" />
+          </Button>
+        </div>
+      </div>
+      {footer}
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/GraphWorkspace.tsx b/apps/ui/src/components/GraphWorkspace.tsx
new file mode 100644
index 000000000..a6bee6b8a
--- /dev/null
+++ b/apps/ui/src/components/GraphWorkspace.tsx
@@ -0,0 +1,72 @@
+import type { ReactNode, Ref } from "react";
+import { Button } from "./ui/button.js";
+import "../../styles/graph-workspace.css";
+
+/** Transport-free graph chrome; hosts own graph data, selection and persistence. */
+export function GraphWorkspace({
+  children,
+  inspector,
+  inspectorLabel,
+  canvasRef,
+  label,
+  hint,
+  onZoomIn,
+  onZoomOut,
+  onFit,
+  fitLabel = "Fit graph",
+  zoomInIcon = "+",
+  zoomOutIcon = "−",
+  fitIcon,
+}: {
+  children: ReactNode;
+  inspector: ReactNode;
+  inspectorLabel: string;
+  canvasRef?: Ref<HTMLDivElement>;
+  label: string;
+  hint?: ReactNode;
+  onZoomIn: () => void;
+  onZoomOut: () => void;
+  onFit: () => void;
+  fitLabel?: string;
+  zoomInIcon?: ReactNode;
+  zoomOutIcon?: ReactNode;
+  fitIcon?: ReactNode;
+}) {
+  return (
+    <div className="graph-workspace">
+      <div className="graph-workspace__canvas" ref={canvasRef}>
+        <div
+          className="graph-workspace__toolbar"
+          role="group"
+          aria-label={label}
+        >
+          <Button
+            variant="ghost"
+            size="icon"
+            aria-label="Zoom in"
+            onClick={onZoomIn}
+          >
+            {zoomInIcon}
+          </Button>
+          <Button
+            variant="ghost"
+            size="icon"
+            aria-label="Zoom out"
+            onClick={onZoomOut}
+          >
+            {zoomOutIcon}
+          </Button>
+          <Button variant="ghost" size="sm" onClick={onFit}>
+            {fitIcon}
+            {fitLabel}
+          </Button>
+        </div>
+        <div className="graph-workspace__view">{children}</div>
+        {hint ? <span className="graph-workspace__hint">{hint}</span> : null}
+      </div>
+      <aside className="graph-workspace__inspector" aria-label={inspectorLabel}>
+        {inspector}
+      </aside>
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/MarkdownContent.tsx b/apps/ui/src/components/MarkdownContent.tsx
new file mode 100644
index 000000000..6f56663fd
--- /dev/null
+++ b/apps/ui/src/components/MarkdownContent.tsx
@@ -0,0 +1,321 @@
+import {
+  Children,
+  isValidElement,
+  memo,
+  useId,
+  useMemo,
+  useState,
+} from "react";
+import type { ComponentPropsWithoutRef, ComponentType, ReactNode } from "react";
+import rehypeSanitize from "rehype-sanitize";
+import ReactMarkdown from "react-markdown";
+import type { Components, UrlTransform } from "react-markdown";
+import remarkGfm from "remark-gfm";
+export type MarkdownLink = ComponentType<{
+  href?: string | undefined;
+  children?: ReactNode;
+}>;
+
+/** Presentation URL budget only. Hosts retain final navigation authority. */
+export function safeWebLink(value: string | undefined): string | null {
+  if (!value || value.length > 8192 || /[\u0000-\u0020\\]/.test(value))
+    return null;
+  try {
+    const url = new URL(value);
+    return ["https:", "http:"].includes(url.protocol) &&
+      !url.username &&
+      !url.password
+      ? url.href
+      : null;
+  } catch {
+    return null;
+  }
+}
+function InertLink({
+  children,
+}: {
+  href?: string | undefined;
+  children?: ReactNode;
+}) {
+  return <span className="markdown-link-inert">{children}</span>;
+}
+
+export interface MarkdownContentProps {
+  content: string;
+  className?: string;
+  linkComponent?: MarkdownLink | undefined;
+}
+
+interface MarkdownAstNode {
+  type: string;
+  children?: MarkdownAstNode[];
+  depth?: number;
+  value?: string;
+}
+
+interface MarkdownAstRoot extends MarkdownAstNode {
+  children: MarkdownAstNode[];
+}
+
+interface MarkdownFile {
+  value?: unknown;
+}
+
+export const MAX_MARKDOWN_CHARACTERS = 16_384;
+export const MAX_MARKDOWN_AST_NODES = 1_000;
+const MAX_MARKDOWN_AST_DEPTH = 32;
+const STRUCTURE_FALLBACK_NOTICE =
+  "Complex response shown as plain text for performance and safety.";
+
+const ALLOWED_ELEMENTS = [
+  "a",
+  "blockquote",
+  "br",
+  "code",
+  "del",
+  "em",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "img",
+  "input",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "strong",
+  "table",
+  "tbody",
+  "td",
+  "th",
+  "thead",
+  "tr",
+  "ul",
+];
+const REHYPE_PLUGINS = [rehypeSanitize];
+// Presentation-only ordinals identify multiple scroll regions without speaking
+// framework IDs. Allocated once per mount; no transport/state authority lives here.
+let nextScrollRegion = 1;
+
+// Remote images remain blocked. Links become explicit native-browser actions
+// only when a browser controller is available; never privileged-view navigation.
+// Preserve the validated spelling for native checks against saved instructions.
+const safeDestination: UrlTransform = (url, key) =>
+  key === "href" && safeWebLink(url) ? url : null;
+
+function BlockedImage({ alt }: Pick<ComponentPropsWithoutRef<"img">, "alt">) {
+  return (
+    <span className="markdown-image-blocked" role="note">
+      Image omitted{alt === undefined || alt === "" ? "" : `: ${alt}`}
+    </span>
+  );
+}
+
+function MarkdownTable({
+  children,
+}: Pick<ComponentPropsWithoutRef<"table">, "children">) {
+  const labelId = useId();
+  const [ordinal] = useState(() => nextScrollRegion++);
+  function text(node: ReactNode): string {
+    if (typeof node === "string" || typeof node === "number")
+      return String(node);
+    if (isValidElement<{ children?: ReactNode }>(node))
+      return Children.toArray(node.props.children).map(text).join(" ");
+    return "";
+  }
+  const heading = Children.toArray(children).find(
+    (node) => isValidElement(node) && node.type === "thead",
+  );
+  const columns = text(heading).trim().slice(0, 240);
+  return (
+    <div
+      className="markdown-table-scroll"
+      role="region"
+      aria-labelledby={labelId}
+      tabIndex={0}
+    >
+      <span id={labelId} className="shared-sr-only">
+        Scrollable Markdown table {ordinal}
+        {columns ? `: ${columns}` : ""}
+      </span>
+      <table>{children}</table>
+    </div>
+  );
+}
+
+function MarkdownPre({
+  children,
+}: Pick<ComponentPropsWithoutRef<"pre">, "children">) {
+  const [ordinal] = useState(() => nextScrollRegion++);
+  return (
+    <pre
+      role="region"
+      aria-label={`Scrollable Markdown code block ${ordinal}`}
+      tabIndex={0}
+    >
+      {children}
+    </pre>
+  );
+}
+
+function replaceWithPlainText(tree: MarkdownAstRoot, file: MarkdownFile): void {
+  const content = typeof file.value === "string" ? file.value : "";
+  tree.children = [
+    {
+      type: "blockquote",
+      children: [
+        {
+          type: "paragraph",
+          children: [{ type: "text", value: STRUCTURE_FALLBACK_NOTICE }],
+        },
+      ],
+    },
+    { type: "code", value: content },
+  ];
+}
+
+/**
+ * Caps the eventual React tree and keeps response headings beneath the
+ * assistant article heading. The character cap separately bounds parser work.
+ */
+function enforceStructureBudget() {
+  return (tree: MarkdownAstRoot, file: MarkdownFile): void => {
+    let nodeCount = 0;
+    let shallowestHeading = 7;
+    const stack = [{ node: tree as MarkdownAstNode, depth: 0 }];
+
+    while (stack.length > 0) {
+      const current = stack.pop();
+      if (current === undefined) {
+        break;
+      }
+
+      nodeCount += 1;
+      if (
+        nodeCount > MAX_MARKDOWN_AST_NODES ||
+        current.depth > MAX_MARKDOWN_AST_DEPTH
+      ) {
+        replaceWithPlainText(tree, file);
+        return;
+      }
+
+      if (
+        current.node.type === "heading" &&
+        typeof current.node.depth === "number"
+      ) {
+        shallowestHeading = Math.min(shallowestHeading, current.node.depth);
+      }
+
+      for (const child of current.node.children ?? []) {
+        stack.push({ node: child, depth: current.depth + 1 });
+      }
+    }
+
+    if (shallowestHeading > 6) {
+      return;
+    }
+
+    const headingStack = [tree as MarkdownAstNode];
+    while (headingStack.length > 0) {
+      const node = headingStack.pop();
+      if (node === undefined) {
+        break;
+      }
+      if (node.type === "heading" && typeof node.depth === "number") {
+        node.depth = Math.min(6, 4 + node.depth - shallowestHeading);
+      }
+      headingStack.push(...(node.children ?? []));
+    }
+  };
+}
+
+const REMARK_PLUGINS = [remarkGfm, enforceStructureBudget];
+
+const MARKDOWN_COMPONENTS: Components = {
+  a: InertLink,
+  img: BlockedImage,
+  pre: MarkdownPre,
+  table: MarkdownTable,
+  input: ({ checked }) => (
+    <input
+      type="checkbox"
+      checked={checked}
+      disabled
+      tabIndex={-1}
+      readOnly
+      aria-label={checked ? "Completed task" : "Incomplete task"}
+    />
+  ),
+};
+
+function joinClasses(...classes: Array<string | undefined>): string {
+  return classes
+    .filter((value) => value !== undefined && value !== "")
+    .join(" ");
+}
+
+/**
+ * Renders model-authored Markdown without interpreting HTML, fetching remote
+ * media, or allowing model output to navigate the privileged desktop webview.
+ */
+function MarkdownContentView({
+  content,
+  className,
+  linkComponent,
+}: MarkdownContentProps): ReactNode {
+  const classes = joinClasses("shared-markdown", "markdown-content", className);
+  const components = useMemo(
+    () =>
+      linkComponent
+        ? { ...MARKDOWN_COMPONENTS, a: linkComponent }
+        : MARKDOWN_COMPONENTS,
+    [linkComponent],
+  );
+
+  if (content.length > MAX_MARKDOWN_CHARACTERS) {
+    return (
+      <div className={joinClasses(classes, "markdown-content-fallback")}>
+        <p className="markdown-render-notice">
+          Large response shown as plain text for performance and safety.
+        </p>
+        <div className="markdown-plain-text preserve-lines">{content}</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className={classes}>
+      <ReactMarkdown
+        allowedElements={ALLOWED_ELEMENTS}
+        components={components}
+        rehypePlugins={REHYPE_PLUGINS}
+        remarkPlugins={REMARK_PLUGINS}
+        skipHtml
+        urlTransform={safeDestination}
+      >
+        {content}
+      </ReactMarkdown>
+    </div>
+  );
+}
+
+export function markdownContentPropsAreEqual(
+  previous: MarkdownContentProps,
+  next: MarkdownContentProps,
+): boolean {
+  return (
+    previous.content === next.content &&
+    previous.className === next.className &&
+    previous.linkComponent === next.linkComponent
+  );
+}
+
+export const MarkdownContent = /* @__PURE__ */ memo(
+  MarkdownContentView,
+  markdownContentPropsAreEqual,
+);
+MarkdownContent.displayName = "MarkdownContent";
diff --git a/apps/ui/src/components/RadioGroup.tsx b/apps/ui/src/components/RadioGroup.tsx
new file mode 100644
index 000000000..53ea75518
--- /dev/null
+++ b/apps/ui/src/components/RadioGroup.tsx
@@ -0,0 +1,110 @@
+import { useId, useRef, type ReactNode } from "react";
+import { IconCircle, IconCircleCheck } from "@tabler/icons-react";
+import { Button } from "./Controls.js";
+
+export interface RadioGroupOption {
+  value: string;
+  label: string;
+  description?: ReactNode;
+}
+
+/** Accessible choices composed from the shared shadcn button foundation. */
+export function RadioGroup({
+  value,
+  onValueChange,
+  options,
+  disabled = false,
+  variant = "cards",
+  "aria-label": label,
+}: {
+  value: string;
+  onValueChange: (value: string) => void;
+  options: RadioGroupOption[];
+  disabled?: boolean;
+  variant?: "cards" | "compact";
+  "aria-label": string;
+}) {
+  const id = useId();
+  const controls = useRef<(HTMLButtonElement | null)[]>([]);
+  const selected = options.findIndex((option) => option.value === value);
+  return (
+    <div
+      role="radiogroup"
+      aria-label={label}
+      className={
+        variant === "compact"
+          ? "ui-radio-group ui-radio-group--compact"
+          : "ui-radio-group ui:flex ui:flex-col ui:gap-2"
+      }
+    >
+      {options.map((option, index) => {
+        const checked = value === option.value;
+        return (
+          <Button
+            key={option.value}
+            role="radio"
+            aria-checked={checked}
+            aria-describedby={option.description ? `${id}-${index}` : undefined}
+            ref={(element) => {
+              controls.current[index] = element;
+            }}
+            disabled={disabled}
+            tabIndex={index === Math.max(0, selected) ? 0 : -1}
+            variant="secondary"
+            className={
+              variant === "compact"
+                ? "ui-radio-option--compact"
+                : `ui:h-auto ui:justify-start ui:items-start ui:gap-3 ui:px-3 ui:py-3 ui:text-left ui:whitespace-normal ${checked ? "ui:border-primary ui:bg-accent" : ""}`
+            }
+            onClick={() => onValueChange(option.value)}
+            onKeyDown={(event) => {
+              const step =
+                event.key === "ArrowDown" || event.key === "ArrowRight"
+                  ? 1
+                  : event.key === "ArrowUp" || event.key === "ArrowLeft"
+                    ? -1
+                    : 0;
+              const next =
+                event.key === "Home"
+                  ? 0
+                  : event.key === "End"
+                    ? options.length - 1
+                    : step
+                      ? (index + step + options.length) % options.length
+                      : -1;
+              if (next < 0) return;
+              event.preventDefault();
+              onValueChange(options[next]!.value);
+              controls.current[next]?.focus();
+            }}
+          >
+            {checked ? (
+              <IconCircleCheck
+                className="ui:shrink-0"
+                size={18}
+                aria-hidden="true"
+              />
+            ) : (
+              <IconCircle
+                className="ui:shrink-0"
+                size={18}
+                aria-hidden="true"
+              />
+            )}
+            <span className="ui:min-w-0 ui:flex ui:flex-col ui:gap-1">
+              <span>{option.label}</span>
+              {option.description && (
+                <span
+                  id={`${id}-${index}`}
+                  className="ui:font-normal ui:text-xs ui:text-muted-foreground"
+                >
+                  {option.description}
+                </span>
+              )}
+            </span>
+          </Button>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/WorkWelcome.tsx b/apps/ui/src/components/WorkWelcome.tsx
new file mode 100644
index 000000000..e09d064aa
--- /dev/null
+++ b/apps/ui/src/components/WorkWelcome.tsx
@@ -0,0 +1,51 @@
+import { IconSparkles } from "@tabler/icons-react";
+import colossusMark from "../../assets/colossus-mark.svg";
+import { Button } from "./Controls.js";
+
+export const DEFAULT_WORK_STARTERS = [
+  "Orient yourself in this repo",
+  "Plan a secure migration without making external changes",
+  "Coordinate an implementation and security review",
+] as const;
+
+export interface WorkWelcomeProps {
+  eyebrow?: string;
+  title?: string;
+  description?: string;
+  suggestions?: readonly string[];
+  onSuggestion: (suggestion: string) => void;
+  disabled?: boolean;
+}
+
+/** Shared new-work presentation; the host owns drafts, submission and authority. */
+export function WorkWelcome({
+  eyebrow = "Local-first agent workspace",
+  title = "Give Colossus a goal. Keep control of every effect.",
+  description = "Start a task, switch to plan mode, or coordinate specialist work through one policy-bound local connection.",
+  suggestions = DEFAULT_WORK_STARTERS,
+  onSuggestion,
+  disabled = false,
+}: WorkWelcomeProps) {
+  return (
+    <section className="shared-work-welcome" aria-label="Start new work">
+      <img src={colossusMark} alt="" width={56} height={56} />
+      <p className="shared-work-welcome-eyebrow">{eyebrow}</p>
+      <h3>{title}</h3>
+      <p className="shared-work-welcome-description">{description}</p>
+      <div className="shared-work-starters" aria-label="Example prompts">
+        {suggestions.map((suggestion) => (
+          <Button
+            key={suggestion}
+            type="button"
+            variant="tertiary"
+            disabled={disabled}
+            onClick={() => onSuggestion(suggestion)}
+          >
+            <IconSparkles size={17} stroke={1.6} aria-hidden="true" />
+            <span>{suggestion}</span>
+          </Button>
+        ))}
+      </div>
+    </section>
+  );
+}
diff --git a/apps/ui/src/components/WorkspaceSidebar.tsx b/apps/ui/src/components/WorkspaceSidebar.tsx
new file mode 100644
index 000000000..c077f36d8
--- /dev/null
+++ b/apps/ui/src/components/WorkspaceSidebar.tsx
@@ -0,0 +1,156 @@
+import {
+  IconActivity,
+  IconFolder,
+  IconSearch,
+  IconWorld,
+} from "@tabler/icons-react";
+import type { ReactNode, Ref } from "react";
+
+/** Sidebar data, navigation, shortcuts, and workspace authority stay in the host. */
+export function WorkspaceSidebarHeading({
+  actions,
+  id,
+  className = "",
+}: {
+  actions?: ReactNode;
+  id?: string;
+  className?: string;
+}) {
+  return (
+    <div className={`shared-workspace-sidebar-heading ${className}`}>
+      <span id={id}>Workspaces</span>
+      {actions}
+    </div>
+  );
+}
+export function WorkspaceSidebarSearch({
+  value,
+  onChange,
+  inputRef,
+  shortcut,
+  className = "",
+  maxLength,
+}: {
+  value: string;
+  onChange: (value: string) => void;
+  inputRef?: Ref<HTMLInputElement>;
+  shortcut?: ReactNode;
+  className?: string;
+  maxLength?: number;
+}) {
+  return (
+    <div className={`shared-workspace-search ${className}`}>
+      <IconSearch size={17} stroke={1.7} aria-hidden="true" />
+      <input
+        ref={inputRef}
+        type="search"
+        aria-label="Search threads"
+        placeholder="Search threads"
+        value={value}
+        maxLength={maxLength}
+        onChange={(event) => onChange(event.target.value)}
+      />
+      {shortcut ? <kbd aria-hidden="true">{shortcut}</kbd> : null}
+    </div>
+  );
+}
+export type WorkspaceSidebarScopeValue = "all" | "workspace";
+export function WorkspaceSidebarScope({
+  value,
+  onChange,
+  workspaceDisabled = false,
+  className = "",
+}: {
+  value: WorkspaceSidebarScopeValue;
+  onChange: (value: WorkspaceSidebarScopeValue) => void;
+  workspaceDisabled?: boolean;
+  className?: string;
+}) {
+  return (
+    <div
+      className={`shared-workspace-scope ${className}`}
+      role="group"
+      aria-label="Thread search scope"
+    >
+      <button
+        type="button"
+        aria-pressed={value === "all"}
+        onClick={() => onChange("all")}
+      >
+        <IconWorld size={13} stroke={1.8} aria-hidden="true" />
+        All Workspaces
+      </button>
+      <button
+        type="button"
+        aria-pressed={value === "workspace"}
+        disabled={workspaceDisabled}
+        onClick={() => onChange("workspace")}
+      >
+        <IconFolder size={13} stroke={1.8} aria-hidden="true" />
+        This Workspace
+      </button>
+    </div>
+  );
+}
+export function WorkspaceSidebarWorkspace({
+  identity,
+  state,
+  actions,
+  className = "",
+}: {
+  identity: ReactNode;
+  state?: ReactNode;
+  actions?: ReactNode;
+  className?: string;
+}) {
+  return (
+    <div className={`shared-workspace-row ${className}`}>
+      {identity}
+      {state}
+      {actions}
+    </div>
+  );
+}
+export function WorkspaceSidebarGroupHeading({
+  label,
+  count,
+  className = "",
+  icon = <IconActivity size={14} stroke={1.6} aria-hidden="true" />,
+  headingLevel = 3,
+}: {
+  label: string;
+  count: number;
+  className?: string;
+  icon?: ReactNode;
+  headingLevel?: 2 | 3;
+}) {
+  const Heading = headingLevel === 2 ? "h2" : "h3";
+  return (
+    <div className={`shared-workspace-group-heading ${className}`}>
+      {icon}
+      <Heading>{label}</Heading>
+      <span>{count}</span>
+    </div>
+  );
+}
+export function WorkspaceSidebarThreadContent({
+  title,
+  metadata,
+  status,
+}: {
+  title: string;
+  metadata: ReactNode;
+  status?: ReactNode;
+}) {
+  return (
+    <>
+      <span className="shared-workspace-thread-copy">
+        <strong>{title}</strong>
+        <span>{metadata}</span>
+      </span>
+      {status ? (
+        <span className="shared-workspace-thread-state">{status}</span>
+      ) : null}
+    </>
+  );
+}
diff --git a/apps/ui/src/components/ui/badge.tsx b/apps/ui/src/components/ui/badge.tsx
new file mode 100644
index 000000000..65efc0f0f
--- /dev/null
+++ b/apps/ui/src/components/ui/badge.tsx
@@ -0,0 +1,35 @@
+// Adapted from shadcn/ui radix-nova (MIT). See assets/shadcn-LICENSE.txt.
+import type { ComponentProps } from "react";
+import { cva, type VariantProps } from "class-variance-authority";
+import { cn } from "../../lib/utils.js";
+
+const badgeVariants = cva(
+  "ui:inline-flex ui:items-center ui:gap-1 ui:rounded-sm ui:border ui:px-2 ui:py-0.5 ui:text-xs ui:font-medium",
+  {
+    variants: {
+      variant: {
+        default:
+          "ui:border-transparent ui:bg-primary ui:text-primary-foreground",
+        secondary:
+          "ui:border-transparent ui:bg-secondary ui:text-secondary-foreground",
+        outline: "ui:border-border ui:text-foreground",
+        destructive: "ui:border-border ui:text-destructive",
+      },
+    },
+    defaultVariants: { variant: "outline" },
+  },
+);
+
+export function Badge({
+  className,
+  variant,
+  ...props
+}: ComponentProps<"span"> & VariantProps<typeof badgeVariants>) {
+  return (
+    <span
+      data-slot="badge"
+      className={cn(badgeVariants({ variant }), className)}
+      {...props}
+    />
+  );
+}
diff --git a/apps/ui/src/components/ui/button.tsx b/apps/ui/src/components/ui/button.tsx
new file mode 100644
index 000000000..d7444b78b
--- /dev/null
+++ b/apps/ui/src/components/ui/button.tsx
@@ -0,0 +1,46 @@
+// Adapted from shadcn/ui radix-nova (MIT). See assets/shadcn-LICENSE.txt.
+import type { ComponentProps } from "react";
+import { Slot } from "@radix-ui/react-slot";
+import { cva, type VariantProps } from "class-variance-authority";
+import { cn } from "../../lib/utils.js";
+
+const buttonVariants = cva("ui-button", {
+  variants: {
+    variant: {
+      default: "ui-button--primary",
+      outline: "ui-button--secondary",
+      secondary: "ui-button--secondary",
+      ghost: "ui-button--tertiary",
+      destructive: "ui-button--danger",
+      link: "ui-button--link",
+    },
+    size: {
+      default: "",
+      sm: "",
+      lg: "ui-button--large",
+      icon: "ui-button--icon",
+    },
+  },
+  defaultVariants: { variant: "default", size: "default" },
+});
+
+function Button({
+  className,
+  variant = "default",
+  size = "default",
+  type = "button",
+  asChild = false,
+  ...props
+}: ComponentProps<"button"> &
+  VariantProps<typeof buttonVariants> & { asChild?: boolean }) {
+  const Component = asChild ? Slot : "button";
+  return (
+    <Component
+      {...props}
+      type={type}
+      data-slot="button"
+      className={cn(buttonVariants({ variant, size }), className)}
+    />
+  );
+}
+export { Button, buttonVariants };
diff --git a/apps/ui/src/components/ui/chart.tsx b/apps/ui/src/components/ui/chart.tsx
new file mode 100644
index 000000000..7017f33dd
--- /dev/null
+++ b/apps/ui/src/components/ui/chart.tsx
@@ -0,0 +1,138 @@
+// Adapted from the MIT shadcn radix-nova chart registry; Recharts v3 composition.
+// https://ui.shadcn.com/docs/components/radix/chart
+import {
+  createContext,
+  useContext,
+  useId,
+  type CSSProperties,
+  type HTMLAttributes,
+  type ReactElement,
+  type ReactNode,
+} from "react";
+import {
+  ResponsiveContainer,
+  Tooltip,
+  Legend,
+  type TooltipContentProps,
+  type DefaultLegendContentProps,
+} from "recharts";
+export interface ChartSeries {
+  label: ReactNode;
+  color: `var(--${string})`;
+  dashed?: boolean;
+}
+export type ChartConfig = Record<string, ChartSeries>;
+const ChartContext = createContext<ChartConfig | null>(null);
+function useChart() {
+  const config = useContext(ChartContext);
+  if (!config) throw new Error("Chart content requires ChartContainer.");
+  return config;
+}
+export function ChartContainer({
+  config,
+  children,
+  className = "",
+  style,
+  ...props
+}: HTMLAttributes<HTMLDivElement> & {
+  config: ChartConfig;
+  children: ReactElement;
+}) {
+  const id = useId(),
+    colors = Object.fromEntries(
+      Object.entries(config).map(([key, value]) => [
+        `--color-${key}`,
+        value.color,
+      ]),
+    );
+  return (
+    <ChartContext value={config}>
+      <div
+        {...props}
+        data-slot="chart"
+        data-chart={id}
+        className={`shared-chart-container ${className}`}
+        style={{ ...colors, ...style } as CSSProperties}
+      >
+        <ResponsiveContainer
+          width="100%"
+          height="100%"
+          initialDimension={{ width: 640, height: 260 }}
+        >
+          {children}
+        </ResponsiveContainer>
+      </div>
+    </ChartContext>
+  );
+}
+export const ChartTooltip = Tooltip;
+export const ChartLegend = Legend;
+export function ChartTooltipContent({
+  active,
+  payload,
+  label,
+  labelFormatter,
+}: Partial<TooltipContentProps<number, string>> & {
+  labelFormatter?: (value: string) => ReactNode;
+}) {
+  const config = useChart();
+  if (!active || !payload?.length) return null;
+  return (
+    <div className="shared-chart-tooltip">
+      <strong>
+        {labelFormatter ? labelFormatter(String(label)) : String(label)}
+      </strong>
+      <div>
+        {payload
+          .filter(
+            (item) =>
+              item.type !== "none" &&
+              item.value !== undefined &&
+              item.value !== null,
+          )
+          .map((item) => {
+            const key = String(item.dataKey ?? item.name),
+              series = config[key];
+            return (
+              <div className="shared-chart-tooltip-row" key={key}>
+                <span
+                  className={`shared-chart-indicator ${series?.dashed ? "is-dashed" : ""}`}
+                  style={{ borderColor: series?.color ?? item.color }}
+                />
+                <span>{series?.label ?? item.name}</span>
+                <strong>
+                  {typeof item.value === "number"
+                    ? item.value.toLocaleString()
+                    : String(item.value)}
+                </strong>
+              </div>
+            );
+          })}
+      </div>
+    </div>
+  );
+}
+export function ChartLegendContent({
+  payload,
+}: Partial<DefaultLegendContentProps>) {
+  const config = useChart();
+  return (
+    <div className="shared-chart-legend">
+      {payload
+        ?.filter((item) => item.type !== "none")
+        .map((item) => {
+          const key = String(item.dataKey ?? item.value),
+            series = config[key];
+          return (
+            <span key={key}>
+              <i
+                className={`shared-chart-indicator ${series?.dashed ? "is-dashed" : ""}`}
+                style={{ borderColor: series?.color ?? item.color }}
+              />
+              {series?.label ?? item.value}
+            </span>
+          );
+        })}
+    </div>
+  );
+}
diff --git a/apps/ui/src/components/ui/dropdown-menu.tsx b/apps/ui/src/components/ui/dropdown-menu.tsx
new file mode 100644
index 000000000..a356ed035
--- /dev/null
+++ b/apps/ui/src/components/ui/dropdown-menu.tsx
@@ -0,0 +1,64 @@
+// Adapted from shadcn/ui radix-nova (MIT). See assets/shadcn-LICENSE.txt.
+import type { ComponentProps } from "react";
+import * as MenuPrimitive from "@radix-ui/react-dropdown-menu";
+import { IconCheck } from "@tabler/icons-react";
+import { cn } from "../../lib/utils.js";
+
+export const DropdownMenu = MenuPrimitive.Root;
+export const DropdownMenuTrigger = MenuPrimitive.Trigger;
+export const DropdownMenuGroup = MenuPrimitive.Group;
+
+export function DropdownMenuContent({
+  align = "start",
+  sideOffset = 4,
+  className,
+  ...props
+}: ComponentProps<typeof MenuPrimitive.Content>) {
+  return (
+    <MenuPrimitive.Portal>
+      <MenuPrimitive.Content
+        {...props}
+        align={align}
+        sideOffset={sideOffset}
+        data-slot="dropdown-menu-content"
+        className={cn("ui-menu-content", className)}
+      />
+    </MenuPrimitive.Portal>
+  );
+}
+export function DropdownMenuLabel({
+  className,
+  ...props
+}: ComponentProps<typeof MenuPrimitive.Label>) {
+  return (
+    <MenuPrimitive.Label
+      {...props}
+      className={cn("ui-menu-label", className)}
+    />
+  );
+}
+export function DropdownMenuItem({
+  className,
+  ...props
+}: ComponentProps<typeof MenuPrimitive.Item>) {
+  return (
+    <MenuPrimitive.Item {...props} className={cn("ui-menu-item", className)} />
+  );
+}
+export function DropdownMenuCheckboxItem({
+  children,
+  className,
+  ...props
+}: ComponentProps<typeof MenuPrimitive.CheckboxItem>) {
+  return (
+    <MenuPrimitive.CheckboxItem
+      {...props}
+      className={cn("ui-menu-item ui-menu-checkbox", className)}
+    >
+      {children}
+      <MenuPrimitive.ItemIndicator>
+        <IconCheck size={16} aria-hidden="true" />
+      </MenuPrimitive.ItemIndicator>
+    </MenuPrimitive.CheckboxItem>
+  );
+}
diff --git a/apps/ui/src/components/ui/input.tsx b/apps/ui/src/components/ui/input.tsx
new file mode 100644
index 000000000..3c0ef335e
--- /dev/null
+++ b/apps/ui/src/components/ui/input.tsx
@@ -0,0 +1,12 @@
+// Adapted from shadcn/ui's native Input (MIT). See assets/shadcn-LICENSE.txt.
+import type { ComponentProps } from "react";
+
+export function Input({ className, ...props }: ComponentProps<"input">) {
+  return (
+    <input
+      {...props}
+      data-slot="input"
+      className={`ui-input ${className ?? ""}`}
+    />
+  );
+}
diff --git a/apps/ui/src/components/ui/table.tsx b/apps/ui/src/components/ui/table.tsx
new file mode 100644
index 000000000..070feea5e
--- /dev/null
+++ b/apps/ui/src/components/ui/table.tsx
@@ -0,0 +1,57 @@
+// Adapted from shadcn/ui base-nova (MIT). See assets/shadcn-LICENSE.txt.
+import type { ComponentProps } from "react";
+import { cn } from "../../lib/utils.js";
+
+export function Table({ className, ...props }: ComponentProps<"table">) {
+  return (
+    <div
+      data-slot="table-container"
+      className="ui:relative ui:w-full ui:overflow-x-auto"
+    >
+      <table
+        data-slot="table"
+        className={cn("ui-table ui:w-full ui:text-sm", className)}
+        {...props}
+      />
+    </div>
+  );
+}
+export function TableHeader(props: ComponentProps<"thead">) {
+  return <thead data-slot="table-header" {...props} />;
+}
+export function TableBody(props: ComponentProps<"tbody">) {
+  return <tbody data-slot="table-body" {...props} />;
+}
+export function TableFooter(props: ComponentProps<"tfoot">) {
+  return <tfoot data-slot="table-footer" {...props} />;
+}
+export function TableRow({ className, ...props }: ComponentProps<"tr">) {
+  return (
+    <tr
+      data-slot="table-row"
+      className={cn("ui-table-row", className)}
+      {...props}
+    />
+  );
+}
+export function TableHead({ className, ...props }: ComponentProps<"th">) {
+  return (
+    <th
+      data-slot="table-head"
+      className={cn("ui:text-left ui:align-middle", className)}
+      {...props}
+    />
+  );
+}
+export function TableCell({ className, ...props }: ComponentProps<"td">) {
+  return (
+    <td
+      data-slot="table-cell"
+      className={cn("ui:align-middle", className)}
+      {...props}
+    />
+  );
+}
+export function TableCaption(props: ComponentProps<"caption">) {
+  return <caption data-slot="table-caption" {...props} />;
+}
diff --git a/apps/ui/src/conversation.ts b/apps/ui/src/conversation.ts
new file mode 100644
index 000000000..9fcaf717c
--- /dev/null
+++ b/apps/ui/src/conversation.ts
@@ -0,0 +1,26 @@
+/// <reference path="./assets.d.ts" />
+export {
+  ConversationEntry,
+  ConversationTimeline,
+} from "./components/Conversation.js";
+export type { ConversationEntryProps } from "./components/Conversation.js";
+export { ConversationActivity } from "./components/ConversationActivity.js";
+export type {
+  ConversationActivityProps,
+  ConversationActivityTone,
+} from "./components/ConversationActivity.js";
+export {
+  ConversationComposer,
+  ConversationComposerFrame,
+} from "./components/ConversationComposer.js";
+export {
+  MarkdownContent,
+  safeWebLink,
+  markdownContentPropsAreEqual,
+  MAX_MARKDOWN_CHARACTERS,
+  MAX_MARKDOWN_AST_NODES,
+} from "./components/MarkdownContent.js";
+export type {
+  MarkdownLink,
+  MarkdownContentProps,
+} from "./components/MarkdownContent.js";
diff --git a/apps/ui/src/index.ts b/apps/ui/src/index.ts
index de19b3fd2..0c6001e89 100644
--- a/apps/ui/src/index.ts
+++ b/apps/ui/src/index.ts
@@ -1,5 +1,6 @@
 /// <reference path="./assets.d.ts" />
 export { SettingsFrame } from "./components/SettingsFrame.js";
+export { GraphWorkspace } from "./components/GraphWorkspace.js";
 export {
   ComposerInput,
   ComposerModeSwitch,
@@ -16,3 +17,33 @@ export type {
   DropdownSelectChangeEvent,
   DropdownSelectOption,
 } from "./components/DropdownSelect.js";
+
+export { Button, TextInput } from "./components/Controls.js";
+export {
+  WorkspaceSidebarHeading,
+  WorkspaceSidebarSearch,
+  WorkspaceSidebarScope,
+  WorkspaceSidebarWorkspace,
+  WorkspaceSidebarGroupHeading,
+  WorkspaceSidebarThreadContent,
+} from "./components/WorkspaceSidebar.js";
+export type { WorkspaceSidebarScopeValue } from "./components/WorkspaceSidebar.js";
+export { RadioGroup } from "./components/RadioGroup.js";
+export type { RadioGroupOption } from "./components/RadioGroup.js";
+export { ApplicationFrame } from "./components/ApplicationFrame.js";
+export { CatalogInventory } from "./components/CatalogInventory.js";
+export type {
+  CatalogInventoryRow,
+  CatalogInventoryKind,
+} from "./components/CatalogInventory.js";
+
+export { ControlPlaneFrame } from "./components/ControlPlaneFrame.js";
+export {
+  WorkWelcome,
+  DEFAULT_WORK_STARTERS,
+} from "./components/WorkWelcome.js";
+export type { WorkWelcomeProps } from "./components/WorkWelcome.js";
+export type {
+  ControlPlaneNavigation,
+  ClassificationBanner,
+} from "./components/ControlPlaneFrame.js";
diff --git a/apps/ui/src/lib/utils.ts b/apps/ui/src/lib/utils.ts
new file mode 100644
index 000000000..d1a1d1135
--- /dev/null
+++ b/apps/ui/src/lib/utils.ts
@@ -0,0 +1,7 @@
+import { clsx, type ClassValue } from "clsx";
+import { extendTailwindMerge } from "tailwind-merge";
+
+const merge = /* @__PURE__ */ extendTailwindMerge({ prefix: "ui" });
+export function cn(...inputs: ClassValue[]) {
+  return merge(clsx(inputs));
+}
diff --git a/apps/ui/styles/application.css b/apps/ui/styles/application.css
new file mode 100644
index 000000000..5ce62531e
--- /dev/null
+++ b/apps/ui/styles/application.css
@@ -0,0 +1,109 @@
+.application-frame {
+  height: 100dvh;
+  background: var(--main);
+  color: var(--text);
+}
+.application-frame .managed-settings-header {
+  grid-template-columns: minmax(0, 1fr) auto;
+  background: var(--canvas);
+}
+.application-frame .settings-frame-layout {
+  grid-template-columns: var(--settings-sidebar-width) minmax(0, 1fr);
+}
+.application-header-actions {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 8px;
+  min-width: 0;
+}
+.application-frame .sidebar-nav-item {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  min-width: 0;
+  text-align: left;
+  font-family: var(--font-sans);
+}
+.application-nav-badge {
+  margin-left: auto;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  font-weight: 400;
+}
+.application-skip-link {
+  position: fixed;
+  top: 8px;
+  left: 8px;
+  z-index: 50;
+  padding: 8px 12px;
+  background: var(--surface);
+  color: var(--text);
+  border: 1px solid var(--blue);
+  border-radius: var(--radius-sm);
+  transform: translateY(-200%);
+}
+.application-skip-link:focus {
+  transform: none;
+}
+@media (max-width: 900px) {
+  .application-frame .settings-frame-layout {
+    grid-template-columns: 200px minmax(0, 1fr);
+  }
+}
+@media (max-width: 640px) {
+  .application-frame {
+    height: auto;
+    min-height: 100dvh;
+  }
+  .application-frame .managed-settings-header {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px 16px;
+  }
+  .application-frame .settings-frame-layout {
+    display: flex;
+    flex-direction: column;
+  }
+  .application-frame .settings-sidebar {
+    border-right: 0;
+    border-bottom: 1px solid var(--border);
+    overflow: visible;
+  }
+  .application-frame .settings-sidebar-content {
+    overflow: visible;
+  }
+  .application-frame .managed-settings-tabs {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 4px;
+  }
+  .application-frame .managed-settings-tabs > button {
+    flex: 1 1 auto;
+    min-height: var(--control-height-compact);
+    gap: 6px;
+    padding-inline: 6px;
+  }
+  .application-frame .application-nav-badge {
+    display: none;
+  }
+  .application-frame .sidebar-nav-item > span {
+    min-width: 0;
+    overflow-wrap: anywhere;
+    white-space: normal;
+  }
+  .application-frame .settings-sidebar-footer {
+    margin: 0;
+    padding: 0;
+    border: 0;
+  }
+  .application-frame .settings-sidebar-footer button {
+    width: auto;
+  }
+  .application-frame .settings-main {
+    overflow: visible;
+  }
+  .application-header-actions {
+    flex: 1;
+  }
+}
diff --git a/apps/ui/styles/catalog.css b/apps/ui/styles/catalog.css
new file mode 100644
index 000000000..d1e7891ff
--- /dev/null
+++ b/apps/ui/styles/catalog.css
@@ -0,0 +1,443 @@
+.catalog-settings {
+  container-type: inline-size;
+}
+
+.catalog-heading {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 12px;
+}
+
+.catalog-heading :is(h2, h3) {
+  margin: 0;
+  color: var(--text-strong);
+  font-size: var(--font-size-heading);
+  line-height: 1.25;
+}
+
+.catalog-heading p,
+.catalog-summary,
+.catalog-hint {
+  margin: 4px 0 0;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  line-height: 1.5;
+}
+
+.catalog-heading > .ui-button {
+  flex-shrink: 0;
+}
+
+.catalog-summary {
+  margin: 12px 0 8px;
+}
+
+.catalog-search {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  min-height: 32px;
+  padding: 0 10px;
+  margin-bottom: 10px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+  color: var(--muted);
+}
+
+.catalog-search:focus-within {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+
+.catalog-search > svg {
+  flex-shrink: 0;
+}
+.catalog-search input {
+  flex: 1;
+  min-width: 0;
+  width: 100%;
+  padding: 6px 0;
+  border: 0;
+  outline: none;
+  background: transparent;
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+}
+.catalog-search input::placeholder {
+  color: var(--muted);
+}
+
+.catalog-table-container {
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+}
+.catalog-table {
+  width: 100%;
+  table-layout: fixed;
+  border-spacing: 0;
+  font-size: var(--font-size-body-sm);
+  text-align: left;
+}
+.catalog-name-column {
+  width: 40%;
+}
+.catalog-actions-column {
+  width: 104px;
+}
+.catalog-table th,
+.catalog-table td {
+  padding: var(--settings-row-padding, 10px 12px);
+  vertical-align: middle;
+  overflow-wrap: anywhere;
+}
+.catalog-table thead th {
+  padding-block: 8px;
+  color: var(--muted);
+  background: var(--surface-panel);
+  font-size: var(--font-size-body-sm);
+  font-weight: 600;
+}
+.catalog-table thead th:first-child {
+  border-top-left-radius: var(--radius-sm);
+}
+.catalog-table thead th:last-child {
+  border-top-right-radius: var(--radius-sm);
+}
+.catalog-inventory-row > * {
+  border-top: 1px solid var(--border);
+}
+.catalog-inventory-row:hover {
+  background: var(--surface-hover);
+}
+.catalog-inventory-row[data-expanded="true"] {
+  background: var(--surface-selected);
+}
+.catalog-identity {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+.catalog-identity > div {
+  min-width: 0;
+}
+.catalog-identity .resource-icon {
+  width: 28px;
+  height: 28px;
+  flex: 0 0 28px;
+}
+.catalog-identity .resource-icon > svg {
+  width: 16px;
+  height: 16px;
+}
+.catalog-provider-icon {
+  display: grid;
+  flex: none;
+  width: 28px;
+  height: 28px;
+  place-items: center;
+}
+.catalog-identity small {
+  display: block;
+  margin-top: 2px;
+  color: var(--muted);
+  font-weight: 400;
+  font-size: var(--font-size-caption);
+  line-height: 1.35;
+}
+.catalog-name {
+  padding: 0;
+  border: 0;
+  background: transparent;
+  color: var(--text-strong);
+  font-size: var(--font-size-body-sm);
+  font-weight: 600;
+  line-height: 1.35;
+  text-align: left;
+  overflow-wrap: anywhere;
+}
+.catalog-name:hover {
+  text-decoration: underline;
+}
+.catalog-connection {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  color: var(--muted);
+}
+.catalog-connection > svg {
+  flex-shrink: 0;
+}
+.catalog-text-button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  min-height: 28px;
+  padding: 4px;
+  border: 0;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--blue-strong);
+  font-weight: 600;
+  text-align: left;
+}
+.catalog-text-button:hover {
+  background: var(--blue-soft);
+}
+.catalog-usage {
+  justify-content: flex-start;
+}
+.catalog-usage svg {
+  flex-shrink: 0;
+}
+.catalog-usage[aria-expanded="true"] svg {
+  transform: rotate(90deg);
+}
+.catalog-table .catalog-row-actions {
+  white-space: nowrap;
+  padding-inline: 12px;
+  text-align: right;
+}
+.catalog-action-group {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 4px;
+}
+.catalog-action-group > *,
+.catalog-action-group .ui-icon-button {
+  flex: none;
+}
+.catalog-action-group .ui-icon-button {
+  width: 28px;
+  height: 28px;
+}
+.catalog-actions-menu {
+  display: inline-flex;
+  position: relative;
+  vertical-align: middle;
+}
+.catalog-actions-popup {
+  position: absolute;
+  right: 0;
+  top: calc(100% + 4px);
+  z-index: 15;
+  min-width: 164px;
+  padding: 5px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface);
+  box-shadow: var(--shadow);
+}
+.catalog-actions-popup > button {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  width: 100%;
+  min-height: 38px;
+  padding: 8px 10px;
+  border: 0;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  text-align: left;
+}
+.catalog-actions-popup > button:hover,
+.catalog-actions-popup > button:focus-visible {
+  background: var(--surface-hover);
+}
+.catalog-actions-popup .catalog-delete-action {
+  color: var(--red-text);
+}
+.catalog-detail-row[hidden] {
+  display: none;
+}
+.catalog-detail-row > td {
+  border-top: 1px solid var(--border);
+  background: var(--surface-panel);
+}
+.catalog-details {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 16px;
+}
+.catalog-details h4 {
+  margin: 0 0 8px;
+  font-size: var(--font-size-body-sm);
+}
+.catalog-details dl {
+  margin: 0;
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 6px 16px;
+}
+.catalog-details dt {
+  color: var(--muted);
+}
+.catalog-details dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.catalog-details ul {
+  margin: 0;
+  padding-left: 18px;
+}
+.catalog-details li + li {
+  margin-top: 4px;
+}
+.catalog-details p {
+  margin: 0;
+  color: var(--muted);
+  line-height: 1.5;
+}
+.catalog-details small {
+  display: block;
+  color: var(--muted);
+  margin-top: 3px;
+  font-size: var(--font-size-body-sm);
+}
+.catalog-table .catalog-empty {
+  padding: 24px 12px;
+  text-align: center;
+}
+.catalog-empty p {
+  color: var(--muted);
+}
+.catalog-hint {
+  margin-top: 10px;
+  font-size: var(--font-size-body-sm);
+}
+
+@container (max-width: 640px) {
+  .catalog-heading {
+    flex-wrap: wrap;
+    gap: 12px;
+  }
+  .catalog-table,
+  .catalog-table tbody {
+    display: block;
+  }
+  .catalog-table colgroup {
+    display: none;
+  }
+  .catalog-table thead {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    overflow: hidden;
+    clip-path: inset(50%);
+    white-space: nowrap;
+  }
+  .catalog-inventory-row {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) auto;
+    padding: 10px 12px;
+    gap: 4px 10px;
+    border-top: 1px solid var(--border);
+  }
+  .catalog-inventory-row:first-child {
+    border-top: 0;
+  }
+  .catalog-table .catalog-inventory-row > * {
+    border: 0;
+    padding: 0;
+    min-width: 0;
+  }
+  .catalog-inventory-row > th {
+    grid-column: 1;
+  }
+  .catalog-inventory-row > td[data-label] {
+    grid-column: 1 / -1;
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding-left: 38px;
+  }
+  .catalog-inventory-row > td[data-label]::before {
+    content: attr(data-label);
+    color: var(--muted);
+    font-size: var(--font-size-caption);
+    min-width: 100px;
+  }
+  .catalog-table .catalog-row-actions {
+    grid-column: 2;
+    grid-row: 1;
+    padding: 0;
+  }
+  .catalog-detail-row,
+  .catalog-detail-row > td {
+    display: block;
+  }
+  .catalog-details {
+    grid-template-columns: 1fr;
+  }
+}
+
+@container (max-width: 390px) {
+  .catalog-inventory-row > td[data-label] {
+    padding-left: 0;
+    flex-wrap: wrap;
+  }
+  .catalog-identity {
+    gap: 9px;
+  }
+  .catalog-table .catalog-row-actions {
+    grid-column: 1 / -1;
+    grid-row: auto;
+    justify-self: end;
+  }
+}
+
+.credentials-settings .catalog-actions-column {
+  width: 144px;
+}
+
+.credential-status {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+}
+.credential-status > svg {
+  flex-shrink: 0;
+}
+.catalog-details .credential-rotation-note {
+  margin-top: 10px;
+  font-size: var(--font-size-body-sm);
+}
+.credential-status.tone-warning-text {
+  color: var(--amber-text);
+}
+
+.catalog-heading > .ui-button {
+  min-height: 32px;
+  padding: 6px 10px;
+}
+.catalog-provider-icon .provider-icon {
+  width: 24px;
+  height: 24px;
+}
+
+.catalog-connection-copy small {
+  display: block;
+  margin-top: 2px;
+  font-size: var(--font-size-caption);
+  line-height: 1.35;
+}
+.catalog-sensitive-content {
+  color: var(--amber-text);
+}
+
+.catalog-identity .resource-icon {
+  display: grid;
+  place-items: center;
+  border: 1px solid var(--icon-border);
+  border-radius: var(--radius-sm);
+  background: var(--icon-surface);
+  color: var(--icon-text);
+}
+
+.catalog-search .ui-input:focus-visible {
+  outline: none;
+}
diff --git a/apps/ui/styles/charts.css b/apps/ui/styles/charts.css
new file mode 100644
index 000000000..8ed17709a
--- /dev/null
+++ b/apps/ui/styles/charts.css
@@ -0,0 +1,202 @@
+.shared-chart-container {
+  width: 100%;
+  height: 280px;
+  min-width: 0;
+  min-height: 240px;
+  color: var(--text);
+  font: var(--font-size-caption)/var(--line-height-body) var(--font-sans);
+}
+.shared-chart-container .recharts-cartesian-axis-tick text {
+  fill: var(--muted);
+  font-size: var(--font-size-caption);
+  font-family: var(--font-sans);
+}
+.shared-chart-container .recharts-surface:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: -2px;
+  border-radius: var(--radius-sm);
+}
+.shared-chart-container .recharts-layer:focus {
+  outline: none;
+}
+.shared-chart-tooltip {
+  min-width: 180px;
+  padding: 10px 12px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius);
+  background: var(--surface-raised);
+  box-shadow: var(--shadow);
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+  font-family: var(--font-sans);
+}
+.shared-chart-tooltip > strong {
+  display: block;
+  color: var(--text-strong);
+  font-size: var(--font-size-caption);
+  margin-bottom: 8px;
+}
+.shared-chart-tooltip > div {
+  display: grid;
+  gap: 7px;
+}
+.shared-chart-tooltip-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.shared-chart-tooltip-row > span:nth-child(2) {
+  color: var(--muted);
+  flex: 1;
+}
+.shared-chart-tooltip-row > strong {
+  font-variant-numeric: tabular-nums;
+  color: var(--text-strong);
+}
+.shared-chart-indicator {
+  display: inline-block;
+  width: 18px;
+  height: 0;
+  border-top: 2px solid;
+  flex: none;
+}
+.shared-chart-indicator.is-dashed {
+  border-top-style: dashed;
+}
+.shared-chart-legend {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  gap: 20px;
+  flex-wrap: wrap;
+  padding: 12px 0 2px;
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+.shared-chart-legend > span {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+}
+.shared-chart-footer {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 12px;
+  flex-wrap: wrap;
+  margin-top: 18px;
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+.shared-chart-data {
+  min-width: 0;
+}
+.shared-chart-data > summary {
+  cursor: pointer;
+  color: var(--muted);
+  text-underline-offset: 3px;
+}
+.shared-chart-data > summary:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 3px;
+}
+.shared-chart-data[open] {
+  width: 100%;
+}
+.shared-chart-table {
+  overflow: auto;
+  margin-top: 12px;
+}
+.shared-chart-table table {
+  width: 100%;
+  font-size: var(--font-size-body-sm);
+}
+.shared-chart-table caption {
+  text-align: left;
+  padding: 8px 0;
+  color: var(--muted);
+}
+.shared-chart-table th,
+.shared-chart-table td {
+  padding: 9px 10px;
+  border-bottom: 1px solid var(--border);
+  text-align: left;
+}
+.shared-chart-empty {
+  padding: 30px 0;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.activity-range-selector {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: var(--font-size-body-sm);
+  color: var(--muted);
+}
+.activity-range-selector .app-select {
+  width: 145px;
+}
+.activity-line-heading {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 16px;
+  flex-wrap: wrap;
+}
+.activity-line-heading p {
+  font-size: var(--font-size-body-sm);
+  color: var(--muted);
+  margin: 6px 0 0;
+}
+.activity-line-summary {
+  display: flex;
+  gap: 24px;
+  flex-wrap: wrap;
+  padding: 6px 0 18px;
+  margin-bottom: 8px;
+  border-bottom: 1px solid var(--border);
+}
+.activity-line-summary > div {
+  display: grid;
+  gap: 3px;
+}
+.activity-line-summary span {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.activity-line-summary strong {
+  color: var(--text-strong);
+  font-size: var(--font-size-heading);
+  font-variant-numeric: tabular-nums;
+  font-weight: 550;
+}
+.analytics-range-toolbar {
+  display: flex;
+  justify-content: flex-end;
+  margin: 12px 0;
+}
+@media (max-width: 760px) {
+  .shared-chart-container {
+    height: 250px;
+    min-height: 230px;
+  }
+  .shared-chart-legend {
+    gap: 12px;
+  }
+  .shared-chart-footer {
+    margin-top: 14px;
+  }
+  .activity-line-summary {
+    gap: 20px;
+  }
+  .activity-range-selector .app-select {
+    width: 130px;
+  }
+}
+.activity-header-controls {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+}
diff --git a/apps/ui/styles/control-plane.css b/apps/ui/styles/control-plane.css
new file mode 100644
index 000000000..690cd0b68
--- /dev/null
+++ b/apps/ui/styles/control-plane.css
@@ -0,0 +1,246 @@
+.control-plane-frame {
+  min-height: 100dvh;
+  display: flex;
+  flex-direction: column;
+  background: var(--main);
+  color: var(--text);
+  font-family: var(--font-sans);
+  font-size: var(--font-size-body);
+}
+.control-frame-layout {
+  display: flex;
+  flex: 1;
+  min-height: 0;
+}
+.control-primary-rail {
+  width: 78px;
+  flex: none;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  background: var(--rail);
+  border-right: 1px solid var(--border);
+  position: sticky;
+  top: 0;
+  height: 100dvh;
+  padding: 16px 6px 10px;
+  gap: 20px;
+}
+.control-brand img {
+  width: 34px;
+  height: 34px;
+  display: block;
+}
+.control-primary-rail nav {
+  display: grid;
+  gap: 8px;
+  width: 100%;
+}
+.control-primary-rail nav :is(button, a) {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 5px;
+  min-height: 60px;
+  padding: 10px 2px;
+  border: 1px solid transparent;
+  border-radius: var(--radius);
+  background: transparent;
+  color: var(--muted);
+  font: inherit;
+  font-size: var(--font-size-caption);
+  overflow-wrap: anywhere;
+  cursor: pointer;
+  text-decoration: none;
+}
+.control-primary-rail nav :is(button, a):hover {
+  background: var(--surface-hover);
+  color: var(--text);
+}
+.control-primary-rail nav :is(button, a).is-active {
+  color: var(--accent-text);
+  background: var(--surface-selected);
+  border-color: var(--accent-border);
+}
+.control-primary-rail nav :is(button, a):focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+.control-rail-footer {
+  margin-top: auto;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 12px;
+}
+.control-scope-sidebar {
+  width: 280px;
+  flex: none;
+  background: var(--sidebar);
+  border-right: 1px solid var(--border);
+  min-width: 0;
+}
+.control-frame-main {
+  flex: 1;
+  min-width: 0;
+  background: var(--main);
+}
+.control-header {
+  min-height: 56px;
+  padding: 10px 24px;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  border-bottom: 1px solid var(--border);
+  background: var(--surface-header);
+  position: sticky;
+  top: 0;
+  z-index: 5;
+}
+.control-header > strong {
+  font-size: var(--font-size-body-sm);
+  color: var(--muted);
+  font-weight: 550;
+  white-space: nowrap;
+}
+.control-header > div {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  min-width: 0;
+}
+.control-frame-main > main {
+  outline: none;
+  min-width: 0;
+}
+.control-classification {
+  min-height: 27px;
+  padding: 5px 16px;
+  border-bottom: 1px solid var(--border-strong);
+  background: var(--surface-muted);
+  color: var(--text);
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-tight);
+  font-weight: 650;
+  text-align: center;
+  letter-spacing: 0.07em;
+  overflow-wrap: anywhere;
+}
+.classification-info {
+  background: var(--blue-soft);
+  color: var(--accent-text);
+  border-color: var(--accent-border);
+}
+.classification-warning {
+  background: var(--amber-soft);
+  color: var(--amber-text);
+  border-color: var(--amber-border);
+}
+.classification-danger {
+  background: var(--red-soft);
+  color: var(--red-text);
+  border-color: var(--red-border);
+}
+@media (max-width: 1100px) {
+  .control-scope-sidebar {
+    width: 245px;
+  }
+  .control-header {
+    padding-inline: 16px;
+  }
+}
+@media (max-width: 760px) {
+  .control-primary-rail {
+    width: 62px;
+    padding-inline: 4px;
+  }
+  .control-primary-rail nav :is(button, a) {
+    min-height: 56px;
+  }
+  .control-frame-layout {
+    display: grid;
+    grid-template-columns: 62px minmax(0, 1fr);
+  }
+  .control-primary-rail {
+    grid-column: 1;
+    grid-row: 1/3;
+  }
+  .control-scope-sidebar {
+    grid-column: 2;
+    grid-row: 1;
+    width: 100%;
+    border-bottom: 1px solid var(--border);
+    border-right: none;
+    max-height: 300px;
+    overflow: auto;
+  }
+  .control-frame-main {
+    grid-column: 2;
+    grid-row: 2;
+  }
+  .control-plane-frame:not(.has-scope-sidebar) .control-frame-main {
+    grid-row: 1/3;
+  }
+  .control-header {
+    position: static;
+    flex-wrap: wrap;
+    padding: 10px 12px;
+    gap: 8px;
+  }
+  .control-header > div {
+    flex-wrap: wrap;
+    gap: 8px;
+  }
+  .control-header > strong {
+    display: none;
+  }
+}
+/* Keep classification markings around the viewport while content panes scroll. */
+.control-plane-frame {
+  height: 100dvh;
+  overflow: hidden;
+}
+.control-frame-layout {
+  overflow: hidden;
+}
+.control-primary-rail {
+  height: 100%;
+}
+.control-frame-main {
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+}
+.control-header {
+  flex: none;
+}
+.control-frame-main > main {
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+}
+.control-scope-sidebar {
+  overflow: auto;
+  min-height: 0;
+}
+.control-classification {
+  flex: none;
+}
+@media (max-width: 760px) {
+  .control-frame-layout {
+    grid-template-rows: auto minmax(0, 1fr);
+  }
+  .control-plane-frame:not(.has-scope-sidebar) .control-frame-layout {
+    grid-template-rows: minmax(0, 1fr);
+  }
+  .control-plane-frame:not(.has-scope-sidebar) .control-frame-main {
+    grid-row: 1;
+  }
+  .control-plane-frame:not(.has-scope-sidebar) .control-primary-rail {
+    grid-row: 1;
+  }
+  .control-primary-rail {
+    min-height: 0;
+  }
+}
diff --git a/apps/ui/styles/controls.css b/apps/ui/styles/controls.css
new file mode 100644
index 000000000..a7edfa27f
--- /dev/null
+++ b/apps/ui/styles/controls.css
@@ -0,0 +1,144 @@
+.ui-button {
+  display: inline-flex;
+  min-height: var(--control-height-compact);
+  align-items: center;
+  justify-content: center;
+  gap: 7px;
+  padding: 6px 10px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface);
+  color: var(--text);
+  font: 600 var(--font-size-body-sm) / var(--line-height-tight) var(--font-sans);
+  text-decoration: none;
+  cursor: pointer;
+}
+.ui-button > svg {
+  flex: none;
+}
+.ui-button:hover:not(:disabled) {
+  background: var(--surface-hover);
+  border-color: var(--blue-strong);
+}
+.ui-button--primary {
+  border-color: var(--blue);
+  background: var(--blue);
+  color: var(--text-on-accent);
+}
+.ui-button--primary:hover:not(:disabled) {
+  border-color: var(--blue-hover);
+  background: var(--blue-hover);
+}
+.ui-button--tertiary {
+  border-color: transparent;
+  background: transparent;
+  color: var(--muted);
+}
+.ui-button--tertiary:hover:not(:disabled) {
+  border-color: var(--border);
+  color: var(--text);
+}
+.ui-button--danger {
+  border-color: var(--red-border);
+  background: var(--red-soft);
+  color: var(--red-text);
+}
+.ui-button--danger:hover:not(:disabled) {
+  border-color: var(--red);
+  background: var(--red-soft);
+}
+.ui-icon-button {
+  display: inline-grid;
+  width: var(--icon-control-size);
+  height: var(--icon-control-size);
+  place-items: center;
+  padding: 0;
+  border: 1px solid transparent;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--muted);
+  cursor: pointer;
+}
+.ui-icon-button:hover:not(:disabled) {
+  border-color: var(--border);
+  background: var(--surface-hover);
+  color: var(--text);
+}
+:is(.ui-button, .ui-icon-button, .ui-input):focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+:is(.ui-button, .ui-icon-button):disabled {
+  opacity: var(--disabled-opacity);
+  cursor: not-allowed;
+}
+.ui-input {
+  width: 100%;
+  min-width: 0;
+  min-height: var(--control-height-compact);
+  padding: 6px 10px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface-control);
+  color: var(--text);
+  font: 400 var(--font-size-control) / var(--line-height-body) var(--font-sans);
+}
+.ui-input::placeholder {
+  color: var(--muted);
+}
+.ui-input:disabled {
+  opacity: var(--disabled-opacity);
+}
+.ui-button--link {
+  background: transparent;
+  border-color: transparent;
+  color: var(--accent-text);
+}
+.ui-button--link:hover:not(:disabled) {
+  text-decoration: underline;
+}
+.ui-button--icon {
+  width: var(--control-height-compact);
+  padding: 6px;
+}
+.ui-button--large {
+  min-height: var(--control-height);
+}
+
+.ui-radio-group--compact {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 2px;
+}
+.ui-radio-group--compact > .ui-radio-option--compact {
+  max-width: 100%;
+  min-height: var(--control-height-compact);
+  align-items: flex-start;
+  justify-content: flex-start;
+  gap: 8px;
+  padding: 4px 6px;
+  border-color: transparent;
+  background: transparent;
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+  font-weight: 400;
+  line-height: var(--line-height-body);
+  text-align: left;
+  white-space: normal;
+}
+.ui-radio-group--compact > .ui-radio-option--compact:hover:not(:disabled) {
+  border-color: transparent;
+  background: var(--surface-hover);
+}
+.ui-radio-option--compact > svg {
+  flex: none;
+  margin-top: 1px;
+}
+.ui-radio-option--compact[aria-checked="true"] > svg {
+  color: var(--blue);
+}
+.ui-radio-option--compact > span {
+  min-width: 0;
+}
diff --git a/apps/ui/styles/conversation.css b/apps/ui/styles/conversation.css
new file mode 100644
index 000000000..687557910
--- /dev/null
+++ b/apps/ui/styles/conversation.css
@@ -0,0 +1,623 @@
+.shared-sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip-path: inset(50%);
+  white-space: nowrap;
+  border: 0;
+}
+.shared-conversation-timeline {
+  display: grid;
+  align-content: start;
+  gap: 24px;
+  min-width: 0;
+  width: 100%;
+  max-width: var(--conversation-max-width, 790px);
+  margin-inline: auto;
+}
+.shared-conversation-entry {
+  position: relative;
+  display: grid;
+  grid-template-columns: 30px minmax(0, 1fr);
+  gap: 10px;
+}
+.shared-feed-marker {
+  display: grid;
+  width: 28px;
+  height: 28px;
+  place-items: center;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-raised);
+  color: var(--blue-strong);
+}
+.shared-assistant-marker {
+  border-color: var(--accent-border);
+  background: var(--blue-soft);
+}
+.shared-assistant-marker img {
+  display: block;
+  width: 17px;
+  height: 17px;
+  max-width: 17px;
+  max-height: 17px;
+  object-fit: contain;
+}
+.shared-feed-content {
+  min-width: 0;
+}
+.shared-feed-heading {
+  display: flex;
+  min-height: 24px;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  margin-bottom: 5px;
+}
+.shared-feed-heading strong {
+  color: var(--text-strong);
+  font-size: var(--font-size-body-sm);
+}
+.shared-feed-heading > div {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.shared-message-body {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  color: var(--text);
+  font-size: var(--font-size-body);
+  line-height: var(--line-height-body);
+  overflow-wrap: anywhere;
+}
+.shared-message-user .shared-message-body {
+  padding: 11px 13px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius);
+  background: var(--surface-raised);
+}
+.shared-message-assistant .shared-message-body {
+  padding-top: 2px;
+}
+.shared-message-system .shared-message-body,
+.shared-message-tool .shared-message-body {
+  padding: 9px 11px;
+  border-left: 2px solid var(--border-strong);
+  background: var(--surface-muted);
+}
+.shared-message-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+  margin-top: 5px;
+}
+.shared-preserve-lines {
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+.shared-conversation-activity {
+  min-width: 0;
+  padding: 2px 0 12px;
+  border-bottom: 1px solid var(--border);
+}
+.shared-conversation-activity > summary {
+  list-style: none;
+  cursor: pointer;
+}
+.shared-conversation-activity > summary::-webkit-details-marker,
+.shared-activity-tool > summary::-webkit-details-marker {
+  display: none;
+}
+.shared-conversation-activity > summary:focus-visible,
+.shared-activity-tool > summary:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 4px;
+  border-radius: var(--radius-sm);
+}
+.shared-conversation-activity .run-activity-summary {
+  display: grid;
+  min-width: 0;
+  grid-template-columns: auto auto minmax(0, 1fr) auto auto;
+  gap: 9px;
+  align-items: center;
+  padding-bottom: 8px;
+}
+.shared-conversation-activity .run-activity-chevron {
+  display: grid;
+  color: var(--muted);
+  transition: transform 160ms ease;
+}
+.shared-conversation-activity:not([open]) .run-activity-chevron {
+  transform: rotate(-90deg);
+}
+.shared-conversation-activity .run-activity-mark {
+  display: grid;
+  width: 28px;
+  height: 28px;
+  place-items: center;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-raised);
+}
+.shared-conversation-activity .run-activity-mark img {
+  display: block;
+  width: 17px;
+  height: 17px;
+  max-width: 17px;
+  max-height: 17px;
+  object-fit: contain;
+}
+.shared-conversation-activity[data-tone="success"] .run-activity-mark {
+  border-color: var(--green-border);
+  background: var(--green-soft);
+}
+.shared-conversation-activity[data-tone="active"] .run-activity-mark {
+  border-color: color-mix(in srgb, var(--cyan) 48%, var(--border));
+  background: color-mix(in srgb, var(--cyan) 12%, var(--surface));
+}
+.shared-conversation-activity .run-activity-title {
+  display: flex;
+  min-width: 0;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 4px 8px;
+}
+.shared-conversation-activity .run-activity-title strong {
+  color: var(--text-strong);
+  font-size: var(--font-size-body-sm);
+}
+.shared-conversation-activity .run-activity-title small {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.shared-conversation-activity .run-activity-status,
+.shared-conversation-activity .run-activity-exceptions {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  font-weight: 680;
+}
+.shared-conversation-activity .tone-success {
+  color: var(--green);
+}
+.shared-conversation-activity .tone-danger,
+.shared-conversation-activity .run-activity-exceptions {
+  color: var(--red);
+}
+.shared-conversation-activity .tone-warning {
+  color: var(--amber);
+}
+.shared-conversation-activity .tone-active {
+  color: var(--cyan);
+}
+.shared-conversation-activity .run-activity-body {
+  position: relative;
+  display: grid;
+  min-width: 0;
+  gap: 6px;
+  padding: 6px 0 0 74px;
+}
+.shared-conversation-activity .run-activity-body::before {
+  position: absolute;
+  top: 8px;
+  bottom: 8px;
+  left: 38px;
+  width: 2px;
+  background: var(--border-strong);
+  content: "";
+}
+.shared-conversation-turn {
+  display: grid;
+  min-width: 0;
+  gap: 16px;
+}
+.shared-conversation-turn > :empty {
+  display: none;
+}
+.shared-activity-item {
+  position: relative;
+  min-width: 0;
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+}
+.shared-activity-item::before {
+  position: absolute;
+  top: 12px;
+  left: -39px;
+  box-sizing: border-box;
+  width: 8px;
+  height: 8px;
+  border: 2px solid var(--surface);
+  border-radius: 50%;
+  background: var(--muted);
+  content: "";
+}
+.shared-activity-item[data-state="completed"]::before {
+  background: var(--green);
+}
+.shared-activity-item[data-state="started"]::before,
+.shared-activity-item[data-state="requested"]::before {
+  background: var(--cyan);
+}
+.shared-activity-item[data-state="failed"]::before,
+.shared-activity-item[data-state="outcome_unknown"]::before {
+  background: var(--red);
+}
+.shared-activity-item[data-state="waiting_approval"]::before {
+  background: var(--amber);
+}
+.shared-activity-tool > summary {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 6px 10px;
+  padding: 4px 0;
+  list-style: none;
+  cursor: pointer;
+}
+.shared-activity-tool > summary > strong {
+  min-width: 0;
+  overflow-wrap: anywhere;
+}
+.shared-activity-meta {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.shared-activity-tool > summary > time {
+  margin-left: auto;
+}
+.shared-activity-history {
+  display: grid;
+  gap: 0;
+  margin: 4px 0 0;
+  padding: 0;
+  list-style: none;
+}
+.shared-activity-history > li {
+  display: grid;
+  grid-template-columns: minmax(70px, auto) minmax(0, 1fr);
+  gap: 10px;
+  padding: 7px 0;
+  border-top: 1px solid var(--border);
+  overflow-wrap: anywhere;
+}
+.shared-activity-detail {
+  display: grid;
+  gap: 4px;
+  padding: 9px 11px;
+  margin: 5px 0;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-muted);
+}
+.shared-activity-detail > strong {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.shared-activity-detail > pre {
+  max-height: 260px;
+  margin: 0;
+  overflow: auto;
+  color: var(--text);
+  font-family: var(--font-mono);
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+.shared-markdown.markdown-content {
+  min-width: 0;
+  max-width: 100%;
+  color: inherit;
+  overflow-wrap: anywhere;
+}
+.shared-markdown.markdown-content > :first-child {
+  margin-top: 0;
+}
+.shared-markdown.markdown-content > :last-child {
+  margin-bottom: 0;
+}
+.shared-markdown.markdown-content p,
+.shared-markdown.markdown-content ul,
+.shared-markdown.markdown-content ol,
+.shared-markdown.markdown-content blockquote,
+.shared-markdown.markdown-content pre,
+.shared-markdown.markdown-content hr,
+.shared-markdown .markdown-table-scroll {
+  margin: 0 0 12px;
+}
+.shared-markdown.markdown-content h3,
+.shared-markdown.markdown-content h4,
+.shared-markdown.markdown-content h5,
+.shared-markdown.markdown-content h6 {
+  margin: 16px 0 8px;
+  color: var(--text-strong);
+  line-height: var(--line-height-tight);
+  font-size: var(--font-size-heading-sm);
+}
+.shared-markdown.markdown-content h5,
+.shared-markdown.markdown-content h6 {
+  font-size: var(--font-size-body);
+}
+.shared-markdown.markdown-content strong {
+  color: var(--text-strong);
+  font-weight: 700;
+}
+.shared-markdown.markdown-content ul,
+.shared-markdown.markdown-content ol {
+  padding-left: 22px;
+}
+.shared-markdown.markdown-content li + li {
+  margin-top: 4px;
+}
+.shared-markdown.markdown-content li > p {
+  margin-bottom: 6px;
+}
+.shared-markdown.markdown-content .contains-task-list {
+  padding-left: 0;
+  list-style: none;
+}
+.shared-markdown.markdown-content input[type="checkbox"] {
+  width: 12px;
+  height: 12px;
+  margin-right: 8px;
+  accent-color: var(--cyan);
+}
+.shared-markdown.markdown-content blockquote {
+  padding: 10px 12px;
+  border-left: 2px solid var(--blue);
+  border-radius: 0 var(--radius-sm) var(--radius-sm) 0;
+  background: var(--surface-panel);
+  color: var(--muted);
+}
+.shared-markdown.markdown-content blockquote > :last-child {
+  margin-bottom: 0;
+}
+.shared-markdown.markdown-content hr {
+  border: 0;
+  border-top: 1px solid var(--border);
+}
+.shared-markdown.markdown-content code {
+  padding: 2px 5px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface-muted);
+  color: var(--accent-text);
+  font-family: var(--font-mono);
+  font-size: var(--font-size-body-sm);
+  overflow-wrap: anywhere;
+  word-break: break-word;
+}
+.shared-markdown.markdown-content pre {
+  max-width: 100%;
+  padding: 12px 14px;
+  overflow: auto;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface-editor);
+  overscroll-behavior: contain;
+  white-space: pre;
+}
+.shared-markdown.markdown-content pre code {
+  padding: 0;
+  border: 0;
+  background: transparent;
+  color: var(--text);
+  line-height: var(--line-height-body);
+  overflow-wrap: normal;
+  word-break: normal;
+}
+.shared-markdown .markdown-table-scroll {
+  max-width: 100%;
+  overflow-x: auto;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  overscroll-behavior-inline: contain;
+}
+.shared-markdown .markdown-table-scroll:focus-visible,
+.shared-markdown.markdown-content pre:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+.shared-markdown.markdown-content table {
+  width: max-content;
+  min-width: 100%;
+  border-collapse: collapse;
+  background: var(--surface-inset);
+  font-size: var(--font-size-body-sm);
+}
+.shared-markdown.markdown-content th,
+.shared-markdown.markdown-content td {
+  padding: 8px 10px;
+  border-right: 1px solid var(--border);
+  border-bottom: 1px solid var(--border);
+  color: var(--text);
+  text-align: left;
+  vertical-align: top;
+}
+.shared-markdown.markdown-content th {
+  background: var(--surface-header);
+  color: var(--text-strong);
+  font-weight: 700;
+}
+.shared-markdown.markdown-content tr:last-child td {
+  border-bottom: 0;
+}
+.shared-markdown.markdown-content th:last-child,
+.shared-markdown.markdown-content td:last-child {
+  border-right: 0;
+}
+.markdown-link-inert {
+  color: var(--blue-strong);
+  text-decoration: underline dotted var(--accent-border);
+  text-underline-offset: 3px;
+}
+.markdown-image-blocked {
+  display: inline-flex;
+  max-width: 100%;
+  padding: 2px 6px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface-muted);
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  font-style: italic;
+}
+.markdown-render-notice {
+  padding: 8px 10px;
+  border-left: 2px solid var(--amber);
+  background: var(--amber-soft);
+  color: var(--amber-text);
+  font-size: var(--font-size-body-sm);
+}
+.markdown-plain-text {
+  min-width: 0;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+.shared-composer-dock {
+  min-width: 0;
+  padding: 12px 20px 10px;
+  background: var(--surface-muted);
+  border-top: 1px solid var(--border);
+}
+.shared-conversation-composer {
+  position: relative;
+  min-width: 0;
+  width: 100%;
+  max-width: var(--conversation-max-width, 790px);
+  margin: 0 auto;
+  padding: 0;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius);
+  background: var(--surface-inset);
+  box-shadow: var(--shadow);
+}
+.shared-conversation-composer:focus-within {
+  border-color: var(--blue-strong);
+}
+.shared-composer-header {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 4px 8px;
+  padding: 4px 8px;
+  border-bottom: 1px solid var(--border);
+  background: var(--surface-muted);
+  border-radius: var(--radius) var(--radius) 0 0;
+}
+.shared-composer-body {
+  padding: 6px 12px;
+}
+.shared-composer-body > textarea {
+  display: block;
+  width: 100%;
+  min-height: 48px;
+  max-height: min(320px, 35dvh, var(--composer-available-height, 320px));
+  overflow-y: auto;
+  padding: 4px 0;
+  resize: none;
+  border: 0;
+  outline: 0;
+  background: transparent;
+  color: var(--text);
+  font-family: var(--font-sans);
+  font-size: var(--font-size-body);
+  line-height: var(--line-height-body);
+}
+.shared-composer-body > textarea::placeholder {
+  color: var(--faint);
+}
+.shared-composer-footer {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 6px 12px;
+  padding: 6px 10px;
+  border-top: 1px solid var(--border);
+  background: var(--surface-muted);
+  border-radius: 0 0 var(--radius) var(--radius);
+}
+.shared-composer-controls {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 6px;
+  min-width: 0;
+}
+.shared-composer-run-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-left: auto;
+}
+.shared-composer-notice {
+  max-width: var(--conversation-max-width, 790px);
+  margin: 8px auto 0;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+}
+.shared-spin {
+  animation: shared-spin 1s linear infinite;
+}
+@keyframes shared-spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .shared-spin {
+    animation: none;
+  }
+  .shared-conversation-activity .run-activity-chevron {
+    transition: none;
+  }
+}
+@media (max-width: 640px) {
+  .shared-conversation-entry {
+    grid-template-columns: 26px minmax(0, 1fr);
+    gap: 8px;
+  }
+  .shared-feed-marker {
+    width: 24px;
+    height: 24px;
+  }
+  .shared-composer-dock {
+    padding: 10px 12px;
+  }
+  .shared-composer-controls {
+    flex-basis: 100%;
+  }
+  .shared-feed-heading {
+    flex-wrap: wrap;
+    gap: 4px;
+  }
+  .shared-conversation-activity .run-activity-summary {
+    grid-template-columns: auto auto minmax(0, 1fr) auto;
+  }
+  .shared-conversation-activity .run-activity-title {
+    display: grid;
+    gap: 1px;
+  }
+  .shared-conversation-activity .run-activity-exceptions {
+    grid-column: 3 / -1;
+  }
+  .shared-conversation-activity .run-activity-body {
+    padding-left: 62px;
+  }
+  .shared-activity-item::before {
+    left: -27px;
+  }
+}
diff --git a/apps/ui/styles/data-table.css b/apps/ui/styles/data-table.css
new file mode 100644
index 000000000..14c0ba80d
--- /dev/null
+++ b/apps/ui/styles/data-table.css
@@ -0,0 +1,142 @@
+.ui-data-table {
+  container-type: inline-size;
+}
+.ui-data-table-toolbar {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+  margin-bottom: 12px;
+}
+.ui-data-table-toolbar .catalog-search {
+  margin-bottom: 0;
+  flex: 1;
+  min-width: min(230px, 100%);
+  max-width: 360px;
+}
+.ui-data-table-toolbar .app-select {
+  width: 160px;
+}
+.ui-data-table-columns {
+  margin-left: auto;
+}
+.ui-data-table-sort {
+  padding: 4px 0;
+  min-height: var(--control-height-compact);
+  color: var(--muted);
+  justify-content: flex-start;
+}
+.ui-data-table-sort:hover:not(:disabled) {
+  border-color: transparent;
+  background: transparent;
+}
+.ui-data-table-grid {
+  table-layout: auto;
+}
+.ui-data-table-grid td {
+  overflow-wrap: anywhere;
+}
+.ui-data-table-grid td:last-child,
+.ui-data-table-grid th:last-child {
+  padding-right: 12px;
+}
+.ui-data-table-empty {
+  text-align: center;
+  padding: 28px 16px !important;
+  color: var(--muted);
+}
+.ui-data-table-empty .empty-state {
+  min-height: 0;
+}
+.ui-data-table-pagination {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 12px;
+  margin-top: 12px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.ui-data-table-page-size,
+.ui-data-table-page-buttons {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+.ui-data-table-page-size {
+  margin-left: auto;
+}
+.ui-data-table-page-size .app-select {
+  width: 72px;
+}
+.ui-data-table-page-buttons .ui-button {
+  padding: 6px;
+}
+.ui-data-table-mobile-sort {
+  display: none;
+  margin-bottom: 12px;
+}
+.ui-menu-positioner {
+  isolation: isolate;
+  z-index: 100;
+  outline: none;
+}
+.ui-menu-content {
+  z-index: 100;
+  box-sizing: border-box;
+  min-width: 180px;
+  max-width: calc(100vw - 24px);
+  max-height: var(--radix-dropdown-menu-content-available-height);
+  overflow: auto;
+  padding: 4px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius);
+  background: var(--surface-raised);
+  color: var(--text);
+  box-shadow: var(--shadow);
+  font: 400 var(--font-size-body-sm) / var(--line-height-body) var(--font-sans);
+  outline: none;
+}
+.ui-menu-label {
+  padding: 5px 8px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  font-weight: 600;
+}
+.ui-menu-item {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 20px;
+  padding: 6px 8px;
+  min-height: var(--control-height-compact);
+  border-radius: var(--radius-sm);
+  cursor: default;
+  outline: none;
+}
+.ui-menu-item[data-highlighted] {
+  color: var(--text);
+  background: var(--surface-selected);
+  outline: 2px solid var(--cyan);
+  outline-offset: -2px;
+}
+.ui-menu-item[data-disabled] {
+  opacity: var(--disabled-opacity);
+}
+@container (max-width: 640px) {
+  .ui-data-table-mobile-sort {
+    display: block;
+  }
+  .ui-data-table-columns {
+    margin-left: 0;
+  }
+  .ui-data-table-page-size {
+    margin-left: 0;
+  }
+  .ui-data-table-pagination > [role="status"] {
+    flex-basis: 100%;
+  }
+  .ui-data-table-page-buttons {
+    flex-wrap: wrap;
+  }
+}
diff --git a/apps/ui/styles/graph-workspace.css b/apps/ui/styles/graph-workspace.css
new file mode 100644
index 000000000..a096abb87
--- /dev/null
+++ b/apps/ui/styles/graph-workspace.css
@@ -0,0 +1,81 @@
+.graph-workspace {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) 245px;
+  border-top: 1px solid var(--border);
+}
+.graph-workspace__canvas {
+  position: relative;
+  min-width: 0;
+  height: 660px;
+  background: var(--surface-control);
+}
+.graph-workspace__view {
+  position: absolute;
+  inset: 58px 0 42px;
+}
+.graph-workspace__toolbar {
+  position: absolute;
+  top: 12px;
+  left: 12px;
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  z-index: 5;
+  padding: 4px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--surface);
+}
+.graph-workspace__hint {
+  position: absolute;
+  bottom: 12px;
+  left: 12px;
+  max-width: calc(100% - 24px);
+  padding: 6px 9px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface);
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  pointer-events: none;
+}
+.graph-workspace__inspector {
+  min-width: 0;
+  padding: 18px;
+  border-left: 1px solid var(--border);
+  background: var(--surface);
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+  overflow-wrap: anywhere;
+}
+.graph-workspace__inspector label {
+  display: grid;
+  gap: 6px;
+  margin-top: 16px;
+}
+.graph-workspace__inspector h4 {
+  margin: 20px 0 10px;
+  font-size: var(--font-size-heading);
+}
+.graph-workspace__canvas .react-flow__handle {
+  opacity: 0;
+  pointer-events: none;
+}
+.graph-workspace__canvas .react-flow__attribution {
+  background: var(--surface);
+}
+.graph-workspace__canvas .react-flow__attribution a {
+  color: var(--muted);
+}
+@media (max-width: 1050px) {
+  .graph-workspace {
+    grid-template-columns: minmax(0, 1fr);
+  }
+  .graph-workspace__canvas {
+    height: 600px;
+  }
+  .graph-workspace__inspector {
+    border-left: 0;
+    border-top: 1px solid var(--border);
+  }
+}
diff --git a/apps/ui/styles/shadcn.css b/apps/ui/styles/shadcn.css
new file mode 100644
index 000000000..41c3284e8
--- /dev/null
+++ b/apps/ui/styles/shadcn.css
@@ -0,0 +1,48 @@
+/* Shared shadcn utility layer. No Preflight reset; existing hosts own base styles. */
+@layer theme, base, components, utilities;
+@import "tailwindcss/theme.css" layer(theme) prefix(ui);
+@import "tailwindcss/utilities.css" layer(utilities) prefix(ui) source(none);
+@import "./controls.css";
+@import "./catalog.css";
+@import "./data-table.css";
+@import "./conversation.css";
+@import "./workspace-sidebar.css";
+@import "./charts.css";
+@source "../src";
+
+@custom-variant dark (&:where(:root:not([data-theme="light"]) *));
+
+/* Inline aliases keep all palettes and text-size preferences live, including portals. */
+@theme inline {
+  --color-*: initial;
+  --color-background: var(--surface);
+  --color-foreground: var(--text);
+  --color-primary: var(--blue);
+  --color-primary-foreground: var(--text-on-accent);
+  --color-secondary: var(--surface-muted);
+  --color-secondary-foreground: var(--text);
+  --color-muted: var(--surface-hover);
+  --color-muted-foreground: var(--muted);
+  --color-accent: var(--surface-selected);
+  --color-accent-foreground: var(--text);
+  --color-popover: var(--surface-raised);
+  --color-popover-foreground: var(--text);
+  --color-card: var(--surface);
+  --color-card-foreground: var(--text);
+  --color-border: var(--border);
+  --color-input: var(--border-strong);
+  --color-ring: var(--cyan);
+  --color-destructive: var(--red-text);
+  --font-sans: var(--font-sans);
+  --font-mono: var(--font-mono);
+  --text-xs: var(--font-size-caption);
+  --text-xs--line-height: var(--line-height-body);
+  --text-sm: var(--font-size-body-sm);
+  --text-sm--line-height: var(--line-height-body);
+  --text-base: var(--font-size-body);
+  --text-base--line-height: var(--line-height-body);
+  --radius-sm: var(--radius-sm);
+  --radius-md: var(--radius);
+  --radius-lg: var(--radius-lg);
+}
+@import "./control-plane.css";
diff --git a/apps/ui/styles/theme.css b/apps/ui/styles/theme.css
index c9f4fbd13..fc8be1cad 100644
--- a/apps/ui/styles/theme.css
+++ b/apps/ui/styles/theme.css
@@ -15,6 +15,7 @@
     Inter, ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI",
     sans-serif;
   --font-mono: "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
+  --font-size-overline: 0.6875rem;
   --font-size-caption: 0.75rem;
   --font-size-body-sm: 0.8125rem;
   --font-size-body: 0.875rem;
@@ -22,6 +23,8 @@
   --font-size-heading-sm: 0.9375rem;
   --font-size-heading: 1.125rem;
   --font-size-title: 1.5rem;
+  --font-size-page-title: 1.875rem;
+  --font-size-display: 2.75rem;
   --line-height-tight: 1.25;
   --line-height-body: 1.5;
 
@@ -92,6 +95,10 @@
   --shadow: 0 16px 38px rgba(0, 0, 0, 0.22);
   --disabled-opacity: 0.5;
 
+  --control-height-compact: 32px;
+  --icon-control-size: 28px;
+  --settings-sidebar-width: 260px;
+
   --settings-content-max: 1180px;
   --settings-gutter: 28px;
   --settings-section-gap: 20px;
diff --git a/apps/ui/styles/work-welcome.css b/apps/ui/styles/work-welcome.css
new file mode 100644
index 000000000..ecb77ca8d
--- /dev/null
+++ b/apps/ui/styles/work-welcome.css
@@ -0,0 +1,64 @@
+.shared-work-welcome {
+  width: 100%;
+  max-width: 650px;
+  margin: clamp(16px, 7vh, 70px) auto 0;
+  padding-inline: 16px;
+  text-align: center;
+}
+.shared-work-welcome > img {
+  width: 56px;
+  height: 56px;
+  max-width: 56px;
+  max-height: 56px;
+  margin-bottom: 14px;
+  object-fit: contain;
+}
+.shared-work-welcome-eyebrow {
+  margin: 0 0 8px;
+  color: var(--blue-strong);
+  font-size: var(--font-size-caption);
+  font-weight: 750;
+  letter-spacing: 0.09em;
+  text-transform: uppercase;
+}
+.shared-work-welcome h3 {
+  margin: 0;
+  color: var(--text-strong);
+  font-size: var(--font-size-heading);
+  letter-spacing: -0.018em;
+  line-height: var(--line-height-tight);
+}
+.shared-work-welcome-description {
+  margin: 8px 0 12px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+}
+.shared-work-starters {
+  display: grid;
+  gap: 7px;
+  margin-top: 18px;
+  text-align: left;
+}
+.shared-work-starters .ui-button {
+  justify-content: flex-start;
+  gap: 9px;
+  padding: 10px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--surface);
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+  text-align: left;
+  white-space: normal;
+}
+.shared-work-starters .ui-button svg {
+  flex-shrink: 0;
+  color: var(--blue-strong);
+}
+.shared-work-starters .ui-button:hover:not(:disabled),
+.shared-work-starters .ui-button:focus-visible {
+  border-color: var(--accent-border);
+  background: var(--surface-hover);
+  color: var(--text-strong);
+}
diff --git a/apps/ui/styles/workspace-sidebar.css b/apps/ui/styles/workspace-sidebar.css
new file mode 100644
index 000000000..e7ca487a5
--- /dev/null
+++ b/apps/ui/styles/workspace-sidebar.css
@@ -0,0 +1,200 @@
+.shared-workspace-sidebar-heading {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  font-weight: 650;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+.shared-workspace-search {
+  display: flex;
+  align-items: center;
+  gap: 9px;
+  min-height: 38px;
+  padding: 0 4px 0 9px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  color: var(--muted);
+  background: var(--surface-control);
+}
+.shared-workspace-search:focus-within {
+  border-color: var(--cyan);
+  outline: 1px solid var(--cyan);
+}
+.shared-workspace-search > svg {
+  flex: none;
+}
+.shared-workspace-search input {
+  width: 100%;
+  min-width: 0;
+  padding: 0;
+  border: 0;
+  outline: 0;
+  background: transparent;
+  color: var(--text);
+  font: inherit;
+  font-size: var(--font-size-body-sm);
+  font-weight: 400;
+}
+.shared-workspace-search input::placeholder {
+  color: var(--muted);
+}
+.shared-workspace-search kbd {
+  flex: none;
+  padding: 1px 4px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  font-family: var(--font-sans);
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+}
+.shared-workspace-scope {
+  display: flex;
+  gap: 4px;
+}
+.shared-workspace-scope button {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  gap: 5px;
+  flex: 1;
+  min-width: 0;
+  min-height: 28px;
+  padding: 4px 6px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--muted);
+  font: inherit;
+  font-size: var(--font-size-caption);
+  font-weight: 600;
+  line-height: var(--line-height-body);
+}
+.shared-workspace-scope button[aria-pressed="true"] {
+  border-color: var(--accent-border);
+  background: var(--surface-selected);
+  color: var(--accent-text);
+}
+.shared-workspace-scope button:disabled {
+  opacity: var(--disabled-opacity);
+}
+.shared-workspace-row {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  min-width: 0;
+  min-height: 38px;
+  padding: 3px 6px 3px 8px;
+  background: var(--surface-selected);
+  border-radius: var(--radius-sm);
+}
+.shared-workspace-row-identity {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex: 1;
+  min-width: 0;
+  padding: 0;
+  border: 0;
+  background: transparent;
+  color: var(--text-strong);
+  font: inherit;
+  font-size: var(--font-size-body-sm);
+  font-weight: 650;
+  text-align: left;
+  text-decoration: none;
+}
+.shared-workspace-row-identity > svg {
+  flex: none;
+  color: var(--blue-strong);
+}
+.shared-workspace-row-identity > strong {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  font: inherit;
+}
+.shared-workspace-readiness {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  flex: none;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.shared-workspace-group-heading {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  min-width: 0;
+  padding: 0 6px 5px 8px;
+  color: var(--muted);
+}
+.shared-workspace-group-heading :is(h2, h3) {
+  margin: 0;
+  flex: 1;
+  font-size: var(--font-size-body-sm);
+  font-weight: 650;
+  letter-spacing: 0.07em;
+  text-transform: uppercase;
+}
+.shared-workspace-group-heading > span {
+  font-size: var(--font-size-caption);
+}
+.shared-workspace-thread-link {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  width: 100%;
+  min-width: 0;
+  padding: 9px 10px;
+  text-align: left;
+  color: var(--text);
+  background: transparent;
+  border: 0;
+  border-radius: var(--radius-sm);
+  text-decoration: none;
+}
+.shared-workspace-thread-link:hover {
+  background: var(--surface-hover);
+}
+.shared-workspace-thread-link[aria-current="page"] {
+  background: var(--surface-selected);
+}
+.shared-workspace-thread-copy {
+  display: flex;
+  flex-direction: column;
+  flex: 1;
+  gap: 3px;
+  min-width: 0;
+}
+.shared-workspace-thread-copy > strong {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--text-strong);
+  font-size: var(--font-size-body-sm);
+  font-weight: 600;
+}
+.shared-workspace-thread-copy > span {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.shared-workspace-thread-state {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex: none;
+}
+.shared-workspace-scope button:focus-visible,
+.shared-workspace-row :is(button, a):focus-visible,
+.shared-workspace-thread-link:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
diff --git a/apps/ui/test/boundary.test.mjs b/apps/ui/test/boundary.test.mjs
index aece4e79f..df83c2846 100644
--- a/apps/ui/test/boundary.test.mjs
+++ b/apps/ui/test/boundary.test.mjs
@@ -22,7 +22,21 @@ test("shared UI cannot import a host, transport, or runtime authority", () => {
       assert.ok(
         specifier.startsWith("./") ||
           specifier.startsWith("../") ||
-          ["react", "react-dom", "@tabler/icons-react"].includes(specifier),
+          [
+            "react",
+            "react-dom",
+            "@tabler/icons-react",
+            "@radix-ui/react-slot",
+            "@radix-ui/react-dropdown-menu",
+            "@tanstack/react-table",
+            "class-variance-authority",
+            "clsx",
+            "tailwind-merge",
+            "react-markdown",
+            "rehype-sanitize",
+            "remark-gfm",
+            "recharts",
+          ].includes(specifier),
         `${path}: forbidden dependency ${specifier}`,
       );
       if (specifier.startsWith("."))
@@ -39,7 +53,7 @@ test("shared UI cannot import a host, transport, or runtime authority", () => {
   }
   const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
   assert.equal(manifest.private, true);
-  for (const app of ["desktop", "vscode"]) {
+  for (const app of ["desktop", "vscode", "web"]) {
     const consumer = JSON.parse(
       readFileSync(join(root, "..", app, "package.json"), "utf8"),
     );
diff --git a/apps/ui/tsconfig.json b/apps/ui/tsconfig.json
new file mode 100644
index 000000000..78fe5289b
--- /dev/null
+++ b/apps/ui/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "paths": {
+      "@colossus/ui/*": ["./src/*"]
+    }
+  },
+  "include": ["src"]
+}
diff --git a/apps/vscode/.vscodeignore b/apps/vscode/.vscodeignore
index cedf05d06..030f9b46d 100644
--- a/apps/vscode/.vscodeignore
+++ b/apps/vscode/.vscodeignore
@@ -11,6 +11,8 @@
 !dist/icons/**
 !dist/colossus-mark.svg
 !dist/THIRD_PARTY_NOTICES.txt
+!dist/shadcn.css
+!dist/shadcn-LICENSE.txt
 !dist/node_modules/**
 !dist/explorer.js
 !dist/inspector.js
diff --git a/apps/vscode/package-lock.json b/apps/vscode/package-lock.json
index 802250d9b..2dcdb3630 100644
--- a/apps/vscode/package-lock.json
+++ b/apps/vscode/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "colossus",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "colossus",
-      "version": "0.1.13",
+      "version": "0.1.14",
       "license": "Apache-2.0",
       "dependencies": {
         "@colossus/ui": "file:../ui",
@@ -14,12 +14,15 @@
         "@napi-rs/keyring": "2.1.0",
         "@obscuritylabs/colossus-sdk": "file:../../sdk/typescript",
         "react": "19.2.7",
-        "react-dom": "19.2.7"
+        "react-dom": "19.2.7",
+        "react-is": "19.2.7"
       },
       "devDependencies": {
         "@axe-core/playwright": "4.12.1",
         "@playwright/test": "1.62.0",
         "@tabler/icons": "3.45.0",
+        "@tailwindcss/node": "4.3.3",
+        "@tailwindcss/oxide": "4.3.3",
         "@types/mdast": "4.0.4",
         "@types/node": "22.18.0",
         "@types/react": "19.2.17",
@@ -31,6 +34,7 @@
         "mdast-util-gfm-table": "2.0.0",
         "micromark-extension-gfm-table": "2.1.1",
         "prettier": "3.9.5",
+        "tailwindcss": "4.3.3",
         "typescript": "5.9.3"
       },
       "engines": {
@@ -251,7 +255,18 @@
       "resolved": "file:../ui",
       "license": "Apache-2.0",
       "dependencies": {
-        "@tabler/icons-react": "3.45.0"
+        "@radix-ui/react-dropdown-menu": "2.1.24",
+        "@radix-ui/react-slot": "1.3.3",
+        "@tabler/icons-react": "3.45.0",
+        "@tanstack/react-table": "9.2.6",
+        "class-variance-authority": "0.7.1",
+        "clsx": "2.1.1",
+        "react-is": "19.2.7",
+        "react-markdown": "10.1.0",
+        "recharts": "3.10.1",
+        "rehype-sanitize": "6.0.0",
+        "remark-gfm": "4.0.1",
+        "tailwind-merge": "3.7.0"
       },
       "peerDependencies": {
         "react": "19.2.7",
@@ -700,6 +715,44 @@
         "node": ">=18"
       }
     },
+    "node_modules/@floating-ui/core": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.8.0.tgz",
+      "integrity": "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/utils": "^0.2.12"
+      }
+    },
+    "node_modules/@floating-ui/dom": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.8.0.tgz",
+      "integrity": "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/core": "^1.8.0",
+        "@floating-ui/utils": "^0.2.12"
+      }
+    },
+    "node_modules/@floating-ui/react-dom": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.9.tgz",
+      "integrity": "sha512-JDjEFGCpImxDCA7JJKviA0M9+RtmJdj0m/NVU5IMgBK+AmZouAQQ7/+2GLH0GXXY0YMw9oXPB8hKdbPYg5QLYg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/dom": "^1.8.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@floating-ui/utils": {
+      "version": "0.2.12",
+      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.12.tgz",
+      "integrity": "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==",
+      "license": "MIT"
+    },
     "node_modules/@grpc/grpc-js": {
       "version": "1.14.5",
       "resolved": "https://registry.npmjs.org/@grpc/grpc-js/-/grpc-js-1.14.5.tgz",
@@ -731,6 +784,56 @@
         "node": ">=6"
       }
     },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
     "node_modules/@js-sdsl/ordered-map": {
       "version": "4.4.2",
       "resolved": "https://registry.npmjs.org/@js-sdsl/ordered-map/-/ordered-map-4.4.2.tgz",
@@ -1045,187 +1148,1238 @@
       "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
       "license": "BSD-3-Clause"
     },
-    "node_modules/@secretlint/core": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/@secretlint/core/-/core-10.2.2.tgz",
-      "integrity": "sha512-6rdwBwLP9+TO3rRjMVW1tX+lQeo5gBbxl1I5F8nh8bgGtKwdlCMhMKsBWzWg1ostxx/tIG7OjZI0/BxsP8bUgw==",
-      "dev": true,
+    "node_modules/@radix-ui/primitive": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.7.tgz",
+      "integrity": "sha512-rqWnm76nYT8HoNNqEjpgJ7Pw/DrBj5iBTrmEPo6HTX5+VJyBNOqTdv4g89G63HuR5g0AaENoAcH7Is5fF2kZ8Q==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/react-arrow": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.15.tgz",
+      "integrity": "sha512-v4zggRcjadnI+ClKDuijlQEW4tw3NoaeHc/PwpKnLoLLKNUG4InLegkstooLcRIUWCs+8L22dGURCVuFfOKfnA==",
       "license": "MIT",
       "dependencies": {
-        "@secretlint/profiler": "^10.2.2",
-        "@secretlint/types": "^10.2.2",
-        "debug": "^4.4.1",
-        "structured-source": "^4.0.0"
+        "@radix-ui/react-primitive": "2.1.10"
       },
-      "engines": {
-        "node": ">=20.0.0"
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@secretlint/profiler": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/@secretlint/profiler/-/profiler-10.2.2.tgz",
-      "integrity": "sha512-qm9rWfkh/o8OvzMIfY8a5bCmgIniSpltbVlUVl983zDG1bUuQNd1/5lUEeWx5o/WJ99bXxS7yNI4/KIXfHexig==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@secretlint/secretlint-rule-no-dotenv": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/@secretlint/secretlint-rule-no-dotenv/-/secretlint-rule-no-dotenv-10.2.2.tgz",
-      "integrity": "sha512-KJRbIShA9DVc5Va3yArtJ6QDzGjg3PRa1uYp9As4RsyKtKSSZjI64jVca57FZ8gbuk4em0/0Jq+uy6485wxIdg==",
-      "dev": true,
+    "node_modules/@radix-ui/react-collection": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.15.tgz",
+      "integrity": "sha512-9W+B9NPF0NaaPh/1NJd3+KqsnlLqU9H7T2rvww+fp+T/evVXdNAyYcnfRQZFOjkR1ajQp3yORlqnI8soawLvNA==",
       "license": "MIT",
       "dependencies": {
-        "@secretlint/types": "^10.2.2"
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-slot": "1.3.3"
       },
-      "engines": {
-        "node": ">=20.0.0"
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@secretlint/secretlint-rule-preset-recommend": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/@secretlint/secretlint-rule-preset-recommend/-/secretlint-rule-preset-recommend-10.2.2.tgz",
-      "integrity": "sha512-K3jPqjva8bQndDKJqctnGfwuAxU2n9XNCPtbXVI5JvC7FnQiNg/yWlQPbMUlBXtBoBGFYp08A94m6fvtc9v+zA==",
-      "dev": true,
+    "node_modules/@radix-ui/react-compose-refs": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.5.tgz",
+      "integrity": "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA==",
       "license": "MIT",
-      "engines": {
-        "node": ">=20.0.0"
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@secretlint/source-creator": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/@secretlint/source-creator/-/source-creator-10.2.2.tgz",
-      "integrity": "sha512-h6I87xJfwfUTgQ7irWq7UTdq/Bm1RuQ/fYhA3dtTIAop5BwSFmZyrchph4WcoEvbN460BWKmk4RYSvPElIIvxw==",
-      "dev": true,
+    "node_modules/@radix-ui/react-context": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.2.2.tgz",
+      "integrity": "sha512-RHCUGwKHDr0hDGg4X7ma4JG4/+12qxw8rkh5QKdDldlCvtja6nUx1Ef/8HVrJze81lEsgLQlqjzjGNHantgnQA==",
       "license": "MIT",
-      "dependencies": {
-        "@secretlint/types": "^10.2.2",
-        "istextorbinary": "^9.5.0"
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
       },
-      "engines": {
-        "node": ">=20.0.0"
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@secretlint/types": {
-      "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/@secretlint/types/-/types-10.2.2.tgz",
-      "integrity": "sha512-Nqc90v4lWCXyakD6xNyNACBJNJ0tNCwj2WNk/7ivyacYHxiITVgmLUFXTBOeCdy79iz6HtN9Y31uw/jbLrdOAg==",
-      "dev": true,
+    "node_modules/@radix-ui/react-direction": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.4.tgz",
+      "integrity": "sha512-5pzg4FGQNpExhnhT2zlrP1wZFaYCd1K0nYWoFAdcYoYK868IEigqMX3B3f8yIoRlAhAeDWciLI6ZdCKHF9P4Vg==",
       "license": "MIT",
-      "engines": {
-        "node": ">=20.0.0"
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@tabler/icons": {
-      "version": "3.45.0",
-      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.45.0.tgz",
-      "integrity": "sha512-jiATwV8+zGYLTZ7gMLGivCic+KtsMZXcDmufIG8umlLxoHhI6902hGYIEt0Oa9Y9SXblNzUlrisHm5jOFMxOQA==",
+    "node_modules/@radix-ui/react-dismissable-layer": {
+      "version": "1.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.19.tgz",
+      "integrity": "sha512-8g4pfOL9HoKKLWGiypT+dphVqjFfmcXO5GBnhsG6zI+lxAx/8feQpr+1LSN8Re3hiZ+XkLNS4O9ztK11/LzQ6w==",
       "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/codecalm"
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-effect-event": "0.0.5"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@tabler/icons-react": {
-      "version": "3.45.0",
-      "resolved": "https://registry.npmjs.org/@tabler/icons-react/-/icons-react-3.45.0.tgz",
-      "integrity": "sha512-t/AuKs7ALMDDTY+B9IvfZnlO0mbLlP/lJxP/HnGC49QkM8mCsTN38kYyxjXxgrb1+TeK53ioVBJqIV7n/eysXQ==",
+    "node_modules/@radix-ui/react-dropdown-menu": {
+      "version": "2.1.24",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.24.tgz",
+      "integrity": "sha512-geq8l2rJkxvkXsT9RMgtUE3P8pITFpTsvYpbySi1IH4fZEABD/Gp85myayFgxk0ktljGMJnCbeFkyTusvSvv7g==",
       "license": "MIT",
       "dependencies": {
-        "@tabler/icons": "3.45.0"
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-menu": "2.1.24",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-controllable-state": "1.2.6"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/codecalm"
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
       },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-guards": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.6.tgz",
+      "integrity": "sha512-RNOJjfZMTyBM6xYmV3IVGXkPjIhcBAuv48POevAXwrGJhkWZ9p1rFoIS1JFooPuT193AZmRsCPhpoVJxx6OPoQ==",
+      "license": "MIT",
       "peerDependencies": {
-        "react": ">= 16"
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@types/debug": {
-      "version": "4.1.13",
-      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
-      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
-      "dev": true,
+    "node_modules/@radix-ui/react-focus-scope": {
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.16.tgz",
+      "integrity": "sha512-wmRZ2WWLvmt6KHy2rNPOdPUjwq5xOHY02+m+udwJTn0aNIox/rkskAvJTyTLGhPK6KgrUjlJUJpgmx/+wFiFIQ==",
       "license": "MIT",
       "dependencies": {
-        "@types/ms": "*"
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@types/mdast": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
-      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
-      "dev": true,
+    "node_modules/@radix-ui/react-id": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.1.4.tgz",
+      "integrity": "sha512-TMQp2llA+RYn7JcjnrMnz7wN4pcVttPZnRZo52PLQsoLVKzNlVwUeHmfePgTgRluXFvlD3GD5g5MOVVTJCO0qA==",
       "license": "MIT",
       "dependencies": {
-        "@types/unist": "*"
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@types/ms": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
-      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/node": {
-      "version": "22.18.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.18.0.tgz",
-      "integrity": "sha512-m5ObIqwsUp6BZzyiy4RdZpzWGub9bqLJMvZDD0QMXhxjqMHMENlj+SqF5QxoUwaQNFe+8kz8XM8ZQhqkQPTgMQ==",
+    "node_modules/@radix-ui/react-menu": {
+      "version": "2.1.24",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.24.tgz",
+      "integrity": "sha512-uW7RVuU6Lp/ZtfeY4b3kL32zccgEWvPv1+cf17ubYzHa9cL8AHokmk36cG/XEiH/smbQvumnieXX9j/e9RqJWA==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~6.21.0"
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-collection": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-direction": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.19",
+        "@radix-ui/react-focus-guards": "1.1.6",
+        "@radix-ui/react-focus-scope": "1.1.16",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-popper": "1.3.7",
+        "@radix-ui/react-portal": "1.1.17",
+        "@radix-ui/react-presence": "1.1.10",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-roving-focus": "1.1.19",
+        "@radix-ui/react-slot": "1.3.3",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "aria-hidden": "^1.2.4",
+        "react-remove-scroll": "^2.7.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@types/react": {
-      "version": "19.2.17",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
-      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
-      "dev": true,
+    "node_modules/@radix-ui/react-popper": {
+      "version": "1.3.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.3.7.tgz",
+      "integrity": "sha512-UsJrrd7w4wuKKTdvd/DNERVlwSlUcyXzjhyDwBk+3aPOsCjOY6ZSbxuw8E6lZTjjfP8Cpd0J8VVkrYUWyGYXyg==",
       "license": "MIT",
       "dependencies": {
-        "csstype": "^3.2.2"
+        "@floating-ui/react-dom": "^2.0.0",
+        "@radix-ui/react-arrow": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-layout-effect": "1.1.4",
+        "@radix-ui/react-use-rect": "1.1.4",
+        "@radix-ui/react-use-size": "1.1.4",
+        "@radix-ui/rect": "1.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@types/react-dom": {
-      "version": "19.2.3",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
-      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
-      "dev": true,
+    "node_modules/@radix-ui/react-portal": {
+      "version": "1.1.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.17.tgz",
+      "integrity": "sha512-vKQLcWypUnwZVvfV7UkGahH2g6ySe8M8R+zYBwPrv5byZ9QAW6cQVvNKo7GgmD+p8aYb6D9JBuvy8/WhOno2wQ==",
       "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
       "peerDependencies": {
-        "@types/react": "^19.2.0"
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@types/unist": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
-      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/vscode": {
-      "version": "1.101.0",
-      "resolved": "https://registry.npmjs.org/@types/vscode/-/vscode-1.101.0.tgz",
-      "integrity": "sha512-ZWf0IWa+NGegdW3iU42AcDTFHWW7fApLdkdnBqwYEtHVIBGbTu0ZNQKP/kX3Ds/uMJXIMQNAojHR4vexCEEz5Q==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.9",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.9.tgz",
-      "integrity": "sha512-edSdeAqkdxBVzA1yL1LrLCml1YjyCVvPMtMqJpbF+6K609tHe8V6sQUzFQSGcYNhcuhOceZtjvN32+mpIth30A==",
-      "dev": true,
+    "node_modules/@radix-ui/react-presence": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.10.tgz",
+      "integrity": "sha512-3wyzCQ6+ubRA+D4uv9m95JYLXxmOHp05qjrkjeA7uKHHtjpPggQzc6DAb0URl7j67oR0K2foO4ip27TiX037Bw==",
       "license": "MIT",
       "dependencies": {
-        "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.0",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-primitive": {
+      "version": "2.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.10.tgz",
+      "integrity": "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-slot": "1.3.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-roving-focus": {
+      "version": "1.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.19.tgz",
+      "integrity": "sha512-V9jI6hDjT7l3jsCQD9bLNvDLM3tH/gdbOTp7Tefp3hbbgCGQoK7tUvrWiRlcoBHIZ809ElXwNQwVo0B98LuTXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-collection": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-direction": "1.1.4",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-controllable-state": "1.2.6",
+        "@radix-ui/react-use-is-hydrated": "0.1.3",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-slot": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.3.3.tgz",
+      "integrity": "sha512-qx7oqnYbxnK9kYI9m317qmFmEgo6ywqWvbTogdj7cL9p3/yx4M48p7Rnw5z3H890cL/ow/EeWJsuTykeZVXP5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.5"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-callback-ref": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.1.4.tgz",
+      "integrity": "sha512-R6OUY2e2fA6Yn6s+VSx5KBV6Nx8LQEhu+cz7LCej18rQ1HLyg9PSC9jP/ZNx0o6FAIK9c0F1kHylzSxKsdlkrQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-controllable-state": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.2.6.tgz",
+      "integrity": "sha512-uEQJGT97ZA/TgP/Hydw47lHu+/vQj6z/0jA+WeTbK1o9Rx45GImjpD0tc3W5ad3D6XTSR6e1yEO0FvGq6WQfVQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-use-effect-event": "0.0.5",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-effect-event": {
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-effect-event/-/react-use-effect-event-0.0.5.tgz",
+      "integrity": "sha512-7cshFL8HGS/7HEiHH+9kL9HBwp2sa9yX18Knwek6KYWmXwM7pegMgta2AXMQKI+rq3JnfSj9x8wYqFMTdG1Jgg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-is-hydrated": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-is-hydrated/-/react-use-is-hydrated-0.1.3.tgz",
+      "integrity": "sha512-umO/aJ+82CpOnhDZUTbILCQf7kU/g0iv+oGs/Q8jw7IkhWBzaEP4sA268PhFAJTFetbwp3ICc6ktpI4TqtxcIw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-layout-effect": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.4.tgz",
+      "integrity": "sha512-K20DkRkUwDnxEYMBPcg3Y6voLkEy5p5QQmszZgLngKKiC7dzBR/aEuK3w1qlx2JWDUNH6FluahYdgR3BP+QbYw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-rect": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-rect/-/react-use-rect-1.1.4.tgz",
+      "integrity": "sha512-cSOCh6JlkmfjLyNcLiu2nB4v+nm+dkZ+Q5KHWk/soo4U7ZLiEQFKHK9/YmtBHjfCEaU43IBKQOc4/uJmCaiCTQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/rect": "1.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-size": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.4.tgz",
+      "integrity": "sha512-D3anSY15EJoxrihpsXI6SMrmmonnQtR2ni7arO+Lfdg3O95b9hNXxONk8jA5C8ANdF/h5HMAxejgs8PWJ6rlhw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/rect": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/rect/-/rect-1.1.3.tgz",
+      "integrity": "sha512-JtyZR+mqgBibTo8xea3B6ZRmzZiM/YeVBtUkas6zMuXjAlfIFIW2FgqeM9eLyvEaYX66vr6DJMK+4U6LV0KhNw==",
+      "license": "MIT"
+    },
+    "node_modules/@reduxjs/toolkit": {
+      "version": "2.13.0",
+      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.13.0.tgz",
+      "integrity": "sha512-f6jwVRfwW30+tnllz4YcsHHpPYYOE7abcHkyUCovD+P7DyhdAI5prz2Fh/8TLhakjpN+7aIEion1s5L/tvlYlA==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/utils": "^0.3.0",
+        "immer": "^11.0.0",
+        "redux": "^5.0.1",
+        "redux-thunk": "^3.1.0",
+        "reselect": "^5.1.0"
+      },
+      "peerDependencies": {
+        "react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
+        "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@secretlint/core": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/@secretlint/core/-/core-10.2.2.tgz",
+      "integrity": "sha512-6rdwBwLP9+TO3rRjMVW1tX+lQeo5gBbxl1I5F8nh8bgGtKwdlCMhMKsBWzWg1ostxx/tIG7OjZI0/BxsP8bUgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@secretlint/profiler": "^10.2.2",
+        "@secretlint/types": "^10.2.2",
+        "debug": "^4.4.1",
+        "structured-source": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@secretlint/profiler": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/@secretlint/profiler/-/profiler-10.2.2.tgz",
+      "integrity": "sha512-qm9rWfkh/o8OvzMIfY8a5bCmgIniSpltbVlUVl983zDG1bUuQNd1/5lUEeWx5o/WJ99bXxS7yNI4/KIXfHexig==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@secretlint/secretlint-rule-no-dotenv": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/@secretlint/secretlint-rule-no-dotenv/-/secretlint-rule-no-dotenv-10.2.2.tgz",
+      "integrity": "sha512-KJRbIShA9DVc5Va3yArtJ6QDzGjg3PRa1uYp9As4RsyKtKSSZjI64jVca57FZ8gbuk4em0/0Jq+uy6485wxIdg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@secretlint/types": "^10.2.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@secretlint/secretlint-rule-preset-recommend": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/@secretlint/secretlint-rule-preset-recommend/-/secretlint-rule-preset-recommend-10.2.2.tgz",
+      "integrity": "sha512-K3jPqjva8bQndDKJqctnGfwuAxU2n9XNCPtbXVI5JvC7FnQiNg/yWlQPbMUlBXtBoBGFYp08A94m6fvtc9v+zA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@secretlint/source-creator": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/@secretlint/source-creator/-/source-creator-10.2.2.tgz",
+      "integrity": "sha512-h6I87xJfwfUTgQ7irWq7UTdq/Bm1RuQ/fYhA3dtTIAop5BwSFmZyrchph4WcoEvbN460BWKmk4RYSvPElIIvxw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@secretlint/types": "^10.2.2",
+        "istextorbinary": "^9.5.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@secretlint/types": {
+      "version": "10.2.2",
+      "resolved": "https://registry.npmjs.org/@secretlint/types/-/types-10.2.2.tgz",
+      "integrity": "sha512-Nqc90v4lWCXyakD6xNyNACBJNJ0tNCwj2WNk/7ivyacYHxiITVgmLUFXTBOeCdy79iz6HtN9Y31uw/jbLrdOAg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
+      "license": "MIT"
+    },
+    "node_modules/@tabler/icons": {
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.45.0.tgz",
+      "integrity": "sha512-jiATwV8+zGYLTZ7gMLGivCic+KtsMZXcDmufIG8umlLxoHhI6902hGYIEt0Oa9Y9SXblNzUlrisHm5jOFMxOQA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/codecalm"
+      }
+    },
+    "node_modules/@tabler/icons-react": {
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons-react/-/icons-react-3.45.0.tgz",
+      "integrity": "sha512-t/AuKs7ALMDDTY+B9IvfZnlO0mbLlP/lJxP/HnGC49QkM8mCsTN38kYyxjXxgrb1+TeK53ioVBJqIV7n/eysXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tabler/icons": "3.45.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/codecalm"
+      },
+      "peerDependencies": {
+        "react": ">= 16"
+      }
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
+      "integrity": "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "^5.24.1",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz",
+      "integrity": "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-x64": "4.3.3",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.3",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.3",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.3",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.3.tgz",
+      "integrity": "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.3.tgz",
+      "integrity": "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.3.tgz",
+      "integrity": "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.3.tgz",
+      "integrity": "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.3.tgz",
+      "integrity": "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.3.tgz",
+      "integrity": "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.3.tgz",
+      "integrity": "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.3.tgz",
+      "integrity": "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.3.tgz",
+      "integrity": "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+      "integrity": "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
+      "integrity": "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.3.tgz",
+      "integrity": "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tanstack/react-store": {
+      "version": "0.11.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.11.2.tgz",
+      "integrity": "sha512-oj5O5DmiMWE+ih+SioX2ayC1kbK7d3fpLx0B75fPJr9nY3zU+hoW010yr64qXsY/9fyiLVE2bn5mGNV3owm8RQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/store": "0.11.2",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/@tanstack/react-table": {
+      "version": "9.2.6",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-table/-/react-table-9.2.6.tgz",
+      "integrity": "sha512-Wmt3sbzwz+5CtB0pqIxGw2FrNW9mF4AhJ9KnS1/VGZ8cDAEg51S4ixru2dnF0xQnY407kdYNLer3ms+n8zCN6w==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/react-store": "^0.11.2",
+        "@tanstack/table-core": "9.2.6"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": ">=18"
+      }
+    },
+    "node_modules/@tanstack/store": {
+      "version": "0.11.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/store/-/store-0.11.2.tgz",
+      "integrity": "sha512-sJ4mjol8uQsHV0gOJzzjwXfh2Fwm+Sz0+8deqiTm4jGbMdjzNSW+xZCFm0kUa870uhd8yi+DpKnZb5Kc4apa0Q==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tanstack/table-core": {
+      "version": "9.2.6",
+      "resolved": "https://registry.npmjs.org/@tanstack/table-core/-/table-core-9.2.6.tgz",
+      "integrity": "sha512-t5LaLx8gDCgzjvwtZo5xtLklJP11D9zaKOW8q6jOCyuQYhkqpTK1heqMfgTQwDlhl0dU8f1X66Xurbj3jpCUSw==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/store": "^0.11.2"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@types/d3-array": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
+      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-color": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
+      "integrity": "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-ease": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
+      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-interpolate": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
+      "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-color": "*"
+      }
+    },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
+      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
+    "node_modules/@types/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-kVd74ta9eof3eJOvbNd1vGKS/XERRyQbT26Og63hIsvDO84cjD5gEOhsXf26w3FSoNlPVz84DOFcKv/oou+fMw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
+      }
+    },
+    "node_modules/@types/d3-time": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
+      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-timer": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
+      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/debug": {
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/ms": "*"
+      }
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/estree-jsx": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz",
+      "integrity": "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "*"
+      }
+    },
+    "node_modules/@types/hast": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/mdast": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
+      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "22.18.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.18.0.tgz",
+      "integrity": "sha512-m5ObIqwsUp6BZzyiy4RdZpzWGub9bqLJMvZDD0QMXhxjqMHMENlj+SqF5QxoUwaQNFe+8kz8XM8ZQhqkQPTgMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@types/react": {
+      "version": "19.2.17",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
+      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
+      "license": "MIT",
+      "dependencies": {
+        "csstype": "^3.2.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "19.2.3",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
+      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "^19.2.0"
+      }
+    },
+    "node_modules/@types/unist": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
+      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
+      "license": "MIT"
+    },
+    "node_modules/@types/use-sync-external-store": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
+      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/vscode": {
+      "version": "1.101.0",
+      "resolved": "https://registry.npmjs.org/@types/vscode/-/vscode-1.101.0.tgz",
+      "integrity": "sha512-ZWf0IWa+NGegdW3iU42AcDTFHWW7fApLdkdnBqwYEtHVIBGbTu0ZNQKP/kX3Ds/uMJXIMQNAojHR4vexCEEz5Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@typespec/ts-http-runtime": {
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.9.tgz",
+      "integrity": "sha512-edSdeAqkdxBVzA1yL1LrLCml1YjyCVvPMtMqJpbF+6K609tHe8V6sQUzFQSGcYNhcuhOceZtjvN32+mpIth30A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.0",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=22.0.0"
       }
     },
+    "node_modules/@ungap/structured-clone": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
+      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==",
+      "license": "ISC"
+    },
     "node_modules/@vscode/vsce": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/@vscode/vsce/-/vsce-4.0.0.tgz",
@@ -1678,6 +2832,18 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
+    "node_modules/aria-hidden": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
+      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/axe-core": {
       "version": "4.12.1",
       "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.12.1.tgz",
@@ -1699,6 +2865,16 @@
         "typed-rest-client": "^1.8.4"
       }
     },
+    "node_modules/bail": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
+      "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/balanced-match": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
@@ -1809,17 +2985,68 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/ccount": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
+      "integrity": "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/character-entities": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
       "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/character-entities-html4": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
+      "integrity": "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-legacy": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
+      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-reference-invalid": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
+      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/class-variance-authority": {
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
+      "integrity": "sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "clsx": "^2.1.1"
+      },
+      "funding": {
+        "url": "https://polar.sh/cva"
+      }
+    },
     "node_modules/cliui": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
@@ -1834,6 +3061,15 @@
         "node": ">=12"
       }
     },
+    "node_modules/clsx": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/cockatiel": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/cockatiel/-/cockatiel-3.2.1.tgz",
@@ -1862,6 +3098,16 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
+    "node_modules/comma-separated-tokens": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
+      "integrity": "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/commander": {
       "version": "12.1.0",
       "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
@@ -1876,14 +3122,133 @@
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "dev": true,
       "license": "MIT"
     },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-ease": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-3.0.1.tgz",
+      "integrity": "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-format": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
+      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-color": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-timer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
+      "integrity": "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
       "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -1897,11 +3262,16 @@
         }
       }
     },
+    "node_modules/decimal.js-light": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
+      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
+      "license": "MIT"
+    },
     "node_modules/decode-named-character-reference": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
       "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "character-entities": "^2.0.0"
@@ -1958,17 +3328,21 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
       "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
       }
     },
+    "node_modules/detect-node-es": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
+      "integrity": "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==",
+      "license": "MIT"
+    },
     "node_modules/devlop": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
       "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "dequal": "^2.0.0"
@@ -2026,6 +3400,20 @@
       "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "license": "MIT"
     },
+    "node_modules/enhanced-resolve": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.26.0.tgz",
+      "integrity": "sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
     "node_modules/entities": {
       "version": "8.1.0",
       "resolved": "https://registry.npmjs.org/entities/-/entities-8.1.0.tgz",
@@ -2072,6 +3460,18 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-toolkit": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.52.0.tgz",
+      "integrity": "sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA==",
+      "license": "MIT",
+      "workspaces": [
+        "docs",
+        "benchmarks",
+        "tests/types",
+        "tests/browser-compat"
+      ]
+    },
     "node_modules/esbuild": {
       "version": "0.25.12",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
@@ -2123,6 +3523,40 @@
         "node": ">=6"
       }
     },
+    "node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/estree-util-is-identifier-name": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/estree-util-is-identifier-name/-/estree-util-is-identifier-name-3.0.0.tgz",
+      "integrity": "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/eventemitter3": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
+      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
+      "license": "MIT"
+    },
+    "node_modules/extend": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
+      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
+      "license": "MIT"
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -2200,6 +3634,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/get-nonce": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-nonce/-/get-nonce-1.0.1.tgz",
+      "integrity": "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/get-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
@@ -2260,6 +3703,61 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/hast-util-sanitize": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/hast-util-sanitize/-/hast-util-sanitize-5.0.2.tgz",
+      "integrity": "sha512-3yTWghByc50aGS7JlGhk61SPenfE/p1oaFeNwkOOyrscaOkMGrcW9+Cy/QAIOBpZxP1yqDIzFMR0+Np0i0+usg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@ungap/structured-clone": "^1.0.0",
+        "unist-util-position": "^5.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-to-jsx-runtime": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.6.tgz",
+      "integrity": "sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/unist": "^3.0.0",
+        "comma-separated-tokens": "^2.0.0",
+        "devlop": "^1.0.0",
+        "estree-util-is-identifier-name": "^3.0.0",
+        "hast-util-whitespace": "^3.0.0",
+        "mdast-util-mdx-expression": "^2.0.0",
+        "mdast-util-mdx-jsx": "^3.0.0",
+        "mdast-util-mdxjs-esm": "^2.0.0",
+        "property-information": "^7.0.0",
+        "space-separated-tokens": "^2.0.0",
+        "style-to-js": "^1.0.0",
+        "unist-util-position": "^5.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-whitespace": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/hast-util-whitespace/-/hast-util-whitespace-3.0.0.tgz",
+      "integrity": "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/hosted-git-info": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz",
@@ -2273,6 +3771,16 @@
         "node": ">=10"
       }
     },
+    "node_modules/html-url-attributes": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/html-url-attributes/-/html-url-attributes-3.0.1.tgz",
+      "integrity": "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/http-proxy-agent": {
       "version": "7.0.2",
       "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
@@ -2301,6 +3809,65 @@
         "node": ">= 14"
       }
     },
+    "node_modules/immer": {
+      "version": "11.1.21",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.21.tgz",
+      "integrity": "sha512-bZSadeCPGdaY5/qRLgr6mDSH1ra21rD3rqpiWk7+QTr4ayYPTE9qZYdLh/NdPhMe0wSrTvHD/Lk8q5EwhUs0aw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
+    "node_modules/inline-style-parser": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.2.7.tgz",
+      "integrity": "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==",
+      "license": "MIT"
+    },
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/is-alphabetical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
+      "integrity": "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-alphanumerical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-2.0.1.tgz",
+      "integrity": "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==",
+      "license": "MIT",
+      "dependencies": {
+        "is-alphabetical": "^2.0.0",
+        "is-decimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-decimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-2.0.1.tgz",
+      "integrity": "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/is-docker": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz",
@@ -2326,6 +3893,16 @@
         "node": ">=8"
       }
     },
+    "node_modules/is-hexadecimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-2.0.1.tgz",
+      "integrity": "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/is-inside-container": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
@@ -2345,6 +3922,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/is-plain-obj": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
+      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-wsl": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
@@ -2379,57 +3968,338 @@
         "url": "https://bevry.me/fund"
       }
     },
-    "node_modules/jsonc-parser": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
-      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/jsonwebtoken": {
-      "version": "9.0.3",
-      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
-      "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
+      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/jsonwebtoken": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-9.0.3.tgz",
+      "integrity": "sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "jws": "^4.0.1",
+        "lodash.includes": "^4.3.0",
+        "lodash.isboolean": "^3.0.3",
+        "lodash.isinteger": "^4.0.4",
+        "lodash.isnumber": "^3.0.3",
+        "lodash.isplainobject": "^4.0.6",
+        "lodash.isstring": "^4.0.1",
+        "lodash.once": "^4.0.0",
+        "ms": "^2.1.1",
+        "semver": "^7.5.4"
+      },
+      "engines": {
+        "node": ">=12",
+        "npm": ">=6"
+      }
+    },
+    "node_modules/jwa": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
+      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "buffer-equal-constant-time": "^1.0.1",
+        "ecdsa-sig-formatter": "1.0.11",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/jws": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
+      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "jwa": "^2.0.1",
+        "safe-buffer": "^5.0.1"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "jws": "^4.0.1",
-        "lodash.includes": "^4.3.0",
-        "lodash.isboolean": "^3.0.3",
-        "lodash.isinteger": "^4.0.4",
-        "lodash.isnumber": "^3.0.3",
-        "lodash.isplainobject": "^4.0.6",
-        "lodash.isstring": "^4.0.1",
-        "lodash.once": "^4.0.0",
-        "ms": "^2.1.1",
-        "semver": "^7.5.4"
-      },
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=12",
-        "npm": ">=6"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/jwa": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
-      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-equal-constant-time": "^1.0.1",
-        "ecdsa-sig-formatter": "1.0.11",
-        "safe-buffer": "^5.0.1"
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/jws": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
-      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
+    "node_modules/lightningcss/node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "jwa": "^2.0.1",
-        "safe-buffer": "^5.0.1"
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
       }
     },
     "node_modules/lodash.camelcase": {
@@ -2497,7 +4367,6 @@
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/longest-streak/-/longest-streak-3.1.0.tgz",
       "integrity": "sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -2517,11 +4386,20 @@
         "node": ">=10"
       }
     },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
     "node_modules/markdown-table": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-3.0.4.tgz",
       "integrity": "sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -2551,11 +4429,26 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/mdast-util-find-and-replace": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.3.tgz",
+      "integrity": "sha512-xPgpDNl0/OXHsI7TlaIs22lWnH3KlpvZdXG1ET/m/YT2Hhdkx8lJV4kLphE6l9simyM4KPDFBwas08BgEob6Jw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "escape-string-regexp": "^5.0.0",
+        "unist-util-is": "^6.0.0",
+        "unist-util-visit-parents": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdast-util-from-markdown": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.3.tgz",
       "integrity": "sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -2576,11 +4469,78 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/mdast-util-gfm": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm/-/mdast-util-gfm-3.1.0.tgz",
+      "integrity": "sha512-0ulfdQOM3ysHhCJ1p06l0b0VKlhU0wuQs3thxZQagjcjPrlFRqY215uZGHHJan9GEAXd9MbfPjFJz+qMkVR6zQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-gfm-autolink-literal": "^2.0.0",
+        "mdast-util-gfm-footnote": "^2.0.0",
+        "mdast-util-gfm-strikethrough": "^2.0.0",
+        "mdast-util-gfm-table": "^2.0.0",
+        "mdast-util-gfm-task-list-item": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-autolink-literal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.1.tgz",
+      "integrity": "sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "ccount": "^2.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-find-and-replace": "^3.0.0",
+        "micromark-util-character": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-footnote": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-footnote/-/mdast-util-gfm-footnote-2.1.0.tgz",
+      "integrity": "sha512-sqpDWlsHn7Ac9GNZQMeUzPQSMzR6Wv0WKRNvQRg0KqHh02fpTz69Qc1QSseNX29bhz1ROIyNyxExfawVKTm1GQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.1.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-strikethrough": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-strikethrough/-/mdast-util-gfm-strikethrough-2.0.1.tgz",
+      "integrity": "sha512-OuJHqvr455pwu2OaOrir7dbzqs4jlWKOtlu9L6GjcIjjQwNyw02VntQsr/Ek6/A13vgnXfUhBekWRUP1OkNivw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdast-util-gfm-table": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/mdast-util-gfm-table/-/mdast-util-gfm-table-2.0.0.tgz",
       "integrity": "sha512-78UEvebzz/rJIxLvE7ZtDd/vIQ0RHv+3Mh5DR96p7cS7HsBhYIICDBCu8csTNWNO6tBWfqXPWekRuj2FNOGOZg==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -2594,11 +4554,86 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/mdast-util-gfm-task-list-item": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-task-list-item/-/mdast-util-gfm-task-list-item-2.0.0.tgz",
+      "integrity": "sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdx-expression": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdx-expression/-/mdast-util-mdx-expression-2.0.1.tgz",
+      "integrity": "sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdx-jsx": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdx-jsx/-/mdast-util-mdx-jsx-3.2.0.tgz",
+      "integrity": "sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "ccount": "^2.0.0",
+        "devlop": "^1.1.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "parse-entities": "^4.0.0",
+        "stringify-entities": "^4.0.0",
+        "unist-util-stringify-position": "^4.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdxjs-esm": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdxjs-esm/-/mdast-util-mdxjs-esm-2.0.1.tgz",
+      "integrity": "sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdast-util-phrasing": {
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/mdast-util-phrasing/-/mdast-util-phrasing-4.1.0.tgz",
       "integrity": "sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -2609,11 +4644,31 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/mdast-util-to-hast": {
+      "version": "13.2.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@ungap/structured-clone": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "trim-lines": "^3.0.0",
+        "unist-util-position": "^5.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/mdast-util-to-markdown": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.2.0.tgz",
       "integrity": "sha512-2Jn/ADrHFFyyniBMi0bncTbJqU78K3/TEYvzvwrWWzD9MYPUa/Gm4r3nOeKFQg/PDM5BsbDYdc8ackW4NTY6NA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0",
@@ -2637,7 +4692,6 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
       "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/mdast": "^4.0.0"
@@ -2651,7 +4705,6 @@
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.3.tgz",
       "integrity": "sha512-oGYfQzHSG5dOMovQcJ3fyTmZlWAWpi0XA0sJwJs+i6OT88o1+Jtw/8z0CmdowSLxGhhFK89rQ/oXph/wN02PNw==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2688,7 +4741,6 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.4.tgz",
       "integrity": "sha512-wxEeE8v8XVvOrxn1TZj74qYhAtTQsSqufHVS3uNVyT1MupXxhyaHk8/9xDNPh9BmL77QNDgWTkZ3RsYHB2ry7w==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2701,30 +4753,133 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "decode-named-character-reference": "^1.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-factory-destination": "^2.0.0",
+        "micromark-factory-label": "^2.0.0",
+        "micromark-factory-space": "^2.1.0",
+        "micromark-factory-title": "^2.0.0",
+        "micromark-factory-whitespace": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-edit-map": "^1.0.0",
+        "micromark-util-html-tag-name": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.3"
+      }
+    },
+    "node_modules/micromark-extension-gfm": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm/-/micromark-extension-gfm-3.0.0.tgz",
+      "integrity": "sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark-extension-gfm-autolink-literal": "^2.0.0",
+        "micromark-extension-gfm-footnote": "^2.0.0",
+        "micromark-extension-gfm-strikethrough": "^2.0.0",
+        "micromark-extension-gfm-table": "^2.0.0",
+        "micromark-extension-gfm-tagfilter": "^2.0.0",
+        "micromark-extension-gfm-task-list-item": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-autolink-literal": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-autolink-literal/-/micromark-extension-gfm-autolink-literal-2.1.0.tgz",
+      "integrity": "sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-footnote": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-footnote/-/micromark-extension-gfm-footnote-2.1.0.tgz",
+      "integrity": "sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-strikethrough": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-strikethrough/-/micromark-extension-gfm-strikethrough-2.1.0.tgz",
+      "integrity": "sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw==",
+      "license": "MIT",
+      "dependencies": {
         "devlop": "^1.0.0",
-        "micromark-factory-destination": "^2.0.0",
-        "micromark-factory-label": "^2.0.0",
-        "micromark-factory-space": "^2.1.0",
-        "micromark-factory-title": "^2.0.0",
-        "micromark-factory-whitespace": "^2.0.0",
-        "micromark-util-character": "^2.0.0",
         "micromark-util-chunked": "^2.0.0",
         "micromark-util-classify-character": "^2.0.0",
-        "micromark-util-edit-map": "^1.0.0",
-        "micromark-util-html-tag-name": "^2.0.0",
-        "micromark-util-normalize-identifier": "^2.0.0",
         "micromark-util-resolve-all": "^2.0.0",
-        "micromark-util-subtokenize": "^2.0.0",
         "micromark-util-symbol": "^2.0.0",
-        "micromark-util-types": "^2.0.3"
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
     "node_modules/micromark-extension-gfm-table": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.1.1.tgz",
       "integrity": "sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg==",
-      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-tagfilter": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-tagfilter/-/micromark-extension-gfm-tagfilter-2.0.0.tgz",
+      "integrity": "sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-task-list-item": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-task-list-item/-/micromark-extension-gfm-task-list-item-2.1.0.tgz",
+      "integrity": "sha512-qIBZhqxqI6fjLDYFTBIa4eivDMnP+OZqsNwmQ3xNLE4Cxwc+zfQEfbs6tzAo2Hjq+bh6q5F+Z8/cksrLFYWQQw==",
       "license": "MIT",
       "dependencies": {
         "devlop": "^1.0.0",
@@ -2742,7 +4897,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
       "integrity": "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2764,7 +4918,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
       "integrity": "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2787,7 +4940,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.1.0.tgz",
       "integrity": "sha512-fS8hnLIjnjvdQIj39Geug8wWsR0HrYZ43KShKxNfwT7t2LOHo/LbWZEzEaSOjwtjdCsjoE6syHhonEzW0zv0+Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2808,7 +4960,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
       "integrity": "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2831,7 +4982,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
       "integrity": "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2854,7 +5004,6 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
       "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2875,7 +5024,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
       "integrity": "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2895,7 +5043,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
       "integrity": "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2917,7 +5064,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
       "integrity": "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2938,7 +5084,6 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
       "integrity": "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2958,7 +5103,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
       "integrity": "sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -2981,7 +5125,6 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/micromark-util-edit-map/-/micromark-util-edit-map-1.0.0.tgz",
       "integrity": "sha512-Pa2ljlsEL6sVwFaYeyrOLSYbQt73JvGbPOYFq+9AElXiSnfI5Q4465RRZ1sHv7lDjDOnGRDDaqPXqClqWK/q1Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3001,7 +5144,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
       "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3018,7 +5160,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
       "integrity": "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3035,7 +5176,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
       "integrity": "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3055,7 +5195,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
       "integrity": "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3075,7 +5214,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
       "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3097,7 +5235,6 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
       "integrity": "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3120,7 +5257,6 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
       "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3137,7 +5273,6 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.3.tgz",
       "integrity": "sha512-oxB2Ik03hI0gv+VNn9tnh1t1YEe9MDPptViAEgfdf3YQHsn0pzGTgCdlSCJXcwhqm8phaEuM7zeEu3QQzVBrPg==",
-      "dev": true,
       "funding": [
         {
           "type": "GitHub Sponsors",
@@ -3183,7 +5318,6 @@
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/mute-stream": {
@@ -3225,6 +5359,31 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/parse-entities": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-4.0.2.tgz",
+      "integrity": "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^2.0.0",
+        "character-entities-legacy": "^3.0.0",
+        "character-reference-invalid": "^2.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "is-alphanumerical": "^2.0.0",
+        "is-decimal": "^2.0.0",
+        "is-hexadecimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/parse-entities/node_modules/@types/unist": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-2.0.11.tgz",
+      "integrity": "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==",
+      "license": "MIT"
+    },
     "node_modules/parse5": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
@@ -3287,109 +5446,369 @@
         "playwright-core": "cli.js"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=20"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "3.9.5",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.5.tgz",
+      "integrity": "sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
+    "node_modules/proper-lockfile": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
+      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "retry": "^0.12.0",
+        "signal-exit": "^3.0.2"
+      }
+    },
+    "node_modules/property-information": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",
+      "integrity": "sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/protobufjs": {
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
+      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
+        "@types/node": ">=13.7.0",
+        "long": "^5.3.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/react": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
+      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
+      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.7"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.7.tgz",
+      "integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
+      "license": "MIT"
+    },
+    "node_modules/react-markdown": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/react-markdown/-/react-markdown-10.1.0.tgz",
+      "integrity": "sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "hast-util-to-jsx-runtime": "^2.0.0",
+        "html-url-attributes": "^3.0.0",
+        "mdast-util-to-hast": "^13.0.0",
+        "remark-parse": "^11.0.0",
+        "remark-rehype": "^11.0.0",
+        "unified": "^11.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      },
+      "peerDependencies": {
+        "@types/react": ">=18",
+        "react": ">=18"
+      }
+    },
+    "node_modules/react-redux": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
+      "integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/use-sync-external-store": "^0.0.6",
+        "use-sync-external-store": "^1.4.0"
+      },
+      "peerDependencies": {
+        "@types/react": "^18.2.25 || ^19",
+        "react": "^18.0 || ^19",
+        "redux": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.7.2.tgz",
+      "integrity": "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-remove-scroll-bar": "^2.3.7",
+        "react-style-singleton": "^2.2.3",
+        "tslib": "^2.1.0",
+        "use-callback-ref": "^1.3.3",
+        "use-sidecar": "^1.1.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll-bar": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll-bar/-/react-remove-scroll-bar-2.3.8.tgz",
+      "integrity": "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-style-singleton": "^2.2.2",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-style-singleton": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/react-style-singleton/-/react-style-singleton-2.2.3.tgz",
+      "integrity": "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==",
+      "license": "MIT",
+      "dependencies": {
+        "get-nonce": "^1.0.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/read": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/read/-/read-1.0.7.tgz",
+      "integrity": "sha512-rSOKNYUmaxy0om1BNjMN4ezNT6VKK+2xF4GBhc81mkH7L60i6dp8qPYrkndNLT3QPphoII3maL9PVC9XmhHwVQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "mute-stream": "~0.0.4"
+      },
+      "engines": {
+        "node": ">=0.8"
       }
     },
-    "node_modules/prettier": {
-      "version": "3.9.5",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.5.tgz",
-      "integrity": "sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==",
-      "dev": true,
+    "node_modules/recharts": {
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.10.1.tgz",
+      "integrity": "sha512-QXFrvt6IVcw7eeZCoyXTwkIJAX3Dv1nyVhMicXJ47GsGDDpcN8z6o644DibE9XjpBTThtsomLKnTV6lc+cVFUA==",
       "license": "MIT",
-      "bin": {
-        "prettier": "bin/prettier.cjs"
+      "workspaces": [
+        "www"
+      ],
+      "dependencies": {
+        "@reduxjs/toolkit": "^1.9.0 || 2.x.x",
+        "clsx": "^2.1.1",
+        "decimal.js-light": "^2.5.1",
+        "es-toolkit": "^1.39.3",
+        "eventemitter3": "^5.0.1",
+        "immer": "^11.1.8",
+        "react-redux": "8.x.x || 9.x.x",
+        "reselect": "5.2.0",
+        "tiny-invariant": "^1.3.3",
+        "use-sync-external-store": "^1.2.2",
+        "victory-vendor": "^37.0.2"
       },
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       },
-      "funding": {
-        "url": "https://github.com/prettier/prettier?sponsor=1"
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/proper-lockfile": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
-      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
-      "dev": true,
+    "node_modules/redux": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
+      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
+      "license": "MIT"
+    },
+    "node_modules/redux-thunk": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
+      "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
       "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.4",
-        "retry": "^0.12.0",
-        "signal-exit": "^3.0.2"
+      "peerDependencies": {
+        "redux": "^5.0.0"
       }
     },
-    "node_modules/protobufjs": {
-      "version": "7.6.6",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
-      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
-      "hasInstallScript": true,
-      "license": "BSD-3-Clause",
+    "node_modules/rehype-sanitize": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/rehype-sanitize/-/rehype-sanitize-6.0.0.tgz",
+      "integrity": "sha512-CsnhKNsyI8Tub6L4sm5ZFsme4puGfc6pYylvXo1AeqaGbjOYyzNv3qZPwvs0oMJ39eryyeOdmxwUIo94IpEhqg==",
+      "license": "MIT",
       "dependencies": {
-        "@protobufjs/aspromise": "^1.1.2",
-        "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.5",
-        "@protobufjs/eventemitter": "^1.1.1",
-        "@protobufjs/fetch": "^1.1.1",
-        "@protobufjs/float": "^1.0.2",
-        "@protobufjs/path": "^1.1.2",
-        "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.1",
-        "@types/node": ">=13.7.0",
-        "long": "^5.3.2"
+        "@types/hast": "^3.0.0",
+        "hast-util-sanitize": "^5.0.0"
       },
-      "engines": {
-        "node": ">=12.0.0"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
-      "dev": true,
-      "license": "BSD-3-Clause",
+    "node_modules/remark-gfm": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/remark-gfm/-/remark-gfm-4.0.1.tgz",
+      "integrity": "sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==",
+      "license": "MIT",
       "dependencies": {
-        "es-define-property": "^1.0.1",
-        "side-channel": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=0.6"
+        "@types/mdast": "^4.0.0",
+        "mdast-util-gfm": "^3.0.0",
+        "micromark-extension-gfm": "^3.0.0",
+        "remark-parse": "^11.0.0",
+        "remark-stringify": "^11.0.0",
+        "unified": "^11.0.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/react": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
-      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
+    "node_modules/remark-parse": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-11.0.0.tgz",
+      "integrity": "sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==",
       "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "unified": "^11.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/react-dom": {
-      "version": "19.2.7",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
-      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
+    "node_modules/remark-rehype": {
+      "version": "11.1.2",
+      "resolved": "https://registry.npmjs.org/remark-rehype/-/remark-rehype-11.1.2.tgz",
+      "integrity": "sha512-Dh7l57ianaEoIpzbp0PC9UKAdCSVklD8E5Rpw7ETfbTl3FqcOOgq5q2LVDhgGCkaBv7p24JXikPdvhhmHvKMsw==",
       "license": "MIT",
       "dependencies": {
-        "scheduler": "^0.27.0"
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "mdast-util-to-hast": "^13.0.0",
+        "unified": "^11.0.0",
+        "vfile": "^6.0.0"
       },
-      "peerDependencies": {
-        "react": "^19.2.7"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
-    "node_modules/read": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/read/-/read-1.0.7.tgz",
-      "integrity": "sha512-rSOKNYUmaxy0om1BNjMN4ezNT6VKK+2xF4GBhc81mkH7L60i6dp8qPYrkndNLT3QPphoII3maL9PVC9XmhHwVQ==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/remark-stringify": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/remark-stringify/-/remark-stringify-11.0.0.tgz",
+      "integrity": "sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw==",
+      "license": "MIT",
       "dependencies": {
-        "mute-stream": "~0.0.4"
+        "@types/mdast": "^4.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "unified": "^11.0.0"
       },
-      "engines": {
-        "node": ">=0.8"
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
       }
     },
     "node_modules/require-directory": {
@@ -3401,6 +5820,12 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/reselect": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.2.0.tgz",
+      "integrity": "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw==",
+      "license": "MIT"
+    },
     "node_modules/retry": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
@@ -3557,6 +5982,26 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/source-map-js": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/space-separated-tokens": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
+      "integrity": "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/string-width": {
       "version": "4.2.3",
       "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
@@ -3571,6 +6016,20 @@
         "node": ">=8"
       }
     },
+    "node_modules/stringify-entities": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
+      "integrity": "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==",
+      "license": "MIT",
+      "dependencies": {
+        "character-entities-html4": "^2.0.0",
+        "character-entities-legacy": "^3.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
@@ -3593,6 +6052,55 @@
         "boundary": "^2.0.0"
       }
     },
+    "node_modules/style-to-js": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.21.tgz",
+      "integrity": "sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ==",
+      "license": "MIT",
+      "dependencies": {
+        "style-to-object": "1.0.14"
+      }
+    },
+    "node_modules/style-to-object": {
+      "version": "1.0.14",
+      "resolved": "https://registry.npmjs.org/style-to-object/-/style-to-object-1.0.14.tgz",
+      "integrity": "sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw==",
+      "license": "MIT",
+      "dependencies": {
+        "inline-style-parser": "0.2.7"
+      }
+    },
+    "node_modules/tailwind-merge": {
+      "version": "3.7.0",
+      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.7.0.tgz",
+      "integrity": "sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/dcastil"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz",
+      "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
     "node_modules/textextensions": {
       "version": "6.11.0",
       "resolved": "https://registry.npmjs.org/textextensions/-/textextensions-6.11.0.tgz",
@@ -3609,6 +6117,12 @@
         "url": "https://bevry.me/fund"
       }
     },
+    "node_modules/tiny-invariant": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
+      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
+      "license": "MIT"
+    },
     "node_modules/tinyglobby": {
       "version": "0.2.17",
       "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
@@ -3626,11 +6140,30 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
+    "node_modules/trim-lines": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz",
+      "integrity": "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/trough": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/trough/-/trough-2.2.0.tgz",
+      "integrity": "sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
       "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "dev": true,
       "license": "0BSD"
     },
     "node_modules/tunnel": {
@@ -3682,11 +6215,42 @@
       "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
       "license": "MIT"
     },
+    "node_modules/unified": {
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/unified/-/unified-11.0.5.tgz",
+      "integrity": "sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "bail": "^2.0.0",
+        "devlop": "^1.0.0",
+        "extend": "^3.0.0",
+        "is-plain-obj": "^4.0.0",
+        "trough": "^2.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/unist-util-is": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
       "integrity": "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==",
-      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-position": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-position/-/unist-util-position-5.0.0.tgz",
+      "integrity": "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==",
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0"
@@ -3700,7 +6264,6 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
       "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0"
@@ -3714,7 +6277,6 @@
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-5.1.0.tgz",
       "integrity": "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0",
@@ -3730,7 +6292,6 @@
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-6.0.2.tgz",
       "integrity": "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/unist": "^3.0.0",
@@ -3748,6 +6309,58 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/use-callback-ref": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.3.tgz",
+      "integrity": "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sidecar": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/use-sidecar/-/use-sidecar-1.1.3.tgz",
+      "integrity": "sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==",
+      "license": "MIT",
+      "dependencies": {
+        "detect-node-es": "^1.1.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sync-external-store": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.7.0.tgz",
+      "integrity": "sha512-6L+EeigHMQhdaIPNIFUKwfWJSwWFQ8gJbJ2DLOs5sDIegTwR9fRxvnM3uciHKjIZhFz+KAv2emhWMRvDmMcY8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
     "node_modules/version-range": {
       "version": "4.15.0",
       "resolved": "https://registry.npmjs.org/version-range/-/version-range-4.15.0.tgz",
@@ -3761,6 +6374,56 @@
         "url": "https://bevry.me/fund"
       }
     },
+    "node_modules/vfile": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/vfile/-/vfile-6.0.3.tgz",
+      "integrity": "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/vfile-message": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-4.0.3.tgz",
+      "integrity": "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/victory-vendor": {
+      "version": "37.3.6",
+      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-37.3.6.tgz",
+      "integrity": "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==",
+      "license": "MIT AND ISC",
+      "dependencies": {
+        "@types/d3-array": "^3.0.3",
+        "@types/d3-ease": "^3.0.0",
+        "@types/d3-interpolate": "^3.0.1",
+        "@types/d3-scale": "^4.0.2",
+        "@types/d3-shape": "^3.1.0",
+        "@types/d3-time": "^3.0.0",
+        "@types/d3-timer": "^3.0.0",
+        "d3-array": "^3.1.6",
+        "d3-ease": "^3.0.1",
+        "d3-interpolate": "^3.0.1",
+        "d3-scale": "^4.0.2",
+        "d3-shape": "^3.1.0",
+        "d3-time": "^3.0.0",
+        "d3-timer": "^3.0.1"
+      }
+    },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
@@ -3888,7 +6551,6 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
       "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "type": "github",
diff --git a/apps/vscode/package.json b/apps/vscode/package.json
index 69e111401..3f150f57e 100644
--- a/apps/vscode/package.json
+++ b/apps/vscode/package.json
@@ -2,7 +2,7 @@
   "name": "colossus",
   "displayName": "Colossus",
   "description": "Work with the Colossus agent runtime from VS Code.",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "publisher": "obscuritylabs",
   "icon": "media/colossus.png",
   "type": "module",
@@ -210,12 +210,15 @@
     "@napi-rs/keyring": "2.1.0",
     "@obscuritylabs/colossus-sdk": "file:../../sdk/typescript",
     "react": "19.2.7",
-    "react-dom": "19.2.7"
+    "react-dom": "19.2.7",
+    "react-is": "19.2.7"
   },
   "devDependencies": {
     "@axe-core/playwright": "4.12.1",
     "@playwright/test": "1.62.0",
     "@tabler/icons": "3.45.0",
+    "@tailwindcss/node": "4.3.3",
+    "@tailwindcss/oxide": "4.3.3",
     "@types/mdast": "4.0.4",
     "@types/node": "22.18.0",
     "@types/react": "19.2.17",
@@ -227,6 +230,7 @@
     "mdast-util-gfm-table": "2.0.0",
     "micromark-extension-gfm-table": "2.1.1",
     "prettier": "3.9.5",
+    "tailwindcss": "4.3.3",
     "typescript": "5.9.3"
   },
   "overrides": {
diff --git a/apps/vscode/scripts/build.mjs b/apps/vscode/scripts/build.mjs
index a05f10878..909bc07a6 100644
--- a/apps/vscode/scripts/build.mjs
+++ b/apps/vscode/scripts/build.mjs
@@ -1,12 +1,49 @@
 import { build } from "esbuild";
+import { compile, optimize } from "@tailwindcss/node";
+import { Scanner } from "@tailwindcss/oxide";
 import { validateViewContributions } from "./validate-manifest.mjs";
 import { cp, mkdir, readdir, rm, readFile, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { basename, dirname, resolve } from "node:path";
 
 validateViewContributions(JSON.parse(await readFile("package.json", "utf8")));
 
 await rm("dist", { recursive: true, force: true });
 await mkdir("dist", { recursive: true });
+const sharedStylesheet = resolve("node_modules/@colossus/ui/styles/shadcn.css");
+const compiler = await compile(await readFile(sharedStylesheet, "utf8"), {
+  from: sharedStylesheet,
+  base: dirname(sharedStylesheet),
+  onDependency() {},
+});
+const sourceRoots =
+  compiler.root === "none"
+    ? []
+    : compiler.root === null
+      ? [{ base: process.cwd(), pattern: "**/*", negated: false }]
+      : [{ ...compiler.root, negated: false }];
+const scanner = new Scanner({
+  sources: [
+    ...sourceRoots,
+    ...compiler.sources,
+    {
+      base: dirname(process.execPath),
+      pattern: basename(process.execPath),
+      negated: true,
+    },
+    {
+      base: dirname(sharedStylesheet),
+      pattern: basename(sharedStylesheet),
+      negated: false,
+    },
+  ],
+});
+await writeFile(
+  "dist/shadcn.css",
+  optimize(compiler.build(scanner.scan()), {
+    file: sharedStylesheet,
+    minify: true,
+  }).code,
+);
 const hostBuild = await build({
   entryPoints: ["src/extension.ts"],
   bundle: true,
@@ -80,6 +117,14 @@ licenses.set(
   "tabler",
   `@tabler/icons@${tabler.version} (MIT)\n${await readFile("node_modules/@tabler/icons/LICENSE", "utf8")}`,
 );
+licenses.set(
+  "shadcn",
+  await readFile("node_modules/@colossus/ui/assets/shadcn-LICENSE.txt", "utf8"),
+);
+await cp(
+  "node_modules/@colossus/ui/assets/shadcn-LICENSE.txt",
+  "dist/shadcn-LICENSE.txt",
+);
 await writeFile(
   "dist/THIRD_PARTY_NOTICES.txt",
   [...licenses.values()].join(
diff --git a/apps/vscode/scripts/capture-preview.mjs b/apps/vscode/scripts/capture-preview.mjs
index 41d81695e..34e8d3d1a 100644
--- a/apps/vscode/scripts/capture-preview.mjs
+++ b/apps/vscode/scripts/capture-preview.mjs
@@ -9,7 +9,8 @@ const directory = resolve("artifacts/review");
 await mkdir(directory, { recursive: true });
 const { version } = JSON.parse(await readFile("package.json", "utf8"));
 const mark = `data:image/svg+xml;base64,${(await readFile("dist/colossus-mark.svg")).toString("base64")}`;
-let style = `${await readFile("dist/theme.css", "utf8")}\n${await readFile("dist/style.css", "utf8")}
+let style = `${await readFile("dist/theme.css", "utf8")}
+${await readFile("dist/shadcn.css", "utf8")}\n${await readFile("dist/style.css", "utf8")}
 ${await readFile("dist/composer.css", "utf8")}
 ${await readFile("dist/select.css", "utf8")}`;
 for (const name of await readdir("dist/icons")) {
diff --git a/apps/vscode/scripts/preview.mjs b/apps/vscode/scripts/preview.mjs
index 073198fea..713e9e0f2 100644
--- a/apps/vscode/scripts/preview.mjs
+++ b/apps/vscode/scripts/preview.mjs
@@ -7,6 +7,7 @@ const paths = new Map([
   ["/inspector.js", ["dist/inspector.js", "text/javascript"]],
   ["/workspace.css", ["dist/workspace.css", "text/css"]],
   ["/theme.css", ["dist/theme.css", "text/css"]],
+  ["/shadcn.css", ["dist/shadcn.css", "text/css"]],
   ["/style.css", ["dist/style.css", "text/css"]],
   ["/composer.css", ["dist/composer.css", "text/css"]],
   ["/select.css", ["dist/select.css", "text/css"]],
@@ -38,7 +39,7 @@ const server = createServer(async (request, response) => {
     const css =
       page === "settings" ? "settings" : page === "webview" ? "" : "workspace";
     response.end(
-      `<!doctype html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Colossus ${page} preview</title><link rel="stylesheet" href="/theme.css"><link rel="stylesheet" href="/style.css"><link rel="stylesheet" href="/composer.css"><link rel="stylesheet" href="/select.css">${page === "settings" ? '<link rel="stylesheet" href="/settings-frame.css">' : ""}${css ? `<link rel="stylesheet" href="/${css}.css">` : ""}</head><body data-colossus-mark="/colossus-mark.svg"><div id="app"></div><script src="/${page}.js"></script></body></html>`,
+      `<!doctype html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Colossus ${page} preview</title><link rel="stylesheet" href="/theme.css"><link rel="stylesheet" href="/shadcn.css"><link rel="stylesheet" href="/style.css"><link rel="stylesheet" href="/composer.css"><link rel="stylesheet" href="/select.css">${page === "settings" ? '<link rel="stylesheet" href="/settings-frame.css">' : ""}${css ? `<link rel="stylesheet" href="/${css}.css">` : ""}</head><body data-colossus-mark="/colossus-mark.svg"><div id="app"></div><script src="/${page}.js"></script></body></html>`,
     );
   } catch {
     response.writeHead(500).end();
diff --git a/apps/vscode/src/extension.ts b/apps/vscode/src/extension.ts
index 96ecb9ae5..fb4a129c0 100644
--- a/apps/vscode/src/extension.ts
+++ b/apps/vscode/src/extension.ts
@@ -151,7 +151,7 @@ export function activate(context: vscode.ExtensionContext) {
         : page === "work"
           ? ""
           : "workspace.css";
-    view.html = `<!doctype html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src ${view.cspSource}; script-src 'nonce-${nonce}'; img-src ${view.cspSource}; connect-src 'none'; base-uri 'none'; form-action 'none'"><link rel="stylesheet" href="${asset("theme.css")}"><link rel="stylesheet" href="${asset("style.css")}"><link rel="stylesheet" href="${asset("composer.css")}"><link rel="stylesheet" href="${asset("select.css")}">${page === "settings" ? `<link rel="stylesheet" href="${asset("settings-frame.css")}">` : ""}${extraCss ? `<link rel="stylesheet" href="${asset(extraCss)}">` : ""}<title>Colossus ${page}</title></head><body data-colossus-mark="${asset("colossus-mark.svg")}"><div id="app"></div><script nonce="${nonce}" src="${asset(`${script}.js`)}"></script></body></html>`;
+    view.html = `<!doctype html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src ${view.cspSource}; script-src 'nonce-${nonce}'; img-src ${view.cspSource}; connect-src 'none'; base-uri 'none'; form-action 'none'"><link rel="stylesheet" href="${asset("theme.css")}"><link rel="stylesheet" href="${asset("shadcn.css")}"><link rel="stylesheet" href="${asset("style.css")}"><link rel="stylesheet" href="${asset("composer.css")}"><link rel="stylesheet" href="${asset("select.css")}">${page === "settings" ? `<link rel="stylesheet" href="${asset("settings-frame.css")}">` : ""}${extraCss ? `<link rel="stylesheet" href="${asset(extraCss)}">` : ""}<title>Colossus ${page}</title></head><body data-colossus-mark="${asset("colossus-mark.svg")}"><div id="app"></div><script nonce="${nonce}" src="${asset(`${script}.js`)}"></script></body></html>`;
   }
 
   async function openInspector(id: string, kind: "run" | "plan") {
diff --git a/apps/vscode/test/browser/markdown.spec.ts b/apps/vscode/test/browser/markdown.spec.ts
index 711bd1df9..103f77c99 100644
--- a/apps/vscode/test/browser/markdown.spec.ts
+++ b/apps/vscode/test/browser/markdown.spec.ts
@@ -96,12 +96,12 @@ test("table cells preserve formatting and escaped pipes without loading or execu
   await expect(
     page.getByRole("cell", { name: "| pipe", exact: true }),
   ).toBeVisible();
-  await expect(
-    page.locator("#messages img, #messages a, #messages script"),
-  ).toHaveCount(0);
+  await expect(page.locator("#messages a, #messages script")).toHaveCount(0);
+  // The assistant avatar is the only image; generated remote images stay inert.
+  await expect(page.locator("#messages img")).toHaveCount(1);
   await expect(
     page.getByText('onerror="alert(1)"', { exact: false }),
-  ).toBeVisible();
+  ).toHaveCount(0);
   expect(outbound).toEqual([]);
 });
 
@@ -113,7 +113,7 @@ test("oversized and over-budget tables use the bounded plain-text fallback", asy
   const text = `${header}\n${separator}\n${header}`;
   expect(text.length).toBeLessThan(16_384);
   await show(page, text);
-  await expect(page.locator(".markdown.plain-text")).toHaveText(text);
+  await expect(page.locator(".shared-markdown pre code")).toHaveText(text);
   await expect(page.getByRole("table")).toHaveCount(0);
   await page.evaluate(
     (view) => window.postMessage({ type: "state", view }, "*"),
@@ -125,7 +125,7 @@ test("oversized and over-budget tables use the bounded plain-text fallback", asy
       ],
     },
   );
-  await expect(page.locator(".markdown.plain-text")).toHaveText(
+  await expect(page.locator(".markdown-plain-text")).toHaveText(
     processes.repeat(40),
   );
   await expect(page.getByRole("table")).toHaveCount(0);
diff --git a/apps/vscode/test/browser/sidebar.spec.ts b/apps/vscode/test/browser/sidebar.spec.ts
index b4d8e861e..e4156322c 100644
--- a/apps/vscode/test/browser/sidebar.spec.ts
+++ b/apps/vscode/test/browser/sidebar.spec.ts
@@ -22,9 +22,14 @@ async function open(page: Page, view: WorkView) {
   );
 }
 
-test("sidebar works at narrow widths, retains a cancelled draft, and renders model content as text", async ({
+test("sidebar works at narrow widths, retains a cancelled draft, and sanitizes model Markdown", async ({
   page,
 }) => {
+  const outbound: string[] = [];
+  page.on("request", (request) => {
+    if (!request.url().startsWith("http://127.0.0.1:4312"))
+      outbound.push(request.url());
+  });
   const view = {
     ...initialView("project"),
     connected: true,
@@ -54,7 +59,9 @@ test("sidebar works at narrow widths, retains a cancelled draft, and renders mod
   await expect(
     page.getByRole("textbox", { name: "Task for Colossus" }),
   ).toHaveValue("Inspect this function");
-  const model = '<img src="https://example.invalid/steal" onerror="alert(1)">';
+  const unsafeHtml =
+    '<img src="https://example.invalid/steal" onerror="alert(1)">';
+  const model = `Function inspection complete.\n\n${unsafeHtml}`;
   await page.evaluate(
     (view) => window.postMessage({ type: "state", view }, "*"),
     {
@@ -65,8 +72,24 @@ test("sidebar works at narrow widths, retains a cancelled draft, and renders mod
       ],
     },
   );
-  await expect(page.getByText(model, { exact: true })).toBeVisible();
-  await expect(page.locator("#messages img")).toHaveCount(0);
+  await expect(
+    page.getByText("Function inspection complete.", { exact: true }),
+  ).toBeVisible();
+  await expect(page.getByText(unsafeHtml, { exact: true })).toHaveCount(0);
+  await expect(
+    page.locator(
+      "#messages .shared-message-body img, #messages a, #messages script",
+    ),
+  ).toHaveCount(0);
+  const avatar = page.locator("#messages .shared-assistant-marker > img");
+  await expect(page.locator("#messages img")).toHaveCount(1);
+  await expect(avatar).toHaveAttribute(
+    "src",
+    /^data:image\/svg\+xml(?:;base64)?,/u,
+  );
+  await expect(avatar).toHaveCSS("width", "17px");
+  await expect(avatar).toHaveCSS("height", "17px");
+  expect(outbound).toEqual([]);
   await page.getByRole("button", { name: "Open Colossus settings" }).click();
   await expect
     .poll(() =>
@@ -134,9 +157,15 @@ test("long conversations scroll above a fixed composer and honor saved editor pr
   await expect(page.locator(".tool-thread")).toBeHidden();
   await expect(
     page.locator(
-      "#messages a, #messages img:not([data-brand-mark]), #messages script",
+      "#messages a, #messages .shared-message-body img, #messages script",
     ),
   ).toHaveCount(0);
+  // One shared response avatar and one host-owned tool-group mark remain.
+  await expect(page.locator("#messages img")).toHaveCount(2);
+  await expect(page.locator("#messages [data-brand-mark]")).toHaveCount(1);
+  await expect(
+    page.locator("#messages .shared-assistant-marker > img"),
+  ).toHaveAttribute("src", /^data:image\/svg\+xml(?:;base64)?,/u);
   await expect(page.locator("#messages pre code")).toHaveText(
     "colossus worker",
   );
diff --git a/apps/vscode/test/manifest.test.mjs b/apps/vscode/test/manifest.test.mjs
index bfb9ddabb..cc48a260f 100644
--- a/apps/vscode/test/manifest.test.mjs
+++ b/apps/vscode/test/manifest.test.mjs
@@ -6,6 +6,32 @@ import { validateViewContributions } from "../scripts/validate-manifest.mjs";
 const manifest = JSON.parse(
   await readFile(new URL("../package.json", import.meta.url), "utf8"),
 );
+test("referenced webview assets and shared attribution remain in the VSIX allowlist", async () => {
+  const [extension, build, ignore] = await Promise.all([
+    readFile(new URL("../src/extension.ts", import.meta.url), "utf8"),
+    readFile(new URL("../scripts/build.mjs", import.meta.url), "utf8"),
+    readFile(new URL("../.vscodeignore", import.meta.url), "utf8"),
+  ]);
+  const included = new Set(ignore.split(/\r?\n/u));
+  const referenced = [...extension.matchAll(/\basset\("([^"\n]+)"\)/gu)].map(
+    (match) => match[1],
+  );
+  assert.ok(referenced.includes("shadcn.css"));
+  for (const asset of [
+    ...referenced,
+    "shadcn-LICENSE.txt",
+    "THIRD_PARTY_NOTICES.txt",
+  ]) {
+    assert.ok(
+      included.has(`!dist/${asset}`),
+      `Referenced or attributed asset would be omitted: ${asset}`,
+    );
+    assert.ok(
+      build.includes(`dist/${asset}`),
+      `Asset is not emitted by the build: ${asset}`,
+    );
+  }
+});
 
 test("all contributed views have valid VS Code containers and bundled icons", async () => {
   assert.doesNotThrow(() => validateViewContributions(manifest));
diff --git a/apps/vscode/webview/conversation.ts b/apps/vscode/webview/conversation.ts
index 0fec06194..1f11aa643 100644
--- a/apps/vscode/webview/conversation.ts
+++ b/apps/vscode/webview/conversation.ts
@@ -1,6 +1,9 @@
 import type { MessageView, ToolView, WorkView } from "../src/model.js";
 import { brandMarks, icon, node } from "./ui.js";
-import { markdown } from "./markdown.js";
+import { createElement } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { flushSync } from "react-dom";
+import { ConversationEntry } from "@colossus/ui/conversation";
 
 function runId(message: MessageView) {
   return (
@@ -206,7 +209,7 @@ class ToolThread {
 export class Conversation {
   private messages = new Map<
     string,
-    { signature: string; element: HTMLElement }
+    { signature: string; element: HTMLElement; renderer: Root }
   >();
   private threads = new Map<string, ToolThread>();
   constructor(
@@ -247,10 +250,12 @@ export class Conversation {
       const signature = JSON.stringify(message);
       let cached = this.messages.get(message.id);
       if (!cached) {
-        cached = {
-          signature: "",
-          element: node("article", "", `message ${message.role}`),
-        };
+        const element = node(
+          "div",
+          "",
+          `message ${message.role} shared-message-island`,
+        );
+        cached = { signature: "", element, renderer: createRoot(element) };
         this.messages.set(message.id, cached);
       }
       if (cached.signature !== signature) {
@@ -263,11 +268,20 @@ export class Conversation {
             : message.role === "assistant"
               ? "Colossus"
               : "Notice";
-        cached.element.replaceChildren(
-          node("p", label, "message-author"),
-          message.role === "assistant"
-            ? markdown(message.text)
-            : node("div", message.text, "plain-text"),
+        const role =
+          message.role === "user"
+            ? "user"
+            : message.role === "assistant"
+              ? "assistant"
+              : "system";
+        flushSync(() =>
+          cached!.renderer.render(
+            createElement(ConversationEntry, {
+              role,
+              author: label,
+              content: message.text,
+            }),
+          ),
         );
       }
       children.push(cached.element);
@@ -277,7 +291,10 @@ export class Conversation {
     reconcile(this.root, children);
     const retained = new Set(view.messages.map((m) => m.id));
     for (const id of this.messages.keys())
-      if (!retained.has(id)) this.messages.delete(id);
+      if (!retained.has(id)) {
+        this.messages.get(id)?.renderer.unmount();
+        this.messages.delete(id);
+      }
     for (const id of this.threads.keys())
       if (!rendered.has(id)) this.threads.delete(id);
     if (changingSession || atBottom)
diff --git a/apps/vscode/webview/main.tsx b/apps/vscode/webview/main.tsx
index ef9059829..945eadfbc 100644
--- a/apps/vscode/webview/main.tsx
+++ b/apps/vscode/webview/main.tsx
@@ -1,3 +1,4 @@
+import { ConversationComposerFrame } from "@colossus/ui/conversation";
 import { createRoot } from "react-dom/client";
 import { flushSync } from "react-dom";
 import {
@@ -45,7 +46,72 @@ function saveDraft() {
 function renderComposer() {
   flushSync(() =>
     composerRoot.render(
-      <>
+      <ConversationComposerFrame
+        aria-label="Task for Colossus"
+        onSubmit={(event) => {
+          event.preventDefault();
+          send();
+        }}
+        footer={
+          <div className="composer-actions shared-vscode-footer">
+            <div className="composer-controls">
+              <button
+                id="attach"
+                type="button"
+                className="icon-button"
+                title="Add context"
+                aria-label="Add context"
+                aria-expanded={contextOpen}
+                aria-controls="context-actions"
+                disabled={!view?.connected || view.busy}
+                onClick={() => {
+                  contextOpen = !contextOpen;
+                  element("context-actions").hidden = !contextOpen;
+                  renderComposer();
+                }}
+              >
+                <span className="icon icon-paperclip" aria-hidden="true" />
+              </button>
+              <ComposerModeSwitch
+                value={mode.value}
+                disabled={!view?.connected || view.busy}
+                options={[
+                  { value: "plan", label: "Plan" },
+                  { value: "execute", label: "Execute" },
+                ]}
+                onChange={(value) => {
+                  mode.value = value;
+                  saveDraft();
+                  renderComposer();
+                }}
+              />
+            </div>
+            <ComposerSendButton
+              id="send"
+              aria-label="Send"
+              title={
+                preferences.sendShortcut === "enter"
+                  ? "Send (Enter)"
+                  : "Send (Ctrl/Cmd+Enter)"
+              }
+              hidden={!!view?.busy}
+              disabled={!view?.connected || !!view.busy || !draft.trim()}
+              onClick={send}
+            />
+            <ComposerSendButton
+              id="stop"
+              className="is-stop"
+              aria-label="Stop"
+              title="Stop"
+              hidden={!view?.busy}
+              disabled={!view?.connected}
+              onClick={() => post({ type: "stop" })}
+            >
+              <span className="icon icon-square" aria-hidden="true" />
+            </ComposerSendButton>
+          </div>
+        }
+      >
         <ComposerInput
           id="prompt"
           aria-label="Task for Colossus"
@@ -75,63 +141,7 @@ function renderComposer() {
             }
           }}
         />
-        <div className="composer-actions">
-          <div className="composer-controls">
-            <button
-              id="attach"
-              className="icon-button"
-              title="Add context"
-              aria-label="Add context"
-              aria-expanded={contextOpen}
-              aria-controls="context-actions"
-              disabled={!view?.connected || view.busy}
-              onClick={() => {
-                contextOpen = !contextOpen;
-                element("context-actions").hidden = !contextOpen;
-                renderComposer();
-              }}
-            >
-              <span className="icon icon-paperclip" aria-hidden="true" />
-            </button>
-            <ComposerModeSwitch
-              value={mode.value}
-              disabled={!view?.connected || view.busy}
-              options={[
-                { value: "plan", label: "Plan" },
-                { value: "execute", label: "Execute" },
-              ]}
-              onChange={(value) => {
-                mode.value = value;
-                saveDraft();
-                renderComposer();
-              }}
-            />
-          </div>
-          <ComposerSendButton
-            id="send"
-            aria-label="Send"
-            title={
-              preferences.sendShortcut === "enter"
-                ? "Send (Enter)"
-                : "Send (Ctrl/Cmd+Enter)"
-            }
-            hidden={!!view?.busy}
-            disabled={!view?.connected || !!view.busy || !draft.trim()}
-            onClick={send}
-          />
-          <ComposerSendButton
-            id="stop"
-            className="is-stop"
-            aria-label="Stop"
-            title="Stop"
-            hidden={!view?.busy}
-            disabled={!view?.connected}
-            onClick={() => post({ type: "stop" })}
-          >
-            <span className="icon icon-square" aria-hidden="true" />
-          </ComposerSendButton>
-        </div>
-      </>,
+      </ConversationComposerFrame>,
     ),
   );
 }
diff --git a/apps/vscode/webview/markdown.ts b/apps/vscode/webview/markdown.ts
index b76ee239b..7264afeb3 100644
--- a/apps/vscode/webview/markdown.ts
+++ b/apps/vscode/webview/markdown.ts
@@ -1,110 +1,17 @@
-import { fromMarkdown } from "mdast-util-from-markdown";
-import { gfmTableFromMarkdown } from "mdast-util-gfm-table";
-import { gfmTable } from "micromark-extension-gfm-table";
-import type { RootContent, Root, Nodes } from "mdast";
-import { node } from "./ui.js";
-
-let tableNumber = 0;
-
-// Match Desktop's response budget. Only create known DOM elements; HTML, images,
-// links and code never receive navigation, resource-loading or executable authority.
+// Inert DOM adapter for inspector previews. Presentation and budgets are shared.
+import { createElement } from "react";
+import { createRoot } from "react-dom/client";
+import { flushSync } from "react-dom";
+import { MarkdownContent } from "@colossus/ui/conversation";
 export function markdown(text: string): HTMLElement {
-  const container = node("div", "", "markdown");
-  const plain = () => {
-    container.classList.add("plain-text");
-    container.textContent = text;
-    return container;
-  };
-  if (text.length > 16_384) return plain();
-  let root: Root;
-  try {
-    root = fromMarkdown(text, {
-      extensions: [gfmTable()],
-      mdastExtensions: [gfmTableFromMarkdown()],
-    });
-  } catch {
-    return plain();
-  }
-  const stack: { n: Nodes; depth: number }[] = [{ n: root, depth: 0 }];
-  let count = 0;
-  while (stack.length) {
-    const { n, depth } = stack.pop()!;
-    if (++count > 1_000 || depth > 32) return plain();
-    if ("children" in n)
-      for (const child of n.children)
-        stack.push({ n: child, depth: depth + 1 });
-  }
-  function render(n: RootContent): Node {
-    if (n.type === "text" || n.type === "html")
-      return document.createTextNode(n.value);
-    if (n.type === "image" || n.type === "imageReference")
-      return document.createTextNode(`Image omitted: ${n.alt ?? ""}`);
-    if (n.type === "definition") return document.createTextNode("");
-    if (n.type === "code") {
-      const pre = node("pre");
-      pre.tabIndex = 0;
-      pre.setAttribute("aria-label", "Code block");
-      pre.append(node("code", n.value));
-      return pre;
-    }
-    if (n.type === "inlineCode") return node("code", n.value);
-    if (n.type === "table") {
-      const scroll = node("div", "", "markdown-table-scroll");
-      scroll.tabIndex = 0;
-      scroll.setAttribute("role", "region");
-      scroll.setAttribute(
-        "aria-label",
-        `Scrollable Markdown table ${++tableNumber}`,
-      );
-      const table = node("table");
-      const head = node("thead");
-      const body = node("tbody");
-      n.children.forEach((row, index) => {
-        const tr = node("tr");
-        row.children.forEach((cell, column) => {
-          const el = node(index === 0 ? "th" : "td");
-          if (index === 0) el.setAttribute("scope", "col");
-          const align = n.align?.[column];
-          if (align === "left" || align === "right" || align === "center")
-            el.className = `align-${align}`;
-          for (const child of cell.children) el.append(render(child));
-          tr.append(el);
-        });
-        (index === 0 ? head : body).append(tr);
-      });
-      table.append(head, body);
-      scroll.append(table);
-      return scroll;
-    }
-    const tag =
-      n.type === "paragraph"
-        ? "p"
-        : n.type === "heading"
-          ? "h3"
-          : n.type === "strong"
-            ? "strong"
-            : n.type === "emphasis"
-              ? "em"
-              : n.type === "blockquote"
-                ? "blockquote"
-                : n.type === "list"
-                  ? n.ordered
-                    ? "ol"
-                    : "ul"
-                  : n.type === "listItem"
-                    ? "li"
-                    : n.type === "break"
-                      ? "br"
-                      : n.type === "thematicBreak"
-                        ? "hr"
-                        : "span";
-    const el = node(tag);
-    if (n.type === "list" && n.ordered && n.start != null)
-      (el as HTMLOListElement).start = n.start;
-    if ("children" in n)
-      for (const child of n.children) el.append(render(child));
-    return el;
-  }
-  for (const child of root.children) container.append(render(child));
-  return container;
+  const container = document.createElement("div"),
+    root = createRoot(container);
+  flushSync(() =>
+    root.render(
+      createElement(MarkdownContent, { content: text, className: "markdown" }),
+    ),
+  );
+  const rendered = container.firstElementChild!.cloneNode(true) as HTMLElement;
+  root.unmount();
+  return rendered;
 }
diff --git a/apps/vscode/webview/style.css b/apps/vscode/webview/style.css
index 4103a6f72..56052aed5 100644
--- a/apps/vscode/webview/style.css
+++ b/apps/vscode/webview/style.css
@@ -677,3 +677,24 @@ button.workspace-button {
   --blue-strong: var(--vscode-focusBorder, #fff);
   --text-on-accent: var(--vscode-button-foreground, #000);
 }
+/* Shared conversation islands retain host projections, tools, and scroll policy. */
+.message.shared-message-island {
+  padding: 18px 0 4px;
+  margin-left: 0;
+  font-size: var(--font-size-body);
+  color: var(--text);
+}
+.composer:has(.shared-conversation-composer) {
+  border: 0;
+  background: transparent;
+  padding: 0;
+  box-shadow: none;
+}
+.composer .shared-conversation-composer {
+  box-shadow: none;
+}
+.shared-vscode-footer {
+  padding: 0;
+  border: 0;
+  flex: 1;
+}
diff --git a/apps/web/.gitignore b/apps/web/.gitignore
new file mode 100644
index 000000000..b94707787
--- /dev/null
+++ b/apps/web/.gitignore
@@ -0,0 +1,2 @@
+node_modules/
+dist/
diff --git a/apps/web/.npmrc b/apps/web/.npmrc
new file mode 100644
index 000000000..1c0a53b1a
--- /dev/null
+++ b/apps/web/.npmrc
@@ -0,0 +1,2 @@
+install-links=true
+legacy-peer-deps=true
diff --git a/apps/web/index.html b/apps/web/index.html
new file mode 100644
index 000000000..c30067631
--- /dev/null
+++ b/apps/web/index.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" />
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#111315" />
+    <title>Colossus Control Plane</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
diff --git a/apps/web/package-lock.json b/apps/web/package-lock.json
new file mode 100644
index 000000000..20418a6b1
--- /dev/null
+++ b/apps/web/package-lock.json
@@ -0,0 +1,5269 @@
+{
+  "name": "@colossus/web",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@colossus/web",
+      "version": "0.1.0",
+      "dependencies": {
+        "@colossus/ui": "file:../ui",
+        "@tabler/icons-react": "3.45.0",
+        "react": "19.2.7",
+        "react-dom": "19.2.7"
+      },
+      "devDependencies": {
+        "@tailwindcss/vite": "4.3.3",
+        "@types/node": "26.1.1",
+        "@types/react": "19.2.17",
+        "@types/react-dom": "19.2.3",
+        "@vitejs/plugin-react": "6.0.3",
+        "happy-dom": "20.14.5",
+        "prettier": "3.9.5",
+        "tailwindcss": "4.3.3",
+        "typescript": "7.0.2",
+        "vite": "8.1.5",
+        "vitest": "4.1.10"
+      },
+      "engines": {
+        "node": ">=22.12.0"
+      }
+    },
+    "node_modules/@colossus/ui": {
+      "version": "0.1.0",
+      "resolved": "file:../ui",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@radix-ui/react-dropdown-menu": "2.1.24",
+        "@radix-ui/react-slot": "1.3.3",
+        "@tabler/icons-react": "3.45.0",
+        "@tanstack/react-table": "9.2.6",
+        "class-variance-authority": "0.7.1",
+        "clsx": "2.1.1",
+        "react-is": "19.2.7",
+        "react-markdown": "10.1.0",
+        "recharts": "3.10.1",
+        "rehype-sanitize": "6.0.0",
+        "remark-gfm": "4.0.1",
+        "tailwind-merge": "3.7.0"
+      },
+      "peerDependencies": {
+        "react": "19.2.7",
+        "react-dom": "19.2.7"
+      }
+    },
+    "node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@floating-ui/core": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.8.0.tgz",
+      "integrity": "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/utils": "^0.2.12"
+      }
+    },
+    "node_modules/@floating-ui/dom": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.8.0.tgz",
+      "integrity": "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/core": "^1.8.0",
+        "@floating-ui/utils": "^0.2.12"
+      }
+    },
+    "node_modules/@floating-ui/react-dom": {
+      "version": "2.1.9",
+      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.9.tgz",
+      "integrity": "sha512-JDjEFGCpImxDCA7JJKviA0M9+RtmJdj0m/NVU5IMgBK+AmZouAQQ7/+2GLH0GXXY0YMw9oXPB8hKdbPYg5QLYg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/dom": "^1.8.0"
+      },
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/@floating-ui/utils": {
+      "version": "0.2.12",
+      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.12.tgz",
+      "integrity": "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==",
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.4.tgz",
+      "integrity": "sha512-AJxoUD2/15ESHbvpcyjU274nsAPLuOtPHCk0vKJM5pj//Fg/B1FXNWjPnXTT9PymCYYiHo4zPj0ZomXBKhoy7g==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4",
+        "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.139.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.139.0.tgz",
+      "integrity": "sha512-r9gHphtCs+1M7J0pw6Sn/hh/Wpa/iQrOOkrNAlVLF/gHq+/CJmHIWKKUUhdWjcD6CIa8idarspCsASiXCXvFUw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "node_modules/@radix-ui/primitive": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/primitive/-/primitive-1.1.7.tgz",
+      "integrity": "sha512-rqWnm76nYT8HoNNqEjpgJ7Pw/DrBj5iBTrmEPo6HTX5+VJyBNOqTdv4g89G63HuR5g0AaENoAcH7Is5fF2kZ8Q==",
+      "license": "MIT"
+    },
+    "node_modules/@radix-ui/react-arrow": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-arrow/-/react-arrow-1.1.15.tgz",
+      "integrity": "sha512-v4zggRcjadnI+ClKDuijlQEW4tw3NoaeHc/PwpKnLoLLKNUG4InLegkstooLcRIUWCs+8L22dGURCVuFfOKfnA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-collection": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-collection/-/react-collection-1.1.15.tgz",
+      "integrity": "sha512-9W+B9NPF0NaaPh/1NJd3+KqsnlLqU9H7T2rvww+fp+T/evVXdNAyYcnfRQZFOjkR1ajQp3yORlqnI8soawLvNA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-slot": "1.3.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-compose-refs": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-compose-refs/-/react-compose-refs-1.1.5.tgz",
+      "integrity": "sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-context": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-context/-/react-context-1.2.2.tgz",
+      "integrity": "sha512-RHCUGwKHDr0hDGg4X7ma4JG4/+12qxw8rkh5QKdDldlCvtja6nUx1Ef/8HVrJze81lEsgLQlqjzjGNHantgnQA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-direction": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-direction/-/react-direction-1.1.4.tgz",
+      "integrity": "sha512-5pzg4FGQNpExhnhT2zlrP1wZFaYCd1K0nYWoFAdcYoYK868IEigqMX3B3f8yIoRlAhAeDWciLI6ZdCKHF9P4Vg==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dismissable-layer": {
+      "version": "1.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dismissable-layer/-/react-dismissable-layer-1.1.19.tgz",
+      "integrity": "sha512-8g4pfOL9HoKKLWGiypT+dphVqjFfmcXO5GBnhsG6zI+lxAx/8feQpr+1LSN8Re3hiZ+XkLNS4O9ztK11/LzQ6w==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-effect-event": "0.0.5"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-dropdown-menu": {
+      "version": "2.1.24",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-dropdown-menu/-/react-dropdown-menu-2.1.24.tgz",
+      "integrity": "sha512-geq8l2rJkxvkXsT9RMgtUE3P8pITFpTsvYpbySi1IH4fZEABD/Gp85myayFgxk0ktljGMJnCbeFkyTusvSvv7g==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-menu": "2.1.24",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-controllable-state": "1.2.6"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-guards": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-guards/-/react-focus-guards-1.1.6.tgz",
+      "integrity": "sha512-RNOJjfZMTyBM6xYmV3IVGXkPjIhcBAuv48POevAXwrGJhkWZ9p1rFoIS1JFooPuT193AZmRsCPhpoVJxx6OPoQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-focus-scope": {
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-focus-scope/-/react-focus-scope-1.1.16.tgz",
+      "integrity": "sha512-wmRZ2WWLvmt6KHy2rNPOdPUjwq5xOHY02+m+udwJTn0aNIox/rkskAvJTyTLGhPK6KgrUjlJUJpgmx/+wFiFIQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-id": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-id/-/react-id-1.1.4.tgz",
+      "integrity": "sha512-TMQp2llA+RYn7JcjnrMnz7wN4pcVttPZnRZo52PLQsoLVKzNlVwUeHmfePgTgRluXFvlD3GD5g5MOVVTJCO0qA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-menu": {
+      "version": "2.1.24",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-menu/-/react-menu-2.1.24.tgz",
+      "integrity": "sha512-uW7RVuU6Lp/ZtfeY4b3kL32zccgEWvPv1+cf17ubYzHa9cL8AHokmk36cG/XEiH/smbQvumnieXX9j/e9RqJWA==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-collection": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-direction": "1.1.4",
+        "@radix-ui/react-dismissable-layer": "1.1.19",
+        "@radix-ui/react-focus-guards": "1.1.6",
+        "@radix-ui/react-focus-scope": "1.1.16",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-popper": "1.3.7",
+        "@radix-ui/react-portal": "1.1.17",
+        "@radix-ui/react-presence": "1.1.10",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-roving-focus": "1.1.19",
+        "@radix-ui/react-slot": "1.3.3",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "aria-hidden": "^1.2.4",
+        "react-remove-scroll": "^2.7.2"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-popper": {
+      "version": "1.3.7",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-popper/-/react-popper-1.3.7.tgz",
+      "integrity": "sha512-UsJrrd7w4wuKKTdvd/DNERVlwSlUcyXzjhyDwBk+3aPOsCjOY6ZSbxuw8E6lZTjjfP8Cpd0J8VVkrYUWyGYXyg==",
+      "license": "MIT",
+      "dependencies": {
+        "@floating-ui/react-dom": "^2.0.0",
+        "@radix-ui/react-arrow": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-layout-effect": "1.1.4",
+        "@radix-ui/react-use-rect": "1.1.4",
+        "@radix-ui/react-use-size": "1.1.4",
+        "@radix-ui/rect": "1.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-portal": {
+      "version": "1.1.17",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-portal/-/react-portal-1.1.17.tgz",
+      "integrity": "sha512-vKQLcWypUnwZVvfV7UkGahH2g6ySe8M8R+zYBwPrv5byZ9QAW6cQVvNKo7GgmD+p8aYb6D9JBuvy8/WhOno2wQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-presence": {
+      "version": "1.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.10.tgz",
+      "integrity": "sha512-3wyzCQ6+ubRA+D4uv9m95JYLXxmOHp05qjrkjeA7uKHHtjpPggQzc6DAb0URl7j67oR0K2foO4ip27TiX037Bw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-primitive": {
+      "version": "2.1.10",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.1.10.tgz",
+      "integrity": "sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-slot": "1.3.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-roving-focus": {
+      "version": "1.1.19",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-roving-focus/-/react-roving-focus-1.1.19.tgz",
+      "integrity": "sha512-V9jI6hDjT7l3jsCQD9bLNvDLM3tH/gdbOTp7Tefp3hbbgCGQoK7tUvrWiRlcoBHIZ809ElXwNQwVo0B98LuTXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-collection": "1.1.15",
+        "@radix-ui/react-compose-refs": "1.1.5",
+        "@radix-ui/react-context": "1.2.2",
+        "@radix-ui/react-direction": "1.1.4",
+        "@radix-ui/react-id": "1.1.4",
+        "@radix-ui/react-primitive": "2.1.10",
+        "@radix-ui/react-use-callback-ref": "1.1.4",
+        "@radix-ui/react-use-controllable-state": "1.2.6",
+        "@radix-ui/react-use-is-hydrated": "0.1.3",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "@types/react-dom": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc",
+        "react-dom": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-slot": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-slot/-/react-slot-1.3.3.tgz",
+      "integrity": "sha512-qx7oqnYbxnK9kYI9m317qmFmEgo6ywqWvbTogdj7cL9p3/yx4M48p7Rnw5z3H890cL/ow/EeWJsuTykeZVXP5Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-compose-refs": "1.1.5"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-callback-ref": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-callback-ref/-/react-use-callback-ref-1.1.4.tgz",
+      "integrity": "sha512-R6OUY2e2fA6Yn6s+VSx5KBV6Nx8LQEhu+cz7LCej18rQ1HLyg9PSC9jP/ZNx0o6FAIK9c0F1kHylzSxKsdlkrQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-controllable-state": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-controllable-state/-/react-use-controllable-state-1.2.6.tgz",
+      "integrity": "sha512-uEQJGT97ZA/TgP/Hydw47lHu+/vQj6z/0jA+WeTbK1o9Rx45GImjpD0tc3W5ad3D6XTSR6e1yEO0FvGq6WQfVQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/primitive": "1.1.7",
+        "@radix-ui/react-use-effect-event": "0.0.5",
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-effect-event": {
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-effect-event/-/react-use-effect-event-0.0.5.tgz",
+      "integrity": "sha512-7cshFL8HGS/7HEiHH+9kL9HBwp2sa9yX18Knwek6KYWmXwM7pegMgta2AXMQKI+rq3JnfSj9x8wYqFMTdG1Jgg==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-is-hydrated": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-is-hydrated/-/react-use-is-hydrated-0.1.3.tgz",
+      "integrity": "sha512-umO/aJ+82CpOnhDZUTbILCQf7kU/g0iv+oGs/Q8jw7IkhWBzaEP4sA268PhFAJTFetbwp3ICc6ktpI4TqtxcIw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-layout-effect": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-layout-effect/-/react-use-layout-effect-1.1.4.tgz",
+      "integrity": "sha512-K20DkRkUwDnxEYMBPcg3Y6voLkEy5p5QQmszZgLngKKiC7dzBR/aEuK3w1qlx2JWDUNH6FluahYdgR3BP+QbYw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-rect": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-rect/-/react-use-rect-1.1.4.tgz",
+      "integrity": "sha512-cSOCh6JlkmfjLyNcLiu2nB4v+nm+dkZ+Q5KHWk/soo4U7ZLiEQFKHK9/YmtBHjfCEaU43IBKQOc4/uJmCaiCTQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/rect": "1.1.3"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/react-use-size": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@radix-ui/react-use-size/-/react-use-size-1.1.4.tgz",
+      "integrity": "sha512-D3anSY15EJoxrihpsXI6SMrmmonnQtR2ni7arO+Lfdg3O95b9hNXxONk8jA5C8ANdF/h5HMAxejgs8PWJ6rlhw==",
+      "license": "MIT",
+      "dependencies": {
+        "@radix-ui/react-use-layout-effect": "1.1.4"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@radix-ui/rect": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@radix-ui/rect/-/rect-1.1.3.tgz",
+      "integrity": "sha512-JtyZR+mqgBibTo8xea3B6ZRmzZiM/YeVBtUkas6zMuXjAlfIFIW2FgqeM9eLyvEaYX66vr6DJMK+4U6LV0KhNw==",
+      "license": "MIT"
+    },
+    "node_modules/@reduxjs/toolkit": {
+      "version": "2.13.0",
+      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.13.0.tgz",
+      "integrity": "sha512-f6jwVRfwW30+tnllz4YcsHHpPYYOE7abcHkyUCovD+P7DyhdAI5prz2Fh/8TLhakjpN+7aIEion1s5L/tvlYlA==",
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/utils": "^0.3.0",
+        "immer": "^11.0.0",
+        "redux": "^5.0.1",
+        "redux-thunk": "^3.1.0",
+        "reselect": "^5.1.0"
+      },
+      "peerDependencies": {
+        "react": "^16.9.0 || ^17.0.0 || ^18 || ^19",
+        "react-redux": "^7.2.1 || ^8.1.3 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "react": {
+          "optional": true
+        },
+        "react-redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.1.5.tgz",
+      "integrity": "sha512-lZg8fqIv2v7FF237bwMgzGZEJvGL79/s5knJ/i6FmsGF4XXlzccZ4jb+TrFIxtSSxFtIpdsgrPZeMk1I9AFcyQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.1.5.tgz",
+      "integrity": "sha512-51Bnx9pNiMRKSUNtBfySkNJ9vMU9Hh3I1ozDd6gyPPYzaXCfnptUcEZxXGYFn+ul2dtcMUiqGR1Yai2K10uoTw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.1.5.tgz",
+      "integrity": "sha512-Tm+gbfC0aHu1tBA/JvKQh32S0K6YgCHkiAF4/W6xX0K0RmNuc94VeK419dJoE65R5aRxmo+noZQSWrAMF6yb6g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.1.5.tgz",
+      "integrity": "sha512-JMzDKCCXq93YccG5gz3hvOs1oXRKAf0XYpfOS88e+wZrC8Iugj6j68867vrYZkvpDDpKn/KoKORThmchMpF6TA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.1.5.tgz",
+      "integrity": "sha512-uML21j2K5TfPGutKxub+M+nLjZIrWjXQ5Grx4lCe/nimTj9B4L63zHpjXLl4y0L3mcm2htEQIb06oCG/szerNw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.1.5.tgz",
+      "integrity": "sha512-navSiuTMogvnQoZoM/v+l3ZWo50/NTwSHSzheABx/RCnmUPaKwq9qSo4Br2OYRs21+Fz8uFqITZM3H4opOB0/Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.1.5.tgz",
+      "integrity": "sha512-lAryqH7IteztmCXQXk0etKj4wBQ7Gx5S6LjKhsgp9zb8I5bsuvU/2llH1hDQcjsFeqIsovMVN339/8pUDDBXxA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.1.5.tgz",
+      "integrity": "sha512-fsK/sNBnxzBlL4O1JNrZakVQxPspqpED5dLtNsZS9oOKmtSpdNIzxH2kkol5HYTWJN47sE20ztMJPxfZ89qGOg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.1.5.tgz",
+      "integrity": "sha512-gLYb4BIadlfTOYT5gO503n8zQjXflgzpD0FcyKh0Mzx3rqCZKnHoJWV9xe1KXUJ5lx2JfcSHr/mhzS0PC/McAA==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.1.5.tgz",
+      "integrity": "sha512-FjcpEKUyJygHgs1o50VYNvkt5+7Le/VEdYt0AkRpkL33MnyQfwr8l5mXwMmfmTbyMPr5vJLC+8/Gd9gXnwU1QQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.1.5.tgz",
+      "integrity": "sha512-Me+PfPI2TMeOQk0gYWfLQZtTktrmzbr8cDboqX83XKc7UrgAi55gF+2dUkWdxd19n55Essp2yeca+O9N5rBxHg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.1.5.tgz",
+      "integrity": "sha512-yc5WrLzXks6zCQfn9Oxr8pORKyl/pF+QjHmW/Qx3qu0oyrrNC+y2JLTU1E2rcWYAmzlnqngWXHQjy51VzW70Vw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.1.5.tgz",
+      "integrity": "sha512-VbQGPX2b4r48TAMIM2cjgluIM1HYutm4pcTEJsle7iEP7sB1dFqtPLBVbdLAZCxy1txCcPxf4QFf4v8uvltPqA==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "^1.1.6"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.1.5.tgz",
+      "integrity": "sha512-gHv82k63z4qpV5+Q1y/12KrK0ltWBukVDI8nZcbT7Tt/ZlOIVwppazneq0F93oDxTo3IgAMEDIoQh3E2n6mVsw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.1.5.tgz",
+      "integrity": "sha512-tTZuDBPw85tEN5PQi1pnEBzDy0Z49HtScLAbD5t6hyeU92A95pRWaSMw1GZZi/RwgSgUIl0xrSlXIT/9QzvYSA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+      "license": "MIT"
+    },
+    "node_modules/@standard-schema/utils": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/utils/-/utils-0.3.0.tgz",
+      "integrity": "sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==",
+      "license": "MIT"
+    },
+    "node_modules/@tabler/icons": {
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.45.0.tgz",
+      "integrity": "sha512-jiATwV8+zGYLTZ7gMLGivCic+KtsMZXcDmufIG8umlLxoHhI6902hGYIEt0Oa9Y9SXblNzUlrisHm5jOFMxOQA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/codecalm"
+      }
+    },
+    "node_modules/@tabler/icons-react": {
+      "version": "3.45.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons-react/-/icons-react-3.45.0.tgz",
+      "integrity": "sha512-t/AuKs7ALMDDTY+B9IvfZnlO0mbLlP/lJxP/HnGC49QkM8mCsTN38kYyxjXxgrb1+TeK53ioVBJqIV7n/eysXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tabler/icons": "3.45.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/codecalm"
+      },
+      "peerDependencies": {
+        "react": ">= 16"
+      }
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
+      "integrity": "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "^5.24.1",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/node/node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz",
+      "integrity": "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-x64": "4.3.3",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.3",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.3",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.3",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.3.tgz",
+      "integrity": "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.3.tgz",
+      "integrity": "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.3.tgz",
+      "integrity": "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.3.tgz",
+      "integrity": "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.3.tgz",
+      "integrity": "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.3.tgz",
+      "integrity": "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.3.tgz",
+      "integrity": "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.3.tgz",
+      "integrity": "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.3.tgz",
+      "integrity": "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+      "integrity": "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
+      "integrity": "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.3.tgz",
+      "integrity": "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz",
+      "integrity": "sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@tailwindcss/node": "4.3.3",
+        "@tailwindcss/oxide": "4.3.3",
+        "tailwindcss": "4.3.3"
+      },
+      "peerDependencies": {
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
+      }
+    },
+    "node_modules/@tanstack/react-store": {
+      "version": "0.11.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.11.2.tgz",
+      "integrity": "sha512-oj5O5DmiMWE+ih+SioX2ayC1kbK7d3fpLx0B75fPJr9nY3zU+hoW010yr64qXsY/9fyiLVE2bn5mGNV3owm8RQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/store": "0.11.2",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/@tanstack/react-table": {
+      "version": "9.2.6",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-table/-/react-table-9.2.6.tgz",
+      "integrity": "sha512-Wmt3sbzwz+5CtB0pqIxGw2FrNW9mF4AhJ9KnS1/VGZ8cDAEg51S4ixru2dnF0xQnY407kdYNLer3ms+n8zCN6w==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/react-store": "^0.11.2",
+        "@tanstack/table-core": "9.2.6"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": ">=18"
+      }
+    },
+    "node_modules/@tanstack/store": {
+      "version": "0.11.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/store/-/store-0.11.2.tgz",
+      "integrity": "sha512-sJ4mjol8uQsHV0gOJzzjwXfh2Fwm+Sz0+8deqiTm4jGbMdjzNSW+xZCFm0kUa870uhd8yi+DpKnZb5Kc4apa0Q==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tanstack/table-core": {
+      "version": "9.2.6",
+      "resolved": "https://registry.npmjs.org/@tanstack/table-core/-/table-core-9.2.6.tgz",
+      "integrity": "sha512-t5LaLx8gDCgzjvwtZo5xtLklJP11D9zaKOW8q6jOCyuQYhkqpTK1heqMfgTQwDlhl0dU8f1X66Xurbj3jpCUSw==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/store": "^0.11.2"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tybys/wasm-util": {
+      "version": "0.10.4",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.4.tgz",
+      "integrity": "sha512-W3c4gRigFS0T/Ma4qIYF3GDAc5AQdHb1yL5znJT1Zv1YaD9Kitx656wBjvr19qbiosmZT8lWDM5BEMynUqX65A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/d3-array": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
+      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-color": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
+      "integrity": "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-ease": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
+      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-interpolate": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
+      "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-color": "*"
+      }
+    },
+    "node_modules/@types/d3-path": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-scale": {
+      "version": "4.0.9",
+      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
+      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-time": "*"
+      }
+    },
+    "node_modules/@types/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-kVd74ta9eof3eJOvbNd1vGKS/XERRyQbT26Og63hIsvDO84cjD5gEOhsXf26w3FSoNlPVz84DOFcKv/oou+fMw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/d3-path": "*"
+      }
+    },
+    "node_modules/@types/d3-time": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
+      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
+      "license": "MIT"
+    },
+    "node_modules/@types/d3-timer": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
+      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
+      "license": "MIT"
+    },
+    "node_modules/@types/debug": {
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/ms": "*"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/estree-jsx": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz",
+      "integrity": "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "*"
+      }
+    },
+    "node_modules/@types/hast": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/mdast": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
+      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "26.1.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz",
+      "integrity": "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
+    "node_modules/@types/react": {
+      "version": "19.2.17",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
+      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "csstype": "^3.2.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "19.2.3",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
+      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "^19.2.0"
+      }
+    },
+    "node_modules/@types/unist": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
+      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
+      "license": "MIT"
+    },
+    "node_modules/@types/use-sync-external-store": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
+      "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/whatwg-mimetype": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@types/whatwg-mimetype/-/whatwg-mimetype-3.0.2.tgz",
+      "integrity": "sha512-c2AKvDT8ToxLIOUlN51gTiHXflsfIFisS4pO7pDPoKouJCESkhZnEy623gwP9laCy5lnLDAw1vAzu2vM2YLOrA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/ws": {
+      "version": "8.18.2",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
+      "integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@typescript/typescript-aix-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
+      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
+      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
+      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
+      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
+      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
+      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-loong64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
+      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-mips64el": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
+      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
+      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-riscv64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
+      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-s390x": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
+      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
+      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-sunos-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
+      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
+      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
+      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@ungap/structured-clone": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
+      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==",
+      "license": "ISC"
+    },
+    "node_modules/@vitejs/plugin-react": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.3.tgz",
+      "integrity": "sha512-vmFvco5/QuC2f9Oj+wTk0+9XeDFkHxSamwZKYc7MxYwKICfvUvlMhqKI0VuICPltGqh1neqBKDvO4kes1ya8vg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rolldown/pluginutils": "^1.0.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "peerDependencies": {
+        "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0",
+        "babel-plugin-react-compiler": "^1.0.0",
+        "vite": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@rolldown/plugin-babel": {
+          "optional": true
+        },
+        "babel-plugin-react-compiler": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/expect": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
+      "integrity": "sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@standard-schema/spec": "^1.1.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.1.10",
+        "@vitest/utils": "4.1.10",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.10.tgz",
+      "integrity": "sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "4.1.10",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.10.tgz",
+      "integrity": "sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.10.tgz",
+      "integrity": "sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "4.1.10",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.10.tgz",
+      "integrity": "sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.10",
+        "@vitest/utils": "4.1.10",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.10.tgz",
+      "integrity": "sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.10.tgz",
+      "integrity": "sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.10",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/aria-hidden": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
+      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/bail": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
+      "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/buffer-image-size": {
+      "version": "0.6.4",
+      "resolved": "https://registry.npmjs.org/buffer-image-size/-/buffer-image-size-0.6.4.tgz",
+      "integrity": "sha512-nEh+kZOPY1w+gcCMobZ6ETUp9WfibndnosbpwB1iJk/8Gt5ZF2bhS6+B6bPYz424KtwsR6Rflc3tCz1/ghX2dQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/ccount": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
+      "integrity": "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/chai": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/character-entities": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
+      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-html4": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
+      "integrity": "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-legacy": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
+      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-reference-invalid": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
+      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/class-variance-authority": {
+      "version": "0.7.1",
+      "resolved": "https://registry.npmjs.org/class-variance-authority/-/class-variance-authority-0.7.1.tgz",
+      "integrity": "sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "clsx": "^2.1.1"
+      },
+      "funding": {
+        "url": "https://polar.sh/cva"
+      }
+    },
+    "node_modules/clsx": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/comma-separated-tokens": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
+      "integrity": "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/d3-array": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "license": "ISC",
+      "dependencies": {
+        "internmap": "1 - 2"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-color": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-ease": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-3.0.1.tgz",
+      "integrity": "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-format": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
+      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-interpolate": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-color": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-path": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-scale": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2.10.0 - 3",
+        "d3-format": "1 - 3",
+        "d3-interpolate": "1.2.0 - 3",
+        "d3-time": "2.1.1 - 3",
+        "d3-time-format": "2 - 4"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-shape": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-path": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-array": "2 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-time-format": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "license": "ISC",
+      "dependencies": {
+        "d3-time": "1 - 3"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/d3-timer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
+      "integrity": "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decimal.js-light": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
+      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
+      "license": "MIT"
+    },
+    "node_modules/decode-named-character-reference": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
+      "license": "MIT",
+      "dependencies": {
+        "character-entities": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/dequal": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
+      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/detect-node-es": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node-es/-/detect-node-es-1.1.0.tgz",
+      "integrity": "sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==",
+      "license": "MIT"
+    },
+    "node_modules/devlop": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
+      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
+      "license": "MIT",
+      "dependencies": {
+        "dequal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/enhanced-resolve": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.26.0.tgz",
+      "integrity": "sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/entities": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-7.0.1.tgz",
+      "integrity": "sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/es-toolkit": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.52.0.tgz",
+      "integrity": "sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA==",
+      "license": "MIT",
+      "workspaces": [
+        "docs",
+        "benchmarks",
+        "tests/types",
+        "tests/browser-compat"
+      ]
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/estree-util-is-identifier-name": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/estree-util-is-identifier-name/-/estree-util-is-identifier-name-3.0.0.tgz",
+      "integrity": "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/eventemitter3": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz",
+      "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
+      "license": "MIT"
+    },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/extend": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
+      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
+      "license": "MIT"
+    },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/get-nonce": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-nonce/-/get-nonce-1.0.1.tgz",
+      "integrity": "sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/happy-dom": {
+      "version": "20.14.5",
+      "resolved": "https://registry.npmjs.org/happy-dom/-/happy-dom-20.14.5.tgz",
+      "integrity": "sha512-x/RzkpWO40bTjIoT30iQtt64FLLmH/iRcUCN2X//bLx7H3ifkdfPXyqsro/OYtqzIAhiLMMA7mmiOR9C3NOKjQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": ">=20.0.0",
+        "@types/whatwg-mimetype": "^3.0.2",
+        "@types/ws": "^8.18.1",
+        "buffer-image-size": "^0.6.4",
+        "entities": "^7.0.1",
+        "whatwg-mimetype": "^3.0.0",
+        "ws": "^8.21.0"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/hast-util-sanitize": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/hast-util-sanitize/-/hast-util-sanitize-5.0.2.tgz",
+      "integrity": "sha512-3yTWghByc50aGS7JlGhk61SPenfE/p1oaFeNwkOOyrscaOkMGrcW9+Cy/QAIOBpZxP1yqDIzFMR0+Np0i0+usg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@ungap/structured-clone": "^1.0.0",
+        "unist-util-position": "^5.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-to-jsx-runtime": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.6.tgz",
+      "integrity": "sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/unist": "^3.0.0",
+        "comma-separated-tokens": "^2.0.0",
+        "devlop": "^1.0.0",
+        "estree-util-is-identifier-name": "^3.0.0",
+        "hast-util-whitespace": "^3.0.0",
+        "mdast-util-mdx-expression": "^2.0.0",
+        "mdast-util-mdx-jsx": "^3.0.0",
+        "mdast-util-mdxjs-esm": "^2.0.0",
+        "property-information": "^7.0.0",
+        "space-separated-tokens": "^2.0.0",
+        "style-to-js": "^1.0.0",
+        "unist-util-position": "^5.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-whitespace": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/hast-util-whitespace/-/hast-util-whitespace-3.0.0.tgz",
+      "integrity": "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/html-url-attributes": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/html-url-attributes/-/html-url-attributes-3.0.1.tgz",
+      "integrity": "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/immer": {
+      "version": "11.1.21",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.21.tgz",
+      "integrity": "sha512-bZSadeCPGdaY5/qRLgr6mDSH1ra21rD3rqpiWk7+QTr4ayYPTE9qZYdLh/NdPhMe0wSrTvHD/Lk8q5EwhUs0aw==",
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/immer"
+      }
+    },
+    "node_modules/inline-style-parser": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.2.7.tgz",
+      "integrity": "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==",
+      "license": "MIT"
+    },
+    "node_modules/internmap": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/is-alphabetical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
+      "integrity": "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-alphanumerical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-2.0.1.tgz",
+      "integrity": "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==",
+      "license": "MIT",
+      "dependencies": {
+        "is-alphabetical": "^2.0.0",
+        "is-decimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-decimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-2.0.1.tgz",
+      "integrity": "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-hexadecimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-2.0.1.tgz",
+      "integrity": "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-plain-obj": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
+      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/longest-streak": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/longest-streak/-/longest-streak-3.1.0.tgz",
+      "integrity": "sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/markdown-table": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-3.0.4.tgz",
+      "integrity": "sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/mdast-util-find-and-replace": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.3.tgz",
+      "integrity": "sha512-xPgpDNl0/OXHsI7TlaIs22lWnH3KlpvZdXG1ET/m/YT2Hhdkx8lJV4kLphE6l9simyM4KPDFBwas08BgEob6Jw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "escape-string-regexp": "^5.0.0",
+        "unist-util-is": "^6.0.0",
+        "unist-util-visit-parents": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-from-markdown": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.1.0.tgz",
+      "integrity": "sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-to-string": "^4.0.0",
+        "micromark": "^4.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-decode-string": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm/-/mdast-util-gfm-3.1.0.tgz",
+      "integrity": "sha512-0ulfdQOM3ysHhCJ1p06l0b0VKlhU0wuQs3thxZQagjcjPrlFRqY215uZGHHJan9GEAXd9MbfPjFJz+qMkVR6zQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-gfm-autolink-literal": "^2.0.0",
+        "mdast-util-gfm-footnote": "^2.0.0",
+        "mdast-util-gfm-strikethrough": "^2.0.0",
+        "mdast-util-gfm-table": "^2.0.0",
+        "mdast-util-gfm-task-list-item": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-autolink-literal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.1.tgz",
+      "integrity": "sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "ccount": "^2.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-find-and-replace": "^3.0.0",
+        "micromark-util-character": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-footnote": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-footnote/-/mdast-util-gfm-footnote-2.1.0.tgz",
+      "integrity": "sha512-sqpDWlsHn7Ac9GNZQMeUzPQSMzR6Wv0WKRNvQRg0KqHh02fpTz69Qc1QSseNX29bhz1ROIyNyxExfawVKTm1GQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.1.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-strikethrough": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-strikethrough/-/mdast-util-gfm-strikethrough-2.0.1.tgz",
+      "integrity": "sha512-OuJHqvr455pwu2OaOrir7dbzqs4jlWKOtlu9L6GjcIjjQwNyw02VntQsr/Ek6/A13vgnXfUhBekWRUP1OkNivw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-table": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-table/-/mdast-util-gfm-table-2.0.0.tgz",
+      "integrity": "sha512-78UEvebzz/rJIxLvE7ZtDd/vIQ0RHv+3Mh5DR96p7cS7HsBhYIICDBCu8csTNWNO6tBWfqXPWekRuj2FNOGOZg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "markdown-table": "^3.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-task-list-item": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-task-list-item/-/mdast-util-gfm-task-list-item-2.0.0.tgz",
+      "integrity": "sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdx-expression": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdx-expression/-/mdast-util-mdx-expression-2.0.1.tgz",
+      "integrity": "sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdx-jsx": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdx-jsx/-/mdast-util-mdx-jsx-3.2.0.tgz",
+      "integrity": "sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "ccount": "^2.0.0",
+        "devlop": "^1.1.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "parse-entities": "^4.0.0",
+        "stringify-entities": "^4.0.0",
+        "unist-util-stringify-position": "^4.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdxjs-esm": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdxjs-esm/-/mdast-util-mdxjs-esm-2.0.1.tgz",
+      "integrity": "sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-phrasing": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-phrasing/-/mdast-util-phrasing-4.1.0.tgz",
+      "integrity": "sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "unist-util-is": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-to-hast": {
+      "version": "13.2.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@ungap/structured-clone": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "trim-lines": "^3.0.0",
+        "unist-util-position": "^5.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-to-markdown": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.2.0.tgz",
+      "integrity": "sha512-2Jn/ADrHFFyyniBMi0bncTbJqU78K3/TEYvzvwrWWzD9MYPUa/Gm4r3nOeKFQg/PDM5BsbDYdc8ackW4NTY6NA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "longest-streak": "^3.0.0",
+        "mdast-util-phrasing": "^4.0.0",
+        "mdast-util-to-string": "^4.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-decode-string": "^2.0.0",
+        "micromark-util-html-tag-name": "^2.0.0",
+        "unist-util-visit": "^5.0.0",
+        "zwitch": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-to-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
+      "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.3.tgz",
+      "integrity": "sha512-oGYfQzHSG5dOMovQcJ3fyTmZlWAWpi0XA0sJwJs+i6OT88o1+Jtw/8z0CmdowSLxGhhFK89rQ/oXph/wN02PNw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@types/debug": "^4.0.0",
+        "debug": "^4.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-edit-map": "^1.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-core-commonmark": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.4.tgz",
+      "integrity": "sha512-wxEeE8v8XVvOrxn1TZj74qYhAtTQsSqufHVS3uNVyT1MupXxhyaHk8/9xDNPh9BmL77QNDgWTkZ3RsYHB2ry7w==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-factory-destination": "^2.0.0",
+        "micromark-factory-label": "^2.0.0",
+        "micromark-factory-space": "^2.1.0",
+        "micromark-factory-title": "^2.0.0",
+        "micromark-factory-whitespace": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-edit-map": "^1.0.0",
+        "micromark-util-html-tag-name": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.3"
+      }
+    },
+    "node_modules/micromark-extension-gfm": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm/-/micromark-extension-gfm-3.0.0.tgz",
+      "integrity": "sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark-extension-gfm-autolink-literal": "^2.0.0",
+        "micromark-extension-gfm-footnote": "^2.0.0",
+        "micromark-extension-gfm-strikethrough": "^2.0.0",
+        "micromark-extension-gfm-table": "^2.0.0",
+        "micromark-extension-gfm-tagfilter": "^2.0.0",
+        "micromark-extension-gfm-task-list-item": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-autolink-literal": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-autolink-literal/-/micromark-extension-gfm-autolink-literal-2.1.0.tgz",
+      "integrity": "sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-footnote": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-footnote/-/micromark-extension-gfm-footnote-2.1.0.tgz",
+      "integrity": "sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-strikethrough": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-strikethrough/-/micromark-extension-gfm-strikethrough-2.1.0.tgz",
+      "integrity": "sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-table": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.1.2.tgz",
+      "integrity": "sha512-pRzm4kDTu0MjlmBkxmS9yYhw60nncfcEwu9NNdPFSQEFXS95ZKyIIyTSHu/o3ReBUrLKYEq+7YaXCRn/bPB4MA==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-tagfilter": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-tagfilter/-/micromark-extension-gfm-tagfilter-2.0.0.tgz",
+      "integrity": "sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-task-list-item": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-task-list-item/-/micromark-extension-gfm-task-list-item-2.1.0.tgz",
+      "integrity": "sha512-qIBZhqxqI6fjLDYFTBIa4eivDMnP+OZqsNwmQ3xNLE4Cxwc+zfQEfbs6tzAo2Hjq+bh6q5F+Z8/cksrLFYWQQw==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-factory-destination": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
+      "integrity": "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-label": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
+      "integrity": "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-space": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.1.0.tgz",
+      "integrity": "sha512-fS8hnLIjnjvdQIj39Geug8wWsR0HrYZ43KShKxNfwT7t2LOHo/LbWZEzEaSOjwtjdCsjoE6syHhonEzW0zv0+Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-title": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
+      "integrity": "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-whitespace": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
+      "integrity": "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-character": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
+      "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-chunked": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
+      "integrity": "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-classify-character": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
+      "integrity": "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-combine-extensions": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
+      "integrity": "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-numeric-character-reference": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
+      "integrity": "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-string": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
+      "integrity": "sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-edit-map": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-edit-map/-/micromark-util-edit-map-1.0.0.tgz",
+      "integrity": "sha512-Pa2ljlsEL6sVwFaYeyrOLSYbQt73JvGbPOYFq+9AElXiSnfI5Q4465RRZ1sHv7lDjDOnGRDDaqPXqClqWK/q1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-encode": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
+      "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-html-tag-name": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
+      "integrity": "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-normalize-identifier": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
+      "integrity": "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-resolve-all": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
+      "integrity": "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-sanitize-uri": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
+      "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-subtokenize": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
+      "integrity": "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-symbol": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
+      "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-types": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.3.tgz",
+      "integrity": "sha512-oxB2Ik03hI0gv+VNn9tnh1t1YEe9MDPptViAEgfdf3YQHsn0pzGTgCdlSCJXcwhqm8phaEuM7zeEu3QQzVBrPg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.19",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
+      "integrity": "sha512-Y2tUNy4ouw6tq5oDSKeQYGOyhkUBhNOcGV/02KC+6kd9eDGqdZd++mjMiIDilrBYvjEnCYvVtsuHCuP+okSfug==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/obug": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz",
+      "integrity": "sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
+    "node_modules/parse-entities": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-4.0.2.tgz",
+      "integrity": "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^2.0.0",
+        "character-entities-legacy": "^3.0.0",
+        "character-reference-invalid": "^2.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "is-alphanumerical": "^2.0.0",
+        "is-decimal": "^2.0.0",
+        "is-hexadecimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/parse-entities/node_modules/@types/unist": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-2.0.11.tgz",
+      "integrity": "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==",
+      "license": "MIT"
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.28",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.28.tgz",
+      "integrity": "sha512-RRuzqDtt5Y9h3quz5hWhK+TPnsmVs6WwSU6LkJMeY4HstUEDuYTG8UJSdawMRzmzAtV+KEoG8N3Qg2qLy5vM/A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.18",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "3.9.5",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.5.tgz",
+      "integrity": "sha512-/FVl766LpUfB5vXgCYOYa0MeV/441Ia99AeICQIQFTY/Nw0roZwULcXpku5i1/m5kt/baz+s4Zogspd839HSMg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
+    "node_modules/property-information": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",
+      "integrity": "sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/react": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
+      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
+      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.7"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.7.tgz",
+      "integrity": "sha512-kZFnouyVv7eP/Phmrlo9FK+zcAdriZJvzxXHF1Sl1P377WSGe2G/JxVolhTrB/jeV47lKImhNUsijjHAAbcl/A==",
+      "license": "MIT"
+    },
+    "node_modules/react-markdown": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/react-markdown/-/react-markdown-10.1.0.tgz",
+      "integrity": "sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "hast-util-to-jsx-runtime": "^2.0.0",
+        "html-url-attributes": "^3.0.0",
+        "mdast-util-to-hast": "^13.0.0",
+        "remark-parse": "^11.0.0",
+        "remark-rehype": "^11.0.0",
+        "unified": "^11.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      },
+      "peerDependencies": {
+        "@types/react": ">=18",
+        "react": ">=18"
+      }
+    },
+    "node_modules/react-redux": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
+      "integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/use-sync-external-store": "^0.0.6",
+        "use-sync-external-store": "^1.4.0"
+      },
+      "peerDependencies": {
+        "@types/react": "^18.2.25 || ^19",
+        "react": "^18.0 || ^19",
+        "redux": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "redux": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll": {
+      "version": "2.7.2",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll/-/react-remove-scroll-2.7.2.tgz",
+      "integrity": "sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-remove-scroll-bar": "^2.3.7",
+        "react-style-singleton": "^2.2.3",
+        "tslib": "^2.1.0",
+        "use-callback-ref": "^1.3.3",
+        "use-sidecar": "^1.1.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-remove-scroll-bar": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/react-remove-scroll-bar/-/react-remove-scroll-bar-2.3.8.tgz",
+      "integrity": "sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==",
+      "license": "MIT",
+      "dependencies": {
+        "react-style-singleton": "^2.2.2",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-style-singleton": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/react-style-singleton/-/react-style-singleton-2.2.3.tgz",
+      "integrity": "sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==",
+      "license": "MIT",
+      "dependencies": {
+        "get-nonce": "^1.0.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/recharts": {
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.10.1.tgz",
+      "integrity": "sha512-QXFrvt6IVcw7eeZCoyXTwkIJAX3Dv1nyVhMicXJ47GsGDDpcN8z6o644DibE9XjpBTThtsomLKnTV6lc+cVFUA==",
+      "license": "MIT",
+      "workspaces": [
+        "www"
+      ],
+      "dependencies": {
+        "@reduxjs/toolkit": "^1.9.0 || 2.x.x",
+        "clsx": "^2.1.1",
+        "decimal.js-light": "^2.5.1",
+        "es-toolkit": "^1.39.3",
+        "eventemitter3": "^5.0.1",
+        "immer": "^11.1.8",
+        "react-redux": "8.x.x || 9.x.x",
+        "reselect": "5.2.0",
+        "tiny-invariant": "^1.3.3",
+        "use-sync-external-store": "^1.2.2",
+        "victory-vendor": "^37.0.2"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/redux": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/redux/-/redux-5.0.1.tgz",
+      "integrity": "sha512-M9/ELqF6fy8FwmkpnF0S3YKOqMyoWJ4+CS5Efg2ct3oY9daQvd/Pc71FpGZsVsbl3Cpb+IIcjBDUnnyBdQbq4w==",
+      "license": "MIT"
+    },
+    "node_modules/redux-thunk": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/redux-thunk/-/redux-thunk-3.1.0.tgz",
+      "integrity": "sha512-NW2r5T6ksUKXCabzhL9z+h206HQw/NJkcLm1GPImRQ8IzfXwRGqjVhKJGauHirT0DAuyy6hjdnMZaRoAcy0Klw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "redux": "^5.0.0"
+      }
+    },
+    "node_modules/rehype-sanitize": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/rehype-sanitize/-/rehype-sanitize-6.0.0.tgz",
+      "integrity": "sha512-CsnhKNsyI8Tub6L4sm5ZFsme4puGfc6pYylvXo1AeqaGbjOYyzNv3qZPwvs0oMJ39eryyeOdmxwUIo94IpEhqg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "hast-util-sanitize": "^5.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-gfm": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/remark-gfm/-/remark-gfm-4.0.1.tgz",
+      "integrity": "sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-gfm": "^3.0.0",
+        "micromark-extension-gfm": "^3.0.0",
+        "remark-parse": "^11.0.0",
+        "remark-stringify": "^11.0.0",
+        "unified": "^11.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-parse": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-11.0.0.tgz",
+      "integrity": "sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "unified": "^11.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-rehype": {
+      "version": "11.1.2",
+      "resolved": "https://registry.npmjs.org/remark-rehype/-/remark-rehype-11.1.2.tgz",
+      "integrity": "sha512-Dh7l57ianaEoIpzbp0PC9UKAdCSVklD8E5Rpw7ETfbTl3FqcOOgq5q2LVDhgGCkaBv7p24JXikPdvhhmHvKMsw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "mdast-util-to-hast": "^13.0.0",
+        "unified": "^11.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-stringify": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/remark-stringify/-/remark-stringify-11.0.0.tgz",
+      "integrity": "sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "unified": "^11.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/reselect": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/reselect/-/reselect-5.2.0.tgz",
+      "integrity": "sha512-AgZ3UOZm3YndfrJ4OYjgrT7bmCm/1iqkjvEfH/oYjzh6PD2qw4QuT3jjnXIrpdt4MTpMXclMT3lXbmRY+XRakw==",
+      "license": "MIT"
+    },
+    "node_modules/rolldown": {
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.1.5.tgz",
+      "integrity": "sha512-t9z29cJjXf/vxQ8dyhCSpt6H6aSwHTk8cT5I3iy6SMXuFpk5mB6PL6XfC8PCwrPTx93udwKUm9HRteAlTGBLiA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.139.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.1.5",
+        "@rolldown/binding-darwin-arm64": "1.1.5",
+        "@rolldown/binding-darwin-x64": "1.1.5",
+        "@rolldown/binding-freebsd-x64": "1.1.5",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.1.5",
+        "@rolldown/binding-linux-arm64-gnu": "1.1.5",
+        "@rolldown/binding-linux-arm64-musl": "1.1.5",
+        "@rolldown/binding-linux-ppc64-gnu": "1.1.5",
+        "@rolldown/binding-linux-s390x-gnu": "1.1.5",
+        "@rolldown/binding-linux-x64-gnu": "1.1.5",
+        "@rolldown/binding-linux-x64-musl": "1.1.5",
+        "@rolldown/binding-openharmony-arm64": "1.1.5",
+        "@rolldown/binding-wasm32-wasi": "1.1.5",
+        "@rolldown/binding-win32-arm64-msvc": "1.1.5",
+        "@rolldown/binding-win32-x64-msvc": "1.1.5"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
+    },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/space-separated-tokens": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
+      "integrity": "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/std-env": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz",
+      "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/stringify-entities": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
+      "integrity": "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==",
+      "license": "MIT",
+      "dependencies": {
+        "character-entities-html4": "^2.0.0",
+        "character-entities-legacy": "^3.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/style-to-js": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.21.tgz",
+      "integrity": "sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ==",
+      "license": "MIT",
+      "dependencies": {
+        "style-to-object": "1.0.14"
+      }
+    },
+    "node_modules/style-to-object": {
+      "version": "1.0.14",
+      "resolved": "https://registry.npmjs.org/style-to-object/-/style-to-object-1.0.14.tgz",
+      "integrity": "sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw==",
+      "license": "MIT",
+      "dependencies": {
+        "inline-style-parser": "0.2.7"
+      }
+    },
+    "node_modules/tailwind-merge": {
+      "version": "3.7.0",
+      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.7.0.tgz",
+      "integrity": "sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/dcastil"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz",
+      "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/tiny-invariant": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
+      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
+      "license": "MIT"
+    },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz",
+      "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tinyrainbow": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.2.0.tgz",
+      "integrity": "sha512-LgO3D9yZJjApUiuUfl9iFAwrtaX4+lok3wJIqttGoKCHlWUqHqbQpnxCf82L8FjgKsh4iGo78hqJwgL8F6To2A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/trim-lines": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz",
+      "integrity": "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/trough": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/trough/-/trough-2.2.0.tgz",
+      "integrity": "sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/typescript": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
+      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc"
+      },
+      "engines": {
+        "node": ">=16.20.0"
+      },
+      "optionalDependencies": {
+        "@typescript/typescript-aix-ppc64": "7.0.2",
+        "@typescript/typescript-darwin-arm64": "7.0.2",
+        "@typescript/typescript-darwin-x64": "7.0.2",
+        "@typescript/typescript-freebsd-arm64": "7.0.2",
+        "@typescript/typescript-freebsd-x64": "7.0.2",
+        "@typescript/typescript-linux-arm": "7.0.2",
+        "@typescript/typescript-linux-arm64": "7.0.2",
+        "@typescript/typescript-linux-loong64": "7.0.2",
+        "@typescript/typescript-linux-mips64el": "7.0.2",
+        "@typescript/typescript-linux-ppc64": "7.0.2",
+        "@typescript/typescript-linux-riscv64": "7.0.2",
+        "@typescript/typescript-linux-s390x": "7.0.2",
+        "@typescript/typescript-linux-x64": "7.0.2",
+        "@typescript/typescript-netbsd-arm64": "7.0.2",
+        "@typescript/typescript-netbsd-x64": "7.0.2",
+        "@typescript/typescript-openbsd-arm64": "7.0.2",
+        "@typescript/typescript-openbsd-x64": "7.0.2",
+        "@typescript/typescript-sunos-x64": "7.0.2",
+        "@typescript/typescript-win32-arm64": "7.0.2",
+        "@typescript/typescript-win32-x64": "7.0.2"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/unified": {
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/unified/-/unified-11.0.5.tgz",
+      "integrity": "sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "bail": "^2.0.0",
+        "devlop": "^1.0.0",
+        "extend": "^3.0.0",
+        "is-plain-obj": "^4.0.0",
+        "trough": "^2.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-is": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
+      "integrity": "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-position": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-position/-/unist-util-position-5.0.0.tgz",
+      "integrity": "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-stringify-position": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
+      "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-visit": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-5.1.0.tgz",
+      "integrity": "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-is": "^6.0.0",
+        "unist-util-visit-parents": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-visit-parents": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-6.0.2.tgz",
+      "integrity": "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-is": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/use-callback-ref": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/use-callback-ref/-/use-callback-ref-1.3.3.tgz",
+      "integrity": "sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sidecar": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/use-sidecar/-/use-sidecar-1.1.3.tgz",
+      "integrity": "sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==",
+      "license": "MIT",
+      "dependencies": {
+        "detect-node-es": "^1.1.0",
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "@types/react": "*",
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/use-sync-external-store": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.7.0.tgz",
+      "integrity": "sha512-6L+EeigHMQhdaIPNIFUKwfWJSwWFQ8gJbJ2DLOs5sDIegTwR9fRxvnM3uciHKjIZhFz+KAv2emhWMRvDmMcY8A==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/vfile": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/vfile/-/vfile-6.0.3.tgz",
+      "integrity": "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/vfile-message": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-4.0.3.tgz",
+      "integrity": "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/victory-vendor": {
+      "version": "37.3.6",
+      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-37.3.6.tgz",
+      "integrity": "sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==",
+      "license": "MIT AND ISC",
+      "dependencies": {
+        "@types/d3-array": "^3.0.3",
+        "@types/d3-ease": "^3.0.0",
+        "@types/d3-interpolate": "^3.0.1",
+        "@types/d3-scale": "^4.0.2",
+        "@types/d3-shape": "^3.1.0",
+        "@types/d3-time": "^3.0.0",
+        "@types/d3-timer": "^3.0.0",
+        "d3-array": "^3.1.6",
+        "d3-ease": "^3.0.1",
+        "d3-interpolate": "^3.0.1",
+        "d3-scale": "^4.0.2",
+        "d3-shape": "^3.1.0",
+        "d3-time": "^3.0.0",
+        "d3-timer": "^3.0.1"
+      }
+    },
+    "node_modules/vite": {
+      "version": "8.1.5",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.1.5.tgz",
+      "integrity": "sha512-7ULLwsCdYx/nRyrpiEwvqb5TFHrMVZyBt+rg/OAXT7rgj/z+DtTDyKFeLAdDkubDVDKD8jOsndmy7m55XcfUsw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.32.0",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.17",
+        "rolldown": "~1.1.5",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.3.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz",
+      "integrity": "sha512-R9jUTe5S4Qb0HCd4TNqpC7oGcrMssMRGXLW80ubjWsW9VH5GF8y1Y0SFLY9AbqSk6nt0PnOx4H4WNJYZ13GUPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/expect": "4.1.10",
+        "@vitest/mocker": "4.1.10",
+        "@vitest/pretty-format": "4.1.10",
+        "@vitest/runner": "4.1.10",
+        "@vitest/snapshot": "4.1.10",
+        "@vitest/spy": "4.1.10",
+        "@vitest/utils": "4.1.10",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.1",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.3",
+        "std-env": "^4.0.0-rc.1",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^1.0.2",
+        "tinyglobby": "^0.2.15",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "4.1.10",
+        "@vitest/browser-preview": "4.1.10",
+        "@vitest/browser-webdriverio": "4.1.10",
+        "@vitest/coverage-istanbul": "4.1.10",
+        "@vitest/coverage-v8": "4.1.10",
+        "@vitest/ui": "4.1.10",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-3.0.0.tgz",
+      "integrity": "sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+      "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/zwitch": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
+      "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    }
+  }
+}
diff --git a/apps/web/package.json b/apps/web/package.json
new file mode 100644
index 000000000..ea566f73c
--- /dev/null
+++ b/apps/web/package.json
@@ -0,0 +1,35 @@
+{
+  "name": "@colossus/web",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "scripts": {
+    "dev": "vite --host 127.0.0.1 --port 5180",
+    "build": "tsc --noEmit && vite build",
+    "test": "vitest run",
+    "check": "npm run build && npm test",
+    "format": "prettier --write ."
+  },
+  "dependencies": {
+    "@colossus/ui": "file:../ui",
+    "@tabler/icons-react": "3.45.0",
+    "react": "19.2.7",
+    "react-dom": "19.2.7"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "4.3.3",
+    "@types/node": "26.1.1",
+    "@types/react": "19.2.17",
+    "@types/react-dom": "19.2.3",
+    "@vitejs/plugin-react": "6.0.3",
+    "happy-dom": "20.14.5",
+    "prettier": "3.9.5",
+    "tailwindcss": "4.3.3",
+    "typescript": "7.0.2",
+    "vite": "8.1.5",
+    "vitest": "4.1.10"
+  }
+}
diff --git a/apps/web/public/favicon.svg b/apps/web/public/favicon.svg
new file mode 100644
index 000000000..a19b5c644
--- /dev/null
+++ b/apps/web/public/favicon.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><rect width="32" height="32" rx="8" fill="#15151a"/><path d="M10 23h12a5 5 0 0 0 1-10 7 7 0 0 0-13-1 5.5 5.5 0 0 0 0 11Z" fill="none" stroke="#cbb5ff" stroke-width="2"/></svg>
diff --git a/apps/web/src/ActivityChart.test.tsx b/apps/web/src/ActivityChart.test.tsx
new file mode 100644
index 000000000..ef104bf93
--- /dev/null
+++ b/apps/web/src/ActivityChart.test.tsx
@@ -0,0 +1,72 @@
+// @vitest-environment happy-dom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import { ActivityLineChart } from "@colossus/ui/charts";
+import { dashboard } from "./control-api";
+let root: Root, container: HTMLDivElement;
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  vi.stubGlobal(
+    "ResizeObserver",
+    class {
+      observe() {}
+      unobserve() {}
+      disconnect() {}
+    },
+  );
+  vi.spyOn(HTMLElement.prototype, "getBoundingClientRect").mockImplementation(
+    function (this: HTMLElement) {
+      return this.classList.contains("recharts-responsive-container")
+        ? new DOMRect(0, 0, 800, 280)
+        : new DOMRect(0, 0, 0, 16);
+    },
+  );
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+});
+afterEach(async () => {
+  await act(() => root.unmount());
+  container.remove();
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+it("renders genuine line series and retains zero, missing values and UTC dates in its accessible data alternative", async () => {
+  const data = [
+    { date: "2026-10-01", runs: 0, completed: 0, failed: 0 },
+    { date: "2026-10-02", runs: null, completed: null, failed: null },
+    { date: "2026-10-03", runs: 8, completed: 7, failed: 1 },
+  ];
+  await act(() => root.render(<ActivityLineChart data={data} />));
+  expect(container.querySelectorAll(".recharts-line")).toHaveLength(3);
+  expect(container.querySelector(".recharts-area")).toBeNull();
+  const rows = [...container.querySelectorAll("tbody tr")];
+  expect(rows).toHaveLength(3);
+  expect(
+    [...rows[0]!.querySelectorAll("td")].map((cell) => cell.textContent),
+  ).toEqual(["0", "0", "0"]);
+  expect(
+    [...rows[1]!.querySelectorAll("td")].map((cell) => cell.textContent),
+  ).toEqual(["Unavailable", "Unavailable", "Unavailable"]);
+  expect(rows[2]!.querySelector("time")?.getAttribute("dateTime")).toBe(
+    "2026-10-03",
+  );
+  expect(container.querySelector("caption")?.textContent).toContain("UTC");
+  expect(
+    container.querySelector(".shared-chart-legend")?.textContent,
+  ).toContain("Total runs");
+  expect(data[1]!.runs).toBeNull();
+});
+it("shows an empty state without inventing a chart or daily observations", async () => {
+  await act(() => root.render(<ActivityLineChart data={[]} />));
+  expect(container.textContent).toContain("No released run activity");
+  expect(container.querySelector("svg")).toBeNull();
+});
+it("constructs bounded dashboard windows without duplicate or unsupported periods", () => {
+  expect(dashboard()).toBe("/api/dashboard?days=7");
+  expect(dashboard(30)).toBe("/api/dashboard?days=30");
+  expect(dashboard(90)).toBe("/api/dashboard?days=90");
+  for (const invalid of [0, 91, 7.5, NaN])
+    expect(() => dashboard(invalid)).toThrow(RangeError);
+});
diff --git a/apps/web/src/Administration.tsx b/apps/web/src/Administration.tsx
new file mode 100644
index 000000000..cc91e05f8
--- /dev/null
+++ b/apps/web/src/Administration.tsx
@@ -0,0 +1,649 @@
+import { useEffect, useMemo, useState } from "react";
+import { Button, DropdownSelect, TextInput } from "@colossus/ui";
+import { DataTable, type DataTableColumn } from "@colossus/ui/data-table";
+import { IconPlus, IconSettings, IconShieldLock } from "@tabler/icons-react";
+import { request } from "./api";
+import type {
+  AdminSettings,
+  AuthConfig,
+  Classification,
+  Project,
+  User,
+} from "./control-api";
+import { errorMessage, useResource } from "./resources";
+import { LoadState } from "./Home";
+import { ProjectEditor, SectionTabs } from "./Projects";
+import { globalHref, type AdminView } from "./routes";
+export function Administration({
+  authConfig,
+  onRefresh,
+  onSettings,
+  view,
+  onView,
+}: {
+  authConfig: AuthConfig | null;
+  onRefresh: () => void;
+  onSettings: (settings: AdminSettings) => void;
+  view?: AdminView;
+  onView?: (value: AdminView) => void;
+}) {
+  const [localTab, setTab] = useState("users");
+  const tab = view ?? localTab;
+  return (
+    <section className="control-page">
+      <header className="page-heading">
+        <div>
+          <span className="eyebrow">Administration</span>
+          <h1>Control Plane administration</h1>
+          <p>Manage identities, project structure, and environment settings.</p>
+        </div>
+      </header>
+      <SectionTabs
+        items={[
+          { id: "users", label: "Users" },
+          { id: "projects", label: "Projects" },
+          { id: "settings", label: "Authentication & settings" },
+        ]}
+        current={tab}
+        onChange={(value) =>
+          onView ? onView(value as AdminView) : setTab(value)
+        }
+        hrefFor={(value) => globalHref("admin", undefined, value as AdminView)}
+      />
+      {tab === "users" ? (
+        <Users authConfig={authConfig} />
+      ) : tab === "projects" ? (
+        <AdminProjects onRefresh={onRefresh} />
+      ) : (
+        <EnvironmentSettings onSaved={onSettings} />
+      )}
+    </section>
+  );
+}
+function Users({ authConfig }: { authConfig: AuthConfig | null }) {
+  const resource = useResource<{ users: User[]; next_cursor?: string | null }>(
+      "/api/admin/users",
+    ),
+    [extra, setExtra] = useState<User[]>([]),
+    [cursor, setCursor] = useState<string | null>(null),
+    [selected, setSelected] = useState<User | "new" | null>(null),
+    [error, setError] = useState(""),
+    [busy, setBusy] = useState(false);
+  useEffect(() => {
+    setExtra([]);
+    setCursor(resource.data?.next_cursor ?? null);
+  }, [resource.data]);
+  const columns = useMemo<DataTableColumn<User>[]>(
+    () => [
+      {
+        id: "name",
+        label: "User",
+        value: (row) => row.display_name,
+        cell: (row) => (
+          <button
+            type="button"
+            className="catalog-name"
+            onClick={() => setSelected(row)}
+          >
+            {row.display_name}
+          </button>
+        ),
+      },
+      {
+        id: "identity",
+        label: "Login identities",
+        value: (row) => row.identities?.map((id) => id.label).join(" ") ?? "",
+        cell: (row) => (
+          <span>
+            {row.identities?.map((id) => id.label).join(" · ") ||
+              "Provisioned identity"}
+          </span>
+        ),
+      },
+      {
+        id: "active",
+        label: "Status",
+        value: (row) => (row.active ? "Active" : "Disabled"),
+        cell: (row) => (
+          <span
+            className={`status ${row.active ? "status-completed" : "status-cancelled"}`}
+          >
+            {row.active ? "Active" : "Disabled"}
+          </span>
+        ),
+      },
+      {
+        id: "role",
+        label: "Administration",
+        value: (row) => (row.is_admin ? "Administrator" : "Member"),
+        cell: (row) => <span>{row.is_admin ? "Administrator" : "Member"}</span>,
+      },
+    ],
+    [],
+  );
+  return (
+    <>
+      <header className="catalog-heading">
+        <div>
+          <h2>Users</h2>
+          <p>
+            Provision login identities and control access to the Control Plane.
+          </p>
+        </div>
+        <Button variant="primary" onClick={() => setSelected("new")}>
+          <IconPlus size={16} aria-hidden="true" />
+          Create user
+        </Button>
+      </header>
+      <LoadState {...resource} retry={resource.refresh} />
+      {error ? (
+        <div className="alert" role="alert">
+          {error}
+        </div>
+      ) : null}
+      {selected ? (
+        <UserEditor
+          key={
+            selected === "new" ? "new" : `${selected.id}:${selected.revision}`
+          }
+          user={selected === "new" ? undefined : selected}
+          authConfig={authConfig}
+          onCancel={() => setSelected(null)}
+          onSaved={() => {
+            setSelected(null);
+            resource.refresh();
+          }}
+        />
+      ) : null}
+      <DataTable
+        data={[...(resource.data?.users ?? []), ...extra]}
+        columns={columns}
+        getRowId={(row) => row.id}
+        search={{ columnId: "name", label: "Search loaded users" }}
+        label="Control Plane users"
+        loading={resource.loading}
+        empty="No users found."
+      />
+      {cursor ? (
+        <div className="load-more">
+          <p className="field-help">
+            Search and sorting apply to loaded users.
+          </p>
+          <Button
+            disabled={busy}
+            onClick={async () => {
+              setBusy(true);
+              try {
+                const data = await request<{
+                  users: User[];
+                  next_cursor?: string | null;
+                }>(`/api/admin/users?after=${encodeURIComponent(cursor)}`);
+                setExtra((value) => [...value, ...data.users]);
+                setCursor(data.next_cursor ?? null);
+              } catch (e) {
+                setError(errorMessage(e));
+              } finally {
+                setBusy(false);
+              }
+            }}
+          >
+            Load more users
+          </Button>
+        </div>
+      ) : null}
+    </>
+  );
+}
+function UserEditor({
+  user,
+  authConfig,
+  onCancel,
+  onSaved,
+}: {
+  user?: User | undefined;
+  authConfig: AuthConfig | null;
+  onCancel: () => void;
+  onSaved: () => void;
+}) {
+  const [name, setName] = useState(user?.display_name ?? ""),
+    [email, setEmail] = useState(user?.email ?? ""),
+    [username, setUsername] = useState(""),
+    [password, setPassword] = useState(""),
+    [subject, setSubject] = useState(""),
+    [active, setActive] = useState(user?.active ?? true),
+    [admin, setAdmin] = useState(user?.is_admin ?? false),
+    [error, setError] = useState(""),
+    [busy, setBusy] = useState(false),
+    [reset, setReset] = useState(false);
+  const localIdentity = user?.identities?.some((item) => item.kind === "local");
+  async function save() {
+    setBusy(true);
+    setError("");
+    try {
+      if (reset && user)
+        await request(
+          `/api/admin/users/${encodeURIComponent(user.id)}/password`,
+          { revision: user.revision, new_password: password },
+        );
+      else
+        await request(
+          user
+            ? `/api/admin/users/${encodeURIComponent(user.id)}`
+            : "/api/admin/users",
+          user
+            ? {
+                revision: user.revision,
+                display_name: name.trim(),
+                active,
+                is_admin: admin,
+              }
+            : {
+                display_name: name.trim(),
+                email: email.trim() || null,
+                is_admin: admin,
+                ...(username.trim()
+                  ? { username: username.trim(), password }
+                  : {}),
+                ...(subject.trim() ? { oidc_subject: subject.trim() } : {}),
+              },
+          undefined,
+          user && !reset ? "PATCH" : undefined,
+        );
+      onSaved();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setBusy(false);
+      setPassword("");
+    }
+  }
+  return (
+    <form
+      className="management-form control-card"
+      onSubmit={(e) => {
+        e.preventDefault();
+        void save();
+      }}
+    >
+      <header>
+        <h3>
+          {reset
+            ? "Reset local password"
+            : user
+              ? `Edit ${user.display_name}`
+              : "Create user"}
+        </h3>
+        <Button onClick={onCancel}>Close</Button>
+      </header>
+      {error ? (
+        <div className="alert" role="alert">
+          {error}
+        </div>
+      ) : null}
+      {reset ? (
+        <>
+          <p className="field-help">
+            Resetting the password invalidates this user’s existing sessions.
+          </p>
+          <label>
+            <span>New password</span>
+            <TextInput
+              type="password"
+              autoComplete="new-password"
+              required
+              minLength={15}
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+            />
+          </label>
+        </>
+      ) : (
+        <>
+          <label>
+            <span>Display name</span>
+            <TextInput
+              required
+              maxLength={200}
+              value={name}
+              onChange={(e) => setName(e.target.value)}
+            />
+          </label>
+          {!user ? (
+            <>
+              <label>
+                <span>Email · optional</span>
+                <TextInput
+                  type="email"
+                  value={email}
+                  onChange={(e) => setEmail(e.target.value)}
+                  autoComplete="off"
+                />
+              </label>
+              {authConfig?.local_enabled ? (
+                <div className="form-pair">
+                  <label>
+                    <span>Local username</span>
+                    <TextInput
+                      value={username}
+                      onChange={(e) => setUsername(e.target.value)}
+                      autoComplete="off"
+                    />
+                  </label>
+                  <label>
+                    <span>Local password</span>
+                    <TextInput
+                      type="password"
+                      minLength={15}
+                      required={Boolean(username.trim())}
+                      value={password}
+                      onChange={(e) => setPassword(e.target.value)}
+                      autoComplete="new-password"
+                    />
+                  </label>
+                </div>
+              ) : null}
+              {authConfig?.oidc ? (
+                <label>
+                  <span>OIDC subject</span>
+                  <TextInput
+                    value={subject}
+                    onChange={(e) => setSubject(e.target.value)}
+                    autoComplete="off"
+                  />
+                  <small>
+                    Exact subject from {authConfig.oidc.label}. Emails do not
+                    automatically link identities.
+                  </small>
+                </label>
+              ) : null}
+              <p className="field-help">
+                Provide at least one enabled login identity.
+              </p>
+            </>
+          ) : (
+            <label className="checkbox-field">
+              <input
+                type="checkbox"
+                checked={active}
+                onChange={(e) => setActive(e.target.checked)}
+              />
+              Active user<small>Changing this retires existing sessions.</small>
+            </label>
+          )}
+          <label className="checkbox-field">
+            <input
+              type="checkbox"
+              checked={admin}
+              onChange={(e) => setAdmin(e.target.checked)}
+            />
+            Control Plane administrator
+          </label>
+          <p className="field-help">
+            Administrators can read and manage projects. Running tasks and
+            approving actions still require an explicit project role.
+          </p>
+        </>
+      )}
+      <div className="form-actions">
+        <Button
+          variant="primary"
+          type="submit"
+          disabled={
+            busy ||
+            (!reset && !name.trim()) ||
+            (!user && !username.trim() && !subject.trim())
+          }
+        >
+          {busy ? "Saving…" : reset ? "Reset password" : "Save user"}
+        </Button>
+        {user && localIdentity && authConfig?.local_enabled && !reset ? (
+          <Button onClick={() => setReset(true)}>Reset local password</Button>
+        ) : null}
+        <Button onClick={onCancel}>Cancel</Button>
+      </div>
+    </form>
+  );
+}
+function AdminProjects({ onRefresh }: { onRefresh: () => void }) {
+  const resource = useResource<{
+      projects: Project[];
+      next_cursor?: string | null;
+    }>("/api/admin/projects"),
+    [selected, setSelected] = useState<Project | "new" | null>(null),
+    [extra, setExtra] = useState<Project[]>([]),
+    [cursor, setCursor] = useState<string | null>(null),
+    [busy, setBusy] = useState(false),
+    [error, setError] = useState("");
+  useEffect(() => {
+    setExtra([]);
+    setCursor(resource.data?.next_cursor ?? null);
+  }, [resource.data]);
+  const projects = [...(resource.data?.projects ?? []), ...extra];
+  return (
+    <>
+      <header className="catalog-heading">
+        <div>
+          <h2>Project hierarchy</h2>
+          <p>Organizational nesting does not grant inherited membership.</p>
+        </div>
+        <Button variant="primary" onClick={() => setSelected("new")}>
+          <IconPlus size={16} aria-hidden="true" />
+          Create project
+        </Button>
+      </header>
+      <LoadState {...resource} retry={resource.refresh} />
+      {error ? (
+        <div className="alert" role="alert">
+          {error}
+        </div>
+      ) : null}
+      {selected ? (
+        <ProjectEditor
+          key={
+            selected === "new" ? "new" : `${selected.id}:${selected.revision}`
+          }
+          {...(selected === "new" ? {} : { project: selected })}
+          projects={projects}
+          onCancel={() => setSelected(null)}
+          onSaved={() => {
+            setSelected(null);
+            resource.refresh();
+            onRefresh();
+          }}
+        />
+      ) : null}
+      <div className="access-list">
+        {projects.map((project) => (
+          <div key={project.id}>
+            <span>
+              <strong>{project.name}</strong>
+              <small>
+                {project.parent_project_id
+                  ? `Within ${projects.find((item) => item.id === project.parent_project_id)?.name ?? project.parent_project_id}`
+                  : "Top-level project"}
+                {project.archived ? " · Archived" : ""}
+              </small>
+            </span>
+            <Button onClick={() => setSelected(project)}>Edit project</Button>
+          </div>
+        ))}
+      </div>
+      {cursor ? (
+        <Button
+          disabled={busy}
+          onClick={async () => {
+            setBusy(true);
+            try {
+              const data = await request<{
+                projects: Project[];
+                next_cursor?: string | null;
+              }>(`/api/admin/projects?after=${encodeURIComponent(cursor)}`);
+              setExtra((value) => [...value, ...data.projects]);
+              setCursor(data.next_cursor ?? null);
+            } catch (e) {
+              setError(errorMessage(e));
+            } finally {
+              setBusy(false);
+            }
+          }}
+        >
+          Load more projects
+        </Button>
+      ) : null}
+    </>
+  );
+}
+function EnvironmentSettings({
+  onSaved,
+}: {
+  onSaved: (settings: AdminSettings) => void;
+}) {
+  const resource = useResource<AdminSettings>("/api/admin/settings"),
+    [draft, setDraft] = useState<Classification | null>(null),
+    [busy, setBusy] = useState(false),
+    [error, setError] = useState(""),
+    [notice, setNotice] = useState("");
+  useEffect(() => {
+    if (resource.data) setDraft(resource.data.classification);
+  }, [resource.data]);
+  return (
+    <>
+      <LoadState {...resource} retry={resource.refresh} />
+      {resource.data ? (
+        <section className="control-card">
+          <header>
+            <h3>
+              <IconShieldLock size={17} aria-hidden="true" />
+              Authentication
+            </h3>
+          </header>
+          <dl className="stat-list">
+            <div>
+              <dt>Local login</dt>
+              <dd>
+                {resource.data.auth.local_enabled ? "Enabled" : "Disabled"}
+              </dd>
+            </div>
+            <div>
+              <dt>OIDC provider</dt>
+              <dd>{resource.data.auth.oidc_label ?? "Not configured"}</dd>
+            </div>
+          </dl>
+          <p className="field-help">
+            Authentication providers are configured by the deployment operator.
+            Credentials and client secrets stay outside this interface.
+          </p>
+        </section>
+      ) : null}
+      {draft && resource.data ? (
+        <section className="control-card">
+          <header>
+            <h3>
+              <IconSettings size={17} aria-hidden="true" />
+              Classification banner
+            </h3>
+          </header>
+          <form
+            className="management-form"
+            onSubmit={async (event) => {
+              event.preventDefault();
+              setBusy(true);
+              setError("");
+              setNotice("");
+              try {
+                const result = await request<AdminSettings>(
+                  "/api/admin/settings",
+                  { revision: resource.data!.revision, classification: draft },
+                  undefined,
+                  "PATCH",
+                );
+                onSaved(result);
+                resource.refresh();
+                setNotice("Environment settings saved.");
+              } catch (e) {
+                setError(errorMessage(e));
+              } finally {
+                setBusy(false);
+              }
+            }}
+          >
+            {error ? (
+              <div className="alert" role="alert">
+                {error}
+              </div>
+            ) : null}
+            {notice ? (
+              <p role="status" className="notice">
+                {notice}
+              </p>
+            ) : null}
+            <label className="checkbox-field">
+              <input
+                type="checkbox"
+                checked={draft.enabled}
+                onChange={(e) =>
+                  setDraft({ ...draft, enabled: e.target.checked })
+                }
+              />
+              Display classification banner
+            </label>
+            <label>
+              <span>Classification text</span>
+              <TextInput
+                required={draft.enabled}
+                maxLength={160}
+                value={draft.text}
+                onChange={(e) => setDraft({ ...draft, text: e.target.value })}
+              />
+            </label>
+            <div className="form-pair">
+              <label>
+                <span>Tone</span>
+                <DropdownSelect
+                  value={draft.tone}
+                  onChange={(e) =>
+                    setDraft({
+                      ...draft,
+                      tone: e.target.value as Classification["tone"],
+                    })
+                  }
+                >
+                  <option value="neutral">Neutral</option>
+                  <option value="info">Information</option>
+                  <option value="warning">Warning</option>
+                  <option value="danger">Danger</option>
+                </DropdownSelect>
+              </label>
+              <label>
+                <span>Placement</span>
+                <DropdownSelect
+                  value={draft.position}
+                  onChange={(e) =>
+                    setDraft({
+                      ...draft,
+                      position: e.target.value as Classification["position"],
+                    })
+                  }
+                >
+                  <option value="top">Top</option>
+                  <option value="top_and_bottom">Top and bottom</option>
+                </DropdownSelect>
+              </label>
+            </div>
+            {draft.enabled ? (
+              <div
+                className={`control-classification classification-${draft.tone}`}
+                aria-label="Banner preview"
+              >
+                {draft.text || "Classification preview"}
+              </div>
+            ) : null}
+            <Button variant="primary" type="submit" disabled={busy}>
+              {busy ? "Saving…" : "Save environment settings"}
+            </Button>
+          </form>
+        </section>
+      ) : null}
+    </>
+  );
+}
diff --git a/apps/web/src/AgentScope.test.tsx b/apps/web/src/AgentScope.test.tsx
new file mode 100644
index 000000000..65cbcdc6a
--- /dev/null
+++ b/apps/web/src/AgentScope.test.tsx
@@ -0,0 +1,211 @@
+// @vitest-environment happy-dom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import { AgentSidebar, AgentWorkspace } from "./AgentScope";
+import type { FleetNode, Task, Thread } from "./api";
+import type { RunRequest } from "./RunComposer";
+const at = "2026-10-06T10:00:00Z";
+const node = (id: string): FleetNode => ({
+  node: {
+    node_id: id,
+    project_id: "p",
+    instance_id: id,
+    label: `Agent ${id}`,
+    workspace_label: `Workspace ${id}`,
+    certificate_sha256: "test",
+    roles: ["primary"],
+    revoked: false,
+    revision: 1,
+  },
+  presence: { ready: true, connection_id: id, capabilities: [] },
+});
+const nodes = [node("a"), node("b")];
+const thread = (id: string, nodeId: string): Thread => ({
+  thread_id: id,
+  project_id: "p",
+  node_id: nodeId,
+  title: `Thread ${id}`,
+  created_at: at,
+  updated_at: at,
+  revision: 1,
+  archived: false,
+  source: "cloud",
+  sync_status: "current",
+  can_continue: nodeId === "a",
+});
+const first = thread("first", "a"),
+  other = thread("other", "b"),
+  older = thread("older", "a");
+const task: Task = {
+  task_id: "task",
+  project_id: "p",
+  node_id: "a",
+  thread_id: "first",
+  subject: "human",
+  request: { input: [{ text: "Plan" }], role: "primary", mode: "plan" },
+  run_id: "run",
+  last_sequence: 1,
+  revision: 1,
+  snapshot: {
+    run: {
+      run_id: "run",
+      title: "Plan",
+      role: "primary",
+      mode: "plan",
+      status: "completed",
+      created_at: at,
+      updated_at: at,
+      last_sequence: 1,
+      terminal: null,
+    },
+    pending_interactions: [],
+  },
+};
+let root: Root, container: HTMLDivElement, paths: string[];
+let deferOlder = false;
+const pending: { resolve: ((response: Response) => void) | null } = {
+  resolve: null,
+};
+const response = (value: unknown) => new Response(JSON.stringify(value));
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  Object.defineProperty(document, "fonts", {
+    configurable: true,
+    value: new EventTarget(),
+  });
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+  paths = [];
+  deferOlder = false;
+  pending.resolve = null;
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (path: string) => {
+      paths.push(path);
+      const url = new URL(path, "http://fixture.test");
+      if (url.searchParams.has("after")) {
+        if (deferOlder)
+          return new Promise<Response>((resolve) => {
+            pending.resolve = resolve;
+          });
+        return response({ threads: [older], next_cursor: null });
+      }
+      return response({
+        threads: url.searchParams.has("node_id") ? [first] : [first, other],
+        next_cursor: url.searchParams.has("node_id") ? "older-cursor" : null,
+      });
+    }),
+  );
+});
+afterEach(async () => {
+  await act(() => root.unmount());
+  container.remove();
+  vi.unstubAllGlobals();
+});
+const button = (name: string) =>
+  [...container.querySelectorAll<HTMLButtonElement>("button")].find(
+    (item) =>
+      item.getAttribute("aria-label") === name ||
+      item.textContent?.trim() === name,
+  )!;
+async function renderSidebar() {
+  await act(() =>
+    root.render(
+      <AgentSidebar
+        project="p"
+        nodes={nodes}
+        hosts={[]}
+        agentId="a"
+        selected="first"
+        tasks={[task]}
+        onAgent={() => {}}
+        onOpen={() => {}}
+        onNew={() => {}}
+        onBack={() => {}}
+      />,
+    ),
+  );
+}
+it("uses authorized workspace scopes and appends paged history with exact permalinks", async () => {
+  await renderSidebar();
+  expect(paths[0]).toContain("node_id=a");
+  expect(container.textContent).toContain("Plan ·");
+  expect(
+    container.querySelector('a[href="/projects/p/threads/first"]'),
+  ).not.toBeNull();
+  await act(() => button("Load older threads").click());
+  expect(paths.at(-1)).toContain("after=older-cursor");
+  expect(container.textContent).toContain("Thread older");
+  expect(container.textContent).toContain("2 loaded threads");
+  await act(() => button("All Workspaces").click());
+  expect(
+    new URL(paths.at(-1)!, "http://fixture.test").searchParams.has("node_id"),
+  ).toBe(false);
+  expect(container.textContent).toContain("In this project");
+  expect(
+    container.querySelector('a[href="/projects/p/threads/other"]'),
+  ).not.toBeNull();
+  expect(container.textContent).toContain("View only");
+  expect(container.textContent).not.toContain("Execute ·");
+});
+it("keeps search keyboard focus and rejects an older page after a scope change", async () => {
+  await renderSidebar();
+  await act(() =>
+    window.dispatchEvent(
+      new KeyboardEvent("keydown", {
+        key: "k",
+        ctrlKey: true,
+        cancelable: true,
+      }),
+    ),
+  );
+  expect(document.activeElement).toBe(
+    container.querySelector('input[aria-label="Search threads"]'),
+  );
+  deferOlder = true;
+  await act(() => button("Load older threads").click());
+  expect(pending.resolve).not.toBeNull();
+  await act(() => button("All Workspaces").click());
+  await act(async () =>
+    pending.resolve!(response({ threads: [older], next_cursor: null })),
+  );
+  expect(container.textContent).not.toContain("Thread older");
+  expect(container.textContent).toContain("Thread other");
+});
+it("renders a dedicated new-work hero and seeds a focused draft without changing retry idempotence", async () => {
+  const submit = vi.fn<(request: RunRequest) => Promise<boolean>>(
+    async () => false,
+  );
+  await act(() =>
+    root.render(
+      <AgentWorkspace
+        project="p"
+        agent={nodes[0]}
+        nodes={nodes}
+        permissions={["read", "execute"]}
+        creating
+        busy={false}
+        onCreate={submit}
+        onNew={() => {}}
+        view="threads"
+      />,
+    ),
+  );
+  expect(container.querySelector(".shared-work-welcome")).not.toBeNull();
+  expect(container.querySelector(".section-tabs")).toBeNull();
+  expect(container.textContent).not.toContain("Agent conversations");
+  await act(() => button("Orient yourself in this repo").click());
+  const input = container.querySelector<HTMLTextAreaElement>("textarea")!;
+  expect(input.value).toBe("Orient yourself in this repo");
+  expect(document.activeElement).toBe(input);
+  await act(() => button("Start conversation").click());
+  await act(() => button("Start conversation").click());
+  expect(submit).toHaveBeenCalledTimes(2);
+  expect(submit.mock.calls[0]![0].idempotency_key).toBe(
+    submit.mock.calls[1]![0].idempotency_key,
+  );
+  expect(submit.mock.calls[0]![0].role).toBe("primary");
+  expect(submit.mock.calls[0]![0].mode).toBe("execute");
+});
diff --git a/apps/web/src/AgentScope.tsx b/apps/web/src/AgentScope.tsx
new file mode 100644
index 000000000..5f98de78f
--- /dev/null
+++ b/apps/web/src/AgentScope.tsx
@@ -0,0 +1,856 @@
+import { useEffect, useRef, useState } from "react";
+import {
+  Button,
+  DropdownSelect,
+  WorkspaceSidebarHeading,
+  WorkspaceSidebarSearch,
+  WorkspaceSidebarScope,
+  WorkspaceSidebarWorkspace,
+  WorkspaceSidebarGroupHeading,
+  WorkspaceSidebarThreadContent,
+  WorkWelcome,
+} from "@colossus/ui";
+import {
+  IconArrowLeft,
+  IconFolder,
+  IconPlus,
+  IconShield,
+  IconChevronDown,
+  IconPencilPlus,
+  IconCheck,
+  IconLock,
+  IconAlertTriangle,
+} from "@tabler/icons-react";
+import {
+  projectPath,
+  request,
+  taskStatus,
+  statusLabel,
+  type Task,
+  type FleetNode,
+  type Host,
+  type Permission,
+  type Thread,
+} from "./api";
+import type { AgentPolicy } from "./control-api";
+import { useResource } from "./resources";
+import { AnalyticsPanel, LoadState, Metrics } from "./Home";
+import { SectionTabs } from "./Projects";
+import { RunComposer, type RunRequest } from "./RunComposer";
+import { RouteLink } from "./navigation";
+import { agentHref, globalHref, threadHref, type AgentView } from "./routes";
+export function AgentSidebar({
+  project,
+  nodes,
+  hosts,
+  agentId,
+  selected,
+  onAgent,
+  onOpen,
+  onNew,
+  onBack,
+  tasks = [],
+  newDisabled = false,
+}: {
+  project: string;
+  nodes: FleetNode[];
+  hosts: Host[];
+  agentId: string;
+  selected: string;
+  onAgent: (id: string) => void;
+  onOpen: (thread: Thread) => void;
+  onNew: () => void;
+  onBack: () => void;
+  tasks?: Task[];
+  newDisabled?: boolean;
+}) {
+  const [query, setQuery] = useState(""),
+    [search, setSearch] = useState(""),
+    [archive, setArchive] = useState("false"),
+    [scope, setScope] = useState<"all" | "workspace">("workspace"),
+    [expanded, setExpanded] = useState(true),
+    [choosing, setChoosing] = useState(false),
+    [older, setOlder] = useState<Thread[]>([]),
+    [loadedScope, setLoadedScope] = useState(""),
+    [nextCursor, setNextCursor] = useState<string | null>(null),
+    [moreLoaded, setMoreLoaded] = useState(false),
+    [moreBusy, setMoreBusy] = useState(false),
+    [moreError, setMoreError] = useState("");
+  const searchRef = useRef<HTMLInputElement>(null),
+    alive = useRef(true),
+    currentScope = useRef("");
+  useEffect(() => {
+    alive.current = true;
+    return () => {
+      alive.current = false;
+    };
+  }, []);
+  useEffect(() => {
+    const timer = setTimeout(() => setSearch(query.trim()), 250);
+    return () => clearTimeout(timer);
+  }, [query]);
+  const scopeKey = JSON.stringify([
+    project,
+    scope === "workspace" ? agentId : null,
+    search,
+    archive,
+  ]);
+  currentScope.current = scopeKey;
+  useEffect(() => {
+    setOlder([]);
+    setLoadedScope("");
+    setNextCursor(null);
+    setMoreLoaded(false);
+    setMoreError("");
+    setMoreBusy(false);
+  }, [scopeKey]);
+  useEffect(() => {
+    const focus = (event: KeyboardEvent) => {
+      if (
+        (event.metaKey || event.ctrlKey) &&
+        event.key.toLowerCase() === "k" &&
+        !event.isComposing
+      ) {
+        event.preventDefault();
+        searchRef.current?.focus();
+      }
+    };
+    window.addEventListener("keydown", focus);
+    return () => window.removeEventListener("keydown", focus);
+  }, []);
+  const params = new URLSearchParams({ archived: archive, limit: "25" });
+  if (scope === "workspace") params.set("node_id", agentId);
+  if (search) params.set("query", search);
+  const path = `${projectPath(project)}/threads?${params}`;
+  const resource = useResource<{
+    threads: Thread[];
+    next_cursor?: string | null;
+  }>(path, 3000);
+  const visible = new Map<string, Thread>();
+  for (const thread of loadedScope === scopeKey ? older : [])
+    visible.set(thread.thread_id, thread);
+  for (const thread of resource.data?.threads ?? [])
+    visible.set(thread.thread_id, thread);
+  const threads = (resource.error ? [] : [...visible.values()])
+    .filter(
+      (thread) =>
+        thread.project_id === project &&
+        (scope === "all" || thread.node_id === agentId) &&
+        thread.archived === (archive === "true"),
+    )
+    .sort(
+      (a, b) =>
+        b.updated_at.localeCompare(a.updated_at) ||
+        a.thread_id.localeCompare(b.thread_id),
+    );
+  const agent = nodes.find((item) => item.node.node_id === agentId),
+    host = hosts.find((item) => item.host_id === agent?.node.host_id),
+    cursor =
+      loadedScope === scopeKey && moreLoaded
+        ? nextCursor
+        : resource.data?.next_cursor;
+  async function loadOlder() {
+    if (!cursor || moreBusy) return;
+    const expected = scopeKey;
+    setMoreBusy(true);
+    setMoreError("");
+    try {
+      const value = await request<{
+        threads: Thread[];
+        next_cursor?: string | null;
+      }>(`${path}&after=${encodeURIComponent(cursor)}`);
+      if (!alive.current || currentScope.current !== expected) return;
+      setOlder((current) => {
+        const map = new Map(current.map((item) => [item.thread_id, item]));
+        for (const item of [
+          ...(resource.data?.threads ?? []),
+          ...value.threads,
+        ])
+          map.set(item.thread_id, item);
+        return [...map.values()];
+      });
+      setLoadedScope(expected);
+      setNextCursor(value.next_cursor ?? null);
+      setMoreLoaded(true);
+    } catch (error) {
+      if (alive.current && currentScope.current === expected)
+        setMoreError(
+          error instanceof Error
+            ? error.message
+            : "Earlier threads could not be loaded.",
+        );
+    } finally {
+      if (alive.current && currentScope.current === expected)
+        setMoreBusy(false);
+    }
+  }
+  const ready = agent?.presence?.ready && !agent.node.revoked,
+    state = agent?.node.revoked
+      ? "Revoked"
+      : ready
+        ? "Ready"
+        : agent?.presence
+          ? "Starting"
+          : "Offline";
+  return (
+    <div className="agent-sidebar">
+      <RouteLink
+        className="ui-button ui-button--tertiary scope-fleet-back"
+        href={globalHref("fleet", project)}
+        onNavigate={onBack}
+        back
+      >
+        <IconArrowLeft size={15} aria-hidden="true" />
+        Back
+      </RouteLink>
+      <WorkspaceSidebarHeading />
+      <WorkspaceSidebarSearch
+        value={query}
+        onChange={setQuery}
+        inputRef={searchRef}
+        maxLength={256}
+        shortcut={
+          navigator.platform.toLowerCase().includes("mac") ? "⌘K" : "Ctrl K"
+        }
+      />
+      <WorkspaceSidebarScope
+        value={scope}
+        onChange={setScope}
+        workspaceDisabled={!agent}
+      />
+      <div className="scope-filter-line">
+        <span>
+          {scope === "all"
+            ? "In this project"
+            : (host?.label ?? "Assigned workspace")}
+        </span>
+        <DropdownSelect
+          aria-label="Conversation archive filter"
+          value={archive}
+          onChange={(event) => setArchive(event.target.value)}
+        >
+          <option value="false">Open</option>
+          <option value="true">Archived</option>
+        </DropdownSelect>
+      </div>
+      <WorkspaceSidebarWorkspace
+        identity={
+          <RouteLink
+            className="shared-workspace-row-identity"
+            href={agentHref(project, agentId)}
+            onNavigate={() => onAgent(agentId)}
+            title={agent?.node.label ?? agentId}
+          >
+            <IconFolder size={17} stroke={1.7} aria-hidden="true" />
+            <strong>
+              {agent?.node.workspace_label ?? agent?.node.label ?? "Workspace"}
+            </strong>
+          </RouteLink>
+        }
+        state={
+          <span className="shared-workspace-readiness">
+            <span className={`dot ${ready ? "live" : ""}`} />
+            {state}
+          </span>
+        }
+        actions={
+          <>
+            <button
+              className="scope-workspace-toggle"
+              type="button"
+              aria-label="Choose workspace agent"
+              aria-expanded={choosing}
+              onClick={() => setChoosing((value) => !value)}
+            >
+              <IconChevronDown size={16} aria-hidden="true" />
+            </button>
+            <button
+              className="scope-new-thread"
+              type="button"
+              aria-label="New conversation"
+              title="New conversation"
+              disabled={newDisabled || !agent || agent.node.revoked}
+              onClick={onNew}
+            >
+              <IconPencilPlus size={17} stroke={1.8} aria-hidden="true" />
+            </button>
+          </>
+        }
+      />
+      {choosing ? (
+        <div className="scope-workspace-choices">
+          <DropdownSelect
+            aria-label="Select workspace agent"
+            value={agentId}
+            onChange={(event) => {
+              setChoosing(false);
+              onAgent(event.target.value);
+            }}
+          >
+            {nodes.map((item) => (
+              <option key={item.node.node_id} value={item.node.node_id}>
+                {item.node.workspace_label
+                  ? `${item.node.workspace_label} · `
+                  : ""}
+                {item.node.label}
+              </option>
+            ))}
+          </DropdownSelect>
+          <p>
+            Showing {nodes.length} loaded agents in this project. Fleet provides
+            the full paged inventory.
+          </p>
+        </div>
+      ) : null}
+      <div className="scope-recent-heading">
+        <WorkspaceSidebarGroupHeading
+          label={search ? "Results" : "Recent"}
+          count={threads.length}
+        />
+        <button
+          className="scope-recent-toggle"
+          type="button"
+          aria-label={
+            expanded ? "Collapse recent threads" : "Expand recent threads"
+          }
+          aria-expanded={expanded}
+          onClick={() => setExpanded((value) => !value)}
+        >
+          <IconChevronDown size={14} aria-hidden="true" />
+        </button>
+      </div>
+      <div className="scope-thread-stack" hidden={!expanded}>
+        <LoadState {...resource} retry={resource.refresh} />
+        <nav
+          className="scope-compact-thread-list"
+          aria-label="Agent conversations"
+        >
+          {threads.map((thread) => {
+            const task = thread.active_task_id
+              ? tasks.find(
+                  (item) =>
+                    item.task_id === thread.active_task_id &&
+                    item.project_id === project &&
+                    item.node_id === thread.node_id,
+                )
+              : tasks
+                  .filter(
+                    (item) =>
+                      item.thread_id === thread.thread_id &&
+                      item.project_id === project &&
+                      item.node_id === thread.node_id,
+                  )
+                  .sort((a, b) =>
+                    (
+                      b.created_at ??
+                      b.snapshot?.run.created_at ??
+                      ""
+                    ).localeCompare(
+                      a.created_at ?? a.snapshot?.run.created_at ?? "",
+                    ),
+                  )[0];
+            const state = task
+              ? taskStatus(task)
+              : thread.active_task_id
+                ? "active"
+                : thread.can_continue
+                  ? ""
+                  : "read_only";
+            const date = new Date(thread.updated_at),
+              updated = Number.isFinite(date.getTime())
+                ? date.toLocaleString([], {
+                    month: "short",
+                    day: "numeric",
+                    hour: "numeric",
+                    minute: "2-digit",
+                  })
+                : "Date unavailable";
+            const workspace = nodes.find(
+              (item) => item.node.node_id === thread.node_id,
+            )?.node;
+            const metadata = [
+              scope === "all"
+                ? (workspace?.workspace_label ??
+                  workspace?.label ??
+                  thread.node_id)
+                : null,
+              task ? statusLabel(task.request.mode) : null,
+              updated,
+              thread.archived ? "Archived" : null,
+              !thread.can_continue ? "View only" : null,
+              thread.sync_status === "incomplete" ? "Incomplete" : null,
+            ]
+              .filter(Boolean)
+              .join(" · ");
+            const status =
+              state === "completed" ? (
+                <IconCheck size={13} stroke={2.2} aria-hidden="true" />
+              ) : state === "read_only" ? (
+                <IconLock size={13} aria-hidden="true" />
+              ) : ["failed", "outcome_unknown"].includes(state) ? (
+                <IconAlertTriangle size={13} aria-hidden="true" />
+              ) : state ? (
+                <span className="dot" />
+              ) : null;
+            return (
+              <RouteLink
+                className="shared-workspace-thread-link"
+                key={thread.thread_id}
+                href={threadHref(project, thread.thread_id)}
+                onNavigate={() => onOpen(thread)}
+                aria-current={
+                  selected === thread.thread_id ? "page" : undefined
+                }
+              >
+                <WorkspaceSidebarThreadContent
+                  title={thread.title || "Untitled conversation"}
+                  metadata={metadata}
+                  status={
+                    status ? (
+                      <span
+                        className={`scope-thread-status ${state === "completed" ? "is-success" : ["failed", "outcome_unknown"].includes(state) ? "is-danger" : ""}`}
+                        title={statusLabel(state)}
+                      >
+                        <span className="sr-only">{statusLabel(state)}</span>
+                        {status}
+                      </span>
+                    ) : null
+                  }
+                />
+              </RouteLink>
+            );
+          })}
+        </nav>
+        {!resource.loading && !resource.error && !threads.length ? (
+          <p className="empty-copy">
+            {search
+              ? "No matching threads."
+              : "No shared conversations in this scope."}
+          </p>
+        ) : null}
+        {cursor ? (
+          <Button
+            variant="tertiary"
+            className="scope-load-older"
+            disabled={resource.loading || moreBusy}
+            onClick={() => void loadOlder()}
+          >
+            {moreBusy ? "Loading history…" : "Load older threads"}
+          </Button>
+        ) : null}
+        {moreError ? (
+          <p className="sidebar-error" role="alert">
+            {moreError}
+          </p>
+        ) : null}
+        {threads.length ? (
+          <p className="scope-history-note">
+            {threads.length} loaded{" "}
+            {threads.length === 1 ? "thread" : "threads"}
+            {cursor ? " · more history available" : ""}
+          </p>
+        ) : null}
+      </div>
+    </div>
+  );
+}
+export function AgentWorkspace({
+  project,
+  agent,
+  nodes,
+  permissions,
+  creating,
+  busy,
+  onCreate,
+  onNew,
+  initialTab = "overview",
+  view,
+  onView,
+  onOpen,
+}: {
+  project: string;
+  agent: FleetNode | undefined;
+  nodes: FleetNode[];
+  permissions: Permission[];
+  creating: boolean;
+  busy: boolean;
+  onCreate: (request: RunRequest) => Promise<boolean>;
+  onNew: () => void;
+  initialTab?: string;
+  view?: AgentView;
+  onView?: (value: AgentView) => void;
+  onOpen?: (thread: Thread) => void;
+}) {
+  const [localTab, setTab] = useState(initialTab);
+  const [draftSeed, setDraftSeed] = useState<
+    { key: string; text: string } | undefined
+  >();
+  const tab = view ?? localTab;
+  const changeTab = (value: string) =>
+    onView ? onView(value as AgentView) : setTab(value);
+  if (creating)
+    return (
+      <section className="agent-new-work" aria-labelledby="new-thread-heading">
+        <header className="page-heading">
+          <div>
+            <span className="eyebrow">
+              Fleet /{" "}
+              {agent?.node.workspace_label ?? agent?.node.label ?? "Agent"}
+            </span>
+            <h1 id="new-thread-heading">New thread</h1>
+          </div>
+          <span className="shared-workspace-readiness">
+            <span className={`dot ${agent?.presence?.ready ? "live" : ""}`} />
+            {agent?.node.revoked
+              ? "Enrollment revoked"
+              : agent?.presence?.ready
+                ? "Agent ready"
+                : agent?.presence
+                  ? "Agent starting"
+                  : "Agent offline"}
+          </span>
+        </header>
+        <div className="agent-new-work-welcome">
+          <WorkWelcome
+            eyebrow="Connected agent workspace"
+            description="Send work to this agent, switch to plan mode, or continue a conversation. Its runtime retains tools, approvals, and canonical context."
+            disabled={
+              busy ||
+              !permissions.includes("execute") ||
+              !agent ||
+              agent.node.revoked
+            }
+            onSuggestion={(text) =>
+              setDraftSeed({ key: crypto.randomUUID(), text })
+            }
+          />
+        </div>
+        <div className="agent-new-work-composer">
+          <RunComposer
+            draftSeed={draftSeed}
+            onPolicy={() => changeTab("policy")}
+            nodes={nodes}
+            nodeId={agent?.node.node_id ?? ""}
+            lockedRuntime
+            busy={busy}
+            disabled={
+              !permissions.includes("execute") || !agent || agent.node.revoked
+            }
+            label="Start a conversation"
+            action="Start conversation"
+            onSubmit={onCreate}
+          />
+        </div>
+      </section>
+    );
+  return (
+    <section className="control-page agent-workspace">
+      <header className="page-heading">
+        <div>
+          <span className="eyebrow">Fleet / agent</span>
+          <h1>{agent?.node.label ?? "Agent"}</h1>
+          <p>
+            {agent?.node.workspace_label ??
+              "Open a conversation from the sidebar or start new work."}
+          </p>
+        </div>
+        <Button
+          variant="primary"
+          disabled={
+            !permissions.includes("execute") || !agent || agent.node.revoked
+          }
+          onClick={onNew}
+        >
+          <IconPlus size={16} aria-hidden="true" />
+          New conversation
+        </Button>
+      </header>
+      <SectionTabs
+        current={tab}
+        onChange={changeTab}
+        hrefFor={
+          agent
+            ? (value) =>
+                agentHref(project, agent.node.node_id, value as AgentView)
+            : undefined
+        }
+        items={[
+          { id: "overview", label: "Overview" },
+          { id: "threads", label: "Conversations" },
+          { id: "analytics", label: "Analytics" },
+          { id: "policy", label: "Policy & configuration" },
+        ]}
+      />
+      {agent ? (
+        tab === "threads" ? (
+          <AgentConversations
+            project={project}
+            node={agent.node.node_id}
+            onOpen={onOpen}
+          />
+        ) : tab === "overview" || tab === "analytics" ? (
+          <AnalyticsPanel
+            path={`${projectPath(project)}/nodes/${encodeURIComponent(agent.node.node_id)}/analytics`}
+          />
+        ) : (
+          <AgentPolicyPanel
+            path={`${projectPath(project)}/nodes/${encodeURIComponent(agent.node.node_id)}/policy`}
+          />
+        )
+      ) : (
+        <p className="empty-copy">Agent inventory is loading.</p>
+      )}
+    </section>
+  );
+}
+function AgentConversations({
+  project,
+  node,
+  onOpen,
+}: {
+  project: string;
+  node: string;
+  onOpen: ((thread: Thread) => void) | undefined;
+}) {
+  const [cursors, setCursors] = useState([""]);
+  const params = new URLSearchParams({
+    node_id: node,
+    archived: "false",
+    limit: "25",
+  });
+  if (cursors.at(-1)) params.set("after", cursors.at(-1)!);
+  const resource = useResource<{
+    threads: Thread[];
+    next_cursor?: string | null;
+  }>(`${projectPath(project)}/threads?${params}`, 3000);
+  return (
+    <section className="control-card">
+      <header>
+        <h3>Agent conversations</h3>
+      </header>
+      <LoadState {...resource} retry={resource.refresh} />
+      {resource.data?.threads.length ? (
+        <ul className="recent-list">
+          {resource.data.threads.map((thread) => (
+            <li key={thread.thread_id}>
+              <RouteLink
+                href={threadHref(project, thread.thread_id)}
+                onNavigate={() => onOpen?.(thread)}
+              >
+                <span>
+                  <strong>{thread.title || "Untitled conversation"}</strong>
+                  <small>
+                    {thread.can_continue ? "Conversation" : "Read-only history"}
+                    {thread.sync_status === "incomplete" ? " · Incomplete" : ""}
+                  </small>
+                </span>
+                <time dateTime={thread.updated_at}>
+                  {new Date(thread.updated_at).toLocaleDateString()}
+                </time>
+              </RouteLink>
+            </li>
+          ))}
+        </ul>
+      ) : !resource.loading && !resource.error ? (
+        <p className="empty-copy">No shared conversations in this workspace.</p>
+      ) : null}
+      <div className="scope-pagination">
+        <Button
+          variant="tertiary"
+          disabled={resource.loading || cursors.length === 1}
+          onClick={() => setCursors((value) => value.slice(0, -1))}
+        >
+          Previous
+        </Button>
+        <span>{cursors.length}</span>
+        <Button
+          variant="tertiary"
+          disabled={resource.loading || !resource.data?.next_cursor}
+          onClick={() => {
+            if (resource.data?.next_cursor)
+              setCursors((value) => [...value, resource.data!.next_cursor!]);
+          }}
+        >
+          Next
+        </Button>
+      </div>
+    </section>
+  );
+}
+export function AgentPolicyPanel({ path }: { path: string }) {
+  const resource = useResource<AgentPolicy>(path, 15000),
+    data = resource.data;
+  return (
+    <>
+      <LoadState {...resource} retry={resource.refresh} />
+      {data ? (
+        <>
+          <section className="control-card">
+            <header>
+              <h3>
+                <IconShield size={17} aria-hidden="true" />
+                Runtime policy posture
+              </h3>
+              <span
+                className={`status ${data.evaluation.status === "aligned" ? "status-completed" : data.evaluation.status === "drift" ? "status-waiting" : "status-cancelled"}`}
+              >
+                {data.evaluation.status === "aligned"
+                  ? "Aligned with baseline"
+                  : data.evaluation.status === "drift"
+                    ? "Configuration drift"
+                    : "Evaluation unavailable"}
+              </span>
+            </header>
+            <p className="field-help">{data.description}</p>
+            <dl className="stat-list">
+              <div>
+                <dt>Source</dt>
+                <dd>Authenticated runtime report</dd>
+              </div>
+              <div>
+                <dt>Observed</dt>
+                <dd>
+                  {data.observed_at
+                    ? new Date(data.observed_at * 1000).toLocaleString()
+                    : "Not reported"}
+                  {data.stale ? " · Stale" : ""}
+                </dd>
+              </div>
+              <div>
+                <dt>Connection</dt>
+                <dd>{data.connected ? "Connected" : "Offline"}</dd>
+              </div>
+            </dl>
+            {data.evaluation.findings.length ? (
+              <ul className="policy-findings">
+                {data.evaluation.findings.map((finding) => (
+                  <li key={finding.code}>{finding.description}</li>
+                ))}
+              </ul>
+            ) : null}
+            {data.stale ? (
+              <p className="sync-notice">
+                The latest report is stale. Drift evaluation resumes when the
+                agent reports current posture.
+              </p>
+            ) : null}
+          </section>
+          {data.posture ? (
+            <section className="control-card">
+              <header>
+                <h3>Reported configuration</h3>
+              </header>
+              <dl className="configuration-list">
+                {[
+                  ["Access profile", data.posture.access_profile],
+                  [
+                    "Sandbox",
+                    `${data.posture.sandbox_backend} · ${data.posture.sandbox_profile}`,
+                  ],
+                  [
+                    "Approval mode",
+                    data.posture.approval_mode.replaceAll("_", " "),
+                  ],
+                  [
+                    "Model routing",
+                    data.posture.models
+                      .map((model) => `${model.profile}: ${model.label}`)
+                      .join(" · ") || "Not reported",
+                  ],
+                  [
+                    "Configuration revision",
+                    data.posture.configuration_revision ?? "Not reported",
+                  ],
+                  ["Configuration fingerprint", data.posture.fingerprint],
+                ].map(([label, value]) => (
+                  <div key={label}>
+                    <dt>{label}</dt>
+                    <dd>{value}</dd>
+                  </div>
+                ))}
+              </dl>
+              {[
+                ["Roles", data.posture.allowed_roles],
+                ["Allowed tools", data.posture.allowed_tools],
+                ["Capabilities", data.posture.capabilities],
+              ].map(([label, values]) => (
+                <div className="configuration-group" key={label as string}>
+                  <h4>{label as string}</h4>
+                  <div className="configuration-tags">
+                    {(values as string[]).length ? (
+                      (values as string[]).map((value) => (
+                        <span key={value}>{value}</span>
+                      ))
+                    ) : (
+                      <span>None</span>
+                    )}
+                  </div>
+                </div>
+              ))}
+              {data.posture.findings.length ? (
+                <div className="configuration-group">
+                  <h4>Reported configuration findings</h4>
+                  <ul className="policy-findings">
+                    {data.posture.findings.map((finding) => (
+                      <li key={finding.code}>{findingLabel(finding.code)}</li>
+                    ))}
+                  </ul>
+                </div>
+              ) : null}
+              <div className="configuration-group">
+                <h4>Canonical policy counters</h4>
+                <Metrics
+                  items={[
+                    {
+                      label: "Denied requests",
+                      value:
+                        data.posture.telemetry.denied_requests ?? "Unavailable",
+                    },
+                    {
+                      label: "Approval requests",
+                      value:
+                        data.posture.telemetry.approval_requests ??
+                        "Unavailable",
+                    },
+                    {
+                      label: "Unknown outcomes",
+                      value:
+                        data.posture.telemetry.outcome_unknown_runs ??
+                        "Unavailable",
+                    },
+                  ]}
+                />
+                <p className="field-help">
+                  These counters require a canonical runtime report. Run
+                  failures and reported configuration findings are not
+                  enforcement violation counts.
+                </p>
+              </div>
+            </section>
+          ) : (
+            <p className="empty-copy">
+              This runtime has not released its policy configuration.
+            </p>
+          )}
+        </>
+      ) : null}
+    </>
+  );
+}
+
+function findingLabel(code: string) {
+  return (
+    (
+      {
+        "storage.ephemeral": "Runtime journal storage is ephemeral.",
+        "storage.plaintext": "Runtime journal storage is plaintext.",
+        "sandbox.danger_full_access":
+          "Runtime is configured for acknowledged full host access.",
+        "observability.sensitive_journal_payloads":
+          "Runtime retains sensitive journal payloads.",
+        "credentials.mcp_oauth_plaintext":
+          "Runtime stores MCP OAuth credentials as plaintext.",
+      } as Record<string, string>
+    )[code] ?? code
+  );
+}
diff --git a/apps/web/src/App.routes.test.tsx b/apps/web/src/App.routes.test.tsx
new file mode 100644
index 000000000..be466db89
--- /dev/null
+++ b/apps/web/src/App.routes.test.tsx
@@ -0,0 +1,309 @@
+// @vitest-environment happy-dom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import { App } from "./App";
+import { navigate } from "./navigation";
+import type { Me } from "./control-api";
+import type { FleetNode, ThreadDetailResponse } from "./api";
+
+const now = "2026-10-06T10:00:00Z";
+const me: Me = {
+  user: {
+    id: "viewer-a",
+    display_name: "Viewer",
+    email: null,
+    active: true,
+    is_admin: false,
+    revision: 1,
+    created_at: now,
+    updated_at: now,
+  },
+  memberships: [
+    {
+      project_id: "p",
+      user_id: "viewer-a",
+      subject: "viewer-a",
+      role: "viewer",
+      permissions: ["read"],
+    },
+  ],
+  projects: [
+    {
+      id: "p",
+      name: "Project P",
+      description: "",
+      parent_project_id: null,
+      archived: false,
+      revision: 1,
+      created_at: now,
+      updated_at: now,
+    },
+  ],
+};
+const node: FleetNode = {
+  node: {
+    node_id: "n",
+    project_id: "p",
+    label: "Authorized agent",
+    instance_id: "instance",
+    certificate_sha256: "fingerprint",
+    roles: ["primary"],
+    revoked: false,
+    revision: 1,
+  },
+  presence: null,
+};
+const detail: ThreadDetailResponse = {
+  thread: {
+    thread_id: "t",
+    project_id: "p",
+    node_id: "n",
+    session_id: "s",
+    title: "Exact saved conversation",
+    created_at: now,
+    updated_at: now,
+    revision: 1,
+    archived: false,
+    source: "runtime",
+    sync_status: "current",
+    can_continue: false,
+  },
+  tasks: [],
+  messages: [
+    {
+      message_id: "message",
+      role: "assistant",
+      text: "Retained exact-resource reply",
+      created_at: now,
+    },
+  ],
+};
+class EventSourceFixture extends EventTarget {
+  onopen = null;
+  onerror = null;
+  close() {}
+}
+let root: Root, container: HTMLDivElement, paths: string[], account: Me;
+let showInventoryNode = false,
+  denyInventory = false,
+  deferInventory = false;
+const pendingInventory: { resolve: ((value: Response) => void) | null } = {
+  resolve: null,
+};
+const response = (value: unknown, status = 200) =>
+  new Response(JSON.stringify(value), { status });
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  history.replaceState(null, "", "/projects/p/threads/t");
+  sessionStorage.clear();
+  vi.stubGlobal("EventSource", EventSourceFixture);
+  Object.defineProperty(document, "fonts", {
+    configurable: true,
+    value: new EventTarget(),
+  });
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+  paths = [];
+  account = me;
+  showInventoryNode = false;
+  denyInventory = false;
+  deferInventory = false;
+  pendingInventory.resolve = null;
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async (path: string) => {
+      paths.push(path);
+      if (path === "/api/me") return response(account);
+      if (path === "/api/auth/config")
+        return response({ local_enabled: false, oidc: null });
+      if (path === "/api/settings")
+        return response({
+          classification: {
+            enabled: false,
+            text: "",
+            tone: "neutral",
+            position: "top",
+          },
+        });
+      if (path === "/api/projects/p/threads/t") return response(detail);
+      if (path === "/api/projects/p/nodes/n") return response(node);
+      if (path.startsWith("/api/projects/p/nodes?")) {
+        if (deferInventory) {
+          deferInventory = false;
+          return new Promise<Response>((resolve) => {
+            pendingInventory.resolve = resolve;
+          });
+        }
+        if (denyInventory) return response({ error: "permission_denied" }, 403);
+        return response({
+          nodes: showInventoryNode ? [node] : [],
+          next_cursor: null,
+        });
+      }
+      if (path.startsWith("/api/projects/p/tasks?"))
+        return response({ tasks: [], next_cursor: null });
+      if (path.startsWith("/api/projects/p/hosts?"))
+        return response({ hosts: [], next_cursor: null });
+      if (path.startsWith("/api/projects/p/threads?"))
+        return response({ threads: [], next_cursor: null });
+      const archivedInventory =
+        /^\/api\/projects\/archived\/(nodes|tasks|hosts)\?/.exec(path);
+      if (archivedInventory)
+        return response({ [archivedInventory[1]!]: [], next_cursor: null });
+      if (path.endsWith("/analytics"))
+        return response({
+          generated_at: now,
+          window_days: 7,
+          counts: {
+            threads: 0,
+            runs: 0,
+            completed: 0,
+            failed: 0,
+            cancelled: 0,
+            active: 0,
+            queued: 0,
+            agents: 0,
+            online_agents: 0,
+            hosts: 0,
+          },
+          activity: [],
+          usage: {
+            input_tokens: null,
+            output_tokens: null,
+            estimated_cost: null,
+            coverage: "Unavailable",
+          },
+        });
+      return response({ error: "permission_denied" }, 403);
+    }),
+  );
+});
+afterEach(async () => {
+  await act(() => root.unmount());
+  container.remove();
+  history.replaceState(null, "", "/");
+  vi.unstubAllGlobals();
+});
+async function ready() {
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 15));
+  });
+}
+async function contains(text: string) {
+  await vi.waitFor(
+    async () => {
+      await ready();
+      expect(container.textContent).toContain(text);
+    },
+    { timeout: 2000 },
+  );
+}
+it("reopens an exact saved deep link and uses an authorized parent on direct-link Back", async () => {
+  await act(() => root.render(<App />));
+  await contains("Exact saved conversation");
+  expect(
+    container
+      .querySelector('a[aria-label="Documentation (opens in a new tab)"]')
+      ?.getAttribute("href"),
+  ).toBe("/docs/");
+  expect(container.textContent).toContain("Retained exact-resource reply");
+  expect(paths).toContain("/api/projects/p/threads/t");
+  expect(paths).toContain("/api/projects/p/nodes/n");
+  const back = container.querySelector<HTMLAnchorElement>(
+    'a.back[href="/projects/p/agents/n/overview"]',
+  );
+  expect(back).not.toBeNull();
+  await act(() => back!.click());
+  await ready();
+  expect(location.pathname).toBe("/projects/p/agents/n/overview");
+  expect(container.textContent).toContain("Authorized agent");
+});
+it("does not fall back to a prior conversation or project after denied navigation", async () => {
+  await act(() => root.render(<App />));
+  await contains("Retained exact-resource reply");
+  await act(() => navigate("/projects/p/threads/denied"));
+  await ready();
+  expect(container.textContent).toContain("Page unavailable");
+  expect(container.textContent).not.toContain("Retained exact-resource reply");
+  await act(() => navigate("/projects/unauthorized/threads/t"));
+  await ready();
+  expect(container.textContent).toContain("does not have access");
+  expect(container.textContent).not.toContain("Exact saved conversation");
+  expect(
+    paths.some((path) => path.startsWith("/api/projects/unauthorized/")),
+  ).toBe(false);
+});
+it("hides denied inventory immediately and rejects an older in-flight permitted response", async () => {
+  history.replaceState(null, "", "/fleet?project=p");
+  showInventoryNode = true;
+  await act(() => root.render(<App />));
+  await contains("Authorized agent");
+  const refresh = container.querySelector<HTMLButtonElement>(
+    'button[aria-label="Refresh project"]',
+  )!;
+  deferInventory = true;
+  await act(() => refresh.click());
+  await ready();
+  expect(pendingInventory.resolve).not.toBeNull();
+  denyInventory = true;
+  await act(() => refresh.click());
+  await contains("Page unavailable");
+  expect(container.textContent).not.toContain("Authorized agent");
+  await act(async () =>
+    pendingInventory.resolve!(response({ nodes: [node], next_cursor: null })),
+  );
+  expect(container.textContent).toContain("Page unavailable");
+  expect(container.textContent).not.toContain("Authorized agent");
+});
+
+it("defaults to an active project while preserving explicitly selected archived scope", async () => {
+  history.replaceState(null, "", "/");
+  account = {
+    ...me,
+    projects: [
+      {
+        ...me.projects[0]!,
+        id: "archived",
+        name: "Archived project",
+        archived: true,
+      },
+      ...me.projects,
+    ],
+    memberships: [
+      ...me.memberships,
+      { ...me.memberships[0]!, project_id: "archived" },
+    ],
+  };
+  await act(() => root.render(<App />));
+  await contains("Project P");
+  const selector = () =>
+    container.querySelector<HTMLButtonElement>(
+      'button[aria-label="Select project"]',
+    )!;
+  expect(selector().textContent).toContain("Project P");
+  expect(paths.some((path) => path.startsWith("/api/projects/p/nodes?"))).toBe(
+    true,
+  );
+  expect(paths.some((path) => path.startsWith("/api/projects/archived/"))).toBe(
+    false,
+  );
+
+  await act(() => selector().click());
+  const archivedOption = [
+    ...document.querySelectorAll<HTMLButtonElement>('[role="option"]'),
+  ].find((option) => option.textContent?.includes("Archived project"));
+  expect(archivedOption).toBeDefined();
+  await act(() => archivedOption!.click());
+  await ready();
+  expect(location.search).toBe("?project=archived");
+  expect(selector().textContent).toContain("Archived project");
+
+  await act(() => navigate("/fleet?project=archived"));
+  await ready();
+  expect(selector().textContent).toContain("Archived project");
+  await act(() => navigate("/"));
+  await ready();
+  expect(selector().textContent).toContain("Archived project");
+});
diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
new file mode 100644
index 000000000..0853df132
--- /dev/null
+++ b/apps/web/src/App.tsx
@@ -0,0 +1,884 @@
+import {
+  lazy,
+  Suspense,
+  useCallback,
+  useEffect,
+  useRef,
+  useState,
+} from "react";
+import { ControlPlaneFrame, Button, DropdownSelect } from "@colossus/ui";
+import colossusMark from "@colossus/ui/assets/colossus-mark.svg";
+import {
+  IconHome,
+  IconServer,
+  IconFolder,
+  IconUsers,
+  IconSettings,
+  IconLogout,
+  IconRefresh,
+  IconLoader2,
+  IconPlus,
+  IconX,
+} from "@tabler/icons-react";
+import {
+  AppearanceSettings,
+  SendShortcutContext,
+  useAppearance,
+} from "./Appearance";
+import {
+  ApiFailure,
+  request,
+  projectPath,
+  taskStatus,
+  terminalStatuses,
+  type FleetNode,
+  type Host,
+  type Task,
+  type Thread,
+  type ThreadDetailResponse,
+} from "./api";
+import {
+  projectPermissions,
+  type Me,
+  type AuthConfig,
+  type PublicSettings,
+} from "./control-api";
+import { Fleet } from "./Fleet";
+import { TaskDetail } from "./TaskDetail";
+import { TaskTable } from "./TaskTable";
+import { RunComposer, type RunRequest } from "./RunComposer";
+import { Home, LoadState } from "./Home";
+import { Projects } from "./Projects";
+import { AgentSidebar, AgentWorkspace } from "./AgentScope";
+import { SignIn } from "./SignIn";
+import { DocumentationLink } from "./DocumentationLink";
+import { useResource } from "./resources";
+const ThreadDetail = lazy(() =>
+  import("./ThreadDetail").then((module) => ({ default: module.ThreadDetail })),
+);
+const Administration = lazy(() =>
+  import("./Administration").then((module) => ({
+    default: module.Administration,
+  })),
+);
+import {
+  NavigationProvider,
+  useNavigation,
+  restoreSignInReturn,
+  RouteLink,
+} from "./navigation";
+import {
+  agentHref,
+  globalHref,
+  projectHref,
+  routeSurface,
+  taskHref,
+  threadHref,
+  type Surface,
+} from "./routes";
+export function App() {
+  const [me, setMe] = useState<Me | null>(null),
+    [auth, setAuth] = useState<"loading" | "signed_out" | "ready">("loading"),
+    [authConfig, setAuthConfig] = useState<AuthConfig | null>(null),
+    [settings, setSettings] = useState<PublicSettings | null>(null),
+    [error, setError] = useState("");
+  const epoch = useRef(0);
+  const loadMe = useCallback(async (signal?: AbortSignal) => {
+    const generation = ++epoch.current;
+    try {
+      const response = await request<Me>("/api/me", undefined, signal);
+      if (signal?.aborted || generation !== epoch.current) return;
+      setMe(response);
+      setAuth("ready");
+      setError("");
+      restoreSignInReturn();
+    } catch (e) {
+      if (!signal?.aborted && generation === epoch.current) {
+        setMe(null);
+        setAuth("signed_out");
+        if (!(e instanceof ApiFailure && e.status === 403))
+          setError(e instanceof Error ? e.message : "Sign-in unavailable.");
+      }
+    }
+  }, []);
+  useEffect(() => {
+    const abort = new AbortController();
+    let pending = false;
+    const reconcile = () => {
+      if (pending) return;
+      pending = true;
+      void loadMe(abort.signal).finally(() => {
+        pending = false;
+      });
+    };
+    window.addEventListener("colossus:web:reconcile-identity", reconcile);
+    return () => {
+      abort.abort();
+      window.removeEventListener("colossus:web:reconcile-identity", reconcile);
+    };
+  }, [loadMe]);
+  useEffect(() => {
+    const abort = new AbortController();
+    void loadMe(abort.signal);
+    void request<AuthConfig>("/api/auth/config", undefined, abort.signal)
+      .then((value) => {
+        if (!abort.signal.aborted) setAuthConfig(value);
+      })
+      .catch(() => {
+        if (!abort.signal.aborted)
+          setError(
+            "Sign-in configuration could not be loaded. Refresh to retry.",
+          );
+      });
+    void request<PublicSettings>("/api/settings", undefined, abort.signal)
+      .then((value) => {
+        if (!abort.signal.aborted) setSettings(value);
+      })
+      .catch(() => {});
+    return () => abort.abort();
+  }, [loadMe]);
+  async function signOut() {
+    try {
+      await request("/auth/logout", {});
+      epoch.current++;
+      setMe(null);
+      setAuth("signed_out");
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "Sign-out failed.");
+    }
+  }
+  if (auth === "loading")
+    return (
+      <main className="startup" aria-busy="true">
+        <img src={colossusMark} alt="Colossus" />
+        <IconLoader2 size={20} className="spin" aria-hidden="true" />
+        <p>Connecting to your Control Plane…</p>
+      </main>
+    );
+  if (auth === "signed_out")
+    return (
+      <SignIn
+        config={authConfig}
+        classification={settings?.classification}
+        error={error}
+        onSignedIn={() => void loadMe()}
+      />
+    );
+  if (!me) return null;
+  return (
+    <NavigationProvider>
+      <AuthenticatedApp
+        key={me.user.id}
+        me={me}
+        authConfig={authConfig}
+        settings={settings}
+        onSettings={setSettings}
+        loadMe={() => void loadMe()}
+        onSignOut={() => void signOut()}
+      />
+    </NavigationProvider>
+  );
+}
+
+function AuthenticatedApp({
+  me,
+  authConfig,
+  settings,
+  onSettings,
+  loadMe,
+  onSignOut,
+}: {
+  me: Me;
+  authConfig: AuthConfig | null;
+  settings: PublicSettings | null;
+  onSettings: (value: PublicSettings) => void;
+  loadMe: () => void;
+  onSignOut: () => void;
+}) {
+  const navigation = useNavigation(),
+    { route } = navigation;
+  const defaultProject =
+    me.projects.find((item) => !item.archived)?.id ?? me.projects[0]?.id ?? "";
+  const [preferredProject, setPreferredProject] = useState(defaultProject);
+  const requestedProject = route.kind !== "invalid" ? route.project : undefined;
+  const project =
+    requestedProject ??
+    (me.projects.some((item) => item.id === preferredProject)
+      ? preferredProject
+      : defaultProject);
+  const authorizedProject =
+    route.kind !== "invalid" && me.projects.some((item) => item.id === project);
+  useEffect(() => {
+    if (authorizedProject) setPreferredProject(project);
+  }, [authorizedProject, project]);
+  const surface = routeSurface(route);
+  const { appearance, setAppearance } = useAppearance();
+  const [nodeCache, setNodes] = useState<FleetNode[]>([]),
+    [hostCache, setHosts] = useState<Host[]>([]),
+    [taskCache, setTasks] = useState<Task[]>([]),
+    [loadedProject, setLoadedProject] = useState(""),
+    [nodePages, setNodePages] = useState(1),
+    [hostPages, setHostPages] = useState(1),
+    [taskPages, setTaskPages] = useState(1),
+    [loading, setLoading] = useState(true),
+    [error, setError] = useState(""),
+    [deniedProject, setDeniedProject] = useState(""),
+    [node, setNode] = useState(""),
+    [busy, setBusy] = useState(false),
+    [taskComposer, setTaskComposer] = useState(false);
+  const currentProject = useRef(project),
+    alive = useRef(true),
+    inventoryEpoch = useRef(0);
+  currentProject.current = project;
+  useEffect(() => {
+    alive.current = true;
+    return () => {
+      alive.current = false;
+    };
+  }, []);
+  const nodes = loadedProject === project ? nodeCache : [],
+    hosts = loadedProject === project ? hostCache : [],
+    tasks = loadedProject === project ? taskCache : [];
+  const permissions = authorizedProject ? projectPermissions(me, project) : [];
+  const threadResource = useResource<ThreadDetailResponse>(
+    route.kind === "thread" && authorizedProject
+      ? `${projectPath(project)}/threads/${encodeURIComponent(route.thread)}`
+      : null,
+    0,
+    me.user.id,
+  );
+  const taskResource = useResource<{ task: Task }>(
+    route.kind === "task" && authorizedProject
+      ? `${projectPath(project)}/tasks/${encodeURIComponent(route.task)}`
+      : null,
+    0,
+    me.user.id,
+  );
+  const selectedThread =
+    route.kind === "thread" &&
+    !threadResource.error &&
+    threadResource.data?.thread.project_id === project &&
+    threadResource.data.thread.thread_id === route.thread
+      ? threadResource.data.thread
+      : null;
+  const selectedTask =
+    route.kind === "task" &&
+    !taskResource.error &&
+    taskResource.data?.task.project_id === project &&
+    taskResource.data.task.task_id === route.task
+      ? taskResource.data.task
+      : null;
+  const agentId =
+    route.kind === "agent" ? route.node : (selectedThread?.node_id ?? "");
+  const selectedAgent = useResource<FleetNode>(
+    authorizedProject &&
+      agentId &&
+      !nodes.some((item) => item.node.node_id === agentId)
+      ? `${projectPath(project)}/nodes/${encodeURIComponent(agentId)}`
+      : null,
+    3000,
+    me.user.id,
+  );
+  const resolvedAgent =
+    !selectedAgent.error &&
+    selectedAgent.data?.node.project_id === project &&
+    selectedAgent.data.node.node_id === agentId
+      ? selectedAgent.data
+      : null;
+  const scopedNodes =
+    resolvedAgent &&
+    !nodes.some((item) => item.node.node_id === resolvedAgent.node.node_id)
+      ? [...nodes, resolvedAgent]
+      : nodes;
+  const agent = scopedNodes.find((item) => item.node.node_id === agentId);
+  const refresh = useCallback(
+    async (signal?: AbortSignal) => {
+      if (!project || !authorizedProject) return;
+      const generation = ++inventoryEpoch.current;
+      async function pages<T>(
+        kind: "tasks" | "nodes" | "hosts",
+        count: number,
+        id: (item: T) => string,
+      ) {
+        const items: T[] = [];
+        let after = "";
+        for (let page = 0; page < count; page++) {
+          const response = await request<
+              Record<string, T[]> & { next_cursor?: string | null }
+            >(
+              `${projectPath(project)}/${kind}?limit=100${after ? `&after=${encodeURIComponent(after)}` : ""}`,
+              undefined,
+              signal,
+            ),
+            batch = response[kind] ?? [];
+          items.push(...batch);
+          if (batch.length < 100) break;
+          after = response.next_cursor ?? id(batch.at(-1)!);
+        }
+        return items;
+      }
+      try {
+        const [fleet, work, inventory] = await Promise.all([
+          pages<FleetNode>("nodes", nodePages, (item) => item.node.node_id),
+          pages<Task>("tasks", taskPages, (item) => item.task_id),
+          pages<Host>("hosts", hostPages, (item) => item.host_id),
+        ]);
+        if (
+          signal?.aborted ||
+          !alive.current ||
+          currentProject.current !== project ||
+          generation !== inventoryEpoch.current
+        )
+          return;
+        setNodes(fleet);
+        setTasks(work);
+        setHosts(inventory);
+        setLoadedProject(project);
+        setLoading(false);
+        setError("");
+        setDeniedProject("");
+      } catch (e) {
+        if (
+          !signal?.aborted &&
+          alive.current &&
+          currentProject.current === project &&
+          generation === inventoryEpoch.current
+        ) {
+          setLoading(false);
+          if (e instanceof ApiFailure && (e.status === 401 || e.status === 403))
+            setDeniedProject(project);
+          setError(
+            e instanceof Error ? e.message : "Control Plane unavailable.",
+          );
+        }
+      }
+    },
+    [project, authorizedProject, nodePages, taskPages, hostPages],
+  );
+  useEffect(() => {
+    const abort = new AbortController();
+    let pending = false;
+    const poll = async () => {
+      if (pending) return;
+      pending = true;
+      try {
+        await refresh(abort.signal);
+      } finally {
+        pending = false;
+      }
+    };
+    void poll();
+    const timer = setInterval(() => {
+      if (!document.hidden) void poll();
+    }, 3000);
+    return () => {
+      abort.abort();
+      clearInterval(timer);
+    };
+  }, [refresh]);
+  useEffect(() => {
+    setNodes([]);
+    setHosts([]);
+    setTasks([]);
+    setLoadedProject("");
+    setNodePages(1);
+    setHostPages(1);
+    setTaskPages(1);
+    setLoading(true);
+    setNode("");
+    setBusy(false);
+    setTaskComposer(false);
+    setError("");
+    setDeniedProject("");
+  }, [project]);
+  useEffect(() => {
+    if (
+      !node ||
+      !nodes.some((item) => item.node.node_id === node && !item.node.revoked)
+    )
+      setNode(
+        (
+          nodes.find((item) => !item.node.revoked && item.presence?.ready) ??
+          nodes.find((item) => !item.node.revoked)
+        )?.node.node_id ?? "",
+      );
+  }, [nodes, node]);
+  function openThread(thread: Thread) {
+    navigation.go(threadHref(thread.project_id, thread.thread_id));
+  }
+  function openTask(task: Task) {
+    navigation.go(
+      task.thread_id
+        ? threadHref(task.project_id, task.thread_id)
+        : taskHref(task.project_id, task.task_id),
+    );
+  }
+  function openAgent(id: string, view: "overview" | "policy" = "overview") {
+    navigation.go(agentHref(project, id, view));
+  }
+  function selectProject(id: string) {
+    setPreferredProject(id);
+    navigation.go(
+      route.kind === "project"
+        ? projectHref(id, route.view)
+        : surface === "projects"
+          ? projectHref(id)
+          : route.kind === "global"
+            ? globalHref(surface, id, route.view)
+            : globalHref("fleet", id),
+    );
+  }
+  async function createTask(runRequest: RunRequest) {
+    setBusy(true);
+    setError("");
+    const originalProject = project;
+    try {
+      const response = await request<{ task: Task }>(
+        `${projectPath(project)}/tasks`,
+        { node_id: node, request: runRequest },
+      );
+      if (!alive.current || currentProject.current !== originalProject)
+        return false;
+      openTask(response.task);
+      void refresh();
+      return true;
+    } catch (e) {
+      if (alive.current && currentProject.current === originalProject)
+        setError(
+          e instanceof Error
+            ? e.message
+            : "Task submission failed. Retry to reconcile the same task.",
+        );
+      return false;
+    } finally {
+      if (alive.current && currentProject.current === originalProject)
+        setBusy(false);
+    }
+  }
+  async function createThread(runRequest: RunRequest) {
+    setBusy(true);
+    setError("");
+    const originalProject = project;
+    try {
+      const response = await request<{ thread: Thread }>(
+        `${projectPath(project)}/threads`,
+        { node_id: agentId, request: runRequest },
+      );
+      if (!alive.current || currentProject.current !== originalProject)
+        return false;
+      openThread(response.thread);
+      void refresh();
+      return true;
+    } catch (e) {
+      if (alive.current && currentProject.current === originalProject)
+        setError(
+          e instanceof Error
+            ? e.message
+            : "Conversation submission failed. Retry to reconcile the same request.",
+        );
+      return false;
+    } finally {
+      if (alive.current && currentProject.current === originalProject)
+        setBusy(false);
+    }
+  }
+  const active = tasks.filter(
+      (task) => !terminalStatuses.has(taskStatus(task)),
+    ).length,
+    live = nodes.filter(
+      (item) => item.presence?.ready && !item.node.revoked,
+    ).length;
+  const taskView = (
+    <section
+      className="managed-settings-body catalog-settings tasks-settings"
+      aria-labelledby="tasks-heading"
+    >
+      <header className="catalog-heading">
+        <div>
+          <h2 id="tasks-heading">Tasks</h2>
+          <p>
+            Execution requests across this project’s agents. Open a task to view
+            its conversation.
+          </p>
+        </div>
+        <Button
+          variant="primary"
+          onClick={() => setTaskComposer((value) => !value)}
+          disabled={!permissions.includes("execute") || !node}
+        >
+          <IconPlus size={16} aria-hidden="true" />
+          {taskComposer ? "Close composer" : "New task"}
+        </Button>
+      </header>
+      <p className="catalog-summary">
+        {tasks.length} loaded tasks · {active} active
+      </p>
+      {taskComposer ? (
+        <RunComposer
+          onPolicy={() => openAgent(node, "policy")}
+          nodes={scopedNodes}
+          nodeId={node}
+          onNodeChange={setNode}
+          disabled={!permissions.includes("execute")}
+          busy={busy}
+          label="Create an agent task"
+          action="Start task"
+          onSubmit={createTask}
+        />
+      ) : null}
+      <TaskTable
+        key={project}
+        project={project}
+        tasks={tasks}
+        nodes={scopedNodes}
+        loading={loading}
+        hasMore={tasks.length === taskPages * 100}
+        onMore={() => setTaskPages((value) => value + 1)}
+        onOpen={openTask}
+        onFleet={() => navigation.go(globalHref("fleet", project))}
+      />
+    </section>
+  );
+  let unavailable = "";
+  if (route.kind === "invalid") unavailable = route.message;
+  else if (requestedProject && !authorizedProject)
+    unavailable =
+      "This project is unavailable or your signed-in identity does not have access. Choose an authorized project to continue.";
+  else if (
+    deniedProject === project &&
+    surface !== "home" &&
+    surface !== "admin" &&
+    surface !== "settings"
+  )
+    unavailable =
+      "Your project access is unavailable. Refresh your identity or select an authorized project.";
+  else if (surface === "admin" && !me.user.is_admin)
+    unavailable =
+      "Your signed-in identity does not have Control Plane administration access.";
+  else if (route.kind === "thread" && threadResource.error)
+    unavailable = threadResource.error;
+  else if (
+    route.kind === "thread" &&
+    !threadResource.loading &&
+    !selectedThread
+  )
+    unavailable =
+      "The requested conversation could not be found in this project.";
+  else if (route.kind === "task" && taskResource.error)
+    unavailable = taskResource.error;
+  else if (route.kind === "task" && !taskResource.loading && !selectedTask)
+    unavailable = "The requested task could not be found in this project.";
+  else if (route.kind === "agent" && selectedAgent.error)
+    unavailable = selectedAgent.error;
+  else if (
+    route.kind === "agent" &&
+    !selectedAgent.loading &&
+    !loading &&
+    !agent
+  )
+    unavailable = "The requested agent could not be found in this project.";
+  return (
+    <SendShortcutContext value={appearance.sendShortcut}>
+      <ControlPlaneFrame
+        current={surface}
+        navigation={[
+          {
+            id: "home",
+            label: "Home",
+            href: globalHref("home"),
+            icon: <IconHome size={21} aria-hidden="true" />,
+          },
+          {
+            id: "fleet",
+            label: "Fleet",
+            href: globalHref("fleet", authorizedProject ? project : undefined),
+            icon: <IconServer size={21} aria-hidden="true" />,
+          },
+          {
+            id: "projects",
+            label: "Projects",
+            href: globalHref("projects"),
+            icon: <IconFolder size={21} aria-hidden="true" />,
+          },
+          ...(me.user.is_admin
+            ? [
+                {
+                  id: "admin",
+                  label: "Administration",
+                  shortLabel: "Admin",
+                  href: globalHref("admin"),
+                  icon: <IconUsers size={21} aria-hidden="true" />,
+                },
+              ]
+            : []),
+          {
+            id: "settings",
+            label: "Settings",
+            href: globalHref("settings"),
+            icon: <IconSettings size={21} aria-hidden="true" />,
+          },
+        ]}
+        onNavigate={(id) =>
+          navigation.go(
+            globalHref(
+              id as Surface,
+              id === "fleet" && authorizedProject ? project : undefined,
+            ),
+          )
+        }
+        classification={settings?.classification}
+        user={
+          <span className="rail-user" title={me.user.display_name}>
+            {me.user.display_name.slice(0, 2).toUpperCase()}
+          </span>
+        }
+        footer={
+          <>
+            <DocumentationLink />
+            <button
+              type="button"
+              className="ui-icon-button"
+              aria-label="Sign out"
+              title="Sign out"
+              onClick={onSignOut}
+            >
+              <IconLogout size={19} aria-hidden="true" />
+            </button>
+          </>
+        }
+        sidebar={
+          !unavailable && agentId ? (
+            <AgentSidebar
+              key={`${me.user.id}:${project}:${agentId}`}
+              project={project}
+              nodes={scopedNodes}
+              hosts={hosts}
+              agentId={agentId}
+              selected={selectedThread?.thread_id ?? ""}
+              tasks={tasks}
+              newDisabled={
+                !permissions.includes("execute") || Boolean(agent?.node.revoked)
+              }
+              onAgent={(id) => openAgent(id)}
+              onOpen={openThread}
+              onNew={() =>
+                navigation.go(agentHref(project, agentId, "threads", true))
+              }
+              onBack={() => navigation.back(globalHref("fleet", project))}
+            />
+          ) : undefined
+        }
+        header={
+          <>
+            <label className="header-project">
+              <span className="sr-only">Project scope</span>
+              <DropdownSelect
+                aria-label="Select project"
+                value={authorizedProject ? project : ""}
+                onChange={(event) => selectProject(event.target.value)}
+              >
+                {!authorizedProject ? (
+                  <option value="">Select an authorized project</option>
+                ) : null}
+                {me.projects.map((item) => (
+                  <option key={item.id} value={item.id}>
+                    {item.name}
+                    {item.archived ? " · Archived" : ""}
+                  </option>
+                ))}
+              </DropdownSelect>
+            </label>
+            <span className="connection-indicator">
+              <span className={`dot ${live ? "live" : ""}`} />
+              {live} online
+            </span>
+            <button
+              type="button"
+              className="ui-icon-button"
+              aria-label="Refresh project"
+              onClick={() => {
+                void refresh();
+                loadMe();
+                threadResource.refresh();
+                taskResource.refresh();
+                selectedAgent.refresh();
+              }}
+            >
+              <IconRefresh size={16} aria-hidden="true" />
+            </button>
+          </>
+        }
+      >
+        {error && !unavailable ? (
+          <div role="alert" className="alert project-alert">
+            {error}
+            <button
+              type="button"
+              className="ui-icon-button"
+              aria-label="Dismiss error"
+              onClick={() => setError("")}
+            >
+              <IconX size={16} aria-hidden="true" />
+            </button>
+          </div>
+        ) : null}
+        <Suspense
+          key={me.user.id}
+          fallback={
+            <p className="control-page muted" role="status">
+              Loading view…
+            </p>
+          }
+        >
+          {unavailable ? (
+            <section className="control-page">
+              <header className="page-heading">
+                <div>
+                  <h1>Page unavailable</h1>
+                  <p role="alert">{unavailable}</p>
+                </div>
+              </header>
+              <RouteLink
+                className="ui-button ui-button--secondary"
+                href={globalHref("home")}
+              >
+                Go Home
+              </RouteLink>
+            </section>
+          ) : route.kind === "thread" ? (
+            selectedThread ? (
+              <ThreadDetail
+                key={`${project}:${selectedThread.thread_id}`}
+                initial={selectedThread}
+                project={project}
+                nodes={scopedNodes}
+                permissions={permissions}
+                onBack={() =>
+                  navigation.back(agentHref(project, selectedThread.node_id))
+                }
+                backHref={agentHref(project, selectedThread.node_id)}
+                backLabel="Back"
+                onChanged={() => void refresh()}
+                onPolicy={() => openAgent(selectedThread.node_id, "policy")}
+              />
+            ) : (
+              <LoadState {...threadResource} retry={threadResource.refresh} />
+            )
+          ) : route.kind === "task" ? (
+            selectedTask ? (
+              <TaskDetail
+                key={`${project}:${selectedTask.task_id}`}
+                initial={selectedTask}
+                project={project}
+                permissions={selectedTask.source_read_only ? [] : permissions}
+                nodeLabel={
+                  nodes.find(
+                    (item) => item.node.node_id === selectedTask.node_id,
+                  )?.node.label ?? selectedTask.node_id
+                }
+                onBack={() => navigation.back(projectHref(project, "tasks"))}
+                backHref={projectHref(project, "tasks")}
+              />
+            ) : (
+              <LoadState {...taskResource} retry={taskResource.refresh} />
+            )
+          ) : surface === "home" ? (
+            <Home
+              onOpen={openThread}
+              onFleet={() =>
+                navigation.go(globalHref("fleet", project || undefined))
+              }
+            />
+          ) : surface === "settings" ? (
+            <div className="control-page">
+              <header className="page-heading">
+                <div>
+                  <span className="eyebrow">Settings</span>
+                  <h1>Personal preferences</h1>
+                  <p>Customize the Control Plane for this browser.</p>
+                </div>
+              </header>
+              <AppearanceSettings
+                appearance={appearance}
+                onChange={setAppearance}
+              />
+              <section className="control-card">
+                <header>
+                  <h3>Signed-in identity</h3>
+                </header>
+                <p>{me.user.display_name}</p>
+                <p className="field-help">
+                  {me.user.email ?? ""}
+                  {me.user.is_admin ? " · Control Plane administrator" : ""}
+                </p>
+              </section>
+            </div>
+          ) : surface === "admin" ? (
+            <Administration
+              authConfig={authConfig}
+              onRefresh={loadMe}
+              onSettings={onSettings}
+              view={route.kind === "global" ? (route.view ?? "users") : "users"}
+              onView={(view) =>
+                navigation.go(globalHref("admin", undefined, view))
+              }
+            />
+          ) : surface === "projects" ? (
+            <Projects
+              key={project}
+              me={me}
+              selected={route.kind === "project" ? project : ""}
+              onSelect={(id) => navigation.go(projectHref(id))}
+              permissions={permissions}
+              onRefresh={loadMe}
+              tasks={taskView}
+              view={route.kind === "project" ? route.view : "overview"}
+              onView={(view) => navigation.go(projectHref(project, view))}
+            />
+          ) : !project ? (
+            <div className="empty-state">
+              <h2>No project access</h2>
+              <p>Ask your administrator for membership in a project.</p>
+            </div>
+          ) : route.kind === "agent" ? (
+            <AgentWorkspace
+              key={agentId}
+              project={project}
+              agent={agent}
+              nodes={scopedNodes}
+              permissions={permissions}
+              creating={route.compose}
+              busy={busy}
+              onCreate={createThread}
+              onNew={() =>
+                navigation.go(
+                  agentHref(project, agentId, route.view, !route.compose),
+                )
+              }
+              onOpen={openThread}
+              view={route.view}
+              onView={(view) =>
+                navigation.go(agentHref(project, agentId, view))
+              }
+            />
+          ) : (
+            <Fleet
+              key={project}
+              hosts={hosts}
+              nodes={nodes}
+              project={project}
+              permissions={permissions}
+              onRefresh={() => void refresh()}
+              onError={setError}
+              hasMore={nodes.length === nodePages * 100}
+              hasMoreHosts={hosts.length === hostPages * 100}
+              onMoreHosts={() => setHostPages((value) => value + 1)}
+              onMore={() => setNodePages((value) => value + 1)}
+              onOpenAgent={(id) => openAgent(id)}
+            />
+          )}
+        </Suspense>
+      </ControlPlaneFrame>
+    </SendShortcutContext>
+  );
+}
diff --git a/apps/web/src/Appearance.tsx b/apps/web/src/Appearance.tsx
new file mode 100644
index 000000000..36fdc26b4
--- /dev/null
+++ b/apps/web/src/Appearance.tsx
@@ -0,0 +1,183 @@
+import { createContext, useEffect, useState } from "react";
+import { DropdownSelect } from "@colossus/ui";
+
+type Appearance = {
+  colorTheme: "system" | "dark" | "light";
+  darkPalette: "colossus" | "neutral" | "hacker";
+  textSize: "compact" | "comfortable" | "large";
+  sendShortcut: "enter" | "modEnter";
+};
+const storageKey = "colossus.web.appearance.v1";
+const defaults: Appearance = {
+  colorTheme: "system",
+  darkPalette: "colossus",
+  textSize: "comfortable",
+  sendShortcut: "enter",
+};
+export const SendShortcutContext = createContext<"enter" | "modEnter">("enter");
+
+function readAppearance(): Appearance {
+  try {
+    const stored = localStorage.getItem(storageKey);
+    if (!stored) {
+      const legacy = localStorage.getItem("colossus-cloud-theme");
+      return {
+        ...defaults,
+        colorTheme: legacy === "light" || legacy === "dark" ? legacy : "system",
+      };
+    }
+    const value = JSON.parse(stored) as Partial<Appearance>;
+    return {
+      sendShortcut: value.sendShortcut === "modEnter" ? "modEnter" : "enter",
+      colorTheme: ["system", "dark", "light"].includes(value.colorTheme ?? "")
+        ? value.colorTheme!
+        : defaults.colorTheme,
+      darkPalette: ["colossus", "neutral", "hacker"].includes(
+        value.darkPalette ?? "",
+      )
+        ? value.darkPalette!
+        : defaults.darkPalette,
+      textSize: ["compact", "comfortable", "large"].includes(
+        value.textSize ?? "",
+      )
+        ? value.textSize!
+        : defaults.textSize,
+    };
+  } catch {
+    return defaults;
+  }
+}
+
+/** Browser preferences stay in the web host, outside the shared presentation. */
+export function useAppearance() {
+  const [appearance, setAppearance] = useState(readAppearance);
+  useEffect(() => {
+    const system = window.matchMedia("(prefers-color-scheme: dark)");
+    const apply = () => {
+      const root = document.documentElement;
+      root.dataset.theme =
+        appearance.colorTheme === "system"
+          ? system.matches
+            ? "dark"
+            : "light"
+          : appearance.colorTheme;
+      root.dataset.palette = appearance.darkPalette;
+      root.dataset.textSize = appearance.textSize;
+      root.dataset.themePreference = appearance.colorTheme;
+    };
+    apply();
+    system.addEventListener("change", apply);
+    try {
+      localStorage.setItem(storageKey, JSON.stringify(appearance));
+    } catch {
+      /* Preferences are best-effort. */
+    }
+    return () => system.removeEventListener("change", apply);
+  }, [appearance]);
+  return { appearance, setAppearance };
+}
+
+export function AppearanceSettings({
+  appearance,
+  onChange,
+}: {
+  appearance: Appearance;
+  onChange: (appearance: Appearance) => void;
+}) {
+  return (
+    <section
+      className="managed-settings-body appearance-settings"
+      aria-labelledby="appearance-heading"
+    >
+      <header className="catalog-heading">
+        <div>
+          <h2 id="appearance-heading">Appearance</h2>
+          <p>Display preferences for this browser.</p>
+        </div>
+      </header>
+      <div className="appearance-fields">
+        <label>
+          <span>
+            <strong>Send shortcut</strong>
+            <small>Shift+Enter inserts a new line.</small>
+          </span>
+          <DropdownSelect
+            aria-label="Send shortcut"
+            value={appearance.sendShortcut}
+            onChange={(event) =>
+              onChange({
+                ...appearance,
+                sendShortcut: event.target.value as Appearance["sendShortcut"],
+              })
+            }
+          >
+            <option value="enter">Enter to send</option>
+            <option value="modEnter">Ctrl / Cmd + Enter to send</option>
+          </DropdownSelect>
+        </label>
+        <label>
+          <span>
+            <strong>Color theme</strong>
+            <small>Follow your system or choose a light or dark theme.</small>
+          </span>
+          <DropdownSelect
+            aria-label="Color theme"
+            value={appearance.colorTheme}
+            onChange={(event) =>
+              onChange({
+                ...appearance,
+                colorTheme: event.target.value as Appearance["colorTheme"],
+              })
+            }
+          >
+            <option value="system">System</option>
+            <option value="dark">Dark</option>
+            <option value="light">Light</option>
+          </DropdownSelect>
+        </label>
+        <label>
+          <span>
+            <strong>Dark palette</strong>
+            <small>Used when the color theme is dark.</small>
+          </span>
+          <DropdownSelect
+            aria-label="Dark palette"
+            value={appearance.darkPalette}
+            onChange={(event) =>
+              onChange({
+                ...appearance,
+                darkPalette: event.target.value as Appearance["darkPalette"],
+              })
+            }
+          >
+            <option value="colossus">Colossus blue</option>
+            <option value="neutral">Neutral dark</option>
+            <option value="hacker">Hacker</option>
+          </DropdownSelect>
+        </label>
+        <label>
+          <span>
+            <strong>Text size</strong>
+            <small>
+              Scale text across navigation, controls, and task output.
+            </small>
+          </span>
+          <DropdownSelect
+            aria-label="Text size"
+            value={appearance.textSize}
+            onChange={(event) =>
+              onChange({
+                ...appearance,
+                textSize: event.target.value as Appearance["textSize"],
+              })
+            }
+          >
+            <option value="compact">Compact</option>
+            <option value="comfortable">Comfortable</option>
+            <option value="large">Large</option>
+          </DropdownSelect>
+        </label>
+      </div>
+    </section>
+  );
+}
diff --git a/apps/web/src/DataTable.test.tsx b/apps/web/src/DataTable.test.tsx
new file mode 100644
index 000000000..d0f80e8ef
--- /dev/null
+++ b/apps/web/src/DataTable.test.tsx
@@ -0,0 +1,296 @@
+// @vitest-environment happy-dom
+import { act, type ReactNode } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { DataTable, type DataTableColumn } from "@colossus/ui/data-table";
+import { Button, ControlPlaneFrame } from "@colossus/ui";
+import {
+  ConversationEntry,
+  ConversationTimeline,
+  ConversationActivity,
+} from "@colossus/ui/conversation";
+
+type Item = { id: string; title: string; status: string; created: number };
+const items: Item[] = Array.from({ length: 35 }, (_, index) => ({
+  id: String(index),
+  title: `Task ${index + 1}`,
+  status: index % 2 ? "Finished" : "Active",
+  created: index,
+}));
+const columns: DataTableColumn<Item>[] = [
+  {
+    id: "title",
+    label: "Task",
+    value: (row) => row.title,
+    rowHeader: true,
+    hideable: false,
+  },
+  {
+    id: "status",
+    label: "Status",
+    value: (row) => row.status,
+    filter: {
+      label: "Filter status",
+      options: [
+        { value: "", label: "All statuses" },
+        { value: "Active", label: "Active" },
+      ],
+      matches: (row, value) => !value || row.status === value,
+    },
+  },
+  { id: "created", label: "Created", value: (row) => row.created },
+];
+let container: HTMLDivElement, root: Root;
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+});
+afterEach(async () => {
+  await act(() => root.unmount());
+  container.remove();
+});
+async function render(data = items, key = "one", definitions = columns) {
+  await act(() =>
+    root.render(
+      <DataTable
+        key={key}
+        data={data}
+        columns={definitions}
+        getRowId={(row) => row.id}
+        label="Tasks"
+        itemLabel="tasks"
+        search={{ columnId: "title", label: "Search tasks" }}
+        initialSorting={[{ id: "created", desc: true }]}
+      />,
+    ),
+  );
+}
+function button(label: string) {
+  const result = [
+    ...document.querySelectorAll<HTMLButtonElement>("button"),
+  ].find(
+    (node) =>
+      node.getAttribute("aria-label") === label ||
+      node.textContent?.trim() === label,
+  );
+  if (!result) throw new Error(`Missing button: ${label}`);
+  return result;
+}
+async function click(node: HTMLElement) {
+  await act(() => {
+    node.dispatchEvent(
+      new PointerEvent("pointerdown", {
+        bubbles: true,
+        button: 0,
+        pointerType: "mouse",
+      }),
+    );
+    node.click();
+  });
+}
+const titles = () =>
+  [...container.querySelectorAll('tbody th[scope="row"]')].map(
+    (node) => node.textContent,
+  );
+it("shared frame preserves timeline entries and the full navigation name behind a compact caption", async () => {
+  await act(() =>
+    root.render(
+      <ControlPlaneFrame
+        current="admin"
+        navigation={[
+          {
+            id: "admin",
+            label: "Administration",
+            shortLabel: "Admin",
+            icon: <span aria-hidden="true" />,
+          },
+        ]}
+        onNavigate={() => {}}
+      >
+        <ConversationTimeline>
+          <ConversationEntry role="user" content="Retained human turn" />
+          <ConversationEntry
+            role="assistant"
+            content="**Retained assistant reply**"
+          />
+        </ConversationTimeline>
+      </ControlPlaneFrame>,
+    ),
+  );
+  expect(container.querySelectorAll(".shared-conversation-entry")).toHaveLength(
+    2,
+  );
+  expect(
+    container.querySelector(".shared-conversation-timeline")?.textContent,
+  ).toContain("Retained human turn");
+  expect(container.querySelector(".shared-markdown strong")?.textContent).toBe(
+    "Retained assistant reply",
+  );
+  const navigation = container.querySelector(
+    'button[aria-label="Administration"]',
+  );
+  expect(navigation?.textContent).toBe("Admin");
+  expect(navigation?.getAttribute("title")).toBe("Administration");
+});
+const status = () => container.querySelector('[role="status"]')!.textContent;
+it("bounds shared activity and assistant brand images before conversation CSS loads", async () => {
+  await act(() =>
+    root.render(
+      <>
+        <ConversationActivity
+          description="1 action"
+          statusLabel="Completed"
+          tone="success"
+        >
+          <p>Released activity</p>
+        </ConversationActivity>
+        <ConversationEntry
+          role="assistant"
+          content="Retained reply"
+          markdown={false}
+        />
+      </>,
+    ),
+  );
+  const images = [
+    ...container.querySelectorAll<HTMLImageElement>(
+      ".run-activity-mark img, .shared-assistant-marker img",
+    ),
+  ];
+  expect(images).toHaveLength(2);
+  for (const image of images) {
+    expect(image.width).toBe(17);
+    expect(image.height).toBe(17);
+    expect(image.getAttribute("width")).toBe("17");
+    expect(image.getAttribute("height")).toBe("17");
+    expect(image.alt).toBe("");
+  }
+});
+async function select(label: string, value: string) {
+  await click(
+    document.querySelector<HTMLElement>(
+      `[role="combobox"][aria-label="${label}"]`,
+    )!,
+  );
+  const option = [
+    ...document.querySelectorAll<HTMLElement>('[role="option"]'),
+  ].find((node) => node.textContent?.trim() === value)!;
+  await click(option);
+}
+async function search(value: string) {
+  const input = container.querySelector<HTMLInputElement>(
+    'input[type="search"]',
+  )!;
+  await act(() => {
+    Object.getOwnPropertyDescriptor(
+      HTMLInputElement.prototype,
+      "value",
+    )!.set!.call(input, value);
+    input.dispatchEvent(new Event("input", { bubbles: true }));
+  });
+}
+describe("shared data table interactions", () => {
+  it("sorts all loaded rows and exposes the sort direction", async () => {
+    await render();
+    expect(titles()[0]).toBe("Task 35");
+    await click(button("Sort by Task"));
+    expect(titles().slice(0, 3)).toEqual(["Task 1", "Task 2", "Task 3"]);
+    expect(
+      container.querySelector('thead th[aria-sort="ascending"]')?.textContent,
+    ).toContain("Task");
+    await click(button("Sort by Task"));
+    expect(titles()[0]).toBe("Task 35");
+  });
+  it("keeps the current page through polling and resets it for searches", async () => {
+    await render();
+    await click(button("Next page"));
+    expect(status()).toBe("11–20 of 35 tasks");
+    await render(items.map((item) => ({ ...item })));
+    expect(status()).toBe("11–20 of 35 tasks");
+    await search("Task 35");
+    expect(status()).toBe("1–1 of 1 tasks");
+    expect(titles()).toEqual(["Task 35"]);
+    expect(button("Previous page").disabled).toBe(true);
+    await click(button("Clear filters"));
+    expect(status()).toBe("1–10 of 35 tasks");
+  });
+  it("combines filters and leaves hidden columns searchable", async () => {
+    await render();
+    await select("Filter status", "Active");
+    expect(status()).toBe("1–10 of 18 tasks");
+    await click(button("Columns"));
+    const checkbox = [
+      ...document.querySelectorAll<HTMLElement>('[role="menuitemcheckbox"]'),
+    ].find((node) => node.textContent?.trim() === "Status")!;
+    await click(checkbox);
+    expect(checkbox.getAttribute("aria-checked")).toBe("false");
+    expect(container.querySelectorAll("thead th")).toHaveLength(2);
+    expect(status()).toBe("1–10 of 18 tasks");
+    await act(() =>
+      document.activeElement?.dispatchEvent(
+        new KeyboardEvent("keydown", { key: "Escape", bubbles: true }),
+      ),
+    );
+    await search("Task 35");
+    expect(titles()).toEqual(["Task 35"]);
+    await select("Filter status", "All statuses");
+    expect(titles()).toEqual(["Task 35"]);
+  });
+  it("changes page size and clamps pages when live rows disappear", async () => {
+    await render();
+    await click(button("Next page"));
+    await click(button("Next page"));
+    await click(button("Next page"));
+    expect(status()).toBe("31–35 of 35 tasks");
+    await render(items.slice(0, 12));
+    expect(status()).toBe("11–12 of 12 tasks");
+    await select("Rows per page", "25");
+    expect(status()).toBe("1–12 of 12 tasks");
+    expect(button("Next page").disabled).toBe(true);
+  });
+  it("preserves focused row actions when live polling refreshes data and cell callbacks", async () => {
+    const liveColumns = () =>
+      columns.map((column) =>
+        column.id === "title"
+          ? { ...column, cell: (row: Item) => <button>{row.title}</button> }
+          : { ...column },
+      );
+    await render(items, "one", liveColumns());
+    const action = button("Task 35");
+    action.focus();
+    await render(
+      items.map((item) => ({ ...item })),
+      "one",
+      liveColumns(),
+    );
+    expect(action.isConnected).toBe(true);
+    expect(document.activeElement).toBe(action);
+  });
+  it("resets table preferences when switching projects and handles empty results", async () => {
+    await render();
+    await click(button("Next page"));
+    await search("not present");
+    expect(status()).toBe("0–0 of 0 tasks");
+    expect(container.textContent).toContain("No results.");
+    await render(items, "another-project");
+    expect(status()).toBe("1–10 of 35 tasks");
+    expect(
+      container.querySelector<HTMLInputElement>('input[type="search"]')!.value,
+    ).toBe("");
+  });
+});
+it("shared button preserves native button and explicit form submit behavior", async () => {
+  async function show(children: ReactNode) {
+    await act(() => root.render(<form>{children}</form>));
+  }
+  await show(
+    <>
+      <Button>Cancel</Button>
+      <Button type="submit">Save</Button>
+    </>,
+  );
+  expect(button("Cancel").type).toBe("button");
+  expect(button("Save").type).toBe("submit");
+});
diff --git a/apps/web/src/DocumentationLink.test.tsx b/apps/web/src/DocumentationLink.test.tsx
new file mode 100644
index 000000000..f51a9830a
--- /dev/null
+++ b/apps/web/src/DocumentationLink.test.tsx
@@ -0,0 +1,47 @@
+// @vitest-environment happy-dom
+import { renderToStaticMarkup } from "react-dom/server";
+import { expect, it } from "vitest";
+import { documentationUrl, DocumentationLink } from "./DocumentationLink";
+
+it("supports same-origin mounts and HTTP(S) documentation without unsafe URL schemes", () => {
+  expect(documentationUrl(undefined)).toBe("/docs/");
+  expect(documentationUrl("/reference/?q=runtime#agents")).toBe(
+    "/reference/?q=runtime#agents",
+  );
+  expect(documentationUrl(" https://docs.example.test/reference/ ")).toBe(
+    "https://docs.example.test/reference/",
+  );
+  expect(documentationUrl("http://localhost:8093/docs/")).toBe(
+    "http://localhost:8093/docs/",
+  );
+  for (const value of [
+    "",
+    "javascript:alert(1)",
+    "data:text/html,<script>alert(1)</script>",
+    "//docs.example.test/",
+    "/\\docs.example.test/",
+    "https://user:password@docs.example.test/",
+    "https://docs.example.test/\nreference/",
+    "/docs/\u0000reference/",
+    "https:docs.example.test",
+    "./docs/",
+    "/" + "a".repeat(2048),
+  ])
+    expect(documentationUrl(value)).toBe("/docs/");
+});
+
+it("renders an ordinary labelled documentation anchor that preserves the current page", () => {
+  const container = document.createElement("div");
+  container.innerHTML = renderToStaticMarkup(
+    <DocumentationLink configuredUrl="https://docs.example.test/" />,
+  );
+  const link = container.querySelector("a");
+  expect(link?.getAttribute("href")).toBe("https://docs.example.test/");
+  expect(link?.getAttribute("aria-label")).toBe(
+    "Documentation (opens in a new tab)",
+  );
+  expect(link?.getAttribute("target")).toBe("_blank");
+  expect(link?.getAttribute("rel")).toBe("noopener noreferrer");
+  expect(link?.classList.contains("ui-button--icon")).toBe(true);
+  expect(link?.querySelector("svg")?.getAttribute("aria-hidden")).toBe("true");
+});
diff --git a/apps/web/src/DocumentationLink.tsx b/apps/web/src/DocumentationLink.tsx
new file mode 100644
index 000000000..bb2536a67
--- /dev/null
+++ b/apps/web/src/DocumentationLink.tsx
@@ -0,0 +1,50 @@
+import { Button } from "@colossus/ui/components/ui/button";
+import { IconBook2 } from "@tabler/icons-react";
+
+const defaultDocumentationUrl = "/docs/";
+
+export function documentationUrl(configured: unknown): string {
+  if (typeof configured !== "string") return defaultDocumentationUrl;
+  const candidate = configured.trim();
+  if (
+    !candidate ||
+    candidate.length > 2048 ||
+    /[\s\\\u0000-\u001f\u007f]/u.test(candidate)
+  )
+    return defaultDocumentationUrl;
+  if (candidate.startsWith("/") && !candidate.startsWith("//"))
+    return candidate;
+  if (!/^https?:\/\//i.test(candidate)) return defaultDocumentationUrl;
+  try {
+    const url = new URL(candidate);
+    if (
+      (url.protocol === "https:" || url.protocol === "http:") &&
+      !url.username &&
+      !url.password
+    )
+      return url.href;
+  } catch {
+    // An invalid deployment override uses the same-origin documentation mount.
+  }
+  return defaultDocumentationUrl;
+}
+
+export function DocumentationLink({
+  configuredUrl = import.meta.env.VITE_COLOSSUS_DOCUMENTATION_URL,
+}: {
+  configuredUrl?: string | undefined;
+}) {
+  return (
+    <Button asChild variant="ghost" size="icon">
+      <a
+        href={documentationUrl(configuredUrl)}
+        target="_blank"
+        rel="noopener noreferrer"
+        aria-label="Documentation (opens in a new tab)"
+        title="Documentation (opens in a new tab)"
+      >
+        <IconBook2 size={19} aria-hidden="true" />
+      </a>
+    </Button>
+  );
+}
diff --git a/apps/web/src/Fleet.tsx b/apps/web/src/Fleet.tsx
new file mode 100644
index 000000000..8c3763ffb
--- /dev/null
+++ b/apps/web/src/Fleet.tsx
@@ -0,0 +1,619 @@
+import { Badge } from "@colossus/ui/components/ui/badge";
+import { useEffect, useMemo, useRef, useState } from "react";
+import {
+  IconServer,
+  IconShieldX,
+  IconCopy,
+  IconCheck,
+  IconX,
+  IconArrowUpRight,
+  IconArrowLeft,
+  IconMessageCircle,
+  IconDeviceDesktop,
+} from "@tabler/icons-react";
+import { Button, TextInput } from "@colossus/ui";
+import { DataTable, type DataTableColumn } from "@colossus/ui/data-table";
+import {
+  request,
+  projectPath,
+  type FleetNode,
+  type Permission,
+  type Host,
+} from "./api";
+import { RouteLink } from "./navigation";
+import { agentHref } from "./routes";
+const platforms: Record<string, string> = {
+  macos: "macOS",
+  linux: "Linux",
+  windows: "Windows",
+};
+const platformLabel = (platform: string) => platforms[platform] ?? platform;
+
+export function Fleet({
+  nodes,
+  hosts,
+  project,
+  permissions,
+  onRefresh,
+  onError,
+  hasMore,
+  hasMoreHosts,
+  onMoreHosts,
+  onMore,
+  onOpenAgent,
+}: {
+  nodes: FleetNode[];
+  hosts: Host[];
+  project: string;
+  permissions: Permission[];
+  onRefresh: () => void;
+  onError: (error: string) => void;
+  hasMore: boolean;
+  hasMoreHosts: boolean;
+  onMoreHosts: () => void;
+  onMore: () => void;
+  onOpenAgent: (nodeId: string) => void;
+}) {
+  const [hostId, setHostId] = useState<string | null>(null);
+  const hostBack = useRef<HTMLButtonElement>(null);
+  useEffect(() => {
+    if (hostId !== null) hostBack.current?.focus();
+  }, [hostId]);
+  const [enrolling, setEnrolling] = useState(false),
+    [label, setLabel] = useState(""),
+    [roles, setRoles] = useState("primary"),
+    [busy, setBusy] = useState(false),
+    [copied, setCopied] = useState(false),
+    [invitation, setInvitation] = useState<{
+      token: string;
+      node_id: string;
+      enrollment_url: string;
+      expires_in: number;
+    } | null>(null);
+  const input = useRef<HTMLInputElement>(null),
+    dialog = useRef<HTMLDialogElement>(null),
+    alive = useRef(true),
+    enrollmentAttempt = useRef(0);
+  useEffect(() => {
+    alive.current = true;
+    return () => {
+      alive.current = false;
+    };
+  }, []);
+  useEffect(() => {
+    if (enrolling) {
+      dialog.current?.showModal();
+      input.current?.focus();
+    } else dialog.current?.close();
+  }, [enrolling]);
+  function beginEnrollment() {
+    enrollmentAttempt.current++;
+    setInvitation(null);
+    setBusy(false);
+    setCopied(false);
+    setLabel("");
+    setRoles("primary");
+    setEnrolling(true);
+  }
+  function closeEnrollment() {
+    enrollmentAttempt.current++;
+    setEnrolling(false);
+    setInvitation(null);
+    setBusy(false);
+  }
+  async function invite() {
+    if (busy) return;
+    const attempt = ++enrollmentAttempt.current;
+    setBusy(true);
+    try {
+      const response = await request<{
+        token: string;
+        node_id: string;
+        enrollment_url: string;
+        expires_in: number;
+      }>(`${projectPath(project)}/invitations`, {
+        label,
+        roles: roles
+          .split(",")
+          .map((role) => role.trim())
+          .filter(Boolean),
+      });
+      if (alive.current && attempt === enrollmentAttempt.current) {
+        setInvitation(response);
+        setCopied(false);
+      }
+    } catch (error) {
+      if (alive.current && attempt === enrollmentAttempt.current)
+        onError(
+          error instanceof Error
+            ? error.message
+            : "Enrollment could not be created.",
+        );
+    } finally {
+      if (alive.current && attempt === enrollmentAttempt.current)
+        setBusy(false);
+    }
+  }
+  async function revoke(fleet: FleetNode) {
+    if (
+      !confirm(
+        `Revoke ${fleet.node.label}? Its cloud connection will close. Accepted runs continue locally and remain assigned to this runtime.`,
+      )
+    )
+      return;
+    try {
+      await request(
+        `${projectPath(project)}/nodes/${fleet.node.node_id}/revoke`,
+        { revision: fleet.node.revision },
+      );
+      if (alive.current) onRefresh();
+    } catch (error) {
+      if (alive.current)
+        onError(error instanceof Error ? error.message : "Revocation failed.");
+    }
+  }
+  const visibleNodes = nodes.filter(
+    (item) =>
+      hostId === null ||
+      (hostId === "" ? !item.node.host_id : item.node.host_id === hostId),
+  );
+  const columns = useMemo<DataTableColumn<FleetNode>[]>(
+    () => [
+      {
+        id: "agent",
+        label: "Agent / workspace",
+        hideable: false,
+        rowHeader: true,
+        value: (item) =>
+          `${item.node.label} ${item.node.workspace_label ?? ""} ${item.node.node_id}`,
+        cell: (item) => (
+          <div className="catalog-identity">
+            <span className="resource-icon">
+              <IconServer size={16} aria-hidden="true" />
+            </span>
+            <div>
+              <RouteLink
+                href={agentHref(project, item.node.node_id)}
+                className="catalog-name"
+                onNavigate={() => onOpenAgent(item.node.node_id)}
+              >
+                {item.node.label}
+              </RouteLink>
+              <small>
+                {item.node.workspace_label ||
+                  item.node.workspace_id ||
+                  "Workspace inventory not reported"}
+              </small>
+              <details className="agent-details">
+                <summary>Connection details</summary>
+                <dl>
+                  <dt>Local instance</dt>
+                  <dd className="mono">{item.node.instance_id}</dd>
+                  <dt>Node</dt>
+                  <dd className="mono">{item.node.node_id}</dd>
+                  <dt>Transport</dt>
+                  <dd>Outbound · mutual TLS</dd>
+                  <dt>Capabilities</dt>
+                  <dd>
+                    {item.presence?.capabilities.join(", ") || "Not reported"}
+                  </dd>
+                </dl>
+              </details>
+            </div>
+          </div>
+        ),
+      },
+      {
+        id: "host",
+        label: "Host",
+        value: (item) =>
+          hosts.find((host) => host.host_id === item.node.host_id)?.label ??
+          "Inventory pending",
+      },
+      {
+        id: "status",
+        label: "Connection",
+        value: (item) =>
+          item.node.revoked
+            ? "Revoked"
+            : item.presence?.ready
+              ? "Connected"
+              : item.presence
+                ? "Starting"
+                : "Offline",
+        cell: (item) => {
+          const status = item.node.revoked
+            ? "revoked"
+            : item.presence?.ready
+              ? "connected"
+              : item.presence
+                ? "starting"
+                : "offline";
+          return (
+            <Badge className={`status status-${status}`}>
+              <span className={`dot ${status === "connected" ? "live" : ""}`} />
+              {status[0]!.toUpperCase() + status.slice(1)}
+            </Badge>
+          );
+        },
+        filter: {
+          label: "Filter agents by connection",
+          options: [
+            { value: "", label: "All connections" },
+            { value: "online", label: "Online" },
+            { value: "offline", label: "Offline" },
+            { value: "revoked", label: "Revoked" },
+          ],
+          matches: (item, value) =>
+            !value ||
+            (value === "revoked"
+              ? item.node.revoked
+              : !item.node.revoked &&
+                (value === "online"
+                  ? Boolean(item.presence?.ready)
+                  : !item.presence?.ready)),
+        },
+      },
+      {
+        id: "roles",
+        label: "Allowed roles",
+        value: (item) => item.node.roles.join(", "),
+      },
+      {
+        id: "actions",
+        label: "Actions",
+        value: () => "",
+        sortable: false,
+        hideable: false,
+        cell: (item) => (
+          <div className="agent-row-actions">
+            <RouteLink
+              className="ui-button ui-button--tertiary"
+              href={agentHref(project, item.node.node_id, "threads")}
+              aria-label={`Open threads on ${item.node.label}`}
+              onNavigate={() => onOpenAgent(item.node.node_id)}
+            >
+              <IconMessageCircle size={16} aria-hidden="true" />
+            </RouteLink>
+            {permissions.includes("administer") ? (
+              <Button
+                variant="tertiary"
+                aria-label={`Revoke ${item.node.label}`}
+                disabled={item.node.revoked}
+                onClick={() => void revoke(item)}
+              >
+                <IconShieldX size={16} aria-hidden="true" />
+              </Button>
+            ) : null}
+          </div>
+        ),
+      },
+    ],
+    [hosts, onOpenAgent, permissions, project],
+  );
+  return (
+    <>
+      <section
+        className="managed-settings-body catalog-settings host-settings"
+        aria-labelledby="fleet-heading"
+      >
+        <header className="catalog-heading">
+          <div>
+            <h2 id="fleet-heading">Fleet</h2>
+            <p>
+              Hosts group your connected Desktop workspaces and independent CLI
+              agents.
+            </p>
+          </div>
+          {permissions.includes("administer") ? (
+            <Button variant="primary" onClick={beginEnrollment}>
+              Enroll agent
+            </Button>
+          ) : null}
+        </header>
+        <p className="catalog-summary">
+          {hosts.length} loaded hosts · {nodes.length} loaded agents ·{" "}
+          {
+            nodes.filter((item) => item.presence?.ready && !item.node.revoked)
+              .length
+          }{" "}
+          online
+        </p>
+        <details className="host-directory" open={hostId !== null}>
+          <summary>
+            Browse hosts{hostId !== null ? " · Host filter active" : ""}
+          </summary>
+          {hostId !== null ? (
+            <Button
+              ref={hostBack}
+              variant="tertiary"
+              className="back"
+              onClick={() => {
+                const previous = hostId;
+                setHostId(null);
+                requestAnimationFrame(() =>
+                  document
+                    .querySelector<HTMLButtonElement>(
+                      `[data-host-id="${CSS.escape(previous)}"]`,
+                    )
+                    ?.focus(),
+                );
+              }}
+            >
+              <IconArrowLeft size={16} aria-hidden="true" />
+              All hosts
+            </Button>
+          ) : null}
+          {hostId === null ? (
+            <div className="host-grid">
+              {hosts.map((host) => {
+                const agents = nodes.filter(
+                    (item) =>
+                      item.node.host_id === host.host_id && !item.node.revoked,
+                  ),
+                  online = agents.filter((item) => item.presence?.ready).length;
+                return (
+                  <button
+                    type="button"
+                    className="host-card"
+                    data-host-id={host.host_id}
+                    key={host.host_id}
+                    onClick={() => setHostId(host.host_id)}
+                  >
+                    <span className="host-card-icon">
+                      <IconDeviceDesktop size={22} aria-hidden="true" />
+                    </span>
+                    <span className="host-card-body">
+                      <strong>{host.label}</strong>
+                      <small>
+                        {platformLabel(host.platform) ||
+                          "Platform not reported"}{" "}
+                        ·{" "}
+                        {host.deployment_kind === "cli"
+                          ? "CLI"
+                          : host.deployment_kind === "desktop"
+                            ? "Desktop"
+                            : host.deployment_kind || "Runtime host"}
+                      </small>
+                      <span>
+                        {agents.length} loaded agent
+                        {agents.length === 1 ? "" : "s"} · {online} online
+                      </span>
+                      {agents.length ? (
+                        <small>
+                          {agents
+                            .slice(0, 3)
+                            .map((item) => item.node.label)
+                            .join(" · ")}
+                          {agents.length > 3 ? "…" : ""}
+                        </small>
+                      ) : null}
+                      <small>
+                        {host.last_seen_at
+                          ? `Last seen ${new Date(host.last_seen_at * 1000).toLocaleString()}`
+                          : "Waiting for host inventory"}
+                      </small>
+                    </span>
+                    <IconArrowUpRight size={16} aria-hidden="true" />
+                  </button>
+                );
+              })}
+              {nodes.some((item) => !item.node.host_id) ? (
+                <button
+                  type="button"
+                  className="host-card"
+                  data-host-id=""
+                  onClick={() => setHostId("")}
+                >
+                  <span className="host-card-icon">
+                    <IconServer size={22} aria-hidden="true" />
+                  </span>
+                  <span className="host-card-body">
+                    <strong>Agents without host inventory</strong>
+                    <small>
+                      Existing enrollments that have not reported a host
+                    </small>
+                    <span>
+                      {nodes.filter((item) => !item.node.host_id).length} agents
+                    </span>
+                  </span>
+                  <IconArrowUpRight size={16} aria-hidden="true" />
+                </button>
+              ) : null}
+              {!hosts.length && !nodes.length ? (
+                <div className="empty-state">
+                  <IconDeviceDesktop size={28} aria-hidden="true" />
+                  <h3>Connect your first host</h3>
+                  <p>
+                    Enroll a Desktop workspace or CLI agent. Its host and
+                    workspace inventory will appear after it connects.
+                  </p>
+                </div>
+              ) : null}
+            </div>
+          ) : (
+            <p className="fleet-host-context">
+              <IconDeviceDesktop size={18} aria-hidden="true" />
+              {hosts.find((host) => host.host_id === hostId)?.label ??
+                "Agents without host inventory"}
+            </p>
+          )}
+          {hasMoreHosts && hostId === null ? (
+            <Button className="load-more" onClick={onMoreHosts}>
+              Load more hosts
+            </Button>
+          ) : null}
+        </details>
+      </section>
+      <section
+        className="managed-settings-body catalog-settings runtime-settings"
+        aria-labelledby="agents-heading"
+      >
+        <header className="catalog-heading">
+          <div>
+            <h2 id="agents-heading">Agents and workspaces</h2>
+            <p>
+              Open an agent to view its conversations. Each workspace keeps its
+              own execution authority.
+            </p>
+          </div>
+        </header>
+        <DataTable
+          key={hostId ?? "fleet"}
+          data={visibleNodes}
+          columns={columns}
+          getRowId={(item) => item.node.node_id}
+          label="Fleet agents"
+          itemLabel="agents"
+          search={{ columnId: "agent", label: "Search agents" }}
+          empty={
+            <div className="empty-state">
+              <h3>No matching agents</h3>
+              <p>
+                Connect an enrolled agent on this host or choose another host.
+              </p>
+            </div>
+          }
+          footer={
+            hasMore ? (
+              <div className="task-history-footer">
+                <p>
+                  Filters apply to loaded agents. Load more to include the rest
+                  of your fleet.
+                </p>
+                <Button onClick={onMore}>Load more agents</Button>
+              </div>
+            ) : undefined
+          }
+        />
+      </section>
+      <dialog
+        aria-label="Runtime enrollment"
+        ref={dialog}
+        onCancel={closeEnrollment}
+        onClose={() => {
+          if (!dialog.current?.open) closeEnrollment();
+        }}
+        className="enrollment-dialog"
+      >
+        <div className="dialog-heading">
+          <div className="node-icon">
+            <IconServer size={23} />
+          </div>
+          <button
+            className="ui-icon-button"
+            aria-label="Close enrollment"
+            onClick={closeEnrollment}
+          >
+            <IconX size={20} />
+          </button>
+        </div>
+        <h2>{invitation ? "Connect your runtime" : "Enroll a runtime"}</h2>
+        <p className="muted">
+          {invitation
+            ? "This invitation expires in ten minutes and can enroll one runtime."
+            : "Choose a name and an additional role ceiling for this project's execution target."}
+        </p>
+        {invitation ? (
+          <>
+            <label>
+              Enrollment URL
+              <TextInput readOnly value={invitation.enrollment_url} />
+            </label>
+            <label>
+              One-use invitation
+              <TextInput readOnly value={invitation.token} className="mono" />
+            </label>
+            <Button
+              className="full-width"
+              onClick={() =>
+                void navigator.clipboard
+                  .writeText(invitation.token)
+                  .then(() => setCopied(true))
+                  .catch(() =>
+                    onError(
+                      "Clipboard unavailable. Select and copy the invitation field.",
+                    ),
+                  )
+              }
+            >
+              {copied ? <IconCheck size={17} /> : <IconCopy size={17} />}{" "}
+              {copied ? "Invitation copied" : "Copy invitation"}
+            </Button>
+            <div className="enrollment-instructions">
+              <h3>From Desktop</h3>
+              <p>
+                Open Workspace settings → Control Plane. Paste the URL and
+                invitation, then confirm the native connection dialog.
+              </p>
+              <h3>From the CLI</h3>
+              <code>
+                colossus cloud enroll --enrollment-url URL --local-config
+                LOCAL.json
+              </code>
+              <p>
+                Paste the invitation when prompted. Start the persistent
+                connector with{" "}
+                <code>colossus cloud run --local-config LOCAL.json</code>.
+              </p>
+            </div>
+            <Button
+              variant="primary"
+              className="full-width"
+              onClick={() => {
+                setEnrolling(false);
+                onRefresh();
+              }}
+            >
+              Done <IconArrowUpRight size={17} />
+            </Button>
+          </>
+        ) : (
+          <form
+            onSubmit={(event) => {
+              event.preventDefault();
+              void invite();
+            }}
+          >
+            <label htmlFor="node-label">
+              Runtime name
+              <TextInput
+                ref={input}
+                id="node-label"
+                required
+                maxLength={128}
+                autoComplete="off"
+                placeholder="e.g. Development workstation"
+                value={label}
+                onChange={(event) => setLabel(event.target.value)}
+              />
+            </label>
+            <label htmlFor="node-roles">
+              Allowed roles
+              <TextInput
+                id="node-roles"
+                required
+                value={roles}
+                onChange={(event) => setRoles(event.target.value)}
+                pattern={"[a-zA-Z0-9_, \\-]+"}
+                maxLength={512}
+              />
+              <small>
+                The local application grant further limits these roles and their
+                tools.
+              </small>
+            </label>
+            <Button
+              type="submit"
+              variant="primary"
+              className="full-width"
+              disabled={busy || !label.trim() || !roles.trim()}
+            >
+              {busy ? "Creating invitation…" : "Create enrollment invitation"}
+            </Button>
+          </form>
+        )}
+      </dialog>
+    </>
+  );
+}
diff --git a/apps/web/src/Home.tsx b/apps/web/src/Home.tsx
new file mode 100644
index 000000000..eba12cd92
--- /dev/null
+++ b/apps/web/src/Home.tsx
@@ -0,0 +1,355 @@
+import { lazy, Suspense, useState } from "react";
+import { Button, DropdownSelect } from "@colossus/ui";
+import {
+  IconActivity,
+  IconArrowRight,
+  IconMessageCircle,
+  IconRefresh,
+  IconServer,
+} from "@tabler/icons-react";
+import { useResource } from "./resources";
+import {
+  dashboard,
+  type Activity,
+  type Analytics,
+  type Dashboard,
+} from "./control-api";
+import type { Thread } from "./api";
+import { RouteLink } from "./navigation";
+import { globalHref, threadHref } from "./routes";
+const ActivityLineChart = lazy(() =>
+  import("@colossus/ui/charts").then((module) => ({
+    default: module.ActivityLineChart,
+  })),
+);
+export function LoadState({
+  loading,
+  error,
+  retry,
+}: {
+  loading: boolean;
+  error: string;
+  retry: () => void;
+}) {
+  return error ? (
+    <div className="alert" role="alert">
+      {error}
+      <Button onClick={retry}>Retry</Button>
+    </div>
+  ) : loading ? (
+    <p className="muted" role="status">
+      Loading…
+    </p>
+  ) : null;
+}
+export function Metrics({
+  items,
+}: {
+  items: { label: string; value: number | string; note?: string }[];
+}) {
+  return (
+    <div className="metric-grid">
+      {items.map((item) => (
+        <div className="metric-card" key={item.label}>
+          <span>{item.label}</span>
+          <strong>
+            {typeof item.value === "number"
+              ? item.value.toLocaleString()
+              : item.value}
+          </strong>
+          {item.note ? <small>{item.note}</small> : null}
+        </div>
+      ))}
+    </div>
+  );
+}
+export type ActivityDays = 7 | 30 | 90;
+export function ActivityRange({
+  days,
+  onChange,
+}: {
+  days: ActivityDays;
+  onChange: (days: ActivityDays) => void;
+}) {
+  return (
+    <label className="activity-range-selector">
+      <span className="sr-only">Activity time range</span>
+      <DropdownSelect
+        aria-label="Activity time range"
+        value={String(days)}
+        onChange={(event) =>
+          onChange(Number(event.target.value) as ActivityDays)
+        }
+      >
+        <option value="7">Last 7 days</option>
+        <option value="30">Last 30 days</option>
+        <option value="90">Last 90 days</option>
+      </DropdownSelect>
+    </label>
+  );
+}
+export function ActivityChart({
+  activity,
+  days = 7,
+  onDaysChange,
+}: {
+  activity: Activity[];
+  days?: ActivityDays;
+  onDaysChange?: ((days: ActivityDays) => void) | undefined;
+}) {
+  const totals = { runs: 0, completed: 0, failed: 0 };
+  for (const day of activity) {
+    totals.runs += day.runs;
+    totals.completed += day.completed;
+    totals.failed += day.failed;
+  }
+  return (
+    <section className="control-card activity-line-card">
+      <header className="activity-line-heading">
+        <div>
+          <h3>
+            <IconActivity size={17} aria-hidden="true" />
+            Run activity
+          </h3>
+          <p>Daily execution outcomes over the last {days} days.</p>
+        </div>
+        {onDaysChange ? (
+          <ActivityRange days={days} onChange={onDaysChange} />
+        ) : null}
+      </header>
+      {activity.length ? (
+        <div className="activity-line-summary">
+          {[
+            { label: "Total runs", value: totals.runs },
+            { label: "Completed", value: totals.completed },
+            { label: "Failed", value: totals.failed },
+          ].map((item) => (
+            <div key={item.label}>
+              <span>{item.label}</span>
+              <strong>{item.value.toLocaleString()}</strong>
+            </div>
+          ))}
+        </div>
+      ) : null}
+      <Suspense
+        fallback={
+          <p className="shared-chart-empty" role="status">
+            Loading chart…
+          </p>
+        }
+      >
+        <ActivityLineChart data={activity} />
+      </Suspense>
+    </section>
+  );
+}
+export function Home({
+  onOpen,
+  onFleet,
+}: {
+  onOpen: (thread: Thread) => void;
+  onFleet: () => void;
+}) {
+  const [days, setDays] = useState<ActivityDays>(7);
+  const resource = useResource<Dashboard>(dashboard(days), 15000),
+    data = resource.data;
+  return (
+    <section className="control-page">
+      <header className="page-heading">
+        <div>
+          <span className="eyebrow">Overview</span>
+          <h1>Your Control Plane</h1>
+          <p>
+            Connected agents, active conversations, and work across your
+            projects.
+          </p>
+        </div>
+        <div className="activity-header-controls">
+          {!data ? <ActivityRange days={days} onChange={setDays} /> : null}
+          <Button onClick={resource.refresh}>
+            <IconRefresh size={16} aria-hidden="true" />
+            Refresh
+          </Button>
+        </div>
+      </header>
+      <LoadState {...resource} retry={resource.refresh} />
+      {data ? (
+        <>
+          <Metrics
+            items={[
+              {
+                label: "Agents online",
+                value: data.counts.online_agents,
+                note: `of ${data.counts.agents} enrolled agents`,
+              },
+              { label: "Active runs", value: data.counts.active_runs },
+              { label: "Queued tasks", value: data.counts.queued_tasks },
+              { label: "Projects", value: data.counts.projects },
+            ]}
+          />
+          <div className="dashboard-grid">
+            <ActivityChart
+              activity={data.activity}
+              days={days}
+              onDaysChange={setDays}
+            />
+            <section className="control-card">
+              <header>
+                <h3>
+                  <IconServer size={17} aria-hidden="true" />
+                  Fleet
+                </h3>
+                <RouteLink
+                  className="ui-button ui-button--tertiary"
+                  href={globalHref("fleet")}
+                  onNavigate={onFleet}
+                >
+                  Open Fleet
+                  <IconArrowRight size={16} aria-hidden="true" />
+                </RouteLink>
+              </header>
+              <dl className="stat-list">
+                <div>
+                  <dt>Hosts</dt>
+                  <dd>{data.counts.hosts}</dd>
+                </div>
+                <div>
+                  <dt>Enrolled agents</dt>
+                  <dd>{data.counts.agents}</dd>
+                </div>
+                <div>
+                  <dt>Retained conversations</dt>
+                  <dd>{data.counts.threads}</dd>
+                </div>
+                <div>
+                  <dt>Failed runs · {days} days</dt>
+                  <dd>{data.counts.failed_runs}</dd>
+                </div>
+              </dl>
+              <p className="field-help">
+                Run failures report execution outcomes. They are not policy
+                violation counts.
+              </p>
+            </section>
+          </div>
+          <section className="control-card">
+            <header>
+              <h3>
+                <IconMessageCircle size={17} aria-hidden="true" />
+                Recent conversations
+              </h3>
+              <span className="muted">Across visible projects</span>
+            </header>
+            {data.recent_threads.length ? (
+              <ul className="recent-list">
+                {data.recent_threads.map(({ thread, project_name }) => (
+                  <li key={thread.thread_id}>
+                    <RouteLink
+                      href={threadHref(thread.project_id, thread.thread_id)}
+                      onNavigate={() => onOpen(thread)}
+                    >
+                      <span>
+                        <strong>
+                          {thread.title || "Untitled conversation"}
+                        </strong>
+                        <small>
+                          {project_name} ·{" "}
+                          {thread.source === "runtime"
+                            ? "Shared local session"
+                            : "Control Plane conversation"}
+                        </small>
+                      </span>
+                      <time dateTime={thread.updated_at}>
+                        {new Date(thread.updated_at).toLocaleDateString(
+                          undefined,
+                          { month: "short", day: "numeric" },
+                        )}
+                      </time>
+                      <IconArrowRight size={16} aria-hidden="true" />
+                    </RouteLink>
+                  </li>
+                ))}
+              </ul>
+            ) : (
+              <p className="empty-copy">
+                Start a conversation from an agent in Fleet.
+              </p>
+            )}
+          </section>
+          {data.telemetry && !data.telemetry.complete ? (
+            <p className="sync-notice">
+              This overview covers a bounded set of retained records.{" "}
+              {data.telemetry.description}
+            </p>
+          ) : null}
+        </>
+      ) : null}
+    </section>
+  );
+}
+export function AnalyticsPanel({ path }: { path: string }) {
+  const [days, setDays] = useState<ActivityDays>(7);
+  const resource = useResource<Analytics>(
+      `${path}${path.includes("?") ? "&" : "?"}days=${days}`,
+      15000,
+    ),
+    data = resource.data;
+  return (
+    <>
+      <div className="analytics-range-toolbar">
+        <ActivityRange days={days} onChange={setDays} />
+      </div>
+      <LoadState {...resource} retry={resource.refresh} />
+      {data ? (
+        <>
+          <Metrics
+            items={[
+              { label: "Total runs", value: data.counts.runs },
+              { label: "Completed", value: data.counts.completed },
+              { label: "Failed", value: data.counts.failed },
+              {
+                label: "Active / queued",
+                value: `${data.counts.active} / ${data.counts.queued}`,
+              },
+            ]}
+          />
+          <ActivityChart activity={data.activity} days={days} />
+          <section className="control-card">
+            <header>
+              <h3>Released usage</h3>
+              <span className="muted">Past {data.window_days} days</span>
+            </header>
+            <Metrics
+              items={[
+                {
+                  label: "Input tokens",
+                  value: data.usage.input_tokens ?? "Unavailable",
+                },
+                {
+                  label: "Output tokens",
+                  value: data.usage.output_tokens ?? "Unavailable",
+                },
+                {
+                  label: "Estimated cost",
+                  value:
+                    data.usage.estimated_cost === null
+                      ? "Unavailable"
+                      : `${data.usage.currency ?? ""} ${data.usage.estimated_cost.toFixed(2)}`,
+                },
+              ]}
+            />
+            <p className="field-help">
+              {data.usage.coverage ||
+                "Usage includes only reliable provider values released by runtimes. Unavailable values are not zero."}
+            </p>
+          </section>
+          {data.telemetry && !data.telemetry.complete ? (
+            <p className="sync-notice">
+              Analytics coverage is incomplete. {data.telemetry.description}
+            </p>
+          ) : null}
+        </>
+      ) : null}
+    </>
+  );
+}
diff --git a/apps/web/src/Interactions.tsx b/apps/web/src/Interactions.tsx
new file mode 100644
index 000000000..29c76a2e1
--- /dev/null
+++ b/apps/web/src/Interactions.tsx
@@ -0,0 +1,266 @@
+import { Button, TextInput } from "@colossus/ui";
+import { useRef, useState } from "react";
+import { IconShieldCheck, IconMessageQuestion } from "@tabler/icons-react";
+import {
+  request,
+  projectPath,
+  awaitReceipt,
+  type CommandReceipt,
+  type Interaction,
+  type Permission,
+} from "./api";
+export function Interactions({
+  interactions,
+  project,
+  task,
+  permissions,
+  onUpdate,
+  onError,
+}: {
+  interactions: Interaction[];
+  project: string;
+  task: string;
+  permissions: Permission[];
+  onUpdate: () => void;
+  onError: (message: string) => void;
+}) {
+  const [busy, setBusy] = useState<string | null>(null);
+  const [notice, setNotice] = useState("");
+  const attempts = useRef(
+    new Map<string, { mutation: string; idempotency: string }>(),
+  );
+  const [answers, setAnswers] = useState<Record<string, string>>({});
+  async function respond(interaction: Interaction, response: unknown) {
+    const signature = JSON.stringify([
+      interaction.interaction_id,
+      interaction.etag,
+      response,
+    ]);
+    let attempt = attempts.current.get(signature);
+    if (!attempt) {
+      attempt = {
+        mutation: crypto.randomUUID(),
+        idempotency: crypto.randomUUID(),
+      };
+      attempts.current.set(signature, attempt);
+    }
+    setBusy(interaction.interaction_id);
+    setNotice("");
+    try {
+      const path = `${projectPath(project)}/tasks/${task}`;
+      const { command } = await request<{ command: CommandReceipt }>(
+        `${path}/respond`,
+        {
+          mutation_id: attempt.mutation,
+          request: {
+            run_id: interaction.run_id,
+            interaction_id: interaction.interaction_id,
+            etag: interaction.etag,
+            idempotency_key: attempt.idempotency,
+            response,
+          },
+        },
+      );
+      const settled = await awaitReceipt(path, command);
+      setNotice(
+        settled
+          ? "Response confirmed by the runtime."
+          : "Response queued. It will be delivered when the runtime reconnects; retrying uses this same response.",
+      );
+      onUpdate();
+    } catch (error) {
+      onError(error instanceof Error ? error.message : "Response failed.");
+    } finally {
+      setBusy(null);
+    }
+  }
+  return (
+    <>
+      {notice && (
+        <p className="muted" role="status">
+          {notice}
+        </p>
+      )}
+      {interactions
+        .filter((interaction) => interaction.status === "pending")
+        .map((interaction) => {
+          const approval = interaction.content.approval,
+            prompt = interaction.content.user_prompt;
+          const allowed =
+            interaction.respondable_by_caller &&
+            permissions.includes(approval ? "approve" : "control");
+          return (
+            <section
+              className="interaction"
+              key={interaction.interaction_id}
+              aria-label={approval ? "Approval required" : "Answer required"}
+            >
+              <div className="interaction-heading">
+                {approval ? (
+                  <IconShieldCheck size={19} />
+                ) : (
+                  <IconMessageQuestion size={19} />
+                )}
+                <h3>
+                  {approval ? "Approval required" : "Your input is needed"}
+                </h3>
+              </div>
+              {approval ? (
+                <>
+                  <p>{approval.reason}</p>
+                  {approval.command_context && (
+                    <div className="command-review">
+                      <p>{approval.command_context.justification}</p>
+                      <dl>
+                        <dt>Executable</dt>
+                        <dd>
+                          <code>{approval.command_context.executable}</code>
+                        </dd>
+                        <dt>Arguments</dt>
+                        <dd>
+                          <ol>
+                            {approval.command_context.arguments.map(
+                              (argument, index) => (
+                                <li key={index}>
+                                  <code>{JSON.stringify(argument)}</code>
+                                </li>
+                              ),
+                            )}
+                          </ol>
+                        </dd>
+                        <dt>Working directory</dt>
+                        <dd>
+                          <code>
+                            {approval.command_context.working_directory}
+                          </code>
+                        </dd>
+                      </dl>
+                      {approval.command_context.redacted && (
+                        <p className="muted">
+                          Credentials are redacted from these prepared command
+                          details.
+                        </p>
+                      )}
+                    </div>
+                  )}
+                  <dl>
+                    <dt>Action</dt>
+                    <dd>{approval.action}</dd>
+                    <dt>Resource</dt>
+                    <dd>{approval.resource}</dd>
+                    <dt>Risk</dt>
+                    <dd>{approval.risk ?? "Unspecified"}</dd>
+                  </dl>
+                  <div className="actions">
+                    <Button
+                      variant="primary"
+                      disabled={!allowed || busy !== null}
+                      onClick={() =>
+                        void respond(interaction, {
+                          approval: {
+                            approved: true,
+                            request_hash: approval.request_hash,
+                          },
+                        })
+                      }
+                    >
+                      Approve this action
+                    </Button>
+                    <Button
+                      variant="secondary"
+                      disabled={!allowed || busy !== null}
+                      onClick={() =>
+                        void respond(interaction, {
+                          approval: {
+                            approved: false,
+                            request_hash: approval.request_hash,
+                          },
+                        })
+                      }
+                    >
+                      Deny
+                    </Button>
+                  </div>
+                </>
+              ) : prompt ? (
+                <>
+                  <p>{prompt.question}</p>
+                  <div className="choice-actions">
+                    {prompt.choices.map((choice) => (
+                      <Button
+                        key={choice.choice_id}
+                        variant="secondary"
+                        disabled={!allowed || busy !== null}
+                        onClick={() =>
+                          void respond(interaction, {
+                            prompt: {
+                              choice: {
+                                choice_id: choice.choice_id,
+                                label: choice.label,
+                              },
+                            },
+                          })
+                        }
+                      >
+                        {choice.label}
+                      </Button>
+                    ))}
+                  </div>
+                  {prompt.allow_free_form && (
+                    <form
+                      onSubmit={(event) => {
+                        event.preventDefault();
+                        void respond(interaction, {
+                          prompt: {
+                            free_form:
+                              answers[interaction.interaction_id] ?? "",
+                          },
+                        });
+                      }}
+                    >
+                      <label
+                        className="sr-only"
+                        htmlFor={`answer-${interaction.interaction_id}`}
+                      >
+                        Your answer
+                      </label>
+                      <TextInput
+                        id={`answer-${interaction.interaction_id}`}
+                        value={answers[interaction.interaction_id] ?? ""}
+                        onChange={(event) =>
+                          setAnswers({
+                            ...answers,
+                            [interaction.interaction_id]: event.target.value,
+                          })
+                        }
+                        maxLength={65536}
+                        disabled={!allowed || busy !== null}
+                        placeholder="Write your answer…"
+                      />
+                      <Button
+                        type="submit"
+                        variant="primary"
+                        disabled={
+                          !allowed ||
+                          busy !== null ||
+                          !answers[interaction.interaction_id]?.trim()
+                        }
+                      >
+                        Send answer
+                      </Button>
+                    </form>
+                  )}
+                </>
+              ) : null}
+              {!allowed && (
+                <p className="muted">
+                  Your project permissions or local runtime grant do not allow
+                  this response.
+                </p>
+              )}
+            </section>
+          );
+        })}
+    </>
+  );
+}
diff --git a/apps/web/src/Projects.test.tsx b/apps/web/src/Projects.test.tsx
new file mode 100644
index 000000000..472acd3fc
--- /dev/null
+++ b/apps/web/src/Projects.test.tsx
@@ -0,0 +1,153 @@
+// @vitest-environment happy-dom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import { Projects } from "./Projects";
+import type { Me, Project } from "./control-api";
+
+const project = (
+  id: string,
+  name: string,
+  parent: string | null = null,
+  archived = false,
+): Project => ({
+  id,
+  name,
+  parent_project_id: parent,
+  archived,
+  description: `${name} description`,
+  revision: 1,
+  created_at: "2026-10-07T10:00:00Z",
+  updated_at: "2026-10-07T10:00:00Z",
+});
+const projects = [
+  project("parent", "Alpha"),
+  project("child", "Beta", "parent"),
+  project("old", "Archived acceptance", null, true),
+];
+const me: Me = {
+  user: {
+    id: "user",
+    display_name: "Operator",
+    email: null,
+    active: true,
+    is_admin: true,
+    revision: 1,
+    created_at: "",
+    updated_at: "",
+  },
+  projects,
+  memberships: [
+    {
+      user_id: "user",
+      subject: "user",
+      project_id: "child",
+      role: "viewer",
+      permissions: ["read"],
+    },
+  ],
+};
+let container: HTMLDivElement, root: Root;
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+});
+afterEach(async () => {
+  await act(() => root.unmount());
+  container.remove();
+  vi.unstubAllGlobals();
+});
+async function render(selected = "", user = me) {
+  await act(async () =>
+    root.render(
+      <Projects
+        me={user}
+        selected={selected}
+        onSelect={() => {}}
+        permissions={["read"]}
+        onRefresh={() => {}}
+        tasks={<div>Project tasks fixture</div>}
+        view="tasks"
+      />,
+    ),
+  );
+}
+it("shows an active searchable project directory without a selection placeholder or backend calls", async () => {
+  const fetch = vi.fn();
+  vi.stubGlobal("fetch", fetch);
+  await render();
+  expect(container.querySelector("h1")?.textContent).toBe("Projects");
+  expect(
+    container.querySelector('table[aria-label="Projects"]'),
+  ).not.toBeNull();
+  expect(container.textContent).toContain("Alpha");
+  expect(container.textContent).toContain("Beta");
+  expect(container.textContent).not.toContain("Archived acceptance");
+  expect(container.textContent).not.toContain("Select a project");
+  expect(container.textContent).toContain("Administrator visibility");
+  expect(container.textContent).toContain("Viewer");
+  expect(
+    container.querySelector('a[href="/projects/child/overview"]'),
+  ).not.toBeNull();
+  expect(fetch).not.toHaveBeenCalled();
+  const search = container.querySelector<HTMLInputElement>(
+    'input[aria-label="Search projects"]',
+  )!;
+  await act(() => {
+    Object.getOwnPropertyDescriptor(
+      HTMLInputElement.prototype,
+      "value",
+    )!.set!.call(search, "Beta");
+    search.dispatchEvent(new Event("input", { bubbles: true }));
+  });
+  expect(container.querySelector("tbody")?.textContent).toContain("Beta");
+  expect(
+    container
+      .querySelector("tbody")
+      ?.querySelector('a[href="/projects/parent/overview"]'),
+  ).not.toBeNull();
+  expect(container.querySelectorAll("tbody tr")).toHaveLength(1);
+});
+it("makes archived projects an explicit filter instead of mixing them into the default directory", async () => {
+  await render();
+  await act(() =>
+    container
+      .querySelector<HTMLButtonElement>(
+        '[role="combobox"][aria-label="Project status"]',
+      )!
+      .click(),
+  );
+  const option = [
+    ...document.querySelectorAll<HTMLElement>('[role="option"]'),
+  ].find((entry) => entry.textContent?.trim() === "Archived projects")!;
+  await act(() => option.click());
+  expect(container.querySelector("tbody")?.textContent).toContain(
+    "Archived acceptance",
+  );
+  expect(container.querySelector("tbody")?.textContent).not.toContain("Beta");
+});
+it("shows selected project context and existing content without repeating the directory", async () => {
+  await render("child");
+  expect(container.querySelector("h1")?.textContent).toBe("Beta");
+  expect(container.querySelector('.back[href="/projects"]')).not.toBeNull();
+  expect(
+    container.querySelector('[aria-label="Project directory"]'),
+  ).toBeNull();
+  expect(container.textContent).toContain("Within Alpha");
+  expect(container.textContent).toContain("Project tasks fixture");
+  expect(
+    container.querySelector('a[href="/projects/child/access"]'),
+  ).not.toBeNull();
+});
+it("keeps project creation admin-only and gives a concise empty directory state", async () => {
+  await render("", {
+    ...me,
+    user: { ...me.user, is_admin: false },
+    projects: [],
+  });
+  expect(container.textContent).toContain("No visible projects");
+  expect(container.textContent).not.toContain("New project");
+  expect(container.textContent).not.toContain("Select a project");
+});
diff --git a/apps/web/src/Projects.tsx b/apps/web/src/Projects.tsx
new file mode 100644
index 000000000..2283bda3c
--- /dev/null
+++ b/apps/web/src/Projects.tsx
@@ -0,0 +1,898 @@
+import { useEffect, useMemo, useRef, useState } from "react";
+import { Button, DropdownSelect, TextInput } from "@colossus/ui";
+import { DataTable, type DataTableColumn } from "@colossus/ui/data-table";
+import {
+  IconFolder,
+  IconPlus,
+  IconShield,
+  IconUsers,
+} from "@tabler/icons-react";
+import { projectPath, request, type Permission } from "./api";
+import {
+  projectRoles,
+  projectPermissions,
+  type Member,
+  type Me,
+  type PolicyBaseline,
+  type Project,
+  type ProjectRole,
+} from "./control-api";
+import { errorMessage, useResource } from "./resources";
+import { AnalyticsPanel, LoadState } from "./Home";
+import { RouteLink } from "./navigation";
+import { globalHref, projectHref, type ProjectView } from "./routes";
+export function SectionTabs({
+  items,
+  current,
+  onChange,
+  hrefFor,
+}: {
+  items: { id: string; label: string }[];
+  current: string;
+  onChange: (value: string) => void;
+  hrefFor?: ((value: string) => string) | undefined;
+}) {
+  return (
+    <nav className="section-tabs" aria-label="Section views">
+      {items.map((item) =>
+        hrefFor ? (
+          <RouteLink
+            key={item.id}
+            className="ui-button ui-button--tertiary"
+            href={hrefFor(item.id)}
+            aria-current={current === item.id ? "page" : undefined}
+            onNavigate={() => onChange(item.id)}
+          >
+            {item.label}
+          </RouteLink>
+        ) : (
+          <Button
+            key={item.id}
+            variant="tertiary"
+            aria-current={current === item.id ? "page" : undefined}
+            onClick={() => onChange(item.id)}
+          >
+            {item.label}
+          </Button>
+        ),
+      )}
+    </nav>
+  );
+}
+export function Projects({
+  me,
+  selected,
+  onSelect,
+  permissions,
+  onRefresh,
+  tasks,
+  view,
+  onView,
+}: {
+  me: Me;
+  selected: string;
+  onSelect: (id: string) => void;
+  permissions: Permission[];
+  onRefresh: () => void;
+  tasks: React.ReactNode;
+  view?: ProjectView;
+  onView?: (value: ProjectView) => void;
+}) {
+  const [localTab, setTab] = useState("overview"),
+    [editing, setEditing] = useState(false),
+    [visibility, setVisibility] = useState("active");
+  const tab = view ?? localTab;
+  const project = me.projects.find((item) => item.id === selected);
+  useEffect(() => {
+    setEditing(false);
+  }, [selected]);
+  return (
+    <section className="control-page">
+      {project ? (
+        <RouteLink
+          href={globalHref("projects")}
+          className="ui-button ui-button--tertiary back"
+        >
+          All projects
+        </RouteLink>
+      ) : null}
+      <header className="page-heading">
+        <div>
+          <span className="eyebrow">Projects</span>
+          <h1>{project?.name ?? "Projects"}</h1>
+          <p>
+            {project
+              ? project.description ||
+                "Review activity, work, and access for this project."
+              : "Find your projects and open their work, activity, and access settings."}
+          </p>
+        </div>
+        <div className="project-page-actions">
+          {!project ? (
+            <label className="project-status-filter">
+              <span>Show</span>
+              <DropdownSelect
+                aria-label="Project status"
+                value={visibility}
+                onChange={(event) => setVisibility(event.target.value)}
+              >
+                <option value="active">Active projects</option>
+                <option value="archived">Archived projects</option>
+                <option value="all">All projects</option>
+              </DropdownSelect>
+            </label>
+          ) : null}
+          {me.user.is_admin ? (
+            <Button onClick={() => setEditing(true)}>
+              <IconPlus size={16} aria-hidden="true" />
+              New project
+            </Button>
+          ) : null}
+        </div>
+      </header>
+      {editing ? (
+        <ProjectEditor
+          projects={me.projects}
+          onSaved={() => {
+            setEditing(false);
+            onRefresh();
+          }}
+          onCancel={() => setEditing(false)}
+        />
+      ) : null}
+      {project ? (
+        <>
+          <div className="project-context">
+            <span
+              className={`status ${project.archived ? "status-cancelled" : "status-completed"}`}
+            >
+              {project.archived ? "Archived" : "Active"}
+            </span>
+            {project.parent_project_id ? (
+              <span>
+                Within{" "}
+                {me.projects.find(
+                  (item) => item.id === project.parent_project_id,
+                )?.name ?? "parent project"}
+              </span>
+            ) : (
+              <span>Top-level project</span>
+            )}
+          </div>
+          <SectionTabs
+            current={tab}
+            onChange={(value) =>
+              onView ? onView(value as ProjectView) : setTab(value)
+            }
+            hrefFor={(value) => projectHref(selected, value as ProjectView)}
+            items={[
+              { id: "overview", label: "Overview" },
+              { id: "analytics", label: "Analytics" },
+              { id: "tasks", label: "Tasks" },
+              { id: "access", label: "Access" },
+              { id: "settings", label: "Settings" },
+            ]}
+          />
+          {tab === "overview" || tab === "analytics" ? (
+            <>
+              <AnalyticsPanel path={`${projectPath(selected)}/analytics`} />
+            </>
+          ) : tab === "tasks" ? (
+            tasks
+          ) : tab === "access" ? (
+            <ProjectAccess
+              key={selected}
+              project={selected}
+              canManage={permissions.includes("administer")}
+              onChanged={onRefresh}
+            />
+          ) : (
+            <>
+              <section className="control-card">
+                <header>
+                  <h3>Project details</h3>
+                </header>
+                {permissions.includes("administer") ? (
+                  <ProjectEditor
+                    key={`${project.id}:${project.revision}`}
+                    project={project}
+                    projects={me.projects}
+                    onSaved={onRefresh}
+                    allowHierarchy={me.user.is_admin}
+                  />
+                ) : (
+                  <>
+                    <dl className="stat-list">
+                      <div>
+                        <dt>Name</dt>
+                        <dd>{project.name}</dd>
+                      </div>
+                      <div>
+                        <dt>Parent</dt>
+                        <dd>
+                          {me.projects.find(
+                            (item) => item.id === project.parent_project_id,
+                          )?.name ?? "None"}
+                        </dd>
+                      </div>
+                    </dl>
+                    <p className="field-help">
+                      A Control Plane administrator manages project details.
+                    </p>
+                  </>
+                )}
+              </section>
+              <PolicyEditor
+                key={selected}
+                project={selected}
+                canManage={permissions.includes("administer")}
+              />
+            </>
+          )}
+        </>
+      ) : (
+        <ProjectDirectory me={me} visibility={visibility} onSelect={onSelect} />
+      )}
+    </section>
+  );
+}
+
+const projectRowId = (project: Project) => project.id;
+const projectSorting = [{ id: "project", desc: false }];
+
+function ProjectDirectory({
+  me,
+  visibility,
+  onSelect,
+}: {
+  me: Me;
+  visibility: string;
+  onSelect: (id: string) => void;
+}) {
+  const projects = useMemo(
+    () =>
+      me.projects.filter(
+        (project) =>
+          visibility === "all" ||
+          project.archived === (visibility === "archived"),
+      ),
+    [me.projects, visibility],
+  );
+  const columns = useMemo<DataTableColumn<Project>[]>(() => {
+    const names = new Map(
+        me.projects.map((project) => [project.id, project.name]),
+      ),
+      memberships = new Map(
+        me.memberships.map((member) => [member.project_id, member]),
+      );
+    const role = (project: Project) => {
+      const membership = memberships.get(project.id);
+      return membership
+        ? (projectRoles.find((entry) => entry.value === membership.role)
+            ?.label ?? "Project member")
+        : me.user.is_admin
+          ? "Administrator visibility"
+          : "Project access";
+    };
+    return [
+      {
+        id: "project",
+        label: "Project",
+        value: (project) => `${project.name} ${project.description}`,
+        rowHeader: true,
+        hideable: false,
+        cell: (project) => (
+          <div className="catalog-identity">
+            <span className="resource-icon">
+              <IconFolder size={17} aria-hidden="true" />
+            </span>
+            <div className="project-table-copy">
+              <RouteLink
+                className="catalog-name"
+                href={projectHref(project.id)}
+                onNavigate={() => onSelect(project.id)}
+              >
+                {project.name}
+              </RouteLink>
+              {project.description ? (
+                <small>{project.description}</small>
+              ) : null}
+            </div>
+          </div>
+        ),
+      },
+      {
+        id: "parent",
+        label: "Parent",
+        value: (project) => names.get(project.parent_project_id ?? "") ?? "",
+        cell: (project) =>
+          project.parent_project_id ? (
+            names.has(project.parent_project_id) ? (
+              <RouteLink
+                href={projectHref(project.parent_project_id)}
+                className="project-parent-link"
+                onNavigate={() => onSelect(project.parent_project_id!)}
+              >
+                {names.get(project.parent_project_id)}
+              </RouteLink>
+            ) : (
+              <span className="muted">Parent not visible</span>
+            )
+          ) : (
+            <span className="muted">Top-level</span>
+          ),
+      },
+      {
+        id: "status",
+        label: "Status",
+        value: (project) => (project.archived ? "Archived" : "Active"),
+        cell: (project) => (
+          <span
+            className={`status ${project.archived ? "status-cancelled" : "status-completed"}`}
+          >
+            {project.archived ? "Archived" : "Active"}
+          </span>
+        ),
+      },
+      {
+        id: "access",
+        label: "Your access",
+        value: role,
+        cell: (project) => (
+          <div className="project-table-copy">
+            <strong>{role(project)}</strong>
+            <small>
+              {projectPermissions(me, project.id)
+                .map((permission) =>
+                  permission === "administer"
+                    ? "Manage"
+                    : permission[0]!.toUpperCase() + permission.slice(1),
+                )
+                .join(" · ") || "No project permissions"}
+            </small>
+          </div>
+        ),
+      },
+    ];
+  }, [me, onSelect]);
+  return (
+    <section className="project-table-directory" aria-label="Project directory">
+      <DataTable
+        data={projects}
+        columns={columns}
+        getRowId={projectRowId}
+        label="Projects"
+        itemLabel="projects"
+        search={{ columnId: "project", label: "Search projects" }}
+        initialSorting={projectSorting}
+        empty={
+          <div className="project-table-empty">
+            <IconFolder size={24} aria-hidden="true" />
+            <strong>
+              {me.projects.length
+                ? "No projects match this view"
+                : "No visible projects"}
+            </strong>
+            <span>
+              {me.projects.length
+                ? "Change the status filter or search to find another project."
+                : me.user.is_admin
+                  ? "Create a project to organize agent work."
+                  : "Ask an administrator for project access."}
+            </span>
+          </div>
+        }
+      />
+    </section>
+  );
+}
+export function ProjectEditor({
+  project,
+  projects,
+  onSaved,
+  onCancel,
+  allowHierarchy = true,
+}: {
+  project?: Project;
+  projects: Project[];
+  onSaved: () => void;
+  onCancel?: () => void;
+  allowHierarchy?: boolean;
+}) {
+  const [name, setName] = useState(project?.name ?? ""),
+    [description, setDescription] = useState(project?.description ?? ""),
+    [parent, setParent] = useState(project?.parent_project_id ?? ""),
+    [archived, setArchived] = useState(project?.archived ?? false),
+    [busy, setBusy] = useState(false),
+    [error, setError] = useState("");
+  const creationId = useRef(crypto.randomUUID().replaceAll("-", ""));
+  const candidates = projects.filter((item) => {
+    let cursor: Project | undefined = item;
+    const seen = new Set<string>();
+    while (cursor) {
+      if (cursor.id === project?.id || seen.has(cursor.id)) return false;
+      seen.add(cursor.id);
+      cursor = projects.find((p) => p.id === cursor?.parent_project_id);
+    }
+    return true;
+  });
+  async function save() {
+    setBusy(true);
+    setError("");
+    try {
+      await request(
+        project ? projectPath(project.id) : "/api/projects",
+        {
+          name: name.trim(),
+          description: description.trim(),
+          parent_project_id: parent || null,
+          ...(project
+            ? { revision: project.revision, archived }
+            : { id: creationId.current }),
+        },
+        undefined,
+        project ? "PATCH" : undefined,
+      );
+      onSaved();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+  return (
+    <form
+      className="management-form"
+      onSubmit={(event) => {
+        event.preventDefault();
+        void save();
+      }}
+    >
+      <h3>{project ? "Edit project" : "Create project"}</h3>
+      {error ? (
+        <div className="alert" role="alert">
+          {error}
+        </div>
+      ) : null}
+      <label>
+        <span>Name</span>
+        <TextInput
+          required
+          maxLength={200}
+          value={name}
+          onChange={(e) => setName(e.target.value)}
+        />
+      </label>
+      <label>
+        <span>Description</span>
+        <textarea
+          className="ui-input"
+          rows={3}
+          value={description}
+          onChange={(e) => setDescription(e.target.value)}
+          maxLength={2000}
+        />
+      </label>
+      <label>
+        <span>Parent project</span>
+        <DropdownSelect
+          disabled={!allowHierarchy}
+          value={parent}
+          onChange={(e) => setParent(e.target.value)}
+        >
+          <option value="">None · top-level project</option>
+          {candidates.map((item) => (
+            <option value={item.id} key={item.id}>
+              {item.name}
+            </option>
+          ))}
+        </DropdownSelect>
+      </label>
+      <p className="field-help">
+        Nesting organizes projects. Members of a parent receive no automatic
+        access to its children.
+      </p>
+      {project ? (
+        <label className="checkbox-field">
+          <input
+            type="checkbox"
+            checked={archived}
+            onChange={(e) => setArchived(e.target.checked)}
+          />
+          Archived
+        </label>
+      ) : null}
+      <div className="form-actions">
+        <Button type="submit" variant="primary" disabled={busy || !name.trim()}>
+          {busy ? "Saving…" : "Save project"}
+        </Button>
+        {onCancel ? <Button onClick={onCancel}>Cancel</Button> : null}
+      </div>
+    </form>
+  );
+}
+export function ProjectAccess({
+  project,
+  canManage,
+  onChanged,
+}: {
+  project: string;
+  canManage: boolean;
+  onChanged: () => void;
+}) {
+  const resource = useResource<{
+      members: Member[];
+      next_cursor?: string | null;
+    }>(`${projectPath(project)}/members`),
+    [more, setMore] = useState<Member[]>([]),
+    [cursor, setCursor] = useState<string | null>(null),
+    [query, setQuery] = useState(""),
+    [search, setSearch] = useState(""),
+    [candidate, setCandidate] = useState(""),
+    [role, setRole] = useState<ProjectRole>("viewer"),
+    [busy, setBusy] = useState(false),
+    [error, setError] = useState("");
+  useEffect(() => {
+    const timer = setTimeout(() => setSearch(query.trim()), 250);
+    return () => clearTimeout(timer);
+  }, [query]);
+  const candidates = useResource<{
+    users: { id: string; display_name: string }[];
+  }>(
+    canManage && search.length >= 2
+      ? `${projectPath(project)}/member-candidates?query=${encodeURIComponent(search)}`
+      : null,
+  );
+  useEffect(() => {
+    setMore([]);
+    setCursor(resource.data?.next_cursor ?? null);
+  }, [resource.data]);
+  async function mutate(body: unknown, userId?: string, remove = false) {
+    setBusy(true);
+    setError("");
+    try {
+      await request(
+        `${projectPath(project)}/members${userId ? `/${encodeURIComponent(userId)}${remove ? `?revision=${(body as { revision: number }).revision}` : ""}` : ""}`,
+        remove
+          ? undefined
+          : userId
+            ? { ...(body as object), user_id: userId }
+            : body,
+        undefined,
+        remove ? "DELETE" : userId ? "PATCH" : undefined,
+      );
+      resource.refresh();
+      onChanged();
+      setCandidate("");
+      setQuery("");
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+  return (
+    <section className="control-card">
+      <header>
+        <h3>
+          <IconUsers size={17} aria-hidden="true" />
+          Project access
+        </h3>
+      </header>
+      <p className="field-help">
+        Roles grant explicit project permissions. Agent tools and approvals
+        remain constrained by the host’s native grant.
+      </p>
+      <LoadState {...resource} retry={resource.refresh} />
+      {error ? (
+        <div className="alert" role="alert">
+          {error}
+        </div>
+      ) : null}
+      {canManage ? (
+        <form
+          className="member-invite"
+          onSubmit={(e) => {
+            e.preventDefault();
+            void mutate({ user_id: candidate, role });
+          }}
+        >
+          <label>
+            <span>Find a user</span>
+            <TextInput
+              value={query}
+              onChange={(e) => {
+                setQuery(e.target.value);
+                setCandidate("");
+              }}
+              placeholder="Type at least two characters"
+            />
+          </label>
+          <label>
+            <span>User</span>
+            <DropdownSelect
+              value={candidate}
+              onChange={(e) => setCandidate(e.target.value)}
+              disabled={!candidates.data?.users.length}
+            >
+              <option value="">Select a user</option>
+              {candidates.data?.users.map((user) => (
+                <option key={user.id} value={user.id}>
+                  {user.display_name}
+                </option>
+              ))}
+            </DropdownSelect>
+          </label>
+          <label>
+            <span>Role</span>
+            <DropdownSelect
+              value={role}
+              onChange={(e) => setRole(e.target.value as ProjectRole)}
+            >
+              {projectRoles.map((item) => (
+                <option key={item.value} value={item.value}>
+                  {item.label}
+                </option>
+              ))}
+            </DropdownSelect>
+          </label>
+          <Button type="submit" disabled={busy || !candidate} variant="primary">
+            Add member
+          </Button>
+          {candidates.error ? (
+            <p className="alert" role="alert">
+              {candidates.error}
+            </p>
+          ) : null}
+        </form>
+      ) : null}
+      <div className="access-list">
+        {[...(resource.data?.members ?? []), ...more].map((member) => (
+          <div key={member.user_id}>
+            <span>
+              <strong>{member.display_name || member.user_id}</strong>
+              <small>
+                {
+                  projectRoles.find((item) => item.value === member.role)
+                    ?.description
+                }
+              </small>
+            </span>
+            {canManage ? (
+              <>
+                <DropdownSelect
+                  aria-label={`Role for ${member.display_name || member.user_id}`}
+                  value={member.role}
+                  disabled={busy}
+                  onChange={(e) =>
+                    void mutate(
+                      { role: e.target.value, revision: member.revision },
+                      member.user_id,
+                    )
+                  }
+                >
+                  {projectRoles.map((item) => (
+                    <option key={item.value} value={item.value}>
+                      {item.label}
+                    </option>
+                  ))}
+                </DropdownSelect>
+                <Button
+                  disabled={busy}
+                  onClick={() => {
+                    if (
+                      window.confirm(
+                        `Remove ${member.display_name || member.user_id} from this project?`,
+                      )
+                    )
+                      void mutate(
+                        { revision: member.revision },
+                        member.user_id,
+                        true,
+                      );
+                  }}
+                >
+                  Remove
+                </Button>
+              </>
+            ) : (
+              <span>
+                {projectRoles.find((item) => item.value === member.role)
+                  ?.label ?? member.role}
+              </span>
+            )}
+          </div>
+        ))}
+      </div>
+      {!resource.loading && !resource.data?.members.length ? (
+        <p className="empty-copy">No explicit project memberships.</p>
+      ) : null}
+      {cursor ? (
+        <Button
+          disabled={busy}
+          onClick={async () => {
+            setBusy(true);
+            try {
+              const value = await request<{
+                members: Member[];
+                next_cursor?: string | null;
+              }>(
+                `${projectPath(project)}/members?after=${encodeURIComponent(cursor)}`,
+              );
+              setMore((current) => [...current, ...value.members]);
+              setCursor(value.next_cursor ?? null);
+            } catch (e) {
+              setError(errorMessage(e));
+            } finally {
+              setBusy(false);
+            }
+          }}
+        >
+          Load more members
+        </Button>
+      ) : null}
+    </section>
+  );
+}
+function lines(value: string) {
+  return value
+    .split(/[,\n]/u)
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+export function PolicyEditor({
+  project,
+  canManage,
+}: {
+  project: string;
+  canManage: boolean;
+}) {
+  const resource = useResource<PolicyBaseline>(
+      `${projectPath(project)}/policy`,
+    ),
+    [profile, setProfile] = useState(""),
+    [approvals, setApprovals] = useState(""),
+    [tools, setTools] = useState(""),
+    [toolLimit, setToolLimit] = useState(false),
+    [busy, setBusy] = useState(false),
+    [error, setError] = useState(""),
+    [notice, setNotice] = useState("");
+  useEffect(() => {
+    if (resource.data) {
+      setProfile(resource.data.required_sandbox_profile ?? "");
+      setApprovals(resource.data.allowed_approval_modes.join("\n"));
+      setTools(resource.data.allowed_tools?.join("\n") ?? "");
+      setToolLimit(resource.data.allowed_tools !== null);
+    }
+  }, [resource.data]);
+  return (
+    <section className="control-card">
+      <header>
+        <h3>
+          <IconShield size={17} aria-hidden="true" />
+          Policy monitoring baseline
+        </h3>
+      </header>
+      <p className="field-help">
+        Compare runtime-reported posture with this project’s expectations.
+        Saving a baseline does not change agent policy or establish independent
+        attestation.
+      </p>
+      <LoadState {...resource} retry={resource.refresh} />
+      {resource.data ? (
+        <form
+          className="management-form"
+          onSubmit={async (e) => {
+            e.preventDefault();
+            setBusy(true);
+            setError("");
+            setNotice("");
+            try {
+              await request(
+                `${projectPath(project)}/policy`,
+                {
+                  revision: resource.data!.revision,
+                  required_sandbox_profile: profile.trim() || null,
+                  allowed_approval_modes: lines(approvals),
+                  allowed_tools: toolLimit ? lines(tools) : null,
+                },
+                undefined,
+                "PATCH",
+              );
+              resource.refresh();
+              setNotice("Monitoring baseline saved.");
+            } catch (error) {
+              setError(errorMessage(error));
+            } finally {
+              setBusy(false);
+            }
+          }}
+        >
+          {error ? (
+            <div className="alert" role="alert">
+              {error}
+              <Button onClick={resource.refresh}>Reload baseline</Button>
+            </div>
+          ) : null}
+          {notice ? (
+            <p role="status" className="notice">
+              {notice}
+            </p>
+          ) : null}
+          <label>
+            <span>Required sandbox profile</span>
+            <TextInput
+              value={profile}
+              onChange={(e) => setProfile(e.target.value)}
+              disabled={!canManage}
+              placeholder="Any profile"
+              maxLength={128}
+            />
+          </label>
+          <fieldset className="approval-options">
+            <legend>Allowed approval modes</legend>
+            <p className="field-help">
+              Leave all unchecked to accept any reported mode.
+            </p>
+            {[
+              { value: "ask", label: "Ask for approval" },
+              { value: "deny", label: "Deny approval obligations" },
+              { value: "risk_auto", label: "Risk-based automatic approval" },
+              { value: "danger_auto", label: "Automatic approval" },
+              { value: "unknown", label: "Unknown / unreported" },
+            ].map((item) => (
+              <label className="checkbox-field" key={item.value}>
+                <input
+                  type="checkbox"
+                  disabled={!canManage}
+                  checked={lines(approvals).includes(item.value)}
+                  onChange={(event) =>
+                    setApprovals(
+                      (event.target.checked
+                        ? [...lines(approvals), item.value]
+                        : lines(approvals).filter(
+                            (value) => value !== item.value,
+                          )
+                      ).join("\n"),
+                    )
+                  }
+                />
+                {item.label}
+              </label>
+            ))}
+          </fieldset>
+          <label className="checkbox-field">
+            <input
+              type="checkbox"
+              checked={toolLimit}
+              onChange={(e) => setToolLimit(e.target.checked)}
+              disabled={!canManage}
+            />
+            Monitor a tool ceiling
+          </label>
+          {toolLimit ? (
+            <label>
+              <span>Allowed tools · one per line</span>
+              <textarea
+                className="ui-input"
+                rows={4}
+                value={tools}
+                onChange={(e) => setTools(e.target.value)}
+                disabled={!canManage}
+              />
+            </label>
+          ) : null}
+          {canManage ? (
+            <Button type="submit" variant="primary" disabled={busy}>
+              {busy ? "Saving…" : "Save baseline"}
+            </Button>
+          ) : (
+            <p className="field-help">
+              A project administrator manages this baseline.
+            </p>
+          )}
+        </form>
+      ) : null}
+    </section>
+  );
+}
diff --git a/apps/web/src/RunComposer.tsx b/apps/web/src/RunComposer.tsx
new file mode 100644
index 000000000..e08f2d5a3
--- /dev/null
+++ b/apps/web/src/RunComposer.tsx
@@ -0,0 +1,213 @@
+import { useContext, useEffect, useRef, useState } from "react";
+import { Button, ComposerModeSwitch, DropdownSelect } from "@colossus/ui";
+import { ConversationComposer } from "@colossus/ui/conversation";
+import { type FleetNode } from "./api";
+import { SendShortcutContext } from "./Appearance";
+import { IconShieldCheck } from "@tabler/icons-react";
+
+export interface RunRequest {
+  plugin_skill_ids: string[];
+  input: { text: string }[];
+  session_id: null;
+  end_user_id: null;
+  role: string;
+  mode: string;
+  research_depth: null;
+  research_sources: string[];
+  plan_action: null;
+  branch: null;
+  max_turns: number;
+  idempotency_key: string;
+}
+
+export function RunComposer({
+  nodes,
+  nodeId,
+  lockedRuntime = false,
+  disabled = false,
+  busy,
+  label,
+  action,
+  onNodeChange,
+  onSubmit,
+  onPolicy,
+  draftSeed,
+}: {
+  nodes: FleetNode[];
+  nodeId: string;
+  lockedRuntime?: boolean;
+  disabled?: boolean;
+  busy: boolean;
+  label: string;
+  action: string;
+  onNodeChange?: (id: string) => void;
+  onSubmit: (request: RunRequest) => Promise<boolean>;
+  onPolicy?: (() => void) | undefined;
+  draftSeed?: { key: string; text: string } | undefined;
+}) {
+  const [draft, setDraft] = useState(""),
+    [mode, setMode] = useState("execute"),
+    [role, setRole] = useState("primary");
+  const input = useRef<HTMLTextAreaElement>(null);
+  useEffect(() => {
+    if (draftSeed) {
+      setDraft(draftSeed.text);
+      input.current?.focus();
+    }
+  }, [draftSeed?.key, draftSeed?.text]);
+  const attempt = useRef<{ signature: string; key: string } | null>(null);
+  const target = nodes.find((item) => item.node.node_id === nodeId);
+  const shortcut = useContext(SendShortcutContext);
+  const posture = target?.node.policy;
+  const modelLabel =
+    posture?.models.length === 1
+      ? posture.models[0]?.label
+      : posture?.models.length
+        ? "Agent-routed model"
+        : "Model not reported";
+  const policyStale =
+    !target?.presence?.ready ||
+    !target.node.policy_observed_at ||
+    Date.now() / 1000 - target.node.policy_observed_at > 60;
+  const roles = target?.node.roles ?? [];
+  useEffect(() => {
+    if (roles.length && !roles.includes(role)) setRole(roles[0]!);
+  }, [roles, role]);
+  async function send() {
+    if (!draft.trim() || !nodeId || disabled || busy) return;
+    const signature = JSON.stringify({ draft, nodeId, mode, role });
+    if (attempt.current?.signature !== signature)
+      attempt.current = { signature, key: crypto.randomUUID() };
+    if (
+      await onSubmit({
+        plugin_skill_ids: [],
+        input: [{ text: draft }],
+        session_id: null,
+        end_user_id: null,
+        role,
+        mode,
+        research_depth: null,
+        research_sources: [],
+        plan_action: null,
+        branch: null,
+        max_turns: 24,
+        idempotency_key: attempt.current.key,
+      })
+    ) {
+      setDraft("");
+      attempt.current = null;
+      input.current?.focus();
+    }
+  }
+  return (
+    <ConversationComposer
+      value={draft}
+      onChange={setDraft}
+      textareaRef={input}
+      className="run-composer"
+      label={label}
+      action={busy ? "Submitting…" : action}
+      placeholder={
+        disabled
+          ? "This conversation is available to read."
+          : "What would you like to work on?"
+      }
+      disabled={disabled || !nodeId}
+      busy={busy}
+      shortcut={shortcut}
+      context={
+        <>
+          <span className="composer-context-runtime">
+            {target?.node.label ?? "Select an agent"}
+          </span>
+          <span
+            className="composer-model"
+            title={`Model routing is configured on the host${posture?.models.length ? `: ${posture.models.map((model) => `${model.profile}: ${model.label}`).join(" · ")}` : ""}`}
+          >
+            {modelLabel}
+          </span>
+          {onPolicy ? (
+            <Button
+              variant="tertiary"
+              className="composer-policy-pill"
+              onClick={onPolicy}
+            >
+              <IconShieldCheck size={14} aria-hidden="true" />
+              {posture
+                ? `Approvals: ${posture.approval_mode.replaceAll("_", " ")}`
+                : "Policy not reported"}
+              {posture && policyStale ? " · Stale" : ""}
+            </Button>
+          ) : (
+            <span className="composer-policy-pill">
+              {posture
+                ? `Approvals: ${posture.approval_mode.replaceAll("_", " ")}`
+                : "Policy not reported"}
+            </span>
+          )}
+        </>
+      }
+      onSubmit={(event) => {
+        event.preventDefault();
+        void send();
+      }}
+      controls={
+        <>
+          {!lockedRuntime ? (
+            <DropdownSelect
+              aria-label="Execution agent"
+              value={nodeId}
+              onChange={(event) => onNodeChange?.(event.target.value)}
+              disabled={disabled || busy}
+            >
+              {nodes
+                .filter((item) => !item.node.revoked)
+                .map((item) => (
+                  <option key={item.node.node_id} value={item.node.node_id}>
+                    {item.node.label}
+                    {item.node.workspace_label
+                      ? ` · ${item.node.workspace_label}`
+                      : ""}
+                    {item.presence?.ready ? "" : " · Offline"}
+                  </option>
+                ))}
+            </DropdownSelect>
+          ) : (
+            <span className="composer-target">
+              {target?.node.label ?? "Assigned agent"}
+            </span>
+          )}
+          <ComposerModeSwitch
+            value={mode}
+            onChange={setMode}
+            disabled={disabled || busy}
+            options={[
+              { value: "execute", label: "Execute" },
+              { value: "plan", label: "Plan" },
+            ]}
+          />
+          <DropdownSelect
+            aria-label="Agent role"
+            value={role}
+            onChange={(event) => setRole(event.target.value)}
+            disabled={disabled || busy}
+          >
+            {roles.map((value) => (
+              <option key={value} value={value}>
+                {value}
+              </option>
+            ))}
+          </DropdownSelect>
+          <span className="composer-hint">
+            {shortcut === "enter" ? "Enter ↵ · Shift ↵ newline" : "⌘ / Ctrl ↵"}
+          </span>
+        </>
+      }
+      notice={
+        target && !target.presence?.ready && !target.node.revoked
+          ? "This agent is offline. Accepted messages remain queued until it reconnects."
+          : undefined
+      }
+    />
+  );
+}
diff --git a/apps/web/src/SignIn.tsx b/apps/web/src/SignIn.tsx
new file mode 100644
index 000000000..83b051cc1
--- /dev/null
+++ b/apps/web/src/SignIn.tsx
@@ -0,0 +1,141 @@
+import { useState } from "react";
+import { Button, TextInput } from "@colossus/ui";
+import { IconArrowRight, IconShieldLock } from "@tabler/icons-react";
+import colossusMark from "@colossus/ui/assets/colossus-mark.svg";
+import { ApiFailure, request } from "./api";
+import { rememberSignInReturn } from "./navigation";
+import { errorMessage } from "./resources";
+import type { AuthConfig, Classification } from "./control-api";
+export function SignIn({
+  config,
+  classification,
+  error,
+  onSignedIn,
+}: {
+  config: AuthConfig | null;
+  classification: Classification | undefined;
+  error: string;
+  onSignedIn: () => void;
+}) {
+  const [username, setUsername] = useState(""),
+    [password, setPassword] = useState(""),
+    [failure, setFailure] = useState(""),
+    [busy, setBusy] = useState(false);
+  const banner = classification?.enabled ? (
+    <div
+      className={`control-classification classification-${classification.tone}`}
+    >
+      {classification.text}
+    </div>
+  ) : null;
+  return (
+    <div className="login-layout">
+      {banner}
+      <main className="sign-in">
+        <div className="sign-in-panel">
+          <div className="settings-brand">
+            <img src={colossusMark} alt="" />
+            <strong>Colossus</strong>
+          </div>
+          <span className="eyebrow">Control Plane</span>
+          <h1>Sign in to your Control Plane</h1>
+          <p>
+            Connect your hosts, operate agent conversations, and follow shared
+            work.
+          </p>
+          {failure || error ? (
+            <div className="alert" role="alert">
+              {failure || error}
+            </div>
+          ) : null}
+          {config === null ? (
+            <p role="status" className="muted">
+              Loading sign-in options…
+            </p>
+          ) : (
+            <>
+              {config.oidc ? (
+                <a
+                  className="ui-button ui-button--primary"
+                  href={config.oidc.login_url}
+                  onClick={rememberSignInReturn}
+                >
+                  Sign in with {config.oidc.label}
+                  <IconArrowRight size={16} aria-hidden="true" />
+                </a>
+              ) : null}
+              {config.local_enabled ? (
+                <>
+                  <form
+                    className="local-sign-in management-form"
+                    onSubmit={async (event) => {
+                      event.preventDefault();
+                      setBusy(true);
+                      setFailure("");
+                      try {
+                        await request("/auth/local", { username, password });
+                        setPassword("");
+                        onSignedIn();
+                      } catch (e) {
+                        setFailure(
+                          e instanceof ApiFailure &&
+                            (e.status === 401 || e.status === 403)
+                            ? "Username or password is incorrect, or this account is unavailable."
+                            : errorMessage(e),
+                        );
+                      } finally {
+                        setBusy(false);
+                        setPassword("");
+                      }
+                    }}
+                  >
+                    {config.oidc ? (
+                      <span className="login-divider">
+                        or use your local account
+                      </span>
+                    ) : null}
+                    <label>
+                      <span>Username</span>
+                      <TextInput
+                        required
+                        value={username}
+                        onChange={(event) => setUsername(event.target.value)}
+                        autoComplete="username"
+                      />
+                    </label>
+                    <label>
+                      <span>Password</span>
+                      <TextInput
+                        required
+                        type="password"
+                        value={password}
+                        onChange={(event) => setPassword(event.target.value)}
+                        autoComplete="current-password"
+                      />
+                    </label>
+                    <Button variant="primary" type="submit" disabled={busy}>
+                      {busy ? "Signing in…" : "Sign in"}
+                    </Button>
+                  </form>
+                </>
+              ) : null}
+              {!config.oidc && !config.local_enabled ? (
+                <div className="alert">
+                  No login provider is enabled. Contact your deployment
+                  operator.
+                </div>
+              ) : null}
+            </>
+          )}
+          <p className="sign-in-foot">
+            <IconShieldLock size={16} aria-hidden="true" />
+            Your organization manages project access.
+          </p>
+        </div>
+      </main>
+      {classification?.enabled && classification.position === "top_and_bottom"
+        ? banner
+        : null}
+    </div>
+  );
+}
diff --git a/apps/web/src/TaskDetail.tsx b/apps/web/src/TaskDetail.tsx
new file mode 100644
index 000000000..43fed133c
--- /dev/null
+++ b/apps/web/src/TaskDetail.tsx
@@ -0,0 +1,263 @@
+import { Button } from "@colossus/ui";
+import { Button as LinkButton } from "@colossus/ui/components/ui/button";
+import { useEffect, useRef, useState } from "react";
+import {
+  IconArrowLeft,
+  IconPlayerStop,
+  IconTerminal2,
+  IconLoader2,
+} from "@tabler/icons-react";
+import {
+  request,
+  awaitReceipt,
+  projectPath,
+  taskTitle,
+  taskStatus,
+  statusLabel,
+  terminalStatuses,
+  visibleOutput,
+  type Task,
+  type Update,
+  type Permission,
+  type CommandReceipt,
+} from "./api";
+import { Interactions } from "./Interactions";
+export function TaskDetail({
+  initial,
+  project,
+  permissions,
+  nodeLabel,
+  onBack,
+  backHref,
+}: {
+  initial: Task;
+  project: string;
+  permissions: Permission[];
+  nodeLabel: string;
+  onBack: () => void;
+  backHref?: string;
+}) {
+  const [task, setTask] = useState(initial),
+    [updates, setUpdates] = useState<Update[]>([]),
+    [error, setError] = useState(""),
+    [connected, setConnected] = useState(false),
+    [busy, setBusy] = useState(false);
+  const [notice, setNotice] = useState("");
+  const path = `${projectPath(project)}/tasks/${initial.task_id}`;
+  const cancellation = useRef(crypto.randomUUID());
+  async function refresh() {
+    try {
+      const response = await request<{ task: Task }>(path);
+      setTask(response.task);
+    } catch (error) {
+      setError(error instanceof Error ? error.message : "Task refresh failed.");
+    }
+  }
+  useEffect(() => {
+    const abort = new AbortController();
+    let alive = true;
+    const refresh = () =>
+      void request<{ task: Task }>(path, undefined, abort.signal)
+        .then((response) => {
+          if (alive) setTask(response.task);
+        })
+        .catch((error) => {
+          if (alive)
+            setError(
+              error instanceof Error ? error.message : "Task refresh failed.",
+            );
+        });
+    refresh();
+    const timer = setInterval(refresh, 2000);
+    return () => {
+      alive = false;
+      abort.abort();
+      clearInterval(timer);
+    };
+  }, [path]);
+  useEffect(() => {
+    const source = new EventSource(`${path}/events?after=0`);
+    source.onopen = () => setConnected(true);
+    source.onerror = () => setConnected(false);
+    source.addEventListener("run_update", (event) => {
+      try {
+        const update = JSON.parse(
+          (event as MessageEvent<string>).data,
+        ) as Update;
+        setUpdates((current) =>
+          current.some((existing) => existing.sequence === update.sequence)
+            ? current
+            : current.concat(update).sort((a, b) => a.sequence - b.sequence),
+        );
+      } catch {
+        setError("The event stream returned an invalid update.");
+        source.close();
+      }
+    });
+    return () => source.close();
+  }, [path]);
+  const status = taskStatus(task),
+    finished = terminalStatuses.has(status),
+    output = visibleOutput(updates);
+  async function cancel() {
+    setBusy(true);
+    setError("");
+    setNotice("");
+    try {
+      const { command } = await request<{ command: CommandReceipt }>(
+        `${path}/cancel`,
+        { mutation_id: cancellation.current },
+      );
+      const settled = await awaitReceipt(path, command);
+      setNotice(
+        settled
+          ? "Cancellation confirmed by the runtime."
+          : "Cancellation queued. It will be delivered when the runtime reconnects; retrying uses the same request.",
+      );
+      await refresh();
+    } catch (error) {
+      setError(error instanceof Error ? error.message : "Cancellation failed.");
+    } finally {
+      setBusy(false);
+    }
+  }
+  return (
+    <div className="detail">
+      {backHref ? (
+        <LinkButton asChild variant="ghost" className="back">
+          <a
+            href={backHref}
+            onClick={(event) => {
+              if (
+                event.defaultPrevented ||
+                event.button !== 0 ||
+                event.metaKey ||
+                event.ctrlKey ||
+                event.shiftKey ||
+                event.altKey
+              )
+                return;
+              event.preventDefault();
+              onBack();
+            }}
+          >
+            <IconArrowLeft size={17} aria-hidden="true" />
+            All tasks
+          </a>
+        </LinkButton>
+      ) : (
+        <Button variant="tertiary" className="back" onClick={onBack}>
+          <IconArrowLeft size={17} />
+          All tasks
+        </Button>
+      )}
+      <div className="detail-header">
+        <div>
+          <div className="eyebrow">
+            {nodeLabel} <span> / </span> {task.request.mode}
+          </div>
+          <h2>{taskTitle(task)}</h2>
+        </div>
+        <span className={`status status-${status}`}>{statusLabel(status)}</span>
+      </div>
+      <div className="detail-meta">
+        <span>
+          <span className={`dot ${connected ? "live" : ""}`} />
+          {connected ? "Live event stream" : "Reconnecting event stream"}
+        </span>
+        <span>{task.request.role}</span>
+        <span title={task.task_id}>Task {task.task_id.slice(0, 8)}</span>
+        <Button
+          variant="secondary"
+          disabled={
+            busy || finished || !task.run_id || !permissions.includes("control")
+          }
+          onClick={() => void cancel()}
+        >
+          <IconPlayerStop size={15} />
+          {busy ? "Requesting…" : "Cancel task"}
+        </Button>
+      </div>
+      {error && (
+        <div role="alert" className="alert">
+          {error}
+          <Button aria-label="Dismiss error" onClick={() => setError("")}>
+            ×
+          </Button>
+        </div>
+      )}
+      {notice && (
+        <p className="muted" role="status">
+          {notice}
+        </p>
+      )}
+      {task.dispatch_error && (
+        <div className="alert" role="alert">
+          {task.dispatch_error.message}
+        </div>
+      )}
+      {task.output_limited && (
+        <div className="alert" role="status">
+          This task reached the cloud detail limit. Its status and controls
+          remain available. Earlier output is retained here; open the run
+          locally for complete output or any interactions too large to display
+          here.
+        </div>
+      )}
+      <Interactions
+        interactions={task.snapshot?.pending_interactions ?? []}
+        project={project}
+        task={task.task_id}
+        permissions={permissions}
+        onUpdate={() => void refresh()}
+        onError={setError}
+      />
+      <section className="output-panel">
+        <div className="panel-heading">
+          <IconTerminal2 size={18} />
+          <h2>Run output</h2>
+          <span className="muted">{updates.length} events</span>
+        </div>
+        {output ? (
+          <pre className="run-output">{output}</pre>
+        ) : (
+          <div className="output-empty">
+            {finished ? (
+              <IconTerminal2 size={30} />
+            ) : (
+              <IconLoader2 size={26} className="spin" />
+            )}
+            <h3>
+              {task.run_id
+                ? finished
+                  ? "No text output was released"
+                  : "The runtime is working"
+                : "Waiting for the runtime"}
+            </h3>
+            <p>
+              {task.run_id
+                ? "Released output will appear here as the task progresses."
+                : "This task stays assigned to its selected runtime and starts when the connection is ready."}
+            </p>
+          </div>
+        )}
+        <details className="event-log">
+          <summary>
+            Event activity <span>{updates.length}</span>
+          </summary>
+          <ol>
+            {updates.map((update) => (
+              <li key={update.sequence}>
+                <span className="mono">{update.sequence}</span>
+                <strong>
+                  {statusLabel(Object.keys(update.update)[0] ?? "update")}
+                </strong>
+                <time>{new Date(update.created_at).toLocaleTimeString()}</time>
+              </li>
+            ))}
+          </ol>
+        </details>
+      </section>
+    </div>
+  );
+}
diff --git a/apps/web/src/TaskTable.tsx b/apps/web/src/TaskTable.tsx
new file mode 100644
index 000000000..82afcee6d
--- /dev/null
+++ b/apps/web/src/TaskTable.tsx
@@ -0,0 +1,212 @@
+import { useMemo } from "react";
+import { Button } from "@colossus/ui";
+import { DataTable, type DataTableColumn } from "@colossus/ui/data-table";
+import {
+  IconArrowRight,
+  IconListDetails,
+  IconServer,
+} from "@tabler/icons-react";
+import {
+  statusLabel,
+  taskStatus,
+  taskTitle,
+  terminalStatuses,
+  type FleetNode,
+  type Task,
+} from "./api";
+import { RouteLink } from "./navigation";
+import { globalHref, taskHref, threadHref } from "./routes";
+
+const getRowId = (task: Task) => task.task_id;
+const initialSorting = [{ id: "created", desc: true }];
+
+export function TaskTable({
+  tasks,
+  nodes,
+  loading,
+  hasMore,
+  onMore,
+  onOpen,
+  onFleet,
+  project,
+}: {
+  tasks: Task[];
+  nodes: FleetNode[];
+  loading: boolean;
+  hasMore: boolean;
+  onMore: () => void;
+  onOpen: (task: Task) => void;
+  onFleet: () => void;
+  project?: string;
+}) {
+  const columns = useMemo<DataTableColumn<Task>[]>(() => {
+    const labels = new Map(
+      nodes.map((fleet) => [fleet.node.node_id, fleet.node.label]),
+    );
+    const runtimeIds = [...new Set(tasks.map((task) => task.node_id))];
+    const runtimeLabel = (id: string) => labels.get(id) ?? id.slice(0, 8);
+    return [
+      {
+        id: "title",
+        label: "Task",
+        value: taskTitle,
+        hideable: false,
+        rowHeader: true,
+        className: "task-title-cell",
+        cell: (task) => (
+          <div className="catalog-identity">
+            <span className="resource-icon">
+              <IconListDetails size={16} aria-hidden="true" />
+            </span>
+            <div>
+              <RouteLink
+                href={
+                  task.thread_id
+                    ? threadHref(task.project_id, task.thread_id)
+                    : taskHref(task.project_id, task.task_id)
+                }
+                className="catalog-name"
+                onNavigate={() => onOpen(task)}
+              >
+                {taskTitle(task)}
+              </RouteLink>
+              <small>
+                {task.request.role} · {task.request.mode}
+              </small>
+            </div>
+          </div>
+        ),
+      },
+      {
+        id: "runtime",
+        label: "Runtime",
+        value: (task) => runtimeLabel(task.node_id),
+        cell: (task) => (
+          <span className="catalog-connection">
+            {runtimeLabel(task.node_id)}
+          </span>
+        ),
+        filter: {
+          label: "Filter by runtime",
+          options: [
+            { value: "", label: "All runtimes" },
+            ...runtimeIds
+              .sort((a, b) => runtimeLabel(a).localeCompare(runtimeLabel(b)))
+              .map((id) => ({ value: id, label: runtimeLabel(id) })),
+          ],
+          matches: (task, value) => !value || task.node_id === value,
+        },
+      },
+      {
+        id: "status",
+        label: "Status",
+        value: (task) => statusLabel(taskStatus(task)),
+        cell: (task) => (
+          <span className={`status status-${taskStatus(task)}`}>
+            {statusLabel(taskStatus(task))}
+          </span>
+        ),
+        filter: {
+          label: "Filter by status",
+          options: [
+            { value: "", label: "All statuses" },
+            { value: "active", label: "Active" },
+            { value: "finished", label: "Finished" },
+          ],
+          matches: (task, value) =>
+            !value ||
+            (value === "active"
+              ? !terminalStatuses.has(taskStatus(task))
+              : terminalStatuses.has(taskStatus(task))),
+        },
+      },
+      {
+        id: "created",
+        label: "Created",
+        value: (task) =>
+          Date.parse(task.created_at || task.snapshot?.run.created_at || "") ||
+          0,
+        cell: (task) => {
+          const created = task.created_at || task.snapshot?.run.created_at;
+          return created ? (
+            <time dateTime={created} title={new Date(created).toLocaleString()}>
+              {new Date(created).toLocaleDateString(undefined, {
+                month: "short",
+                day: "numeric",
+              })}
+            </time>
+          ) : (
+            "Created time unavailable"
+          );
+        },
+      },
+      {
+        id: "actions",
+        label: "Actions",
+        value: () => "",
+        sortable: false,
+        hideable: false,
+        className: "catalog-row-actions",
+        cell: (task) => (
+          <RouteLink
+            href={
+              task.thread_id
+                ? threadHref(task.project_id, task.thread_id)
+                : taskHref(task.project_id, task.task_id)
+            }
+            className="ui-icon-button"
+            aria-label={`Open task: ${taskTitle(task)}`}
+            onNavigate={() => onOpen(task)}
+          >
+            <IconArrowRight size={16} aria-hidden="true" />
+          </RouteLink>
+        ),
+      },
+    ];
+  }, [nodes, tasks, onOpen]);
+  return (
+    <DataTable
+      key="project-tasks"
+      data={tasks}
+      columns={columns}
+      getRowId={getRowId}
+      label="Project tasks"
+      itemLabel="tasks"
+      initialSorting={initialSorting}
+      search={{ columnId: "title", label: "Search tasks" }}
+      loading={loading}
+      empty={
+        <div className="empty-state">
+          <h3>{tasks.length ? "No matching tasks" : "No tasks yet"}</h3>
+          <p>
+            {tasks.length
+              ? "Try another search or task filter."
+              : nodes.some((fleet) => !fleet.node.revoked)
+                ? "Describe a task above to start work on the selected runtime."
+                : "Enroll a runtime to start your first task."}
+          </p>
+          {!nodes.some((fleet) => !fleet.node.revoked) && (
+            <RouteLink
+              className="ui-button ui-button--primary"
+              href={globalHref("fleet", project)}
+              onNavigate={onFleet}
+            >
+              <IconServer size={16} aria-hidden="true" />
+              Set up a runtime
+            </RouteLink>
+          )}
+        </div>
+      }
+      footer={
+        hasMore && (
+          <div className="task-history-footer">
+            <p>Sorting and filters apply to the {tasks.length} loaded tasks.</p>
+            <Button onClick={onMore} disabled={loading}>
+              Load more history
+            </Button>
+          </div>
+        )
+      }
+    />
+  );
+}
diff --git a/apps/web/src/ThreadDetail.test.tsx b/apps/web/src/ThreadDetail.test.tsx
new file mode 100644
index 000000000..45f29d56f
--- /dev/null
+++ b/apps/web/src/ThreadDetail.test.tsx
@@ -0,0 +1,505 @@
+// @vitest-environment happy-dom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { ThreadDetail } from "./ThreadDetail";
+import type {
+  FleetNode,
+  Permission,
+  Thread,
+  ThreadDetailResponse,
+  Task,
+  Update,
+} from "./api";
+
+const thread: Thread = {
+  thread_id: "thread-a",
+  project_id: "project-a",
+  node_id: "node-a",
+  session_id: "session-a",
+  title: "Investigate the deployment",
+  created_at: "2026-10-05T10:00:00Z",
+  updated_at: "2026-10-05T10:00:00Z",
+  revision: 7,
+  archived: false,
+  sync_status: "current",
+  source: "cloud",
+  can_continue: true,
+};
+const node: FleetNode = {
+  node: {
+    node_id: "node-a",
+    project_id: "project-a",
+    instance_id: "instance-a",
+    label: "Development workstation",
+    roles: ["primary"],
+    certificate_sha256: "certificate",
+    revoked: false,
+    revision: 1,
+  },
+  presence: { ready: true, capabilities: [], connection_id: "connection-a" },
+};
+const history: ThreadDetailResponse = {
+  thread,
+  tasks: [],
+  messages: [
+    {
+      message_id: "message-b",
+      role: "assistant",
+      text: "Saved assistant reply",
+      created_at: "2026-10-05T10:01:00Z",
+      task_id: "task-a",
+    },
+  ],
+};
+class TestEventSource extends EventTarget {
+  static instances: TestEventSource[] = [];
+  constructor() {
+    super();
+    TestEventSource.instances.push(this);
+  }
+  onopen: (() => void) | null = null;
+  onerror: (() => void) | null = null;
+  close() {}
+}
+let root: Root, container: HTMLDivElement;
+beforeEach(() => {
+  TestEventSource.instances = [];
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  vi.stubGlobal("EventSource", TestEventSource);
+  Object.defineProperty(document, "fonts", {
+    configurable: true,
+    value: new EventTarget(),
+  });
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+});
+afterEach(async () => {
+  await act(() => root.unmount());
+  container.remove();
+  vi.unstubAllGlobals();
+});
+const response = (value: unknown, status = 200) =>
+  new Response(JSON.stringify(value), { status });
+async function render(
+  initial = thread,
+  nodes = [node],
+  permissions: Permission[] = ["read", "execute", "control", "approve"],
+) {
+  await act(async () => {
+    root.render(
+      <ThreadDetail
+        initial={initial}
+        project="project-a"
+        nodes={nodes}
+        permissions={permissions}
+        onBack={() => {}}
+        onChanged={() => {}}
+      />,
+    );
+  });
+}
+function button(label: string) {
+  const result = [
+    ...container.querySelectorAll<HTMLButtonElement>("button"),
+  ].find(
+    (item) =>
+      item.getAttribute("aria-label") === label ||
+      item.textContent?.trim() === label,
+  );
+  if (!result) throw new Error(`Missing button ${label}`);
+  return result;
+}
+async function write(value: string) {
+  const input = container.querySelector<HTMLTextAreaElement>("textarea")!;
+  await act(() => {
+    Object.getOwnPropertyDescriptor(
+      HTMLTextAreaElement.prototype,
+      "value",
+    )!.set!.call(input, value);
+    input.dispatchEvent(new Event("input", { bubbles: true }));
+  });
+}
+describe("human cloud conversation authority", () => {
+  it("exposes a real Back permalink while plain clicks preserve the host callback and modified clicks remain native", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockImplementation(() => Promise.resolve(response(history))),
+    );
+    const onBack = vi.fn();
+    await act(async () =>
+      root.render(
+        <ThreadDetail
+          initial={thread}
+          project="project-a"
+          nodes={[node]}
+          permissions={["read"]}
+          onBack={onBack}
+          onChanged={() => {}}
+          backHref="/projects/project-a/agents/node-a/overview"
+        />,
+      ),
+    );
+    const link = container.querySelector<HTMLAnchorElement>("a.back")!;
+    expect(link.getAttribute("href")).toBe(
+      "/projects/project-a/agents/node-a/overview",
+    );
+    const modified = new MouseEvent("click", {
+      bubbles: true,
+      cancelable: true,
+      ctrlKey: true,
+    });
+    link.dispatchEvent(modified);
+    expect(modified.defaultPrevented).toBe(false);
+    expect(onBack).not.toHaveBeenCalled();
+    const plain = new MouseEvent("click", { bubbles: true, cancelable: true });
+    await act(() => link.dispatchEvent(plain));
+    expect(plain.defaultPrevented).toBe(true);
+    expect(onBack).toHaveBeenCalledTimes(1);
+  });
+  it("renders each human turn, its exact run's activity, and response together rather than appending activity", async () => {
+    const task = (id: string, created: string): Task => ({
+      task_id: id,
+      project_id: "project-a",
+      node_id: "node-a",
+      subject: "human",
+      created_at: created,
+      request: {
+        input: [{ text: `${id} request` }],
+        mode: "execute",
+        role: "primary",
+      },
+      run_id: `run-${id}`,
+      revision: 1,
+      last_sequence: 3,
+      snapshot: {
+        run: {
+          run_id: `run-${id}`,
+          title: "Saved turn",
+          status: "completed",
+          created_at: created,
+          updated_at: created,
+          role: "primary",
+          mode: "execute",
+          last_sequence: 3,
+          terminal: { result: { elapsed_seconds: 2 } },
+        },
+        pending_interactions: [],
+      },
+    });
+    const first = task("first", "2026-10-05T10:00:00Z"),
+      second = task("second", "2026-10-05T10:02:00Z");
+    const detail = {
+      ...history,
+      tasks: [second, first],
+      messages: [first, second].flatMap((task) => [
+        {
+          message_id: `${task.task_id}-user`,
+          task_id: task.task_id,
+          role: "user",
+          text: `${task.task_id} request`,
+          created_at: task.created_at!,
+        },
+        {
+          message_id: `${task.task_id}-assistant`,
+          task_id: task.task_id,
+          role: "assistant",
+          text: `${task.task_id} reply`,
+          created_at: task.created_at!,
+        },
+      ]),
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockImplementation(() => Promise.resolve(response(detail))),
+    );
+    await render();
+    const activity = (task: Task, sequence: number, state: string): Update => ({
+      task_id: task.task_id,
+      run_id: task.run_id!,
+      sequence,
+      created_at: task.created_at!,
+      update: {
+        tool_activity: {
+          call_id: "same-call",
+          tool_name: "echo",
+          state,
+          summary: `${task.task_id} ${state}`,
+          preview: `${task.task_id} released preview`,
+        },
+      },
+    });
+    await act(() => {
+      for (const update of [
+        activity(second, 2, "completed"),
+        activity(first, 1, "requested"),
+        { ...activity(second, 1, "requested"), task_id: first.task_id },
+        activity(second, 1, "requested"),
+        activity(first, 2, "completed"),
+        activity(first, 2, "completed"),
+      ])
+        TestEventSource.instances[0]!.dispatchEvent(
+          new MessageEvent("run_update", { data: JSON.stringify(update) }),
+        );
+    });
+    const turns = [
+      ...container.querySelectorAll<HTMLElement>(".shared-conversation-turn"),
+    ];
+    expect(turns.map((turn) => turn.dataset.taskId)).toEqual([
+      "first",
+      "second",
+    ]);
+    for (const [index, turn] of turns.entries()) {
+      const owner = index === 0 ? "first" : "second",
+        other = index === 0 ? "second" : "first";
+      expect(turn.dataset.runId).toBe(`run-${owner}`);
+      expect(
+        [...turn.children].map(
+          (child) => child.getAttribute("data-role") ?? child.className,
+        ),
+      ).toEqual(["user", "conversation-run", "assistant"]);
+      expect(turn.querySelectorAll(".shared-activity-tool")).toHaveLength(1);
+      expect(
+        turn.querySelector(".shared-conversation-activity")?.textContent,
+      ).toContain("1 action");
+      expect(
+        turn.querySelector(".shared-activity-history")?.textContent,
+      ).toContain(`${owner} completed`);
+      expect(
+        turn.querySelector(".shared-activity-history")?.textContent,
+      ).not.toContain(`${other} completed`);
+      expect(turn.querySelectorAll(".shared-activity-history li")).toHaveLength(
+        2,
+      );
+    }
+    expect(
+      container
+        .querySelector(".shared-conversation-timeline")
+        ?.contains(turns[1]!),
+    ).toBe(true);
+  });
+  it("resolves a selected agent beyond the loaded fleet page without assuming its grant", async () => {
+    const fetch = vi.fn(async (path: string) =>
+      response(path.endsWith("/nodes/node-a") ? node : history),
+    );
+    vi.stubGlobal("fetch", fetch);
+    await render(thread, []);
+    expect(
+      fetch.mock.calls.some(([path]) => path.endsWith("/nodes/node-a")),
+    ).toBe(true);
+    expect(container.querySelector(".composer-target")?.textContent).toBe(
+      "Development workstation",
+    );
+    await write("Continue on the resolved agent");
+    expect(button("Send message").disabled).toBe(false);
+  });
+  it.each([false, true])(
+    "reconciles runtime revision progress once while respecting concurrent archive=%s",
+    async (archived) => {
+      const attempts: {
+        expected_revision: number;
+        request: { idempotency_key: string };
+      }[] = [];
+      vi.stubGlobal(
+        "fetch",
+        vi.fn(async (_path: string, options: RequestInit) => {
+          if (_path.endsWith("/nodes/node-a")) return response(node);
+          if (options.method === "POST") {
+            attempts.push(JSON.parse(options.body as string));
+            return attempts.length === 1
+              ? response({ error: "conflict" }, 409)
+              : response({ thread: { ...thread, revision: 8 } });
+          }
+          return response({
+            ...history,
+            thread: attempts.length
+              ? { ...thread, revision: 8, archived }
+              : thread,
+          });
+        }),
+      );
+      await render();
+      await write("Continue after runtime progress");
+      await act(async () => button("Send message").click());
+      expect(attempts).toHaveLength(archived ? 1 : 2);
+      if (!archived) {
+        expect(attempts.map((attempt) => attempt.expected_revision)).toEqual([
+          7, 8,
+        ]);
+        expect(attempts[0]?.request.idempotency_key).toBe(
+          attempts[1]?.request.idempotency_key,
+        );
+      }
+      expect(container.querySelector("textarea")?.value).toBe(
+        archived ? "Continue after runtime progress" : "",
+      );
+    },
+  );
+  it("keeps imported local-run controls read-only even when project permissions allow responses", async () => {
+    const imported = {
+      ...thread,
+      source: "runtime" as const,
+      can_continue: false,
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        response({
+          ...history,
+          thread: imported,
+          tasks: [
+            {
+              task_id: "imported-task",
+              project_id: "project-a",
+              node_id: "node-a",
+              subject: "runtime",
+              request: { input: [], role: "primary", mode: "execute" },
+              run_id: "local-run",
+              source_read_only: true,
+              last_sequence: 1,
+              revision: 1,
+              snapshot: {
+                run: {
+                  run_id: "local-run",
+                  title: "Shared session",
+                  status: "waiting",
+                  created_at: "2026-10-05T10:00:00Z",
+                  updated_at: "2026-10-05T10:00:00Z",
+                  role: "primary",
+                  mode: "execute",
+                  last_sequence: 1,
+                  terminal: null,
+                },
+                pending_interactions: [
+                  {
+                    interaction_id: "approval-a",
+                    run_id: "local-run",
+                    kind: "approval",
+                    status: "pending",
+                    respondable_by_caller: true,
+                    etag: "current",
+                    content: {
+                      approval: {
+                        action: "execute",
+                        resource: "command",
+                        reason: "Needs approval",
+                        risk: "medium",
+                        request_hash: "prepared-request",
+                        command_context: null,
+                      },
+                    },
+                  },
+                ],
+              },
+            },
+          ],
+        }),
+      ),
+    );
+    await render(imported);
+    expect(button("Approve this action").disabled).toBe(true);
+    expect(button("Deny").disabled).toBe(true);
+    expect(container.textContent).not.toContain("Stop active run");
+  });
+  it("reads saved history offline and prevents continuation when local sharing is read-only", async () => {
+    const readOnly = {
+      ...thread,
+      source: "runtime" as const,
+      can_continue: false,
+      sync_status: "incomplete" as const,
+    };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(response({ ...history, thread: readOnly })),
+    );
+    await render(readOnly, [{ ...node, presence: null }]);
+    expect(container.textContent).toContain("Saved assistant reply");
+    expect(container.textContent).toContain("viewing saved history");
+    expect(container.textContent).toContain(
+      "Released history is incomplete or bounded",
+    );
+    expect(button("Send message").disabled).toBe(true);
+    expect(container.textContent).toContain("shared for viewing");
+    expect(button("Archive").disabled).toBe(false);
+  });
+  it("submits multi-turn input against the exact revision and preserves its idempotency identity after a retry", async () => {
+    const attempts: Array<{
+      expected_revision: number;
+      request: { idempotency_key: string; input: { text: string }[] };
+    }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (_path: string, options: RequestInit) => {
+        if (options.method === "POST") {
+          attempts.push(JSON.parse(options.body as string));
+          return attempts.length === 1
+            ? response({ error: "storage" }, 503)
+            : response({ thread: { ...thread, revision: 8 } });
+        }
+        return response(history);
+      }),
+    );
+    await render();
+    await write("Continue with the deployment checks");
+    await act(async () => button("Send message").click());
+    expect(container.querySelector("textarea")?.value).toBe(
+      "Continue with the deployment checks",
+    );
+    await act(async () => button("Send message").click());
+    expect(attempts).toHaveLength(2);
+    expect(attempts[0]?.expected_revision).toBe(7);
+    expect(attempts[0]?.request.idempotency_key).toBe(
+      attempts[1]?.request.idempotency_key,
+    );
+    expect(attempts[0]?.request.input[0]?.text).toBe(
+      "Continue with the deployment checks",
+    );
+    expect(container.querySelector("textarea")?.value).toBe("");
+  });
+  it("loads earlier history without duplicating messages and uses Control for metadata mutations", async () => {
+    const calls: Array<{ path: string; options: RequestInit }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (path: string, options: RequestInit) => {
+        calls.push({ path, options });
+        if (options.method === "PATCH")
+          return response({
+            thread: { ...thread, archived: true, revision: 8 },
+          });
+        if (path.includes("message_after="))
+          return response({
+            ...history,
+            messages: [
+              {
+                message_id: "message-a",
+                role: "user",
+                text: "Earlier human request",
+                created_at: "2026-10-05T10:00:00Z",
+                task_id: "task-a",
+              },
+              ...history.messages,
+            ],
+          });
+        return response({ ...history, next_message_cursor: "message-b" });
+      }),
+    );
+    await render(thread, [node], ["read", "control"]);
+    await act(async () => button("Load earlier history").click());
+    expect(
+      [...container.querySelectorAll(".shared-message-body")].map(
+        (item) => item.textContent,
+      ),
+    ).toEqual(["Earlier human request", "Saved assistant reply"]);
+    await act(async () => button("Archive").click());
+    const mutation = calls.find((item) => item.options.method === "PATCH")!;
+    expect(JSON.parse(mutation.options.body as string)).toEqual({
+      revision: 7,
+      archived: true,
+    });
+    expect(mutation.options.headers).toEqual({
+      "Content-Type": "application/json",
+      "X-Colossus-CSRF": "1",
+    });
+  });
+});
diff --git a/apps/web/src/ThreadDetail.tsx b/apps/web/src/ThreadDetail.tsx
new file mode 100644
index 000000000..5ad2dd806
--- /dev/null
+++ b/apps/web/src/ThreadDetail.tsx
@@ -0,0 +1,763 @@
+import { WebLink } from "./WebLink";
+import {
+  ConversationEntry,
+  ConversationTimeline,
+} from "@colossus/ui/conversation";
+import { Badge } from "@colossus/ui/components/ui/badge";
+import { Button as LinkButton } from "@colossus/ui/components/ui/button";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { Button, TextInput } from "@colossus/ui";
+import {
+  IconArchive,
+  IconArchiveOff,
+  IconArrowDown,
+  IconArrowLeft,
+  IconCheck,
+  IconEdit,
+  IconLoader2,
+  IconMessageCircle,
+  IconPlayerStop,
+  IconX,
+} from "@tabler/icons-react";
+import {
+  awaitReceipt,
+  ApiFailure,
+  projectPath,
+  request,
+  statusLabel,
+  taskStatus,
+  terminalStatuses,
+  type CommandReceipt,
+  type FleetNode,
+  type Permission,
+  type Thread,
+  type Task,
+  type ThreadMessage,
+  type ThreadDetailResponse,
+  type Update,
+} from "./api";
+import { Interactions } from "./Interactions";
+import { RunComposer, type RunRequest } from "./RunComposer";
+import { conversationProjection } from "./conversation";
+import { ThreadRunActivity } from "./ThreadRunActivity";
+
+function mergeMessages(current: ThreadMessage[], incoming: ThreadMessage[]) {
+  const byId = new Map(current.map((item) => [item.message_id, item]));
+  for (const item of incoming) byId.set(item.message_id, item);
+  return [...byId.values()].sort(
+    (a, b) =>
+      a.created_at.localeCompare(b.created_at) ||
+      a.message_id.localeCompare(b.message_id),
+  );
+}
+function mergeTasks(current: Task[], incoming: Task[]) {
+  const byId = new Map(current.map((item) => [item.task_id, item]));
+  for (const item of incoming) byId.set(item.task_id, item);
+  const created = (task: Task) =>
+    Date.parse(task.created_at || task.snapshot?.run.created_at || "") || 0;
+  return [...byId.values()].sort(
+    (a, b) => created(b) - created(a) || b.task_id.localeCompare(a.task_id),
+  );
+}
+
+export function ThreadDetail({
+  initial,
+  project,
+  nodes,
+  permissions,
+  onBack,
+  onChanged,
+  onPolicy,
+  backLabel = "All threads",
+  backHref,
+}: {
+  initial: Thread;
+  project: string;
+  nodes: FleetNode[];
+  permissions: Permission[];
+  onBack: () => void;
+  onChanged: () => void;
+  onPolicy?: (() => void) | undefined;
+  backLabel?: string;
+  backHref?: string;
+}) {
+  const [detail, setDetail] = useState<ThreadDetailResponse>({
+      thread: initial,
+      tasks: [],
+      messages: [],
+    }),
+    [events, setEvents] = useState<Update[]>([]),
+    [connected, setConnected] = useState(false),
+    [error, setError] = useState(""),
+    [notice, setNotice] = useState(""),
+    [busy, setBusy] = useState(false),
+    [controlling, setControlling] = useState(false),
+    [editing, setEditing] = useState(false),
+    [title, setTitle] = useState(initial.title),
+    [below, setBelow] = useState(false),
+    [historyBusy, setHistoryBusy] = useState(false),
+    [resolvedTarget, setResolvedTarget] = useState<FleetNode | null>(null);
+  const path = `${projectPath(project)}/threads/${encodeURIComponent(initial.thread_id)}`;
+  const nodePath = `${projectPath(project)}/nodes/${encodeURIComponent(initial.node_id)}`;
+  const hasListedTarget = nodes.some(
+    (item) => item.node.node_id === initial.node_id,
+  );
+  const alive = useRef(true),
+    heading = useRef<HTMLHeadingElement>(null),
+    conversation = useRef<HTMLDivElement>(null),
+    follow = useRef(true),
+    cancellations = useRef(new Map<string, string>()),
+    historyLoaded = useRef(false);
+  const refresh = useCallback(
+    async (signal?: AbortSignal) => {
+      try {
+        const [value, target] = await Promise.all([
+          request<ThreadDetailResponse>(path, undefined, signal),
+          hasListedTarget
+            ? Promise.resolve(null)
+            : request<FleetNode>(nodePath, undefined, signal),
+        ]);
+        if (target && !signal?.aborted && alive.current)
+          setResolvedTarget(target);
+        if (
+          value.thread.active_task_id &&
+          !value.tasks.some(
+            (task) => task.task_id === value.thread.active_task_id,
+          )
+        ) {
+          const active = await request<{ task: Task }>(
+            `${projectPath(project)}/tasks/${encodeURIComponent(value.thread.active_task_id)}`,
+            undefined,
+            signal,
+          );
+          value.tasks.push(active.task);
+        }
+        if (!signal?.aborted && alive.current)
+          setDetail((current) => ({
+            ...value,
+            messages: mergeMessages(current.messages, value.messages),
+            tasks: mergeTasks(current.tasks, value.tasks),
+            next_message_cursor:
+              (historyLoaded.current
+                ? current.next_message_cursor
+                : value.next_message_cursor) ?? null,
+            next_task_cursor:
+              (historyLoaded.current
+                ? current.next_task_cursor
+                : value.next_task_cursor) ?? null,
+          }));
+      } catch (error) {
+        if (!signal?.aborted && alive.current)
+          setError(
+            error instanceof Error
+              ? error.message
+              : "The conversation could not be refreshed.",
+          );
+      }
+    },
+    [path, project, nodePath, hasListedTarget],
+  );
+  useEffect(() => {
+    heading.current?.focus();
+  }, []);
+  useEffect(() => {
+    alive.current = true;
+    const abort = new AbortController();
+    let pending = false;
+    const poll = async () => {
+      if (pending) return;
+      pending = true;
+      try {
+        await refresh(abort.signal);
+      } finally {
+        pending = false;
+      }
+    };
+    void poll();
+    const timer = setInterval(() => {
+      if (!document.hidden) void poll();
+    }, 2000);
+    return () => {
+      alive.current = false;
+      abort.abort();
+      clearInterval(timer);
+    };
+  }, [refresh]);
+  useEffect(() => {
+    const source = new EventSource(`${path}/events?after=0`);
+    source.onopen = () => setConnected(true);
+    source.onerror = () => setConnected(false);
+    source.addEventListener("run_update", (event) => {
+      try {
+        const update = JSON.parse(
+          (event as MessageEvent<string>).data,
+        ) as Update;
+        setEvents((current) =>
+          current.some(
+            (item) =>
+              item.run_id === update.run_id &&
+              item.sequence === update.sequence &&
+              item.task_id === update.task_id,
+          )
+            ? current
+            : [...current, update],
+        );
+        if (
+          update.update.message ||
+          update.update.result ||
+          update.update.state ||
+          update.update.interaction
+        )
+          void refresh();
+      } catch {
+        setError("The conversation stream returned an invalid update.");
+        source.close();
+      }
+    });
+    source.addEventListener("thread_changed", () => void refresh());
+    return () => source.close();
+  }, [path, refresh]);
+  useEffect(() => {
+    if (!conversation.current) return;
+    if (follow.current) {
+      conversation.current.scrollTop = conversation.current.scrollHeight;
+      setBelow(false);
+    } else setBelow(true);
+  }, [detail.messages.length, events.length]);
+  const { thread, tasks, messages } = detail;
+  const projection = useMemo(
+    () => conversationProjection(detail, events),
+    [detail, events],
+  );
+  const target =
+    nodes.find((item) => item.node.node_id === thread.node_id) ??
+    resolvedTarget;
+  const composerNodes = target && !hasListedTarget ? [...nodes, target] : nodes;
+  const active = tasks.filter(
+    (task) => !terminalStatuses.has(taskStatus(task)),
+  );
+  const running = active.find(
+    (task) =>
+      !task.source_read_only && task.run_id && taskStatus(task) !== "queued",
+  );
+  async function olderHistory() {
+    if (historyBusy) return;
+    const params = new URLSearchParams();
+    if (detail.next_message_cursor)
+      params.set("message_after", detail.next_message_cursor);
+    if (detail.next_task_cursor)
+      params.set("task_after", detail.next_task_cursor);
+    setHistoryBusy(true);
+    setError("");
+    const panel = conversation.current,
+      oldHeight = panel?.scrollHeight ?? 0;
+    try {
+      const value = await request<ThreadDetailResponse>(`${path}?${params}`);
+      if (!alive.current) return;
+      follow.current = false;
+      historyLoaded.current = true;
+      setDetail((current) => ({
+        ...current,
+        messages: mergeMessages(current.messages, value.messages),
+        tasks: mergeTasks(current.tasks, value.tasks),
+        next_message_cursor: value.next_message_cursor ?? null,
+        next_task_cursor: value.next_task_cursor ?? null,
+      }));
+      requestAnimationFrame(() => {
+        if (panel) panel.scrollTop += panel.scrollHeight - oldHeight;
+      });
+    } catch (error) {
+      if (alive.current)
+        setError(
+          error instanceof Error
+            ? error.message
+            : "Earlier history could not be loaded.",
+        );
+    } finally {
+      if (alive.current) setHistoryBusy(false);
+    }
+  }
+  async function send(runRequest: RunRequest) {
+    setBusy(true);
+    setError("");
+    setNotice("");
+    try {
+      const submit = (revision: number) =>
+        request<{ thread: Thread }>(`${path}/messages`, {
+          expected_revision: revision,
+          request: runRequest,
+        });
+      let result: { thread: Thread };
+      try {
+        result = await submit(thread.revision);
+      } catch (error) {
+        if (!(error instanceof ApiFailure && error.status === 409)) throw error;
+        const [latest, latestTarget] = await Promise.all([
+          request<ThreadDetailResponse>(path),
+          request<FleetNode>(nodePath),
+        ]);
+        if (
+          latest.thread.archived ||
+          !latest.thread.can_continue ||
+          latest.thread.node_id !== thread.node_id ||
+          latest.thread.session_id !== thread.session_id ||
+          latestTarget.node.revoked ||
+          !target ||
+          latestTarget.node.instance_id !== target.node.instance_id ||
+          latestTarget.node.roles.join("\u0000") !==
+            target.node.roles.join("\u0000")
+        )
+          throw error;
+        // Runtime progress can advance the revision without changing this human request.
+        // Reconcile once with the same idempotency key and immutable placement.
+        result = await submit(latest.thread.revision);
+      }
+      if (!alive.current) return false;
+      setDetail((value) => ({ ...value, thread: result.thread }));
+      follow.current = true;
+      await refresh();
+      onChanged();
+      setNotice(
+        target?.presence?.ready
+          ? "Message accepted. The agent will process turns in order."
+          : "Message accepted and queued for this agent to reconnect.",
+      );
+      return true;
+    } catch (error) {
+      if (alive.current) {
+        setError(
+          error instanceof Error
+            ? error.message
+            : "Message submission failed. Retry to reconcile the same request.",
+        );
+        void refresh();
+      }
+      return false;
+    } finally {
+      if (alive.current) setBusy(false);
+    }
+  }
+  async function metadata(values: { title?: string; archived?: boolean }) {
+    setBusy(true);
+    setError("");
+    try {
+      const result = await request<{ thread: Thread }>(
+        path,
+        { revision: thread.revision, ...values },
+        undefined,
+        "PATCH",
+      );
+      if (alive.current) {
+        setDetail((value) => ({ ...value, thread: result.thread }));
+        setEditing(false);
+        onChanged();
+      }
+    } catch (error) {
+      if (alive.current) {
+        setError(
+          error instanceof Error
+            ? error.message
+            : "Conversation changes could not be saved.",
+        );
+        void refresh();
+      }
+    } finally {
+      if (alive.current) setBusy(false);
+    }
+  }
+  async function cancel() {
+    if (!running) return;
+    setControlling(true);
+    setError("");
+    let mutation = cancellations.current.get(running.task_id);
+    if (!mutation) {
+      mutation = crypto.randomUUID();
+      cancellations.current.set(running.task_id, mutation);
+    }
+    const taskPath = `${projectPath(project)}/tasks/${encodeURIComponent(running.task_id)}`;
+    try {
+      const { command } = await request<{ command: CommandReceipt }>(
+        `${taskPath}/cancel`,
+        { mutation_id: mutation },
+      );
+      const settled = await awaitReceipt(taskPath, command);
+      if (alive.current) {
+        setNotice(
+          settled
+            ? "Cancellation confirmed by the runtime."
+            : "Cancellation queued. The runtime will reconcile this exact request after reconnecting.",
+        );
+        void refresh();
+      }
+    } catch (error) {
+      if (alive.current)
+        setError(
+          error instanceof Error ? error.message : "Cancellation failed.",
+        );
+    } finally {
+      if (alive.current) setControlling(false);
+    }
+  }
+  const queuedTurns = Math.max(
+    0,
+    (thread.queued_task_ids?.length ?? active.length) - (running ? 1 : 0),
+  );
+  const canWrite =
+    permissions.includes("execute") &&
+    thread.can_continue &&
+    Boolean(thread.session_id) &&
+    !thread.archived &&
+    Boolean(target && !target.node.revoked);
+  return (
+    <section className="detail thread-detail" aria-labelledby="thread-heading">
+      {backHref ? (
+        <LinkButton asChild variant="ghost" className="back">
+          <a
+            href={backHref}
+            onClick={(event) => {
+              if (
+                event.defaultPrevented ||
+                event.button !== 0 ||
+                event.metaKey ||
+                event.ctrlKey ||
+                event.shiftKey ||
+                event.altKey
+              )
+                return;
+              event.preventDefault();
+              onBack();
+            }}
+          >
+            <IconArrowLeft size={16} aria-hidden="true" />
+            {backLabel}
+          </a>
+        </LinkButton>
+      ) : (
+        <Button variant="tertiary" className="back" onClick={onBack}>
+          <IconArrowLeft size={16} aria-hidden="true" />
+          {backLabel}
+        </Button>
+      )}
+      <div className="detail-header">
+        <div>
+          <div className="eyebrow">
+            {target?.node.label ?? thread.node_id}
+            {target?.node.workspace_label
+              ? ` / ${target.node.workspace_label}`
+              : ""}
+          </div>
+          {editing ? (
+            <form
+              className="thread-rename"
+              onSubmit={(event) => {
+                event.preventDefault();
+                if (title.trim()) void metadata({ title: title.trim() });
+              }}
+            >
+              <h2 id="thread-heading" className="sr-only">
+                Rename {thread.title}
+              </h2>
+              <TextInput
+                aria-label="Thread title"
+                value={title}
+                maxLength={256}
+                onChange={(event) => setTitle(event.target.value)}
+                autoFocus
+              />
+              <Button
+                type="submit"
+                aria-label="Save thread title"
+                disabled={busy || !title.trim()}
+              >
+                <IconCheck size={16} aria-hidden="true" />
+              </Button>
+              <Button
+                aria-label="Cancel rename"
+                onClick={() => setEditing(false)}
+              >
+                <IconX size={16} aria-hidden="true" />
+              </Button>
+            </form>
+          ) : (
+            <h2 id="thread-heading" ref={heading} tabIndex={-1}>
+              {thread.title || "Untitled thread"}
+            </h2>
+          )}
+        </div>
+        <div className="thread-header-actions">
+          {permissions.includes("control") ? (
+            <>
+              <Button
+                variant="tertiary"
+                aria-label="Rename thread"
+                onClick={() => {
+                  setTitle(thread.title);
+                  setEditing(true);
+                }}
+                disabled={busy}
+              >
+                <IconEdit size={16} aria-hidden="true" />
+              </Button>
+              <Button
+                variant="secondary"
+                onClick={() => void metadata({ archived: !thread.archived })}
+                disabled={busy}
+              >
+                {thread.archived ? (
+                  <IconArchiveOff size={16} aria-hidden="true" />
+                ) : (
+                  <IconArchive size={16} aria-hidden="true" />
+                )}
+                {thread.archived ? "Restore" : "Archive"}
+              </Button>
+            </>
+          ) : null}
+        </div>
+      </div>
+      <div className="detail-meta">
+        <span>
+          <span className={`dot ${target?.presence?.ready ? "live" : ""}`} />
+          {target?.presence?.ready ? "Agent online" : "Agent offline"}
+        </span>
+        <span>
+          {connected ? "Live updates connected" : "Reconnecting updates"}
+        </span>
+        <span>
+          {thread.source === "runtime"
+            ? "Shared local session"
+            : "Control Plane conversation"}
+        </span>
+        {thread.archived ? <Badge className="status">Archived</Badge> : null}
+      </div>
+      {error ? (
+        <div className="alert" role="alert">
+          {error}
+          <Button aria-label="Dismiss error" onClick={() => setError("")}>
+            <IconX size={16} aria-hidden="true" />
+          </Button>
+        </div>
+      ) : null}
+      {notice ? (
+        <p className="sync-notice" role="status">
+          {notice}
+        </p>
+      ) : null}
+      {thread.sync_status !== "current" ? (
+        <p className="sync-notice" role="status">
+          Released history is incomplete or bounded. Saved messages are
+          available here; canonical conversation context remains with the agent.
+          Additional released history appears when available.
+        </p>
+      ) : null}
+      {!target?.presence?.ready ? (
+        <p className="sync-notice">
+          You’re viewing saved history. The conversation remains assigned to its
+          original agent.
+        </p>
+      ) : null}
+      {detail.next_message_cursor || detail.next_task_cursor ? (
+        <div className="thread-history-toolbar">
+          <Button disabled={historyBusy} onClick={() => void olderHistory()}>
+            {historyBusy ? "Loading history…" : "Load earlier history"}
+          </Button>
+          <span>
+            Saved messages and runs are paged; earlier history remains
+            available.
+          </span>
+        </div>
+      ) : null}
+      <div
+        className="thread-conversation"
+        ref={conversation}
+        tabIndex={0}
+        aria-label="Conversation history"
+        onScroll={() => {
+          const panel = conversation.current;
+          if (panel) {
+            follow.current =
+              panel.scrollHeight - panel.clientHeight - panel.scrollTop < 80;
+            if (follow.current) setBelow(false);
+          }
+        }}
+      >
+        <ConversationTimeline>
+          {!messages.length && !tasks.length ? (
+            <div className="output-empty">
+              <IconMessageCircle size={28} aria-hidden="true" />
+              <h3>Loading conversation</h3>
+              <p>Released messages and saved agent work will appear here.</p>
+            </div>
+          ) : null}
+          {projection.turns.map((turn, index) => {
+            const firstResponse = turn.messages.findIndex(
+                (message) => message.role !== "user",
+              ),
+              split = firstResponse < 0 ? turn.messages.length : firstResponse,
+              task = turn.task,
+              status = task ? taskStatus(task) : "";
+            const messageEntry = (message: (typeof turn.messages)[number]) => (
+              <ConversationEntry
+                key={message.message_id}
+                role={
+                  message.role === "user"
+                    ? "user"
+                    : message.role === "assistant"
+                      ? "assistant"
+                      : "system"
+                }
+                author={
+                  message.role === "user"
+                    ? "Human"
+                    : message.role === "assistant"
+                      ? "Colossus"
+                      : statusLabel(message.role)
+                }
+                createdAt={message.created_at}
+                content={message.text}
+                linkComponent={WebLink}
+                status={
+                  message.status ? (
+                    <Badge className={`status status-${message.status}`}>
+                      {statusLabel(message.status)}
+                    </Badge>
+                  ) : null
+                }
+              />
+            );
+            return (
+              <section
+                className="shared-conversation-turn"
+                key={turn.key}
+                data-task-id={
+                  task?.task_id ?? turn.messages[0]?.task_id ?? undefined
+                }
+                data-run-id={task?.run_id ?? undefined}
+                aria-label={`Conversation turn ${index + 1}`}
+              >
+                {turn.messages.slice(0, split).map(messageEntry)}
+                {task ? (
+                  <div className="conversation-run" data-task-id={task.task_id}>
+                    {!terminalStatuses.has(status) ||
+                    task.dispatch_error ||
+                    task.output_limited ? (
+                      <div className="run-progress" role="status">
+                        {!terminalStatuses.has(status) ? (
+                          <IconLoader2
+                            size={15}
+                            className={status === "queued" ? undefined : "spin"}
+                            aria-hidden="true"
+                          />
+                        ) : null}
+                        <strong>{statusLabel(status)}</strong>
+                        <span>
+                          {task.dispatch_error?.message ??
+                            (status === "queued"
+                              ? "Waiting for this agent and earlier turns"
+                              : status === "waiting"
+                                ? "The agent needs a response"
+                                : terminalStatuses.has(status)
+                                  ? "Viewing saved run details"
+                                  : "The agent is working")}
+                        </span>
+                      </div>
+                    ) : null}
+                    {task.output_limited ? (
+                      <p className="sync-notice">
+                        This run reached its released-output limit. Open the
+                        local session for complete output.
+                      </p>
+                    ) : null}
+                    {task.history_bounded ? (
+                      <p className="sync-notice">
+                        This run’s released history is bounded. Its canonical
+                        conversation context remains with the agent.
+                      </p>
+                    ) : null}
+                    <ThreadRunActivity
+                      task={task}
+                      updates={turn.updates}
+                      label={`Run activity for turn ${index + 1}`}
+                    />
+                    <Interactions
+                      interactions={task.snapshot?.pending_interactions ?? []}
+                      project={project}
+                      task={task.task_id}
+                      permissions={
+                        task.source_read_only || target?.node.revoked
+                          ? []
+                          : permissions
+                      }
+                      onUpdate={() => void refresh()}
+                      onError={setError}
+                    />
+                  </div>
+                ) : null}
+                {turn.messages.slice(split).map(messageEntry)}
+              </section>
+            );
+          })}
+        </ConversationTimeline>
+      </div>
+      {below ? (
+        <Button
+          className="jump-latest"
+          onClick={() => {
+            if (conversation.current)
+              conversation.current.scrollTop =
+                conversation.current.scrollHeight;
+            follow.current = true;
+            setBelow(false);
+          }}
+        >
+          <IconArrowDown size={16} aria-hidden="true" />
+          Jump to latest
+        </Button>
+      ) : null}
+      {running && permissions.includes("control") ? (
+        <div className="thread-run-controls">
+          <Button
+            variant="secondary"
+            disabled={controlling || !target || target.node.revoked}
+            onClick={() => void cancel()}
+          >
+            <IconPlayerStop size={16} aria-hidden="true" />
+            {controlling ? "Requesting cancellation…" : "Stop active run"}
+          </Button>
+          <span>
+            {queuedTurns > 0
+              ? `${queuedTurns} queued turn${queuedTurns === 1 ? "" : "s"}`
+              : "Runs stay assigned to this agent"}
+          </span>
+        </div>
+      ) : null}
+      <RunComposer
+        onPolicy={onPolicy}
+        nodes={composerNodes}
+        nodeId={thread.node_id}
+        lockedRuntime
+        busy={busy}
+        disabled={!canWrite}
+        label="Message the agent"
+        action={
+          active.length || thread.active_task_id
+            ? "Queue message"
+            : "Send message"
+        }
+        onSubmit={send}
+      />
+      {!canWrite ? (
+        <p className="composer-offline">
+          {thread.archived
+            ? "Restore this thread to continue the conversation."
+            : !thread.can_continue
+              ? "This local session was shared for viewing. Continue it locally or enable continuation in its workspace sharing settings."
+              : !thread.session_id
+                ? "The initial turn is queued or starting. You can continue once this agent establishes its session."
+                : target?.node.revoked
+                  ? "This agent’s enrollment was revoked. Saved history remains available."
+                  : "Your project access does not allow messages to this agent."}
+        </p>
+      ) : null}
+    </section>
+  );
+}
diff --git a/apps/web/src/ThreadRunActivity.tsx b/apps/web/src/ThreadRunActivity.tsx
new file mode 100644
index 000000000..3b23e2eb2
--- /dev/null
+++ b/apps/web/src/ThreadRunActivity.tsx
@@ -0,0 +1,263 @@
+import {
+  ConversationActivity,
+  type ConversationActivityTone,
+} from "@colossus/ui/conversation";
+import { IconChevronDown, IconSparkles, IconTool } from "@tabler/icons-react";
+import {
+  statusLabel,
+  taskStatus,
+  terminalStatuses,
+  type Task,
+  type Update,
+} from "./api";
+
+type ReleasedTool = {
+  call_id: string;
+  tool_name: string;
+  state: string;
+  summary: string;
+  input?: string;
+  preview?: string;
+};
+type ActivityItem =
+  | {
+      key: string;
+      type: "tool";
+      history: { activity: ReleasedTool; update: Update }[];
+    }
+  | {
+      key: string;
+      type: "note";
+      text: string;
+      createdAt: string;
+      reasoning: boolean;
+    };
+
+function record(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+function toolsAndNotes(updates: Update[]): ActivityItem[] {
+  const items: ActivityItem[] = [],
+    tools = new Map<string, Extract<ActivityItem, { type: "tool" }>>();
+  for (const update of updates) {
+    const value = update.update,
+      raw = record(value.tool_activity);
+    if (
+      raw &&
+      typeof raw.tool_name === "string" &&
+      typeof raw.state === "string"
+    ) {
+      const activity: ReleasedTool = {
+        call_id: typeof raw.call_id === "string" ? raw.call_id : "",
+        tool_name: raw.tool_name,
+        state: raw.state,
+        summary: typeof raw.summary === "string" ? raw.summary : "",
+        ...(typeof raw.input === "string" ? { input: raw.input } : {}),
+        ...(typeof raw.preview === "string" ? { preview: raw.preview } : {}),
+      };
+      const key = `${update.run_id}:${activity.call_id || `sequence-${update.sequence}`}`;
+      let item = tools.get(key);
+      if (!item) {
+        item = { key, type: "tool", history: [] };
+        tools.set(key, item);
+        items.push(item);
+      }
+      item.history.push({ activity, update });
+      continue;
+    }
+    let text: string | null =
+      typeof value.reasoning_summary === "string"
+        ? value.reasoning_summary
+        : null;
+    const notice = record(value.notice);
+    if (
+      notice &&
+      typeof notice.message === "string" &&
+      !(
+        typeof notice.reason === "string" &&
+        (notice.reason.startsWith("run.phase.") ||
+          notice.reason === "model.final_output")
+      )
+    )
+      text = notice.message;
+    const failed = record(value.failure),
+      failure = record(failed?.failure);
+    if (typeof failure?.message === "string") text = failure.message;
+    const cancellation = record(value.cancellation);
+    if (typeof cancellation?.message === "string") text = cancellation.message;
+    if (text)
+      items.push({
+        key: `${update.run_id}:${update.sequence}`,
+        type: "note",
+        text,
+        createdAt: update.created_at,
+        reasoning: typeof value.reasoning_summary === "string",
+      });
+  }
+  return items;
+}
+function time(value: string) {
+  const date = new Date(value);
+  return Number.isFinite(date.getTime())
+    ? date.toLocaleTimeString([], { hour: "numeric", minute: "2-digit" })
+    : "";
+}
+function preview(activity: ReleasedTool) {
+  if (activity.preview) return activity.preview;
+  if (activity.state === "completed")
+    return "The tool completed, but this activity feed does not include an output preview.";
+  if (activity.state === "cancelled")
+    return "The tool was stopped before an output preview was released.";
+  if (activity.state === "failed" || activity.state === "outcome_unknown")
+    return activity.summary;
+  return "A released output preview will appear after the tool completes.";
+}
+
+export function ThreadRunActivity({
+  task,
+  updates,
+  label,
+}: {
+  task: Task;
+  updates: Update[];
+  label: string;
+}) {
+  const items = toolsAndNotes(updates),
+    status = taskStatus(task);
+  const terminal = record(task.snapshot?.run.terminal),
+    result = record(terminal?.result),
+    failure = record(terminal?.failure);
+  if (!items.length && typeof failure?.message === "string")
+    items.push({
+      key: "snapshot-failure",
+      type: "note",
+      text: failure.message,
+      createdAt: task.snapshot?.run.updated_at ?? "",
+      reasoning: false,
+    });
+  if (!items.length) return null;
+  const toolItems = items.filter(
+      (item): item is Extract<ActivityItem, { type: "tool" }> =>
+        item.type === "tool",
+    ),
+    actions = toolItems.length,
+    notes = items.filter(
+      (item) => item.type === "note" && item.reasoning,
+    ).length,
+    exceptions = toolItems.filter((item) =>
+      ["failed", "outcome_unknown"].includes(
+        item.history.at(-1)?.activity.state ?? "",
+      ),
+    ).length,
+    duration =
+      typeof result?.elapsed_seconds === "number" &&
+      Number.isFinite(result.elapsed_seconds)
+        ? `${Math.max(0, Math.round(result.elapsed_seconds))}s`
+        : null,
+    tone: ConversationActivityTone =
+      status === "completed"
+        ? "success"
+        : ["failed", "outcome_unknown"].includes(status)
+          ? "danger"
+          : ["waiting", "cancelling"].includes(status)
+            ? "warning"
+            : terminalStatuses.has(status)
+              ? "neutral"
+              : "active",
+    humanStatus =
+      status === "waiting"
+        ? "Needs input"
+        : ["queued", "running"].includes(status)
+          ? "Working"
+          : status === "cancelling"
+            ? "Stopping"
+            : ["cancelled", "interrupted"].includes(status)
+              ? "Stopped"
+              : statusLabel(status);
+  return (
+    <ConversationActivity
+      ariaLabel={label}
+      className={`run-state-${status}`}
+      description={[
+        `${actions} ${actions === 1 ? "action" : "actions"}`,
+        notes ? `${notes} ${notes === 1 ? "note" : "notes"}` : null,
+        duration,
+      ]
+        .filter(Boolean)
+        .join(" · ")}
+      statusLabel={humanStatus}
+      tone={tone}
+      exceptionCount={exceptions}
+      open={
+        !terminalStatuses.has(status) || exceptions > 0 || tone === "danger"
+      }
+    >
+      {items.map((item) => {
+        if (item.type === "note")
+          return (
+            <div className="shared-activity-item" key={item.key}>
+              {item.reasoning ? (
+                <IconSparkles size={16} aria-hidden="true" />
+              ) : null}
+              <p className="shared-preserve-lines">{item.text}</p>
+            </div>
+          );
+        const latest = item.history.at(-1)!,
+          activity = latest.activity,
+          input = [...item.history]
+            .reverse()
+            .find((entry) => entry.activity.input)?.activity.input;
+        return (
+          <details
+            className="shared-activity-item shared-activity-tool"
+            data-state={activity.state}
+            key={item.key}
+          >
+            <summary>
+              <IconTool size={16} aria-hidden="true" />
+              <strong>{activity.tool_name}</strong>
+              <span className="shared-activity-meta">
+                {statusLabel(activity.state)}
+              </span>
+              <time
+                className="shared-activity-meta"
+                dateTime={latest.update.created_at}
+              >
+                {time(latest.update.created_at)}
+              </time>
+              <IconChevronDown size={15} aria-hidden="true" />
+            </summary>
+            <ol className="shared-activity-history">
+              {item.history.map(({ activity, update }) => (
+                <li key={`${update.run_id}:${update.sequence}`}>
+                  <span className="shared-activity-meta">
+                    {statusLabel(activity.state)}
+                  </span>
+                  <span>{activity.summary}</span>
+                </li>
+              ))}
+            </ol>
+            {input ? (
+              <section
+                className="shared-activity-detail"
+                aria-label="Tool input"
+              >
+                <strong>Input</strong>
+                <pre>{input}</pre>
+              </section>
+            ) : null}
+            <section
+              className="shared-activity-detail"
+              aria-label="Tool output preview"
+            >
+              <strong>Preview</strong>
+              <pre>{preview(activity)}</pre>
+            </section>
+          </details>
+        );
+      })}
+    </ConversationActivity>
+  );
+}
diff --git a/apps/web/src/Threads.tsx b/apps/web/src/Threads.tsx
new file mode 100644
index 000000000..9c7abac9a
--- /dev/null
+++ b/apps/web/src/Threads.tsx
@@ -0,0 +1,388 @@
+import { Badge } from "@colossus/ui/components/ui/badge";
+import { useCallback, useEffect, useRef, useState } from "react";
+import { Button, DropdownSelect, TextInput } from "@colossus/ui";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@colossus/ui/components/ui/table";
+import {
+  IconArrowRight,
+  IconChevronLeft,
+  IconChevronRight,
+  IconMessageCircle,
+  IconPlus,
+  IconSearch,
+  IconServer,
+} from "@tabler/icons-react";
+import {
+  projectPath,
+  request,
+  type FleetNode,
+  type Permission,
+  type Thread,
+  type Task,
+} from "./api";
+import { RunComposer, type RunRequest } from "./RunComposer";
+
+export function Threads({
+  project,
+  nodes,
+  permissions,
+  agentId,
+  onAgentChange,
+  onOpen,
+  onError,
+  onFleet,
+}: {
+  project: string;
+  nodes: FleetNode[];
+  permissions: Permission[];
+  agentId: string;
+  onAgentChange: (id: string) => void;
+  onOpen: (thread: Thread) => void;
+  onError: (error: string) => void;
+  onFleet: () => void;
+}) {
+  const [threads, setThreads] = useState<Thread[]>([]),
+    [query, setQuery] = useState(""),
+    [search, setSearch] = useState(""),
+    [archive, setArchive] = useState("false"),
+    [cursors, setCursors] = useState<string[]>([""]),
+    [next, setNext] = useState<string | null>(null),
+    [loading, setLoading] = useState(true),
+    [creating, setCreating] = useState(false),
+    [busy, setBusy] = useState(false),
+    [targetId, setTargetId] = useState(agentId);
+  const alive = useRef(true);
+  const heading = useRef<HTMLHeadingElement>(null),
+    initialAgent = useRef(agentId);
+  useEffect(() => {
+    if (initialAgent.current) heading.current?.focus();
+  }, []);
+  useEffect(() => {
+    alive.current = true;
+    return () => {
+      alive.current = false;
+    };
+  }, []);
+  useEffect(() => {
+    const timer = setTimeout(() => setSearch(query.trim()), 250);
+    return () => clearTimeout(timer);
+  }, [query]);
+  useEffect(() => {
+    setCursors([""]);
+  }, [search, agentId, archive]);
+  useEffect(() => {
+    setTargetId(
+      (current) =>
+        agentId ||
+        (nodes.some(
+          (item) => item.node.node_id === current && !item.node.revoked,
+        )
+          ? current
+          : nodes.find((item) => !item.node.revoked && item.presence?.ready)
+              ?.node.node_id ||
+            nodes.find((item) => !item.node.revoked)?.node.node_id ||
+            ""),
+    );
+  }, [agentId, nodes]);
+  const cursor = cursors[cursors.length - 1] ?? "";
+  const refresh = useCallback(
+    async (signal?: AbortSignal) => {
+      const params = new URLSearchParams({ limit: "25", archived: archive });
+      if (agentId) params.set("node_id", agentId);
+      if (search) params.set("query", search);
+      if (cursor) params.set("after", cursor);
+      try {
+        const result = await request<{
+          threads: Thread[];
+          next_cursor?: string | null;
+        }>(`${projectPath(project)}/threads?${params}`, undefined, signal);
+        if (signal?.aborted || !alive.current) return;
+        setThreads(result.threads);
+        setNext(
+          result.next_cursor ??
+            (result.threads.length === 25
+              ? result.threads.at(-1)!.thread_id
+              : null),
+        );
+        setLoading(false);
+      } catch (error) {
+        if (!signal?.aborted && alive.current) {
+          setLoading(false);
+          onError(
+            error instanceof Error
+              ? error.message
+              : "Threads could not be loaded.",
+          );
+        }
+      }
+    },
+    [project, agentId, search, archive, cursor, onError],
+  );
+  useEffect(() => {
+    const abort = new AbortController();
+    let pending = false;
+    setLoading(true);
+    const poll = async () => {
+      if (pending) return;
+      pending = true;
+      try {
+        await refresh(abort.signal);
+      } finally {
+        pending = false;
+      }
+    };
+    void poll();
+    const timer = setInterval(() => {
+      if (!document.hidden) void poll();
+    }, 3000);
+    return () => {
+      abort.abort();
+      clearInterval(timer);
+    };
+  }, [refresh]);
+  async function create(runRequest: RunRequest) {
+    setBusy(true);
+    try {
+      const result = await request<{ thread: Thread; task: Task }>(
+        `${projectPath(project)}/threads`,
+        { node_id: targetId, request: runRequest },
+      );
+      if (!alive.current) return false;
+      setCreating(false);
+      onOpen(result.thread);
+      return true;
+    } catch (error) {
+      if (alive.current)
+        onError(
+          error instanceof Error
+            ? error.message
+            : "Thread creation failed. Retry to reconcile the same request.",
+        );
+      return false;
+    } finally {
+      if (alive.current) setBusy(false);
+    }
+  }
+  const labels = new Map(
+    nodes.map((item) => [item.node.node_id, item.node.label]),
+  );
+  const selectedAgent = nodes.find((item) => item.node.node_id === agentId);
+  return (
+    <section
+      className="managed-settings-body catalog-settings threads-settings"
+      aria-labelledby="threads-heading"
+    >
+      <header className="catalog-heading">
+        <div>
+          <h2 id="threads-heading" ref={heading} tabIndex={-1}>
+            Threads
+          </h2>
+          <p>
+            {selectedAgent
+              ? `Conversations on ${selectedAgent.node.label}${selectedAgent.node.workspace_label ? ` · ${selectedAgent.node.workspace_label}` : ""}.`
+              : "Open a conversation, follow live work, or continue a saved session."}
+          </p>
+        </div>
+        <Button
+          variant="primary"
+          disabled={
+            !permissions.includes("execute") ||
+            !nodes.some((item) => !item.node.revoked)
+          }
+          onClick={() => setCreating((value) => !value)}
+        >
+          <IconPlus size={16} aria-hidden="true" />
+          {creating ? "Close composer" : "New thread"}
+        </Button>
+      </header>
+      {selectedAgent && !selectedAgent.presence?.ready ? (
+        <p className="sync-notice" role="status">
+          <IconServer size={16} aria-hidden="true" />
+          Agent offline. Synced conversations remain available; new messages
+          queue until it reconnects.
+        </p>
+      ) : null}
+      {creating ? (
+        <RunComposer
+          nodes={nodes}
+          nodeId={targetId}
+          onNodeChange={setTargetId}
+          busy={busy}
+          label="Start a conversation"
+          action="Start thread"
+          disabled={!permissions.includes("execute")}
+          onSubmit={create}
+        />
+      ) : null}
+      <div className="thread-toolbar">
+        <label className="thread-search">
+          <IconSearch size={16} aria-hidden="true" />
+          <span className="sr-only">Search threads</span>
+          <TextInput
+            aria-label="Search threads"
+            placeholder="Search threads…"
+            value={query}
+            onChange={(event) => setQuery(event.target.value)}
+          />
+        </label>
+        <DropdownSelect
+          aria-label="Filter threads by agent"
+          value={agentId}
+          onChange={(event) => onAgentChange(event.target.value)}
+        >
+          <option value="">All agents</option>
+          {nodes.map((item) => (
+            <option key={item.node.node_id} value={item.node.node_id}>
+              {item.node.label}
+            </option>
+          ))}
+        </DropdownSelect>
+        <DropdownSelect
+          aria-label="Thread archive filter"
+          value={archive}
+          onChange={(event) => setArchive(event.target.value)}
+        >
+          <option value="false">Open threads</option>
+          <option value="true">Archived threads</option>
+        </DropdownSelect>
+      </div>
+      <div className="thread-table" aria-busy={loading}>
+        <Table>
+          <TableHeader>
+            <TableRow>
+              <TableHead scope="col">Conversation</TableHead>
+              <TableHead scope="col">Agent / workspace</TableHead>
+              <TableHead scope="col">History</TableHead>
+              <TableHead scope="col">Updated</TableHead>
+              <TableHead scope="col">
+                <span className="sr-only">Open thread</span>
+              </TableHead>
+            </TableRow>
+          </TableHeader>
+          <TableBody>
+            {threads.map((thread) => (
+              <TableRow key={thread.thread_id}>
+                <TableHead scope="row" data-label="Conversation">
+                  <div className="catalog-identity">
+                    <span className="resource-icon">
+                      <IconMessageCircle size={16} aria-hidden="true" />
+                    </span>
+                    <div>
+                      <button
+                        className="catalog-name"
+                        type="button"
+                        onClick={() => onOpen(thread)}
+                      >
+                        {thread.title || "Untitled thread"}
+                      </button>
+                      <small>
+                        {thread.source === "runtime"
+                          ? "Shared local session"
+                          : "Control Plane conversation"}
+                        {thread.active_task_id ? " · Active work" : ""}
+                      </small>
+                    </div>
+                  </div>
+                </TableHead>
+                <TableCell data-label="Agent / workspace">
+                  <div className="thread-agent-cell">
+                    {labels.get(thread.node_id) ?? thread.node_id.slice(0, 8)}
+                    {nodes.find((item) => item.node.node_id === thread.node_id)
+                      ?.node.workspace_label ? (
+                      <small className="thread-cell-note">
+                        {
+                          nodes.find(
+                            (item) => item.node.node_id === thread.node_id,
+                          )?.node.workspace_label
+                        }
+                      </small>
+                    ) : null}
+                  </div>
+                </TableCell>
+                <TableCell data-label="History">
+                  <Badge
+                    className={`status ${thread.sync_status === "current" ? "status-completed" : "status-waiting"}`}
+                  >
+                    {thread.sync_status === "current"
+                      ? "Synced"
+                      : "Sync incomplete"}
+                  </Badge>
+                </TableCell>
+                <TableCell data-label="Updated">
+                  <time
+                    dateTime={thread.updated_at}
+                    title={new Date(thread.updated_at).toLocaleString()}
+                  >
+                    {new Date(thread.updated_at).toLocaleDateString(undefined, {
+                      month: "short",
+                      day: "numeric",
+                    })}
+                  </time>
+                </TableCell>
+                <TableCell className="thread-row-action">
+                  <button
+                    type="button"
+                    className="ui-icon-button"
+                    aria-label={`Open thread: ${thread.title}`}
+                    onClick={() => onOpen(thread)}
+                  >
+                    <IconArrowRight size={16} aria-hidden="true" />
+                  </button>
+                </TableCell>
+              </TableRow>
+            ))}
+          </TableBody>
+        </Table>
+      </div>
+      {!threads.length ? (
+        <div className="empty-state">
+          <IconMessageCircle size={28} aria-hidden="true" />
+          <h3>
+            {loading
+              ? "Loading conversations…"
+              : search
+                ? "No matching threads"
+                : archive === "true"
+                  ? "No archived threads"
+                  : "No conversations yet"}
+          </h3>
+          <p>
+            {search
+              ? "Try a different title or agent."
+              : "Control Plane conversations and explicitly shared local sessions appear here."}
+          </p>
+          {!nodes.length ? (
+            <Button onClick={onFleet}>Set up an agent</Button>
+          ) : null}
+        </div>
+      ) : null}
+      <div className="thread-pagination">
+        <span>
+          {threads.length} conversations · Page {cursors.length}
+        </span>
+        <Button
+          disabled={loading || cursors.length === 1}
+          onClick={() => setCursors((value) => value.slice(0, -1))}
+        >
+          <IconChevronLeft size={16} aria-hidden="true" />
+          Previous
+        </Button>
+        <Button
+          disabled={loading || !next}
+          onClick={() => {
+            if (next) setCursors((value) => [...value, next]);
+          }}
+        >
+          Next
+          <IconChevronRight size={16} aria-hidden="true" />
+        </Button>
+      </div>
+    </section>
+  );
+}
diff --git a/apps/web/src/WebLink.tsx b/apps/web/src/WebLink.tsx
new file mode 100644
index 000000000..578591b95
--- /dev/null
+++ b/apps/web/src/WebLink.tsx
@@ -0,0 +1,19 @@
+import type { ReactNode } from "react";
+import { safeWebLink } from "@colossus/ui/conversation";
+/** Browser navigation remains a web-host decision; generated links receive no application authority. */
+export function WebLink({
+  href,
+  children,
+}: {
+  href?: string | undefined;
+  children?: ReactNode;
+}) {
+  const safe = safeWebLink(href);
+  return safe ? (
+    <a href={safe} target="_blank" rel="noopener noreferrer">
+      {children}
+    </a>
+  ) : (
+    <span>{children}</span>
+  );
+}
diff --git a/apps/web/src/api.test.ts b/apps/web/src/api.test.ts
new file mode 100644
index 000000000..a276bfc98
--- /dev/null
+++ b/apps/web/src/api.test.ts
@@ -0,0 +1,126 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  ApiFailure,
+  awaitReceipt,
+  projectPath,
+  request,
+  taskStatus,
+  terminalStatuses,
+  visibleOutput,
+  type Task,
+} from "./api";
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+describe("browser authority and released data", () => {
+  it("reconciles identity after a project denial without creating an authentication loop", async () => {
+    const dispatchEvent = vi.fn();
+    vi.stubGlobal("window", { dispatchEvent });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockImplementation(() =>
+        Promise.resolve(
+          new Response(JSON.stringify({ error: "permission_denied" }), {
+            status: 403,
+          }),
+        ),
+      ),
+    );
+    await expect(request("/api/projects/p/tasks")).rejects.toBeInstanceOf(
+      ApiFailure,
+    );
+    expect(dispatchEvent).toHaveBeenCalledOnce();
+    expect(dispatchEvent.mock.calls[0]?.[0].type).toBe(
+      "colossus:web:reconcile-identity",
+    );
+    await expect(request("/api/me")).rejects.toBeInstanceOf(ApiFailure);
+    expect(dispatchEvent).toHaveBeenCalledOnce();
+  });
+  it("reports a runtime rejection even when HTTP accepted the queued action", async () => {
+    await expect(
+      awaitReceipt("/api/projects/p/tasks/t", {
+        command_id: "c",
+        reply: {
+          kind: "failed",
+          error: { code: "conflict", message: "The interaction changed." },
+        },
+      }),
+    ).rejects.toThrow("The interaction changed.");
+  });
+  it("waits for the exact receipt without submitting a second mutation", async () => {
+    vi.useFakeTimers();
+    const fetch = vi.fn().mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          command: { command_id: "c", reply: { kind: "responded" } },
+        }),
+      ),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const settled = awaitReceipt("/api/projects/p/tasks/t", {
+      command_id: "c",
+      reply: null,
+    });
+    await vi.advanceTimersByTimeAsync(300);
+    expect(await settled).toBe(true);
+    expect(fetch.mock.calls).toHaveLength(1);
+    expect(fetch.mock.calls[0]?.[0]).toBe("/api/projects/p/tasks/t/commands/c");
+    expect(fetch.mock.calls[0]?.[1].method).toBe("GET");
+  });
+  it("uses same-origin cookies and explicit CSRF protection for mutations", async () => {
+    const fetch = vi
+      .fn()
+      .mockResolvedValue(new Response("{}", { status: 200 }));
+    vi.stubGlobal("fetch", fetch);
+    await request("/api/projects/engineering/tasks", { node_id: "node-a" });
+    expect(fetch).toHaveBeenCalledWith("/api/projects/engineering/tasks", {
+      method: "POST",
+      credentials: "same-origin",
+      headers: { "Content-Type": "application/json", "X-Colossus-CSRF": "1" },
+      body: '{"node_id":"node-a"}',
+    });
+    expect(JSON.stringify(fetch.mock.calls)).not.toContain("Authorization");
+  });
+  it("preserves abort signals and treats permission failures as failures", async () => {
+    const abort = new AbortController();
+    const fetch = vi
+      .fn()
+      .mockResolvedValue(
+        new Response('{"error":"permission_denied"}', { status: 403 }),
+      );
+    vi.stubGlobal("fetch", fetch);
+    await expect(
+      request("/api/me", undefined, abort.signal),
+    ).rejects.toBeInstanceOf(ApiFailure);
+    expect(fetch.mock.calls[0]?.[1].signal).toBe(abort.signal);
+    expect(fetch.mock.calls[0]?.[1].method).toBe("GET");
+  });
+  it("never interpolates a project into a foreign URL or extra path", () => {
+    expect(projectPath("../foreign?x=1")).toBe(
+      "/api/projects/..%2Fforeign%3Fx%3D1",
+    );
+  });
+  it("keeps an unknown allocation explicit instead of suggesting a rerun", () => {
+    const task = {
+      dispatch_error: { code: "outcome_unknown", message: "reconcile" },
+      snapshot: null,
+    } as Task;
+    expect(taskStatus(task)).toBe("outcome_unknown");
+    expect(terminalStatuses.has(taskStatus(task))).toBe(true);
+  });
+  it("renders only released output and replaces deltas with the authoritative result", () => {
+    const events = [
+      { update: { output_delta: "hel" } },
+      { update: { provider_private: "do not display", output_delta: "lo" } },
+      { update: { result: { output: "hello, completed" } } },
+    ].map((event, index) => ({
+      ...event,
+      run_id: "run-a",
+      sequence: index + 1,
+      created_at: "2026-10-04T00:00:00Z",
+    }));
+    expect(visibleOutput(events)).toBe("hello, completed");
+  });
+});
diff --git a/apps/web/src/api.ts b/apps/web/src/api.ts
new file mode 100644
index 000000000..abeb08e6f
--- /dev/null
+++ b/apps/web/src/api.ts
@@ -0,0 +1,292 @@
+export type Permission =
+  "read" | "execute" | "control" | "approve" | "administer";
+export interface Membership {
+  subject: string;
+  project_id: string;
+  permissions: Permission[];
+}
+export interface Node {
+  node_id: string;
+  project_id: string;
+  instance_id: string;
+  label: string;
+  certificate_sha256: string;
+  roles: string[];
+  revoked: boolean;
+  revision: number;
+  host_id?: string | null;
+  workspace_id?: string | null;
+  workspace_label?: string | null;
+  policy?: RuntimePolicyPosture | null;
+  policy_observed_at?: number | null;
+}
+export interface RuntimePolicyPosture {
+  schema_version: number;
+  provenance: string;
+  fingerprint: string;
+  configuration_revision: number | null;
+  access_profile: string;
+  sandbox_backend: string;
+  sandbox_profile: string;
+  boundary_acknowledged: boolean;
+  approval_mode: string;
+  allowed_roles: string[];
+  allowed_tools: string[];
+  capabilities: string[];
+  models: { profile: string; label: string }[];
+  findings: { code: string; severity: string }[];
+  telemetry: {
+    provenance: string;
+    denied_requests: number | null;
+    approval_requests: number | null;
+    outcome_unknown_runs: number | null;
+  };
+}
+export interface Host {
+  host_id: string;
+  project_id: string;
+  label: string;
+  platform: string;
+  deployment_kind: string;
+  revision: number;
+  last_seen_at: number | null;
+}
+export interface Thread {
+  thread_id: string;
+  project_id: string;
+  node_id: string;
+  host_id?: string | null;
+  workspace_id?: string | null;
+  title: string;
+  created_at: string;
+  updated_at: string;
+  revision: number;
+  archived: boolean;
+  session_id?: string | null;
+  sync_status: "current" | "incomplete";
+  source: "cloud" | "runtime";
+  can_continue: boolean;
+  active_task_id?: string | null;
+  queued_task_ids?: string[];
+}
+export interface ThreadMessage {
+  message_id: string;
+  role: string;
+  text: string;
+  created_at: string;
+  task_id?: string | null;
+}
+export interface ThreadDetailResponse {
+  thread: Thread;
+  tasks: Task[];
+  messages: ThreadMessage[];
+  next_task_cursor?: string | null;
+  next_message_cursor?: string | null;
+}
+export interface FleetNode {
+  node: Node;
+  presence: {
+    ready: boolean;
+    capabilities: string[];
+    connection_id: string;
+  } | null;
+}
+export interface Interaction {
+  interaction_id: string;
+  run_id: string;
+  kind: "approval" | "user_prompt";
+  status: string;
+  respondable_by_caller: boolean;
+  etag: string;
+  content: {
+    approval?: {
+      action: string;
+      resource: string;
+      reason: string;
+      risk: string | null;
+      request_hash: string;
+      command_context: {
+        justification: string;
+        executable: string;
+        arguments: string[];
+        working_directory: string;
+        redacted: boolean;
+      } | null;
+    };
+    user_prompt?: {
+      question: string;
+      choices: { choice_id: string; label: string }[];
+      allow_free_form: boolean;
+    };
+  };
+}
+export interface Run {
+  run_id: string;
+  title: string;
+  status: string;
+  created_at: string;
+  updated_at: string;
+  role: string;
+  mode: string;
+  last_sequence: number;
+  terminal: unknown;
+}
+export interface Task {
+  task_id: string;
+  project_id: string;
+  node_id: string;
+  subject: string;
+  created_at?: string;
+  updated_at?: string;
+  request: { input: { text: string }[]; mode: string; role: string };
+  run_id: string | null;
+  snapshot: { run: Run; pending_interactions: Interaction[] } | null;
+  last_sequence: number;
+  revision: number;
+  dispatch_error?: { message: string; code: string } | null;
+  output_limited?: boolean;
+  thread_id?: string | null;
+  source_read_only?: boolean;
+  history_bounded?: boolean;
+  history_complete?: boolean;
+}
+export interface Update {
+  run_id: string;
+  sequence: number;
+  created_at: string;
+  update: Record<string, unknown>;
+  task_id?: string;
+}
+export class ApiFailure extends Error {
+  constructor(
+    public readonly status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+export interface CommandReceipt {
+  command_id: string;
+  reply: { kind: string; error?: { code: string; message: string } } | null;
+}
+
+// A successful HTTP mutation acknowledges the queue. Only the runtime receipt
+// confirms the operation; an offline runtime leaves it durably queued.
+export async function awaitReceipt(
+  taskPath: string,
+  command: CommandReceipt,
+  signal?: AbortSignal,
+): Promise<boolean> {
+  const deadline = Date.now() + 10000;
+  for (;;) {
+    if (command.reply) {
+      if (command.reply.kind === "failed")
+        throw new Error(
+          command.reply.error?.message ?? "The runtime rejected this action.",
+        );
+      return true;
+    }
+    if (Date.now() >= deadline) return false;
+    await new Promise<void>((resolve) => setTimeout(resolve, 300));
+    command = (
+      await request<{ command: CommandReceipt }>(
+        `${taskPath}/commands/${encodeURIComponent(command.command_id)}`,
+        undefined,
+        signal,
+      )
+    ).command;
+  }
+}
+const messages: Record<string, string> = {
+  permission_denied:
+    "Your session expired or this project permission is unavailable.",
+  conflict:
+    "The state changed. Refresh and review the current task before retrying.",
+  storage:
+    "The control plane is temporarily unavailable. Your accepted work remains on its runtime.",
+  resource_exhausted:
+    "A resource limit was reached. Wait for active work to finish before retrying.",
+  invalid_argument: "Check the request fields and try again.",
+  not_found: "This resource is no longer available in the selected project.",
+};
+export async function request<T>(
+  path: string,
+  body?: unknown,
+  signal?: AbortSignal,
+  method?: "PATCH" | "DELETE",
+): Promise<T> {
+  const response = await fetch(path, {
+    method: method ?? (body === undefined ? "GET" : "POST"),
+    credentials: "same-origin",
+    headers:
+      body === undefined
+        ? method === "DELETE"
+          ? { "X-Colossus-CSRF": "1" }
+          : {}
+        : { "Content-Type": "application/json", "X-Colossus-CSRF": "1" },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    ...(signal ? { signal } : {}),
+  });
+  if (!response.ok) {
+    // The web host reconciles identity after authorization failures. A project
+    // denial may only remove one role; it must not blindly log the user out.
+    if (
+      (response.status === 401 || response.status === 403) &&
+      typeof window !== "undefined" &&
+      path.startsWith("/api/") &&
+      !["/api/me", "/api/auth/config", "/api/settings"].includes(path)
+    ) {
+      window.dispatchEvent(new Event("colossus:web:reconcile-identity"));
+    }
+    const error = (await response
+      .json()
+      .catch(() => ({ error: "storage" }))) as { error?: string };
+    throw new ApiFailure(
+      response.status,
+      messages[error.error ?? "storage"] ??
+        "The request could not be completed.",
+    );
+  }
+  if (response.status === 204) return undefined as T;
+  return (await response.json()) as T;
+}
+export function projectPath(project: string) {
+  return `/api/projects/${encodeURIComponent(project)}`;
+}
+export function taskTitle(task: Task) {
+  return (
+    task.snapshot?.run.title ||
+    task.request.input.map((part) => part.text).join(" ") ||
+    "Untitled task"
+  );
+}
+export function taskStatus(task: Task) {
+  return task.dispatch_error?.code === "outcome_unknown"
+    ? "outcome_unknown"
+    : task.dispatch_error
+      ? "failed"
+      : task.snapshot?.run.status || "queued";
+}
+export const terminalStatuses = new Set([
+  "completed",
+  "failed",
+  "cancelled",
+  "interrupted",
+  "outcome_unknown",
+]);
+export function statusLabel(value: string) {
+  return value
+    .split("_")
+    .map((word) => word[0]?.toUpperCase() + word.slice(1))
+    .join(" ");
+}
+export function visibleOutput(updates: Update[]): string {
+  let output = "";
+  for (const event of updates) {
+    if (typeof event.update.output_delta === "string")
+      output += event.update.output_delta;
+    const result = event.update.result as { output?: string } | undefined;
+    if (result?.output) output = result.output;
+  }
+  return output;
+}
diff --git a/apps/web/src/control-api.test.ts b/apps/web/src/control-api.test.ts
new file mode 100644
index 000000000..e7df872a5
--- /dev/null
+++ b/apps/web/src/control-api.test.ts
@@ -0,0 +1,24 @@
+import { expect, it } from "vitest";
+import { projectPermissions, type Me } from "./control-api";
+it("unions administrator management rights with explicit membership and strips archived operation rights", () => {
+  const me = {
+    user: { is_admin: true },
+    projects: [{ id: "project", archived: false }],
+    memberships: [{ project_id: "project", permissions: ["read"] }],
+  } as Me;
+  expect(new Set(projectPermissions(me, "project"))).toEqual(
+    new Set(["read", "administer"]),
+  );
+  me.memberships[0]!.permissions = ["read", "execute", "control"];
+  expect(new Set(projectPermissions(me, "project"))).toEqual(
+    new Set(["read", "execute", "control", "administer"]),
+  );
+  expect(projectPermissions(me, "project")).not.toContain("approve");
+  me.memberships[0]!.permissions = ["read", "control", "approve"];
+  expect(projectPermissions(me, "project")).not.toContain("execute");
+  expect(projectPermissions(me, "project")).toContain("administer");
+  me.projects[0]!.archived = true;
+  expect(new Set(projectPermissions(me, "project"))).toEqual(
+    new Set(["read", "administer"]),
+  );
+});
diff --git a/apps/web/src/control-api.ts b/apps/web/src/control-api.ts
new file mode 100644
index 000000000..74b3fcc49
--- /dev/null
+++ b/apps/web/src/control-api.ts
@@ -0,0 +1,195 @@
+import type {
+  Membership,
+  Permission,
+  RuntimePolicyPosture,
+  Thread,
+} from "./api";
+export interface UserIdentity {
+  kind: "local" | "oidc";
+  label: string;
+  username?: string;
+  issuer?: string;
+  subject?: string;
+}
+export interface User {
+  id: string;
+  display_name: string;
+  email: string | null;
+  active: boolean;
+  is_admin: boolean;
+  revision: number;
+  created_at: string;
+  updated_at: string;
+  identities?: UserIdentity[];
+}
+export interface Project {
+  id: string;
+  name: string;
+  description: string;
+  parent_project_id: string | null;
+  archived: boolean;
+  revision: number;
+  created_at: string;
+  updated_at: string;
+}
+export interface Member {
+  user_id: string;
+  project_id: string;
+  display_name: string;
+  role: ProjectRole;
+  permissions: string[];
+  revision: number;
+  active?: boolean;
+}
+export type ProjectRole = "viewer" | "operator" | "approver" | "project_admin";
+export const projectRoles: {
+  value: ProjectRole;
+  label: string;
+  description: string;
+}[] = [
+  {
+    value: "viewer",
+    label: "Viewer",
+    description: "Read released history and fleet inventory.",
+  },
+  {
+    value: "operator",
+    label: "Operator",
+    description: "Read, execute, and control authorized agent work.",
+  },
+  {
+    value: "approver",
+    label: "Approver",
+    description: "Read and approve actions within the runtime’s grant.",
+  },
+  {
+    value: "project_admin",
+    label: "Project administrator",
+    description:
+      "Operate project work and manage access and its monitoring baseline.",
+  },
+];
+export interface Me {
+  user: User;
+  memberships: (Membership & { user_id: string; role: ProjectRole })[];
+  projects: Project[];
+}
+/** Mirror management visibility without manufacturing execution or approval rights. */
+export function projectPermissions(
+  me: Me | null,
+  projectId: string,
+): Permission[] {
+  const project = me?.projects.find((item) => item.id === projectId);
+  if (!me || !project) return [];
+  const permissions = new Set(
+    me.memberships.find((member) => member.project_id === projectId)
+      ?.permissions ?? [],
+  );
+  if (me.user.is_admin) {
+    permissions.add("read");
+    permissions.add("administer");
+  }
+  if (project.archived) {
+    permissions.delete("execute");
+    permissions.delete("control");
+    permissions.delete("approve");
+  }
+  return [...permissions];
+}
+export interface Classification {
+  enabled: boolean;
+  text: string;
+  tone: "neutral" | "info" | "warning" | "danger";
+  position: "top" | "top_and_bottom";
+}
+export interface PublicSettings {
+  classification: Classification;
+}
+export interface AdminSettings extends PublicSettings {
+  revision: number;
+  auth: { local_enabled: boolean; oidc_label: string | null };
+}
+export interface AuthConfig {
+  local_enabled: boolean;
+  oidc: { label: string; login_url: string } | null;
+}
+export interface Activity {
+  date: string;
+  runs: number;
+  completed: number;
+  failed: number;
+  input_tokens?: number | null;
+  output_tokens?: number | null;
+}
+export interface Analytics {
+  generated_at: string;
+  window_days: number;
+  counts: {
+    threads: number;
+    runs: number;
+    completed: number;
+    failed: number;
+    cancelled: number;
+    active: number;
+    queued: number;
+    agents: number;
+    online_agents: number;
+    hosts: number;
+    interrupted: number;
+    outcome_unknown: number;
+  };
+  activity: Activity[];
+  usage: {
+    input_tokens: number | null;
+    output_tokens: number | null;
+    estimated_cost: number | null;
+    currency?: string;
+    coverage?: string;
+  };
+  telemetry?: { complete: boolean; description?: string };
+}
+export interface Dashboard {
+  generated_at: string;
+  counts: {
+    projects: number;
+    hosts: number;
+    agents: number;
+    online_agents: number;
+    threads: number;
+    active_runs: number;
+    queued_tasks: number;
+    failed_runs: number;
+  };
+  recent_threads: { thread: Thread; project_name: string }[];
+  activity: Activity[];
+  telemetry?: { complete: boolean; description?: string };
+}
+export interface PolicyBaseline {
+  revision: number;
+  required_sandbox_profile: string | null;
+  allowed_approval_modes: string[];
+  allowed_tools: string[] | null;
+}
+export interface AgentPolicy {
+  node_id: string;
+  observed_at: number | null;
+  last_seen_at: number | null;
+  connected: boolean;
+  posture: RuntimePolicyPosture | null;
+  provenance: string;
+  stale: boolean;
+  status: "reported" | "unknown" | "unsupported";
+  description?: string;
+  expectation: PolicyBaseline;
+  evaluation: {
+    status: "unknown" | "aligned" | "drift";
+    findings: { code: string; description: string }[];
+  };
+}
+
+/** Bounded dashboard period. Transport and credentials remain in the web host. */
+export function dashboard(days = 7): string {
+  if (!Number.isInteger(days) || days < 1 || days > 90)
+    throw new RangeError("Activity days must be between 1 and 90.");
+  return `/api/dashboard?days=${days}`;
+}
diff --git a/apps/web/src/conversation.test.ts b/apps/web/src/conversation.test.ts
new file mode 100644
index 000000000..ebe32e517
--- /dev/null
+++ b/apps/web/src/conversation.test.ts
@@ -0,0 +1,159 @@
+import { describe, expect, it } from "vitest";
+import { conversationProjection } from "./conversation";
+import type { Task, ThreadDetailResponse, Update } from "./api";
+
+const task = (id: string, created: string, text: string): Task => ({
+  task_id: id,
+  project_id: "p",
+  node_id: "n",
+  subject: "human",
+  created_at: created,
+  request: { input: [{ text }], mode: "execute", role: "primary" },
+  run_id: `run-${id}`,
+  snapshot: null,
+  revision: 1,
+  last_sequence: 1,
+});
+const output = (id: string, created: string, text: string): Update => ({
+  task_id: id,
+  run_id: `run-${id}`,
+  sequence: 1,
+  created_at: created,
+  update: { result: { output: text } },
+});
+describe("released conversation chronology", () => {
+  it("binds each turn's ordered activity to its exact task/run and fences duplicate or conflicting frames", () => {
+    const early = task("first", "2026-10-05T10:00:00Z", "First request"),
+      late = task("second", "2026-10-05T10:00:00Z", "Second request");
+    const activity = (
+      owner: Task,
+      sequence: number,
+      state: string,
+    ): Update => ({
+      task_id: owner.task_id,
+      run_id: owner.run_id!,
+      sequence,
+      created_at: "2026-10-05T10:01:00Z",
+      update: {
+        tool_activity: {
+          call_id: "same-call-id",
+          tool_name: "echo",
+          state,
+          summary: `${owner.task_id} ${state}`,
+        },
+      },
+    });
+    const first = activity(early, 1, "requested"),
+      second = activity(late, 1, "requested");
+    const detail = {
+      thread: { created_at: early.created_at, updated_at: late.created_at },
+      tasks: [late, early],
+      messages: [],
+    } as unknown as ThreadDetailResponse;
+    const view = conversationProjection(detail, [
+      activity(late, 2, "completed"),
+      second,
+      { ...second, task_id: early.task_id },
+      activity(early, 2, "completed"),
+      first,
+      { ...first, update: { result: { output: "Conflicting duplicate" } } },
+      { ...first, task_id: "unmapped-task", run_id: "unmapped-delegated-run" },
+    ]);
+    expect(view.turns.map((turn) => turn.task?.task_id)).toEqual([
+      "first",
+      "second",
+    ]);
+    expect(
+      view.turns.map((turn) =>
+        turn.updates.map((item) => [item.run_id, item.sequence]),
+      ),
+    ).toEqual([
+      [
+        [early.run_id, 1],
+        [early.run_id, 2],
+      ],
+      [
+        [late.run_id, 1],
+        [late.run_id, 2],
+      ],
+    ]);
+    expect(view.messages.map((message) => message.text)).toEqual([
+      "First request",
+      "Second request",
+    ]);
+  });
+  it("keeps partially loaded history visible without associating unmapped activity by timestamp", () => {
+    const loaded = task("loaded", "2026-10-05T10:00:00Z", "Loaded request");
+    const detail = {
+      thread: { created_at: loaded.created_at, updated_at: loaded.created_at },
+      tasks: [loaded],
+      messages: [
+        {
+          message_id: "older-message",
+          task_id: "not-loaded",
+          role: "assistant",
+          text: "Saved partial history",
+          created_at: loaded.created_at,
+        },
+      ],
+    } as unknown as ThreadDetailResponse;
+    const view = conversationProjection(detail, [
+      {
+        ...output("not-loaded", loaded.created_at!, "Unmapped output"),
+        run_id: loaded.run_id!,
+      },
+    ]);
+    const older = view.turns.find((turn) => turn.key === "task-not-loaded")!;
+    expect(older.task).toBeUndefined();
+    expect(older.updates).toEqual([]);
+    expect(older.messages[0]?.text).toBe("Saved partial history");
+    expect(view.byTask.get(loaded.task_id)).toEqual([]);
+  });
+  it("interleaves completed turns from older SDK result feeds despite hash task IDs and newest-first detail pages", () => {
+    const early = task("zz-first", "2026-10-05T10:00:00Z", "First request"),
+      late = task("aa-second", "2026-10-05T10:02:00Z", "Second request");
+    const detail = {
+      thread: { created_at: early.created_at, updated_at: late.created_at },
+      tasks: [late, early],
+      messages: [],
+    } as unknown as ThreadDetailResponse;
+    const view = conversationProjection(detail, [
+      output(late.task_id, "2026-10-05T10:03:00Z", "Second answer"),
+      output(early.task_id, "2026-10-05T10:01:00Z", "First answer"),
+    ]);
+    expect(view.messages.map((message) => message.text)).toEqual([
+      "First request",
+      "First answer",
+      "Second request",
+      "Second answer",
+    ]);
+  });
+  it("deduplicates authoritative assistant messages and never invents human input from a read-only imported run title", () => {
+    const imported = {
+      ...task("import", "2026-10-05T10:00:00Z", "Source run title"),
+      source_read_only: true,
+      subject: "runtime",
+    };
+    const detail = {
+      thread: {
+        created_at: imported.created_at,
+        updated_at: imported.created_at,
+      },
+      tasks: [imported],
+      messages: [
+        {
+          message_id: "authoritative",
+          role: "assistant",
+          text: "Released answer",
+          created_at: "2026-10-05T10:01:00Z",
+          task_id: imported.task_id,
+        },
+      ],
+    } as unknown as ThreadDetailResponse;
+    const view = conversationProjection(detail, [
+      output(imported.task_id, "2026-10-05T10:01:00Z", "Released answer"),
+    ]);
+    expect(view.messages).toHaveLength(1);
+    expect(view.messages[0]?.message_id).toBe("authoritative");
+  });
+});
diff --git a/apps/web/src/conversation.ts b/apps/web/src/conversation.ts
new file mode 100644
index 000000000..838b1be8d
--- /dev/null
+++ b/apps/web/src/conversation.ts
@@ -0,0 +1,150 @@
+import {
+  taskStatus,
+  visibleOutput,
+  type Task,
+  type ThreadDetailResponse,
+  type ThreadMessage,
+  type Update,
+} from "./api";
+
+export interface ConversationMessage extends ThreadMessage {
+  status?: string;
+}
+export interface ConversationTurn {
+  key: string;
+  task: Task | undefined;
+  messages: ConversationMessage[];
+  updates: Update[];
+}
+const createdTime = (task: Task) =>
+  task.created_at || task.snapshot?.run.created_at || "";
+
+/** Merge released messages and compatible run feeds without reordering completed turns. */
+export function conversationProjection(
+  detail: ThreadDetailResponse,
+  events: Update[],
+) {
+  const byTask = new Map<string, Update[]>(),
+    tasks = new Map(detail.tasks.map((task) => [task.task_id, task])),
+    tasksByRun = new Map<string, Task | null>(),
+    seen = new Set<string>();
+  for (const task of detail.tasks) {
+    byTask.set(task.task_id, []);
+    if (task.run_id)
+      tasksByRun.set(task.run_id, tasksByRun.has(task.run_id) ? null : task);
+  }
+  for (const event of events) {
+    const task = event.task_id
+      ? tasks.get(event.task_id)
+      : tasksByRun.get(event.run_id);
+    // A task claim cannot redirect another run's output or delegated activity.
+    if (
+      !task ||
+      !task.run_id ||
+      event.run_id !== task.run_id ||
+      !Number.isSafeInteger(event.sequence) ||
+      event.sequence <= 0
+    )
+      continue;
+    const key = `${event.run_id}:${event.sequence}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    byTask.get(task.task_id)!.push(event);
+  }
+  for (const updates of byTask.values())
+    updates.sort((a, b) => a.sequence - b.sequence);
+  const messages: ConversationMessage[] = [...detail.messages];
+  const taskTimes = new Map(
+    detail.tasks.map((task) => [
+      task.task_id,
+      Date.parse(createdTime(task)) || 0,
+    ]),
+  );
+  for (const task of detail.tasks) {
+    const updates = byTask.get(task.task_id) ?? [];
+    if (
+      !task.source_read_only &&
+      task.subject !== "runtime" &&
+      !messages.some(
+        (message) =>
+          message.task_id === task.task_id && message.role === "user",
+      )
+    ) {
+      const text = task.request.input
+        .map((part) => part.text)
+        .filter(Boolean)
+        .join("\n");
+      if (text)
+        messages.push({
+          message_id: `task-input-${task.task_id}`,
+          role: "user",
+          text,
+          created_at: createdTime(task) || detail.thread.created_at,
+          task_id: task.task_id,
+        });
+    }
+    const output = visibleOutput(updates);
+    if (
+      output &&
+      !messages.some(
+        (message) =>
+          message.task_id === task.task_id && message.role === "assistant",
+      )
+    ) {
+      messages.push({
+        message_id: `run-output-${task.task_id}`,
+        role: "assistant",
+        text: output,
+        created_at:
+          updates.at(-1)?.created_at ||
+          task.snapshot?.run.updated_at ||
+          createdTime(task) ||
+          detail.thread.updated_at,
+        task_id: task.task_id,
+        status: taskStatus(task),
+      });
+    }
+  }
+  const time = (message: ConversationMessage) =>
+    Date.parse(message.created_at) || 0;
+  messages.sort(
+    (a, b) =>
+      (taskTimes.get(a.task_id ?? "") ?? time(a)) -
+        (taskTimes.get(b.task_id ?? "") ?? time(b)) ||
+      time(a) - time(b) ||
+      (a.role === "user" ? 0 : 1) - (b.role === "user" ? 0 : 1) ||
+      a.message_id.localeCompare(b.message_id),
+  );
+  const turns = new Map<string, ConversationTurn>();
+  for (const message of messages) {
+    const key = message.task_id
+      ? `task-${message.task_id}`
+      : `message-${message.message_id}`;
+    const turn = turns.get(key) ?? {
+      key,
+      task: message.task_id ? tasks.get(message.task_id) : undefined,
+      messages: [],
+      updates: message.task_id ? (byTask.get(message.task_id) ?? []) : [],
+    };
+    turn.messages.push(message);
+    turns.set(key, turn);
+  }
+  for (const task of detail.tasks) {
+    const key = `task-${task.task_id}`;
+    if (!turns.has(key))
+      turns.set(key, {
+        key,
+        task,
+        messages: [],
+        updates: byTask.get(task.task_id) ?? [],
+      });
+  }
+  // Timestamps order complete groups; identity alone binds messages and activity.
+  const position = (turn: ConversationTurn) =>
+    (turn.task ? taskTimes.get(turn.task.task_id) : 0) ||
+    (turn.messages[0] ? time(turn.messages[0]) : 0);
+  const orderedTurns = [...turns.values()].sort(
+    (a, b) => position(a) - position(b) || a.key.localeCompare(b.key),
+  );
+  return { messages, byTask, turns: orderedTurns };
+}
diff --git a/apps/web/src/main.tsx b/apps/web/src/main.tsx
new file mode 100644
index 000000000..3c5e19d90
--- /dev/null
+++ b/apps/web/src/main.tsx
@@ -0,0 +1,20 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { App } from "./App";
+import "@colossus/ui/styles/theme.css";
+import "@colossus/ui/styles/shadcn.css";
+import "@colossus/ui/styles/composer.css";
+import "@colossus/ui/styles/select.css";
+import "@colossus/ui/styles/settings.css";
+import "@colossus/ui/styles/controls.css";
+import "@colossus/ui/styles/application.css";
+import "@colossus/ui/styles/catalog.css";
+import "@colossus/ui/styles/conversation.css";
+import "@colossus/ui/styles/workspace-sidebar.css";
+import "@colossus/ui/styles/work-welcome.css";
+import "./style.css";
+createRoot(document.getElementById("root")!).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);
diff --git a/apps/web/src/navigation.test.tsx b/apps/web/src/navigation.test.tsx
new file mode 100644
index 000000000..66bcbf3cd
--- /dev/null
+++ b/apps/web/src/navigation.test.tsx
@@ -0,0 +1,156 @@
+// @vitest-environment happy-dom
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import {
+  NavigationProvider,
+  RouteLink,
+  navigate,
+  navigateBack,
+  rememberSignInReturn,
+  restoreSignInReturn,
+  useNavigation,
+} from "./navigation";
+import { AgentSidebar } from "./AgentScope";
+let root: Root, container: HTMLDivElement;
+beforeEach(() => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  history.replaceState(null, "", "/");
+  sessionStorage.clear();
+  container = document.createElement("div");
+  document.body.append(container);
+  root = createRoot(container);
+});
+afterEach(async () => {
+  await act(() => root.unmount());
+  container.remove();
+  history.replaceState(null, "", "/");
+  vi.restoreAllMocks();
+});
+function View() {
+  const navigation = useNavigation();
+  return (
+    <>
+      <output>{navigation.href}</output>
+      <RouteLink href="/fleet">Fleet</RouteLink>
+      <RouteLink href="/projects/p/threads/t">Conversation</RouteLink>
+    </>
+  );
+}
+async function changed() {
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  });
+}
+it("updates real URLs and restores the view through Back and Forward", async () => {
+  await act(() =>
+    root.render(
+      <NavigationProvider>
+        <View />
+      </NavigationProvider>,
+    ),
+  );
+  await act(() =>
+    container.querySelector<HTMLAnchorElement>('a[href="/fleet"]')!.click(),
+  );
+  await act(() =>
+    container
+      .querySelector<HTMLAnchorElement>('a[href="/projects/p/threads/t"]')!
+      .click(),
+  );
+  expect(location.pathname).toBe("/projects/p/threads/t");
+  await act(() => navigateBack("/fleet"));
+  await changed();
+  expect(container.querySelector("output")!.textContent).toBe("/fleet");
+  await act(() => history.forward());
+  await changed();
+  expect(container.querySelector("output")!.textContent).toBe(
+    "/projects/p/threads/t",
+  );
+});
+it("uses actual sidebar Back history without pushing another Fleet entry and falls back for a direct load", async () => {
+  vi.spyOn(globalThis, "fetch").mockImplementation(
+    async () =>
+      new Response(JSON.stringify({ threads: [], next_cursor: null })),
+  );
+  navigate("/fleet?project=p");
+  navigate("/projects/p/agents/n/overview");
+  await act(() =>
+    root.render(
+      <NavigationProvider>
+        <AgentSidebar
+          project="p"
+          nodes={[]}
+          hosts={[]}
+          agentId="n"
+          selected=""
+          onAgent={() => {}}
+          onOpen={() => {}}
+          onNew={() => {}}
+          onBack={() => navigateBack("/fleet?project=p")}
+        />
+      </NavigationProvider>,
+    ),
+  );
+  const link = container.querySelector<HTMLAnchorElement>(
+    'a[href="/fleet?project=p"]',
+  )!;
+  expect(link.textContent?.trim()).toBe("Back");
+  const back = vi.spyOn(history, "back"),
+    push = vi.spyOn(history, "pushState");
+  await act(() => link.click());
+  await changed();
+  expect(back).toHaveBeenCalledTimes(1);
+  expect(push).not.toHaveBeenCalled();
+  expect(location.pathname + location.search).toBe("/fleet?project=p");
+  history.replaceState(null, "", "/projects/p/agents/n/overview");
+  await act(() => link.click());
+  expect(back).toHaveBeenCalledTimes(1);
+  expect(location.pathname + location.search).toBe("/fleet?project=p");
+});
+it("keeps modified clicks native and supplies a parent for a direct-link Back", async () => {
+  history.replaceState(null, "", "/projects/p/threads/t");
+  await act(() =>
+    root.render(
+      <NavigationProvider>
+        <View />
+      </NavigationProvider>,
+    ),
+  );
+  const push = vi.spyOn(history, "pushState");
+  const event = new MouseEvent("click", {
+    bubbles: true,
+    cancelable: true,
+    button: 0,
+    ctrlKey: true,
+  });
+  container.querySelector('a[href="/fleet"]')!.dispatchEvent(event);
+  expect(event.defaultPrevented).toBe(false);
+  expect(push).not.toHaveBeenCalled();
+  // Happy DOM performs native modified-link navigation in the same synthetic
+  // window. Reopen the direct link before checking the separate Back contract.
+  history.replaceState(null, "", "/projects/p/threads/t");
+  await act(() => navigateBack("/projects/p/agents/n/overview"));
+  expect(location.pathname).toBe("/projects/p/agents/n/overview");
+});
+it("resumes a bounded local deep link after sign-in without external redirects", () => {
+  history.replaceState(null, "", "/projects/p/threads/t");
+  rememberSignInReturn();
+  history.replaceState(null, "", "/");
+  restoreSignInReturn();
+  expect(location.pathname).toBe("/projects/p/threads/t");
+  expect(sessionStorage.getItem("colossus:web:sign-in-return")).toBeNull();
+  history.replaceState(null, "", "/");
+  sessionStorage.setItem(
+    "colossus:web:sign-in-return",
+    JSON.stringify({
+      path: "https://other.example/",
+      expires: Date.now() + 1000,
+    }),
+  );
+  restoreSignInReturn();
+  expect(location.pathname).toBe("/");
+  expect(() => navigate("https://other.example/fleet")).toThrow(
+    "Invalid Control Plane destination",
+  );
+});
diff --git a/apps/web/src/navigation.tsx b/apps/web/src/navigation.tsx
new file mode 100644
index 000000000..c8c031fd6
--- /dev/null
+++ b/apps/web/src/navigation.tsx
@@ -0,0 +1,146 @@
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useSyncExternalStore,
+  type AnchorHTMLAttributes,
+  type ReactNode,
+} from "react";
+import { parseRoute, safeReturnPath, type Route } from "./routes";
+
+const changed = "colossus:web:navigation";
+const returnKey = "colossus:web:sign-in-return";
+const snapshot = () => `${window.location.pathname}${window.location.search}`;
+function subscribe(listener: () => void) {
+  window.addEventListener("popstate", listener);
+  window.addEventListener(changed, listener);
+  return () => {
+    window.removeEventListener("popstate", listener);
+    window.removeEventListener(changed, listener);
+  };
+}
+function historyMarker() {
+  const marker = window.history.state?.colossusRoute;
+  return marker && typeof marker.from === "string" ? marker : null;
+}
+export function navigate(href: string, replace = false) {
+  const path = safeReturnPath(href, window.location.origin);
+  if (!path) throw new Error("Invalid Control Plane destination.");
+  if (path === snapshot()) return;
+  const state = {
+    colossusRoute: {
+      from: replace ? (historyMarker()?.from ?? null) : snapshot(),
+    },
+  };
+  if (replace) window.history.replaceState(state, "", path);
+  else window.history.pushState(state, "", path);
+  window.dispatchEvent(new Event(changed));
+}
+export function navigateBack(fallback: string) {
+  const from = historyMarker()?.from;
+  if (from && safeReturnPath(from, window.location.origin))
+    window.history.back();
+  else navigate(fallback, true);
+}
+/** The OIDC callback may return Home. Only a validated local route is retained. */
+export function rememberSignInReturn() {
+  const path = safeReturnPath(snapshot(), window.location.origin);
+  try {
+    if (path)
+      window.sessionStorage.setItem(
+        returnKey,
+        JSON.stringify({ path, expires: Date.now() + 600000 }),
+      );
+    else window.sessionStorage.removeItem(returnKey);
+  } catch {
+    /* Storage may be unavailable. */
+  }
+}
+export function restoreSignInReturn() {
+  try {
+    const raw = window.sessionStorage.getItem(returnKey);
+    window.sessionStorage.removeItem(returnKey);
+    if (!raw || snapshot() !== "/") return;
+    const value = JSON.parse(raw) as { path?: unknown; expires?: unknown };
+    if (
+      typeof value.path === "string" &&
+      typeof value.expires === "number" &&
+      value.expires > Date.now() &&
+      value.expires <= Date.now() + 600000 &&
+      safeReturnPath(value.path, window.location.origin)
+    )
+      navigate(value.path, true);
+  } catch {
+    /* Invalid or unavailable storage must not affect sign-in. */
+  }
+}
+interface Navigation {
+  route: Route;
+  href: string;
+  go: (href: string, replace?: boolean) => void;
+  back: (fallback: string) => void;
+}
+const Context = createContext<Navigation | null>(null);
+export function NavigationProvider({ children }: { children: ReactNode }) {
+  const href = useSyncExternalStore(subscribe, snapshot, snapshot);
+  const route = parseRoute(href, window.location.origin);
+  const go = useCallback(
+    (path: string, replace = false) => navigate(path, replace),
+    [],
+  );
+  const back = useCallback((path: string) => navigateBack(path), []);
+  useEffect(() => {
+    document.getElementById("control-main")?.focus();
+  }, [href]);
+  return <Context value={{ route, href, go, back }}>{children}</Context>;
+}
+export function useNavigation() {
+  const value = useContext(Context);
+  if (!value) throw new Error("Navigation must be supplied by the web host.");
+  return value;
+}
+export function RouteLink({
+  href,
+  onNavigate,
+  back = false,
+  children,
+  ...props
+}: AnchorHTMLAttributes<HTMLAnchorElement> & {
+  href: string;
+  onNavigate?: () => void;
+  back?: boolean;
+  children: ReactNode;
+}) {
+  const navigation = useContext(Context);
+  return (
+    <a
+      {...props}
+      href={href}
+      onClick={(event) => {
+        props.onClick?.(event);
+        if (
+          event.defaultPrevented ||
+          event.button !== 0 ||
+          event.metaKey ||
+          event.ctrlKey ||
+          event.shiftKey ||
+          event.altKey ||
+          props.target ||
+          props.download !== undefined
+        )
+          return;
+        if (navigation) {
+          event.preventDefault();
+          if (back) navigation.back(href);
+          else navigation.go(href);
+        } else if (onNavigate) {
+          event.preventDefault();
+          onNavigate();
+        }
+      }}
+    >
+      {children}
+    </a>
+  );
+}
diff --git a/apps/web/src/resources.test.tsx b/apps/web/src/resources.test.tsx
new file mode 100644
index 000000000..7123895e8
--- /dev/null
+++ b/apps/web/src/resources.test.tsx
@@ -0,0 +1,55 @@
+// @vitest-environment happy-dom
+import { act } from "react";
+import { createRoot } from "react-dom/client";
+import { expect, it, vi } from "vitest";
+import { useResource } from "./resources";
+it("discards a deferred prior-account response at the same resource URL", async () => {
+  Object.assign(globalThis, { IS_REACT_ACT_ENVIRONMENT: true });
+  const element = document.createElement("div");
+  document.body.append(element);
+  const root = createRoot(element);
+  const pending: {
+    resolve: (response: Response) => void;
+    signal: AbortSignal;
+  }[] = [];
+  vi.stubGlobal(
+    "fetch",
+    vi
+      .fn()
+      .mockImplementation(
+        (_path: string, options: { signal: AbortSignal }) =>
+          new Promise<Response>((resolve) =>
+            pending.push({ resolve, signal: options.signal }),
+          ),
+      ),
+  );
+  function View({ identity }: { identity: string }) {
+    const { data } = useResource<{ label: string }>(
+      "/api/dashboard",
+      0,
+      identity,
+    );
+    return <span>{data?.label ?? "Loading"}</span>;
+  }
+  try {
+    await act(() => root.render(<View identity="user-a" />));
+    await act(() => root.render(<View identity="user-b" />));
+    expect(pending[0]!.signal.aborted).toBe(true);
+    await act(async () =>
+      pending[0]!.resolve(
+        new Response(JSON.stringify({ label: "Prior account private data" })),
+      ),
+    );
+    expect(element.textContent).toBe("Loading");
+    await act(async () =>
+      pending[1]!.resolve(
+        new Response(JSON.stringify({ label: "Current account" })),
+      ),
+    );
+    expect(element.textContent).toBe("Current account");
+  } finally {
+    await act(() => root.unmount());
+    element.remove();
+    vi.unstubAllGlobals();
+  }
+});
diff --git a/apps/web/src/resources.ts b/apps/web/src/resources.ts
new file mode 100644
index 000000000..12f5dbf09
--- /dev/null
+++ b/apps/web/src/resources.ts
@@ -0,0 +1,82 @@
+import { useCallback, useEffect, useState } from "react";
+import { request } from "./api";
+interface ResourceState<T> {
+  scope: string;
+  data: T | null;
+  error: string;
+  loading: boolean;
+}
+/** The host supplies identity to fence caches across account changes at the same URL. */
+export function useResource<T>(
+  path: string | null,
+  interval = 0,
+  identity = "",
+) {
+  const scope = JSON.stringify([identity, path]);
+  const [state, setState] = useState<ResourceState<T>>({
+      scope,
+      data: null,
+      error: "",
+      loading: Boolean(path),
+    }),
+    [generation, setGeneration] = useState(0);
+  useEffect(() => {
+    if (!path) {
+      setState({ scope, data: null, error: "", loading: false });
+      return;
+    }
+    const abort = new AbortController();
+    let pending = false;
+    setState((current) =>
+      current.scope === scope
+        ? { ...current, loading: current.data === null, error: "" }
+        : { scope, data: null, error: "", loading: true },
+    );
+    const load = async () => {
+      if (pending) return;
+      pending = true;
+      try {
+        const value = await request<T>(path, undefined, abort.signal);
+        if (!abort.signal.aborted)
+          setState({ scope, data: value, error: "", loading: false });
+      } catch (e) {
+        if (!abort.signal.aborted)
+          setState((current) => ({
+            scope,
+            data: current.scope === scope ? current.data : null,
+            error:
+              e instanceof Error ? e.message : "Could not load this resource.",
+            loading: false,
+          }));
+      } finally {
+        pending = false;
+      }
+    };
+    void load();
+    const timer = interval
+      ? setInterval(() => {
+          if (!document.hidden) void load();
+        }, interval)
+      : null;
+    return () => {
+      abort.abort();
+      if (timer) clearInterval(timer);
+    };
+  }, [path, scope, interval, generation]);
+  const refresh = useCallback(() => setGeneration((value) => value + 1), []);
+  const current =
+    state.scope === scope
+      ? state
+      : { scope, data: null, error: "", loading: Boolean(path) };
+  return {
+    data: current.data,
+    error: current.error,
+    loading: current.loading,
+    refresh,
+  };
+}
+export function errorMessage(error: unknown) {
+  return error instanceof Error
+    ? error.message
+    : "The change could not be saved.";
+}
diff --git a/apps/web/src/routes.test.ts b/apps/web/src/routes.test.ts
new file mode 100644
index 000000000..2dfd45a22
--- /dev/null
+++ b/apps/web/src/routes.test.ts
@@ -0,0 +1,67 @@
+import { describe, expect, it } from "vitest";
+import {
+  agentHref,
+  globalHref,
+  parseRoute,
+  projectHref,
+  safeReturnPath,
+  taskHref,
+  threadHref,
+} from "./routes";
+const origin = "https://control.example";
+describe("Control Plane permalinks", () => {
+  it("round-trips major pages and encoded, exact scoped resource identifiers", () => {
+    expect(parseRoute(globalHref("fleet", "project:a"), origin)).toEqual({
+      kind: "global",
+      surface: "fleet",
+      project: "project:a",
+    });
+    expect(
+      parseRoute(globalHref("admin", undefined, "settings"), origin),
+    ).toEqual({ kind: "global", surface: "admin", view: "settings" });
+    expect(parseRoute(projectHref("project:a", "access"), origin)).toEqual({
+      kind: "project",
+      project: "project:a",
+      view: "access",
+    });
+    expect(
+      parseRoute(agentHref("project:a", "node:b", "policy", true), origin),
+    ).toEqual({
+      kind: "agent",
+      project: "project:a",
+      node: "node:b",
+      view: "policy",
+      compose: true,
+    });
+    expect(parseRoute(threadHref("project:a", "thread:c"), origin)).toEqual({
+      kind: "thread",
+      project: "project:a",
+      thread: "thread:c",
+    });
+    expect(parseRoute(taskHref("project:a", "task:d"), origin)).toEqual({
+      kind: "task",
+      project: "project:a",
+      task: "task:d",
+    });
+  });
+  it("rejects malformed, ambiguous, oversized, and cross-origin destinations", () => {
+    for (const href of [
+      "https://other.example/fleet",
+      "//other.example/fleet",
+      "/projects/p/threads/%2Fsecret",
+      "/projects/p/threads/%ZZ",
+      "/projects/p/threads/",
+      "/fleet?project=p&project=q",
+      "/fleet?permissions=execute",
+      "/projects/p/agents/n/policy?compose=0",
+      `/projects/p/threads/${"x".repeat(257)}`,
+      `/fleet?${"x".repeat(2048)}`,
+    ]) {
+      expect(parseRoute(href, origin).kind, href).toBe("invalid");
+      expect(safeReturnPath(href, origin), href).toBeNull();
+    }
+    expect(
+      safeReturnPath(`${origin}/projects/p/threads/t#ignored`, origin),
+    ).toBe("/projects/p/threads/t");
+  });
+});
diff --git a/apps/web/src/routes.ts b/apps/web/src/routes.ts
new file mode 100644
index 000000000..a36380eb2
--- /dev/null
+++ b/apps/web/src/routes.ts
@@ -0,0 +1,147 @@
+export type Surface = "home" | "fleet" | "projects" | "admin" | "settings";
+export type ProjectView =
+  "overview" | "tasks" | "analytics" | "access" | "settings";
+export type AgentView = "overview" | "threads" | "analytics" | "policy";
+export type AdminView = "users" | "projects" | "settings";
+export type Route =
+  | { kind: "global"; surface: Surface; project?: string; view?: AdminView }
+  | { kind: "project"; project: string; view: ProjectView }
+  | {
+      kind: "agent";
+      project: string;
+      node: string;
+      view: AgentView;
+      compose: boolean;
+    }
+  | { kind: "thread"; project: string; thread: string }
+  | { kind: "task"; project: string; task: string }
+  | { kind: "invalid"; message: string };
+
+const projectViews = new Set([
+  "overview",
+  "tasks",
+  "analytics",
+  "access",
+  "settings",
+]);
+const agentViews = new Set(["overview", "threads", "analytics", "policy"]);
+const adminViews = new Set(["users", "projects", "settings"]);
+const invalid = (): Route => ({
+  kind: "invalid",
+  message:
+    "This address does not identify a Control Plane page. Check the link or choose a page from the navigation.",
+});
+function validId(value: string) {
+  return (
+    value.length > 0 &&
+    value.length <= 256 &&
+    value !== "." &&
+    value !== ".." &&
+    !/[\s/\\\u0000-\u001f\u007f]/u.test(value)
+  );
+}
+function id(value: string) {
+  if (!validId(value)) throw new Error("Invalid resource identifier.");
+  return encodeURIComponent(value);
+}
+export function globalHref(
+  surface: Surface,
+  project?: string,
+  view?: AdminView,
+) {
+  const base =
+    surface === "home"
+      ? "/"
+      : `/${surface}${surface === "admin" && view ? `/${view}` : ""}`;
+  return project ? `${base}?project=${id(project)}` : base;
+}
+export const projectHref = (project: string, view: ProjectView = "overview") =>
+  `/projects/${id(project)}/${view}`;
+export const agentHref = (
+  project: string,
+  node: string,
+  view: AgentView = "overview",
+  compose = false,
+) =>
+  `/projects/${id(project)}/agents/${id(node)}/${view}${compose ? "?compose=1" : ""}`;
+export const threadHref = (project: string, thread: string) =>
+  `/projects/${id(project)}/threads/${id(thread)}`;
+export const taskHref = (project: string, task: string) =>
+  `/projects/${id(project)}/tasks/${id(task)}`;
+
+/** Paths select a view only. Every resource still requires an authorized API read. */
+export function parseRoute(href: string, origin: string): Route {
+  if (href.length > 2048) return invalid();
+  try {
+    const url = new URL(href, origin);
+    if (url.origin !== origin || url.username || url.password) return invalid();
+    const raw = url.pathname.split("/").slice(1);
+    if (raw.at(-1) === "") raw.pop();
+    const parts = raw.map(decodeURIComponent);
+    if (parts.some((part) => !validId(part))) return invalid();
+    const query = url.searchParams;
+    if ([...query.keys()].some((key) => query.getAll(key).length !== 1))
+      return invalid();
+    const first = parts[0];
+    if (
+      !parts.length ||
+      (parts.length === 1 &&
+        ["fleet", "projects", "admin", "settings"].includes(first!)) ||
+      (first === "admin" && parts.length === 2 && adminViews.has(parts[1]!))
+    ) {
+      if ([...query.keys()].some((key) => key !== "project")) return invalid();
+      const project = query.get("project");
+      if (project !== null && !validId(project)) return invalid();
+      return {
+        kind: "global",
+        surface: (first ?? "home") as Surface,
+        ...(project ? { project } : {}),
+        ...(parts[1] ? { view: parts[1] as AdminView } : {}),
+      };
+    }
+    if (first !== "projects" || !parts[1]) return invalid();
+    const project = parts[1];
+    if (parts.length === 3 && projectViews.has(parts[2]!)) {
+      if (query.size) return invalid();
+      return { kind: "project", project, view: parts[2] as ProjectView };
+    }
+    if (
+      parts.length === 5 &&
+      parts[2] === "agents" &&
+      agentViews.has(parts[4]!)
+    ) {
+      if (
+        [...query.keys()].some((key) => key !== "compose") ||
+        (query.has("compose") && query.get("compose") !== "1")
+      )
+        return invalid();
+      return {
+        kind: "agent",
+        project,
+        node: parts[3]!,
+        view: parts[4] as AgentView,
+        compose: query.get("compose") === "1",
+      };
+    }
+    if (parts.length === 4 && !query.size) {
+      if (parts[2] === "threads")
+        return { kind: "thread", project, thread: parts[3]! };
+      if (parts[2] === "tasks")
+        return { kind: "task", project, task: parts[3]! };
+    }
+    return invalid();
+  } catch {
+    return invalid();
+  }
+}
+export function safeReturnPath(href: string, origin: string): string | null {
+  if (parseRoute(href, origin).kind === "invalid") return null;
+  const url = new URL(href, origin);
+  return `${url.pathname}${url.search}`;
+}
+export function routeSurface(route: Route): Surface {
+  if (route.kind === "global") return route.surface;
+  if (route.kind === "project" || route.kind === "task") return "projects";
+  if (route.kind === "agent" || route.kind === "thread") return "fleet";
+  return "home";
+}
diff --git a/apps/web/src/style.css b/apps/web/src/style.css
new file mode 100644
index 000000000..67f515164
--- /dev/null
+++ b/apps/web/src/style.css
@@ -0,0 +1,1941 @@
+* {
+  box-sizing: border-box;
+}
+body {
+  margin: 0;
+  background: var(--canvas);
+  color: var(--text);
+  font: var(--font-size-body) / var(--line-height-body) var(--font-sans);
+}
+button,
+input,
+textarea {
+  font-family: inherit;
+}
+button,
+a,
+summary {
+  -webkit-tap-highlight-color: transparent;
+}
+button {
+  cursor: pointer;
+}
+button:disabled {
+  cursor: not-allowed;
+}
+button:focus-visible,
+a:focus-visible,
+summary:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+button,
+input,
+textarea {
+  font-size: var(--font-size-control);
+}
+h1,
+h2,
+h3,
+h4 {
+  color: var(--text-strong);
+  line-height: var(--line-height-tight);
+}
+h1,
+h2 {
+  font-size: var(--font-size-heading);
+}
+h3,
+h4 {
+  font-size: var(--font-size-heading-sm);
+}
+p {
+  line-height: var(--line-height-body);
+}
+.muted {
+  color: var(--muted);
+}
+.mono,
+code,
+pre {
+  font-family: var(--font-mono);
+}
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip-path: inset(50%);
+  white-space: nowrap;
+  border: 0;
+}
+.full-width {
+  width: 100%;
+}
+.project-picker {
+  padding-top: 0;
+}
+.project-picker label {
+  display: grid;
+  min-width: 0;
+  gap: 6px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.project-picker .app-select {
+  width: 100%;
+}
+.connection-indicator {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.dot {
+  display: inline-block;
+  flex: none;
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: var(--muted);
+}
+.dot.live {
+  background: var(--green);
+}
+.new-task-panel {
+  padding: 12px;
+  margin: 12px 0 16px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+}
+.composer-label {
+  display: block;
+  margin-bottom: 6px;
+  font-size: var(--font-size-body-sm);
+  font-weight: 600;
+}
+.new-task-panel .composer-input {
+  padding: 8px 10px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  background: var(--surface-editor);
+  font-size: var(--font-size-control);
+  line-height: var(--line-height-body);
+}
+.new-task-panel .composer-input:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+.composer-controls {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-top: 8px;
+}
+.composer-controls .app-select {
+  width: auto;
+  min-width: 0;
+  max-width: 100%;
+}
+.composer-controls .app-select:first-child {
+  flex: 1;
+  min-width: min(180px, 100%);
+}
+.composer-hint {
+  margin-left: auto;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  white-space: nowrap;
+}
+.task-actions-column {
+  width: 48px;
+}
+.status {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  max-width: 100%;
+  padding: 2px 7px;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius-sm);
+  color: var(--muted);
+  background: var(--surface-muted);
+  font-size: var(--font-size-caption);
+  font-weight: 500;
+  line-height: var(--line-height-body);
+}
+.status-connected,
+.status-completed {
+  border-color: var(--green-border);
+  color: var(--green-text);
+  background: var(--green-soft);
+}
+.status-running,
+.status-starting {
+  border-color: var(--accent-border);
+  color: var(--accent-text);
+  background: var(--blue-soft);
+}
+.status-waiting,
+.status-outcome_unknown {
+  border-color: var(--amber-border);
+  color: var(--amber-text);
+  background: var(--amber-soft);
+}
+.status-failed,
+.status-revoked {
+  border-color: var(--red-border);
+  color: var(--red-text);
+  background: var(--red-soft);
+}
+.empty-state {
+  display: grid;
+  justify-items: center;
+  padding: 24px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+  text-align: center;
+}
+.empty-state h3 {
+  margin: 0;
+}
+.empty-state p {
+  color: var(--muted);
+  margin: 6px 0 12px;
+  max-width: 52ch;
+}
+.load-more {
+  margin-block: 12px;
+}
+.alert {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 10px 12px;
+  margin: 0 0 12px;
+  border: 1px solid var(--red-border);
+  border-radius: var(--radius-sm);
+  background: var(--red-soft);
+  color: var(--red-text);
+  font-size: var(--font-size-body-sm);
+  overflow-wrap: anywhere;
+}
+.alert button {
+  flex: none;
+}
+.project-alert {
+  margin: 12px var(--settings-gutter) 0;
+}
+.enrollment-dialog {
+  width: min(520px, calc(100vw - 32px));
+  max-height: calc(100dvh - 32px);
+  padding: 20px;
+  overflow-y: auto;
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius);
+  background: var(--surface);
+  color: var(--text);
+  box-shadow: var(--shadow);
+}
+.enrollment-dialog::backdrop {
+  background: var(--surface-overlay);
+}
+.dialog-heading {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+}
+.node-icon {
+  display: grid;
+  width: var(--icon-control-size);
+  height: var(--icon-control-size);
+  place-items: center;
+  color: var(--icon-text);
+}
+.enrollment-dialog h2 {
+  margin: 12px 0 6px;
+}
+.enrollment-dialog > p {
+  margin: 0 0 16px;
+  font-size: var(--font-size-body-sm);
+}
+.enrollment-dialog label {
+  display: grid;
+  gap: 6px;
+  margin-bottom: 12px;
+  font-size: var(--font-size-body-sm);
+  font-weight: 600;
+}
+.enrollment-dialog small {
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+  font-weight: 400;
+}
+.enrollment-instructions {
+  padding: 12px;
+  margin-block: 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+}
+.enrollment-instructions h3 {
+  margin: 0 0 6px;
+  font-size: var(--font-size-body-sm);
+}
+.enrollment-instructions p {
+  margin: 0 0 12px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.enrollment-instructions code {
+  display: inline;
+  font-size: var(--font-size-body-sm);
+  overflow-wrap: anywhere;
+}
+.detail {
+  padding: 12px var(--settings-gutter) 20px;
+}
+.detail .back {
+  margin-bottom: 12px;
+}
+.detail-header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 12px;
+}
+.detail-header > div {
+  min-width: 0;
+}
+.detail-header h2 {
+  margin: 6px 0 12px;
+  overflow-wrap: anywhere;
+}
+.detail-header .status {
+  flex: none;
+}
+.eyebrow {
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  overflow-wrap: anywhere;
+}
+.detail-meta {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px 16px;
+  margin-bottom: 16px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.detail-meta > span:first-child {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+}
+.detail-meta > button {
+  margin-left: auto;
+}
+.output-panel {
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+  overflow: hidden;
+}
+.panel-heading {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 12px;
+  border-bottom: 1px solid var(--border);
+  background: var(--surface-panel);
+}
+.panel-heading h2 {
+  margin: 0;
+  font-size: var(--font-size-heading-sm);
+}
+.panel-heading > span {
+  margin-left: auto;
+  font-size: var(--font-size-caption);
+}
+.run-output {
+  margin: 0;
+  padding: 16px 12px;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  color: var(--code-text);
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+}
+.output-empty {
+  padding: 24px 12px;
+  text-align: center;
+  color: var(--muted);
+}
+.output-empty h3 {
+  margin: 8px 0 6px;
+}
+.output-empty p {
+  margin: 0;
+  font-size: var(--font-size-body-sm);
+}
+.event-log {
+  border-top: 1px solid var(--border);
+  font-size: var(--font-size-body-sm);
+}
+.event-log summary {
+  padding: 10px 12px;
+  cursor: pointer;
+}
+.event-log summary > span {
+  color: var(--muted);
+  margin-left: 6px;
+}
+.event-log ol {
+  margin: 0;
+  padding: 0 12px 12px;
+  list-style: none;
+}
+.event-log li {
+  display: grid;
+  grid-template-columns: 36px minmax(0, 1fr) auto;
+  align-items: baseline;
+  gap: 8px;
+  padding: 5px 0;
+  border-top: 1px solid var(--border);
+}
+.event-log strong {
+  overflow-wrap: anywhere;
+  font-weight: 500;
+}
+.event-log time,
+.event-log .mono {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.interaction {
+  padding: 12px;
+  margin-bottom: 12px;
+  border: 1px solid var(--amber-border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-panel);
+}
+.interaction-heading {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  color: var(--amber-text);
+}
+.interaction-heading h3 {
+  margin: 0;
+  font-size: var(--font-size-heading-sm);
+}
+.interaction p {
+  margin-block: 8px;
+}
+.interaction dl {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 6px 16px;
+}
+.interaction dt {
+  color: var(--muted);
+}
+.interaction dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.interaction ol {
+  margin: 0;
+  padding-left: 20px;
+}
+.actions,
+.choice-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: 12px;
+}
+.interaction form {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin-top: 12px;
+}
+.interaction form .ui-input {
+  flex: 1;
+  min-width: min(180px, 100%);
+}
+.command-review {
+  padding: 10px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+  font-size: var(--font-size-body-sm);
+}
+.appearance-fields {
+  margin-top: 16px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+}
+.appearance-fields > label {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 12px;
+  padding: var(--settings-row-padding);
+}
+.appearance-fields > label + label {
+  border-top: 1px solid var(--border);
+}
+.appearance-fields strong {
+  font-size: var(--font-size-body-sm);
+  font-weight: 600;
+}
+.appearance-fields small {
+  display: block;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.appearance-fields .app-select {
+  min-width: 160px;
+}
+.startup {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 12px;
+  min-height: 100dvh;
+  color: var(--muted);
+}
+.startup img {
+  width: 32px;
+  height: 32px;
+}
+.sign-in {
+  display: grid;
+  min-height: 100dvh;
+  place-items: center;
+  padding: 20px;
+}
+.sign-in-panel {
+  width: min(440px, 100%);
+  padding: 24px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--surface);
+}
+.sign-in-panel h1 {
+  margin: 24px 0 6px;
+}
+.sign-in-panel > p {
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  margin: 0 0 20px;
+}
+.sign-in-panel .sign-in-foot {
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+  margin: 16px 0 0;
+  font-size: var(--font-size-caption);
+}
+.sign-in-foot svg {
+  flex: none;
+}
+.spin {
+  animation: spin 1s linear infinite;
+}
+@keyframes spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .spin {
+    animation: none;
+  }
+}
+@media (max-width: 640px) {
+  .project-picker {
+    padding: 0;
+    border: 0;
+  }
+  .application-frame .settings-sidebar {
+    position: relative;
+  }
+  .application-frame .settings-sidebar-footer {
+    position: absolute;
+    right: 12px;
+    top: 8px;
+  }
+  .project-picker label > span {
+    padding-right: 100px;
+  }
+  .composer-controls {
+    gap: 6px;
+  }
+  .composer-controls .app-select:first-child {
+    flex-basis: 100%;
+  }
+  .composer-hint {
+    margin-left: 0;
+  }
+  .composer-controls > .ui-button {
+    margin-left: auto;
+  }
+  .tasks-toolbar .catalog-search {
+    flex-basis: 100%;
+  }
+  .detail-header {
+    flex-wrap: wrap;
+  }
+  .appearance-fields > label {
+    flex-wrap: wrap;
+  }
+  .appearance-fields .app-select {
+    width: 100%;
+  }
+}
+
+.task-title-cell {
+  width: 42%;
+}
+.task-history-footer {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 12px;
+  margin-top: 12px;
+}
+.task-history-footer p {
+  margin: 0;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+
+.project-surface {
+  display: contents;
+}
+.project-surface[hidden] {
+  display: none;
+}
+
+.host-settings {
+  padding-bottom: 0;
+}
+.host-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(100%, 290px), 1fr));
+  gap: 12px;
+  margin: 16px 0;
+}
+.host-grid .empty-state {
+  grid-column: 1 / -1;
+}
+.host-card {
+  display: flex;
+  align-items: flex-start;
+  gap: 12px;
+  padding: 16px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+  color: var(--text);
+  text-align: left;
+}
+.host-card:hover {
+  border-color: var(--accent-border);
+  background: var(--surface-panel);
+}
+.host-card-icon {
+  display: grid;
+  place-items: center;
+  color: var(--icon-text);
+  flex: none;
+  padding-top: 2px;
+}
+.host-card-body {
+  display: grid;
+  gap: 6px;
+  flex: 1;
+  min-width: 0;
+  overflow-wrap: anywhere;
+  font-size: var(--font-size-body-sm);
+}
+.host-card-body strong {
+  color: var(--text-strong);
+  font-weight: 600;
+}
+.host-card-body small {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.host-card > svg {
+  flex: none;
+  color: var(--muted);
+}
+.fleet-host-context {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  color: var(--text-strong);
+  font-size: var(--font-size-heading-sm);
+  font-weight: 600;
+}
+.thread-toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+  margin: 16px 0;
+  align-items: center;
+}
+.thread-search {
+  flex: 1;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: min(220px, 100%);
+  color: var(--muted);
+}
+.thread-search .ui-input {
+  width: 100%;
+}
+.thread-toolbar .app-select {
+  width: auto;
+  max-width: 100%;
+}
+.thread-table {
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  overflow: hidden;
+  background: var(--surface-inset);
+}
+.thread-table table {
+  border-collapse: collapse;
+  font-size: var(--font-size-body-sm);
+}
+.thread-table th,
+.thread-table td {
+  text-align: left;
+  padding: 12px;
+  font-weight: 400;
+  border-bottom: 1px solid var(--border);
+}
+.thread-table thead {
+  background: var(--surface-panel);
+  color: var(--muted);
+}
+.thread-table thead th {
+  font-size: var(--font-size-caption);
+  font-weight: 600;
+}
+.thread-table tbody tr:last-child > * {
+  border-bottom: 0;
+}
+.thread-table tbody tr:hover {
+  background: var(--surface-panel);
+}
+.thread-table tbody th {
+  width: 40%;
+}
+.thread-table .catalog-identity {
+  min-width: 0;
+}
+.thread-table .catalog-name {
+  overflow-wrap: anywhere;
+}
+.thread-cell-note {
+  display: block;
+  margin-top: 4px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.thread-row-action {
+  width: 44px;
+}
+.thread-pagination {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 8px;
+  margin-top: 12px;
+}
+.thread-pagination > span {
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  margin-right: auto;
+}
+.sync-notice {
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+  margin: 8px 0 12px;
+  padding: 10px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+}
+.sync-notice svg {
+  flex: none;
+  margin-top: 2px;
+}
+.thread-header-actions {
+  display: flex;
+  gap: 6px;
+  flex: none;
+}
+.thread-rename {
+  display: flex;
+  gap: 6px;
+  margin: 6px 0 12px;
+}
+.thread-rename .ui-input {
+  min-width: 0;
+  flex: 1;
+}
+.thread-rename .ui-button {
+  flex: none;
+}
+.thread-conversation {
+  max-height: min(58dvh, 720px);
+  min-height: 180px;
+  overflow: auto;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-inset);
+  padding: 16px;
+}
+.thread-conversation:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+.conversation-message {
+  margin: 0 0 16px;
+  padding: 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-panel);
+}
+.conversation-message:last-child {
+  margin-bottom: 0;
+}
+.message-user {
+  border-left: 3px solid var(--accent-border);
+  background: var(--surface-editor);
+}
+.conversation-message header {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 8px;
+}
+.conversation-message strong {
+  color: var(--text-strong);
+  font-size: var(--font-size-body-sm);
+}
+.conversation-message time {
+  margin-left: auto;
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+.conversation-text {
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  font-size: var(--font-size-body);
+  line-height: var(--line-height-body);
+}
+.conversation-run {
+  margin-top: 12px;
+}
+.run-progress {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 0;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.run-progress strong {
+  color: var(--text-strong);
+  font-weight: 500;
+}
+.thread-activity {
+  color: var(--muted);
+  margin: 8px 0 12px;
+  font-size: var(--font-size-body-sm);
+}
+.thread-activity summary {
+  cursor: pointer;
+}
+.thread-activity p {
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+  padding: 8px 12px;
+  border-left: 1px solid var(--border);
+}
+.thread-run-controls {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 12px;
+  align-items: center;
+  justify-content: flex-end;
+  margin-top: 12px;
+}
+.thread-run-controls > span {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.composer-target {
+  color: var(--muted);
+  overflow-wrap: anywhere;
+  font-size: var(--font-size-body-sm);
+}
+.composer-offline {
+  margin: 10px 0 0;
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+  color: var(--muted);
+}
+.jump-latest {
+  display: flex;
+  margin: 8px auto;
+}
+@media (max-width: 640px) {
+  .thread-toolbar > .app-select {
+    flex: 1;
+  }
+  .thread-search {
+    flex-basis: 100%;
+  }
+  .thread-table [data-slot="table-container"] {
+    overflow: visible;
+  }
+  .thread-table table,
+  .thread-table tbody,
+  .thread-table tr {
+    display: block;
+    width: 100%;
+  }
+  .thread-table thead {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    overflow: hidden;
+    clip-path: inset(50%);
+  }
+  .thread-table tbody th,
+  .thread-table tbody td {
+    display: flex;
+    align-items: baseline;
+    justify-content: space-between;
+    gap: 12px;
+    border: 0;
+    width: 100%;
+    padding: 5px 12px;
+    overflow-wrap: anywhere;
+  }
+  .thread-table tbody tr {
+    padding: 10px 0;
+    border-bottom: 1px solid var(--border);
+  }
+  .thread-table tbody tr:last-child {
+    border: 0;
+  }
+  .thread-table tbody th {
+    padding-bottom: 10px;
+  }
+  .thread-table td[data-label]::before {
+    content: attr(data-label);
+    color: var(--muted);
+    font-size: var(--font-size-caption);
+    flex: none;
+  }
+  .thread-table .thread-row-action {
+    justify-content: flex-end;
+  }
+  .thread-conversation {
+    max-height: 52dvh;
+    padding: 10px;
+  }
+  .conversation-message {
+    padding: 10px;
+  }
+  .thread-header-actions {
+    margin-left: auto;
+  }
+  .thread-rename {
+    flex-wrap: wrap;
+  }
+  .thread-rename .ui-input {
+    flex-basis: 100%;
+  }
+  .thread-pagination > span {
+    flex-basis: 100%;
+  }
+}
+.agent-details {
+  margin-top: 6px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.agent-details summary {
+  cursor: pointer;
+}
+.agent-details dl {
+  display: grid;
+  grid-template-columns: auto minmax(0, 1fr);
+  gap: 6px 10px;
+  margin: 10px 0 0;
+}
+.agent-details dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.agent-row-actions {
+  display: flex;
+  gap: 4px;
+}
+.thread-history-toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 12px;
+  margin: 12px 0;
+}
+.thread-history-toolbar > span {
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+h2:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 4px;
+}
+.thread-agent-cell {
+  min-width: 0;
+}
+@media (max-width: 640px) {
+  .thread-agent-cell {
+    flex: 1;
+    text-align: right;
+  }
+}
+/* Control Plane host surfaces use shared frames and conversation foundations. */
+.control-page {
+  padding: 28px;
+  max-width: 1440px;
+  margin: auto;
+  min-width: 0;
+}
+.page-heading {
+  display: flex;
+  justify-content: space-between;
+  gap: 20px;
+  align-items: center;
+  margin-bottom: 24px;
+}
+.page-heading h1 {
+  margin: 5px 0 8px;
+  font-size: var(--font-size-heading);
+}
+.page-heading p {
+  margin: 0;
+  color: var(--muted);
+  max-width: 70ch;
+}
+.eyebrow {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  text-transform: uppercase;
+  letter-spacing: 0.09em;
+}
+.header-project {
+  width: 240px;
+  max-width: 45vw;
+}
+.header-project .app-select {
+  width: 100%;
+}
+.rail-user {
+  width: 30px;
+  height: 30px;
+  border-radius: var(--radius);
+  display: grid;
+  place-items: center;
+  background: var(--surface-selected);
+  color: var(--accent-text);
+  font-size: var(--font-size-caption);
+  font-weight: 650;
+}
+.metric-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(145px, 1fr));
+  gap: 12px;
+  margin: 18px 0;
+}
+.metric-card {
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  background: var(--surface);
+  padding: 18px 20px;
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+  gap: 5px;
+}
+.metric-card > span {
+  font-size: var(--font-size-body-sm);
+  color: var(--muted);
+}
+.metric-card > strong {
+  font-size: var(--font-size-heading-lg);
+  line-height: var(--line-height-tight);
+  font-weight: 600;
+  color: var(--text-strong);
+  overflow-wrap: anywhere;
+}
+.metric-card > small {
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+.dashboard-grid {
+  display: grid;
+  grid-template-columns: minmax(0, 1.8fr) minmax(250px, 1fr);
+  gap: 16px;
+}
+.control-card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  padding: 20px;
+  margin: 16px 0;
+  min-width: 0;
+}
+.control-card > header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  flex-wrap: wrap;
+  margin-bottom: 14px;
+}
+.control-card h3 {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin: 0;
+  font-size: var(--font-size-heading-sm);
+  font-weight: 550;
+}
+.control-card .metric-card {
+  background: var(--surface-muted);
+}
+.field-help {
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  line-height: var(--line-height-body);
+  margin: 10px 0;
+}
+.empty-copy {
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+  padding: 12px 0;
+}
+.stat-list {
+  margin: 0;
+  display: grid;
+  gap: 0;
+}
+.stat-list > div {
+  display: flex;
+  gap: 16px;
+  justify-content: space-between;
+  align-items: flex-start;
+  padding: 12px 0;
+  border-bottom: 1px solid var(--border);
+}
+.stat-list > div:last-child {
+  border: none;
+}
+.stat-list dt {
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.stat-list dd {
+  margin: 0;
+  color: var(--text-strong);
+  overflow-wrap: anywhere;
+  text-align: right;
+}
+.activity-chart {
+  display: flex;
+  align-items: stretch;
+  justify-content: space-between;
+  gap: 8px;
+  height: 190px;
+  padding-top: 12px;
+}
+.activity-column {
+  flex: 1;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 6px;
+}
+.activity-count {
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+.activity-track {
+  width: 100%;
+  max-width: 42px;
+  flex: 1;
+  display: flex;
+  align-items: flex-end;
+  background: var(--surface-muted);
+  border-radius: var(--radius-sm);
+  overflow: hidden;
+}
+.activity-track > div {
+  width: 100%;
+  background: var(--blue);
+  border-radius: var(--radius-sm);
+  min-height: 0;
+}
+.activity-column time {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  white-space: nowrap;
+}
+.activity-data {
+  margin-top: 14px;
+  font-size: var(--font-size-body-sm);
+  color: var(--muted);
+}
+.activity-data table {
+  width: 100%;
+  text-align: left;
+  border-collapse: collapse;
+  margin-top: 12px;
+}
+.activity-data th,
+.activity-data td {
+  padding: 5px;
+  border-bottom: 1px solid var(--border);
+}
+.recent-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.recent-list li + li {
+  border-top: 1px solid var(--border);
+}
+.recent-list :is(button, a) {
+  padding: 14px 0;
+  width: 100%;
+  background: transparent;
+  border: none;
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  color: var(--text);
+  text-align: left;
+}
+.recent-list :is(button, a) > span {
+  display: grid;
+  gap: 4px;
+  flex: 1;
+  min-width: 0;
+}
+.recent-list strong {
+  font-weight: 550;
+  overflow-wrap: anywhere;
+}
+.recent-list small,
+.recent-list time {
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.section-tabs {
+  display: flex;
+  gap: 12px;
+  border-bottom: 1px solid var(--border);
+  margin: 16px 0 20px;
+  overflow: auto;
+}
+.section-tabs .ui-button {
+  border-radius: 0;
+  border: none;
+  border-bottom: 2px solid transparent;
+  margin-bottom: -1px;
+  padding: 10px 4px;
+  white-space: nowrap;
+}
+.section-tabs .ui-button[aria-current="page"] {
+  color: var(--accent-text);
+  border-bottom-color: var(--blue);
+}
+.management-form {
+  display: grid;
+  gap: 15px;
+  max-width: 720px;
+  margin: 18px 0;
+}
+.management-form > h3 {
+  margin: 0;
+}
+.management-form label {
+  display: grid;
+  gap: 6px;
+  font-size: var(--font-size-body-sm);
+  color: var(--text);
+}
+.management-form label > span {
+  font-weight: 550;
+}
+.management-form label > small {
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+.management-form .ui-input {
+  width: 100%;
+  font-size: var(--font-size-control);
+  font-family: var(--font-sans);
+  background: var(--surface-control);
+  border: 1px solid var(--border-strong);
+  border-radius: var(--radius);
+  color: var(--text);
+  padding: 9px 11px;
+  resize: vertical;
+}
+.management-form .app-select {
+  width: 100%;
+}
+.management-form .checkbox-field {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+.checkbox-field input {
+  accent-color: var(--blue);
+}
+.form-actions {
+  display: flex;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+.form-pair {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 14px;
+}
+.management-form .field-help {
+  margin: 0;
+}
+.member-invite {
+  display: grid;
+  grid-template-columns: 1fr 1fr 1fr auto;
+  gap: 12px;
+  align-items: end;
+  padding: 15px 0;
+  border-bottom: 1px solid var(--border);
+}
+.member-invite label {
+  display: grid;
+  gap: 6px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.access-list > div {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 15px 0;
+  border-bottom: 1px solid var(--border);
+}
+.access-list > div > span:first-child {
+  display: grid;
+  gap: 4px;
+  flex: 1;
+  min-width: 0;
+}
+.access-list small {
+  font-size: var(--font-size-caption);
+  color: var(--muted);
+}
+.access-list .app-select {
+  width: 210px;
+}
+.project-page-actions {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px 12px;
+}
+.project-status-filter {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.project-status-filter .app-select {
+  min-width: 170px;
+}
+.project-table-directory {
+  min-width: 0;
+}
+.project-table-copy {
+  display: grid;
+  min-width: 0;
+  gap: 4px;
+  overflow-wrap: anywhere;
+}
+.project-table-copy > strong {
+  color: var(--text);
+  font-size: var(--font-size-body-sm);
+}
+.project-table-copy > small {
+  max-width: 520px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+}
+.project-parent-link {
+  color: var(--blue-strong);
+  font-size: var(--font-size-body-sm);
+  text-decoration: none;
+}
+.project-parent-link:hover {
+  text-decoration: underline;
+}
+.project-context {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 8px 12px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.project-table-empty {
+  display: grid;
+  justify-items: center;
+  gap: 8px;
+  padding: 20px;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.project-table-empty > strong {
+  color: var(--text);
+}
+.load-more {
+  margin: 16px 0;
+}
+.notice {
+  font-size: var(--font-size-body-sm);
+  color: var(--green-text);
+}
+/* Workspace/thread presentation is shared with Desktop; data and paging stay here. */
+.agent-sidebar {
+  display: flex;
+  flex-direction: column;
+  gap: 9px;
+  padding: 14px 10px;
+  min-height: 0;
+  height: 100%;
+  overflow: hidden;
+}
+.agent-sidebar > * {
+  flex-shrink: 0;
+}
+.scope-fleet-back {
+  align-self: flex-start;
+  margin-bottom: 4px;
+}
+.scope-filter-line {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 6px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.scope-filter-line > span {
+  min-width: 0;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.scope-filter-line .app-select {
+  width: 88px;
+  min-height: 26px;
+}
+.scope-workspace-toggle,
+.scope-new-thread,
+.scope-recent-toggle {
+  display: grid;
+  place-items: center;
+  flex: none;
+  width: var(--icon-control-size);
+  height: var(--icon-control-size);
+  padding: 0;
+  border: 1px solid transparent;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--muted);
+}
+.scope-new-thread {
+  border-color: var(--accent-border);
+  background: var(--blue-soft);
+  color: var(--accent-text);
+}
+.scope-workspace-toggle:hover,
+.scope-recent-toggle:hover {
+  background: var(--surface-hover);
+  color: var(--text);
+}
+.scope-workspace-choices {
+  display: grid;
+  gap: 5px;
+  padding: 5px 2px;
+}
+.scope-workspace-choices p,
+.scope-history-note {
+  margin: 0;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  line-height: var(--line-height-body);
+}
+.scope-recent-heading {
+  display: flex;
+  align-items: center;
+  gap: 4px;
+  margin-top: 4px;
+}
+.scope-recent-heading .shared-workspace-group-heading {
+  flex: 1;
+}
+.scope-recent-toggle[aria-expanded="false"] svg {
+  transform: rotate(-90deg);
+}
+.scope-thread-stack {
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+}
+.scope-thread-stack[hidden] {
+  display: none;
+}
+.scope-compact-thread-list {
+  display: grid;
+  align-content: start;
+  gap: 1px;
+  margin-left: 11px;
+  padding-left: 7px;
+  border-left: 1px solid var(--border-strong);
+}
+.scope-thread-status {
+  display: flex;
+  align-items: center;
+  color: var(--muted);
+}
+.scope-thread-status.is-success {
+  color: var(--green);
+}
+.scope-thread-status.is-danger {
+  color: var(--red);
+}
+.scope-thread-status .dot {
+  background: var(--cyan);
+}
+.scope-load-older {
+  margin: 4px 0 3px 20px;
+  color: var(--blue-strong);
+  font-size: var(--font-size-caption);
+}
+.scope-history-note {
+  padding: 4px 10px;
+}
+.scope-pagination {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 4px;
+  font-size: var(--font-size-caption);
+}
+.agent-new-work {
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+  height: 100%;
+  padding: 24px;
+}
+.agent-new-work > .page-heading {
+  flex: none;
+  margin-bottom: 12px;
+}
+.agent-new-work-welcome {
+  display: grid;
+  place-items: center;
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+}
+.agent-new-work-composer {
+  flex: none;
+  width: 100%;
+  max-width: 1100px;
+  margin: 16px auto 0;
+}
+.agent-new-work-composer .run-composer {
+  margin: 0;
+}
+@media (max-width: 760px) {
+  .agent-new-work {
+    min-height: 560px;
+    padding: 16px 12px;
+  }
+  .agent-sidebar {
+    height: auto;
+    max-height: 420px;
+  }
+  .scope-thread-stack {
+    max-height: 200px;
+  }
+}
+.configuration-list {
+  margin: 0;
+}
+.configuration-list > div {
+  display: grid;
+  grid-template-columns: 180px 1fr;
+  gap: 18px;
+  padding: 12px 0;
+  border-bottom: 1px solid var(--border);
+}
+.configuration-list dt {
+  text-transform: capitalize;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.configuration-list dd {
+  margin: 0;
+  overflow-wrap: anywhere;
+  white-space: pre-wrap;
+  font-size: var(--font-size-body-sm);
+}
+.policy-findings {
+  color: var(--amber-text);
+  font-size: var(--font-size-body-sm);
+}
+.login-layout {
+  min-height: 100dvh;
+  display: flex;
+  flex-direction: column;
+}
+.login-layout .sign-in {
+  flex: 1;
+}
+.local-sign-in {
+  max-width: none;
+}
+.login-divider {
+  text-align: center;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+}
+.run-composer .shared-composer-controls .app-select {
+  max-width: 220px;
+}
+.control-frame-main .detail {
+  padding: 24px;
+}
+.control-frame-main .catalog-settings {
+  padding: 28px;
+}
+.control-page .catalog-settings {
+  padding: 0;
+}
+.control-page .appearance-settings {
+  padding: 0;
+}
+.control-page .tasks-settings {
+  margin-top: 20px;
+}
+@media (max-width: 1100px) {
+  .dashboard-grid {
+    grid-template-columns: 1fr;
+  }
+  .control-page {
+    padding: 22px;
+  }
+  .member-invite {
+    grid-template-columns: 1fr 1fr;
+  }
+}
+@media (max-width: 760px) {
+  .control-page,
+  .control-frame-main .catalog-settings,
+  .control-frame-main .detail {
+    padding: 16px 12px;
+  }
+  .page-heading {
+    align-items: flex-start;
+    flex-wrap: wrap;
+    gap: 12px;
+  }
+  .page-heading h1 {
+    overflow-wrap: anywhere;
+  }
+  .metric-grid {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 8px;
+  }
+  .metric-card {
+    padding: 12px;
+  }
+  .metric-card > strong {
+    font-size: var(--font-size-heading);
+  }
+  .control-card {
+    padding: 14px;
+  }
+  .header-project {
+    width: 180px;
+    max-width: 55vw;
+  }
+  .control-header .connection-indicator {
+    font-size: var(--font-size-caption);
+  }
+  .recent-list time {
+    display: none;
+  }
+  .member-invite,
+  .form-pair {
+    grid-template-columns: 1fr;
+  }
+  .access-list > div {
+    flex-wrap: wrap;
+  }
+  .access-list > div > span:first-child {
+    flex-basis: 100%;
+  }
+  .configuration-list > div {
+    grid-template-columns: 1fr;
+    gap: 6px;
+  }
+  .activity-chart {
+    gap: 5px;
+  }
+  .activity-column time {
+    max-width: 100%;
+    overflow: hidden;
+  }
+  .agent-sidebar {
+    position: static;
+    max-height: none;
+    gap: 8px;
+  }
+
+  .agent-sidebar .scope-identity {
+    margin: 0;
+  }
+  .scope-thread-heading {
+    margin: 0;
+  }
+  .run-composer .shared-composer-controls .app-select {
+    max-width: 160px;
+  }
+  .project-directory > :is(button, a) {
+    width: 100%;
+    max-width: none;
+  }
+}
+.thread-detail {
+  --conversation-max-width: 1100px;
+  max-width: 1260px;
+  width: 100%;
+  margin: auto;
+}
+.thread-detail > .back {
+  align-self: flex-start;
+}
+.thread-detail .thread-conversation {
+  border: 0;
+  border-radius: 0;
+  background: transparent;
+  max-height: max(280px, calc(100dvh - 390px));
+  padding: 12px 20px 24px;
+  width: 100%;
+  max-width: none;
+  margin: 0 auto;
+}
+.thread-detail .run-composer {
+  margin: 14px 0 0;
+}
+.thread-detail .detail-header {
+  margin-bottom: 18px;
+}
+.shared-markdown a {
+  color: var(--blue-strong);
+  text-underline-offset: 3px;
+}
+.shared-markdown a:focus-visible {
+  outline: 2px solid var(--cyan);
+  outline-offset: 2px;
+}
+.run-composer .shared-composer-header {
+  font-size: var(--font-size-caption);
+  gap: 8px;
+  padding: 7px 10px;
+}
+.composer-context-runtime {
+  color: var(--muted);
+  max-width: 180px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.composer-model {
+  font-weight: 550;
+  color: var(--text-strong);
+  overflow-wrap: anywhere;
+}
+.composer-policy-pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  margin-left: auto;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  padding: 3px 6px;
+  color: var(--muted);
+  font-size: var(--font-size-caption);
+  background: var(--surface-control);
+}
+.run-composer .mode-switch {
+  margin: 0;
+}
+.run-composer .shared-composer-controls {
+  flex: 1;
+}
+.run-composer .shared-composer-controls > .app-select {
+  max-width: 160px;
+}
+.run-composer .composer-target {
+  display: none;
+}
+.configuration-group {
+  margin-top: 18px;
+}
+.configuration-group h4 {
+  font-size: var(--font-size-body-sm);
+  color: var(--muted);
+  font-weight: 550;
+  margin: 0 0 8px;
+}
+.configuration-tags {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+}
+.configuration-tags > span {
+  background: var(--surface-muted);
+  color: var(--text);
+  border: 1px solid var(--border);
+  padding: 3px 7px;
+  border-radius: var(--radius-sm);
+  font-size: var(--font-size-caption);
+}
+.host-directory {
+  margin: 12px 0;
+  color: var(--muted);
+  font-size: var(--font-size-body-sm);
+}
+.host-directory > summary {
+  cursor: pointer;
+  max-width: max-content;
+  padding: 5px 0;
+}
+.approval-options {
+  display: grid;
+  gap: 9px;
+  padding: 14px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.approval-options legend {
+  padding-inline: 6px;
+  font-size: var(--font-size-body-sm);
+  font-weight: 550;
+}
+.login-layout {
+  height: 100dvh;
+}
+.login-layout .sign-in {
+  min-height: 0;
+  overflow: auto;
+}
+.agent-sidebar {
+  height: 100%;
+  max-height: 100%;
+  position: static;
+}
+.thread-detail {
+  height: 100%;
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+}
+.thread-detail > * {
+  flex-shrink: 0;
+}
+.thread-detail .thread-conversation {
+  flex: 1;
+  min-height: 180px;
+  max-height: none;
+}
+.thread-detail .run-composer {
+  flex: none;
+}
+@media (max-width: 760px) {
+  .agent-sidebar {
+    height: auto;
+    max-height: none;
+  }
+  .thread-detail .thread-conversation {
+    min-height: 200px;
+  }
+}
+@media (max-width: 640px) {
+  .thread-detail .thread-conversation {
+    padding-inline: 12px;
+  }
+}
+
+/* Native anchors retain copy/open-in-new-tab behavior in resource inventories. */
+.recent-list a,
+.project-directory > a,
+.scope-thread-list a {
+  text-decoration: none;
+}
diff --git a/apps/web/src/vite-env.d.ts b/apps/web/src/vite-env.d.ts
new file mode 100644
index 000000000..11f02fe2a
--- /dev/null
+++ b/apps/web/src/vite-env.d.ts
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
diff --git a/apps/web/tsconfig.json b/apps/web/tsconfig.json
new file mode 100644
index 000000000..26337f93c
--- /dev/null
+++ b/apps/web/tsconfig.json
@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true
+  },
+  "include": ["src"]
+}
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
new file mode 100644
index 000000000..447691ec8
--- /dev/null
+++ b/apps/web/vite.config.ts
@@ -0,0 +1,52 @@
+import { readFileSync } from "node:fs";
+import tailwindcss from "@tailwindcss/vite";
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+export default defineConfig({
+  plugins: [
+    {
+      name: "shared-ui-attribution",
+      generateBundle() {
+        this.emitFile({
+          type: "asset",
+          fileName: "shadcn-LICENSE.txt",
+          source: readFileSync(
+            new URL("../ui/assets/shadcn-LICENSE.txt", import.meta.url),
+            "utf8",
+          ),
+        });
+      },
+    },
+    tailwindcss(),
+    react(),
+  ],
+  optimizeDeps: {
+    include: [
+      "use-sync-external-store/shim",
+      "use-sync-external-store/shim/with-selector",
+    ],
+  },
+  server: {
+    strictPort: true,
+    fs: {
+      strict: true,
+      deny: [
+        ".env",
+        ".env.*",
+        "*.{crt,pem,key,p12,pfx,cer,der}",
+        ".npmrc",
+        ".yarnrc.yml",
+        "**/.git/**",
+        "**/development-credentials/**",
+        "**/.authority-key.env",
+      ],
+    },
+    proxy: {
+      "/api": "http://127.0.0.1:8090",
+      "/auth": "http://127.0.0.1:8090",
+      "/health": "http://127.0.0.1:8090",
+      "/docs": "http://127.0.0.1:8081",
+    },
+  },
+  build: { target: "es2022" },
+});
diff --git a/crates/colossus-api-proto/proto/colossus/api/v1alpha1/agent_run.proto b/crates/colossus-api-proto/proto/colossus/api/v1alpha1/agent_run.proto
index ee447987e..bb0e6d9cb 100644
--- a/crates/colossus-api-proto/proto/colossus/api/v1alpha1/agent_run.proto
+++ b/crates/colossus-api-proto/proto/colossus/api/v1alpha1/agent_run.proto
@@ -47,6 +47,13 @@ service AgentRunService {
 
   // RespondInteraction answers one caller-bound prompt or approval exactly once.
   rpc RespondInteraction(RespondInteractionRequest) returns (RespondInteractionResponse);
+
+  // The local application explicitly releases its own workspace sessions.
+  rpc SetWorkspaceSharing(SetWorkspaceSharingRequest) returns (SetWorkspaceSharingResponse);
+  // Discovery includes only owned or explicitly shared released runs.
+  rpc ListVisibleRuns(ListVisibleRunsRequest) returns (ListVisibleRunsResponse);
+  // Caller-scoped configuration metadata; never an enforcement attestation or raw config.
+  rpc GetRuntimePolicyPosture(GetRuntimePolicyPostureRequest) returns (GetRuntimePolicyPostureResponse);
 }
 
 // RunMode selects the runtime's public execution mode.
@@ -1124,3 +1131,58 @@ message StopProcessSessionResponse {
   // Bounded process snapshot.
   ProcessSessionSnapshot snapshot = 1;
 }
+
+// Change the authenticated application's local workspace disclosure relationship.
+message SetWorkspaceSharingRequest {
+  // Exact independently enrolled recipient application identity.
+  string recipient_application_id = 1;
+  // Release source-owned sessions, or revoke future reads.
+  bool enabled = 2;
+  // Permit recipient-owned runs to continue source sessions under its own grant.
+  bool allow_continuation = 3;
+}
+// Durable local sharing posture. Enrollment alone does not enable sharing.
+message SetWorkspaceSharingResponse {
+  // Exact recipient application identity.
+  string recipient_application_id = 1;
+  // Whether released source sessions are visible to the recipient.
+  bool enabled = 2;
+  // Whether recipient-owned runs may continue shared sessions.
+  bool allow_continuation = 3;
+}
+// Bounded discovery filters for caller-owned and explicitly shared runs.
+message ListVisibleRunsRequest {
+  // Optional exact session identity within the released source scope.
+  optional string session_id = 1;
+  // Distinct optional lifecycle states; empty includes all states.
+  repeated RunStatus statuses = 2;
+  // Bounded page size and opaque source-stable continuation cursor.
+  PageRequest page = 3;
+  // Include shared and owned archived threads.
+  bool include_archived = 4;
+}
+// Released run and authority derived by the authenticated runtime.
+message VisibleRun {
+  // Public run projection; never private worker data.
+  Run run = 1;
+  // Whether this caller owns cancellation and interaction response authority.
+  bool controllable = 2;
+  // Whether the caller may continue this session using its own grant.
+  bool continuable = 3;
+}
+// Bounded source-stable page of owned and explicitly shared runs.
+message ListVisibleRunsResponse {
+  // Runtime-authorized released run projections.
+  repeated VisibleRun runs = 1;
+  // Opaque continuation cursor bound to current sharing relationships.
+  PageResponse page = 2;
+}
+
+// Requests current metadata beneath the authenticated application ceiling.
+message GetRuntimePolicyPostureRequest {}
+
+// Contains one closed, validated metadata-only RuntimePolicyPosture contract.
+message GetRuntimePolicyPostureResponse {
+  // Strict RuntimePolicyPosture JSON, at most64KiB; unknown fields are rejected by SDKs.
+  bytes policy_json = 1;
+}
diff --git a/crates/colossus-api-runtime/src/interactions.rs b/crates/colossus-api-runtime/src/interactions.rs
index c96b05d4d..8d56260e5 100644
--- a/crates/colossus-api-runtime/src/interactions.rs
+++ b/crates/colossus-api-runtime/src/interactions.rs
@@ -160,7 +160,7 @@ impl PublicInteractionRouter {
         self
     }
 
-    fn public_approval_mode(&self) -> PublicApprovalMode {
+    pub(crate) fn public_approval_mode(&self) -> PublicApprovalMode {
         self.public_approval_mode
             .as_ref()
             .map_or(PublicApprovalMode::Ask, |provider| {
diff --git a/crates/colossus-api-runtime/src/service.rs b/crates/colossus-api-runtime/src/service.rs
index fd02deeec..7703f8abf 100644
--- a/crates/colossus-api-runtime/src/service.rs
+++ b/crates/colossus-api-runtime/src/service.rs
@@ -46,6 +46,8 @@ use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
 use uuid::Uuid;
+mod posture;
+mod sharing;
 
 const WATCH_PAGE_SIZE: usize = 16;
 const WATCH_CHANNEL_SIZE: usize = 8;
@@ -295,7 +297,7 @@ impl RuntimeAgentRunApi {
                 && event.actor.actor_type == ActorType::Application
                 && event.actor.id == caller.principal().application_id()
         });
-        if !owned {
+        if !owned && !self.shared_session_continuable(caller, session_id)? {
             return Err(ApiError::not_found(
                 ApiErrorReason::RunNotFound,
                 "the requested session was not found",
@@ -1425,6 +1427,39 @@ impl RuntimeAgentRunApi {
 
 #[async_trait]
 impl AgentRunApi for RuntimeAgentRunApi {
+    fn supports_runtime_policy_posture(&self) -> bool {
+        true
+    }
+    async fn get_runtime_policy_posture(
+        &self,
+        caller: &CallerContext,
+    ) -> ApiResult<colossus_api::RuntimePolicyPosture> {
+        caller.require_scope(scopes::RUNS_READ)?;
+        let _permit = self
+            .lists
+            .acquire(caller.principal().application_id())
+            .map_err(|AdmissionLimitReached| capacity_error(caller))?;
+        self.released_policy_posture(caller)
+    }
+    async fn set_workspace_sharing(
+        &self,
+        caller: &CallerContext,
+        request: colossus_api::SetWorkspaceSharingRequest,
+    ) -> ApiResult<colossus_api::WorkspaceSharingState> {
+        self.persist_workspace_sharing(caller, request)
+    }
+
+    async fn list_visible_runs(
+        &self,
+        caller: &CallerContext,
+        request: ListRunsRequest,
+    ) -> ApiResult<colossus_api::ListVisibleRunsResponse> {
+        let _permit = self
+            .lists
+            .acquire(caller.principal().application_id())
+            .map_err(|AdmissionLimitReached| capacity_error(caller))?;
+        self.discover_visible_runs(caller, request)
+    }
     async fn list_process_sessions(
         &self,
         caller: &CallerContext,
@@ -1545,9 +1580,10 @@ impl AgentRunApi for RuntimeAgentRunApi {
     }
 
     async fn get_run(&self, caller: &CallerContext, request: GetRunRequest) -> ApiResult<Run> {
+        let source = self.visible_run_caller(caller, &request.run_id)?;
         let run = self
             .repository
-            .get_run(caller, &request.run_id)?
+            .get_run(&source, &request.run_id)?
             .ok_or_else(|| {
                 ApiError::not_found(
                     ApiErrorReason::RunNotFound,
@@ -1555,7 +1591,11 @@ impl AgentRunApi for RuntimeAgentRunApi {
                 )
                 .with_correlation_id(caller.request_id().clone())
             })?;
-        self.recover_orphan(caller, run)
+        if source.principal().application_id() == caller.principal().application_id() {
+            self.recover_orphan(caller, run)
+        } else {
+            Ok(run)
+        }
     }
 
     async fn list_runs(
@@ -1579,10 +1619,14 @@ impl AgentRunApi for RuntimeAgentRunApi {
         request
             .validate()
             .map_err(|error| error.with_correlation_id(caller.request_id().clone()))?;
+        let source_caller = self.visible_run_caller(caller, &request.source_run_id)?;
         let source = self
             .repository
-            .get_run(caller, &request.source_run_id)?
+            .get_run(&source_caller, &request.source_run_id)?
             .ok_or_else(|| missing_run(caller))?;
+        if !self.session_history_visible(caller, &source.session_id)? {
+            return Err(missing_run(caller));
+        }
         self.runtime
             .drain_projections_bounded(256, 16)
             .map_err(|error| activity_runtime_error(caller, error))?;
@@ -1671,9 +1715,10 @@ impl AgentRunApi for RuntimeAgentRunApi {
         caller: &CallerContext,
         request: WatchRunRequest,
     ) -> ApiResult<RunUpdateStream> {
+        let source = self.visible_run_caller(caller, &request.run_id)?;
         let run = self
             .repository
-            .get_run(caller, &request.run_id)?
+            .get_run(&source, &request.run_id)?
             .ok_or_else(|| {
                 ApiError::not_found(
                     ApiErrorReason::RunNotFound,
@@ -1681,7 +1726,12 @@ impl AgentRunApi for RuntimeAgentRunApi {
                 )
                 .with_correlation_id(caller.request_id().clone())
             })?;
-        let run = self.recover_orphan(caller, run)?;
+        let shared = source.principal().application_id() != caller.principal().application_id();
+        let run = if shared {
+            run
+        } else {
+            self.recover_orphan(caller, run)?
+        };
         let watch_permit = self
             .watches
             .acquire(caller.principal().application_id())
@@ -1689,13 +1739,27 @@ impl AgentRunApi for RuntimeAgentRunApi {
         let mut notifications = self.feeds.subscribe(&run.id, run.last_sequence);
         let repository = Arc::clone(&self.repository);
         let feeds = Arc::clone(&self.feeds);
-        let caller = caller.clone();
+        let recipient = caller.clone();
+        let caller = source;
+        let api = self.clone();
         let run_id = run.id;
         let mut cursor = request.after_sequence;
         let (sender, receiver) = mpsc::channel(WATCH_CHANNEL_SIZE);
         tokio::spawn(async move {
             let _watch_permit = watch_permit;
             loop {
+                if shared
+                    && !api
+                        .workspace_share_allowed(
+                            &recipient,
+                            caller.principal().application_id(),
+                            false,
+                        )
+                        .unwrap_or(false)
+                {
+                    let _ = sender.send(Err(missing_run(&recipient))).await;
+                    return;
+                }
                 match repository.updates_after(&caller, &run_id, cursor, WATCH_PAGE_SIZE) {
                     Ok(updates) => {
                         let had_updates = !updates.is_empty();
@@ -1740,6 +1804,7 @@ impl AgentRunApi for RuntimeAgentRunApi {
                             return;
                         }
                     }
+                    () = tokio::time::sleep(std::time::Duration::from_secs(5)), if shared => {}
                 }
             }
         });
diff --git a/crates/colossus-api-runtime/src/service/posture.rs b/crates/colossus-api-runtime/src/service/posture.rs
new file mode 100644
index 000000000..b81c7542a
--- /dev/null
+++ b/crates/colossus-api-runtime/src/service/posture.rs
@@ -0,0 +1,142 @@
+//! Closed declassification of caller-scoped policy configuration metadata.
+use super::*;
+use colossus_api::{
+    PolicyApprovalMode, PolicyFinding, PolicyFindingSeverity, PolicyModelLabel, PolicyProvenance,
+    PolicySandboxBackend, PolicyTelemetry, PolicyTelemetryProvenance, RuntimePolicyPosture,
+};
+
+fn safe_identifier(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 128
+        && !value.starts_with("sk-")
+        && !value.starts_with("eyJ")
+        && !value.starts_with("AKIA")
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || b"._-".contains(&byte))
+}
+
+impl RuntimeAgentRunApi {
+    pub(super) fn released_policy_posture(
+        &self,
+        caller: &CallerContext,
+    ) -> ApiResult<RuntimePolicyPosture> {
+        caller.require_scope(scopes::RUNS_READ)?;
+        let access = self.runtime.access_resolution();
+        let allowed_roles = caller
+            .principal()
+            .allowed_roles()
+            .map(str::to_owned)
+            .collect::<Vec<_>>();
+        let allowed_tools = access
+            .active_tool_names()
+            .into_iter()
+            .filter(|tool| caller.principal().allows_tool(tool))
+            .collect::<std::collections::BTreeSet<_>>()
+            .into_iter()
+            .collect();
+        let capabilities = [
+            ("agent_runs.read", scopes::RUNS_READ),
+            ("agent_runs.create", scopes::RUNS_EXECUTE),
+            ("agent_runs.cancel", scopes::RUNS_CONTROL),
+            ("prompts.respond", scopes::PROMPTS_RESPOND),
+            ("approvals.respond", scopes::APPROVALS_RESPOND),
+        ]
+        .into_iter()
+        .filter(|(_, scope)| caller.principal().has_scope(scope))
+        .map(|(name, _)| name.to_owned())
+        .collect();
+        let models = allowed_roles
+            .iter()
+            .filter_map(|role| self.runtime.provider_route(role).ok())
+            .filter(|route| safe_identifier(&route.model_profile))
+            .map(|route| PolicyModelLabel {
+                profile: route.model_profile.clone(),
+                label: if safe_identifier(&route.model) {
+                    route.model
+                } else {
+                    route.model_profile
+                },
+            })
+            .map(|model| (model.profile.clone(), model))
+            .collect::<BTreeMap<_, _>>()
+            .into_values()
+            .collect();
+        let findings = self
+            .runtime
+            .security_posture()
+            .findings
+            .iter()
+            .filter(|finding| {
+                matches!(
+                    finding.code.as_str(),
+                    "storage.ephemeral"
+                        | "storage.plaintext"
+                        | "sandbox.danger_full_access"
+                        | "observability.sensitive_journal_payloads"
+                        | "credentials.mcp_oauth_plaintext"
+                )
+            })
+            .map(|finding| PolicyFinding {
+                code: finding.code.clone(),
+                severity: PolicyFindingSeverity::Warning,
+            })
+            .collect();
+        let mut posture = RuntimePolicyPosture {
+            schema_version: 1,
+            provenance: PolicyProvenance::RuntimeReported,
+            fingerprint: String::new(),
+            configuration_revision: None,
+            access_profile: access.profile.to_string(),
+            sandbox_backend: match self.runtime.sandbox_backend() {
+                "native" => PolicySandboxBackend::Native,
+                "windows_job" => PolicySandboxBackend::WindowsJob,
+                "oci" => PolicySandboxBackend::Oci,
+                "external" => PolicySandboxBackend::External,
+                "danger_full_access" => PolicySandboxBackend::DangerFullAccess,
+                _ => PolicySandboxBackend::Unknown,
+            },
+            sandbox_profile: if safe_identifier(self.runtime.sandbox_profile()) {
+                self.runtime.sandbox_profile().to_owned()
+            } else {
+                "unknown".into()
+            },
+            boundary_acknowledged: self.runtime.policy_boundary_acknowledged(),
+            approval_mode: match self.interactions.public_approval_mode() {
+                crate::PublicApprovalMode::Deny => PolicyApprovalMode::Deny,
+                crate::PublicApprovalMode::Ask => PolicyApprovalMode::Ask,
+                crate::PublicApprovalMode::RiskAuto => PolicyApprovalMode::RiskAuto,
+                crate::PublicApprovalMode::FullAccess => PolicyApprovalMode::DangerAuto,
+            },
+            allowed_roles,
+            allowed_tools,
+            capabilities,
+            models,
+            findings,
+            telemetry: PolicyTelemetry {
+                provenance: PolicyTelemetryProvenance::Unavailable,
+                denied_requests: None,
+                approval_requests: None,
+                outcome_unknown_runs: None,
+            },
+        };
+        posture.capabilities.sort();
+        posture
+            .findings
+            .sort_by(|left, right| left.code.cmp(&right.code));
+        let bytes = serde_json::to_vec(&posture).map_err(|_| {
+            ApiError::failed_precondition(
+                ApiErrorReason::InternalInvariant,
+                "runtime policy metadata is unavailable",
+            )
+        })?;
+        posture.fingerprint = hex::encode(Sha256::digest(bytes));
+        if !posture.validate() {
+            return Err(ApiError::failed_precondition(
+                ApiErrorReason::InternalInvariant,
+                "runtime policy metadata is unavailable",
+            ));
+        }
+        Ok(posture)
+    }
+}
diff --git a/crates/colossus-api-runtime/src/service/sharing.rs b/crates/colossus-api-runtime/src/service/sharing.rs
new file mode 100644
index 000000000..830120aea
--- /dev/null
+++ b/crates/colossus-api-runtime/src/service/sharing.rs
@@ -0,0 +1,387 @@
+//! Runtime-owned disclosure relationships; receiving applications retain their own grants.
+use super::*;
+use colossus_api::{
+    ListVisibleRunsResponse, SetWorkspaceSharingRequest, VisibleRun, WorkspaceSharingState,
+};
+use colossus_contracts::{EventClassification, ExecutionContext, NewEvent};
+use serde::{Deserialize, Serialize};
+
+const SHARE_EVENT: &str = "api.workspace.sharing.changed.v1";
+const MAX_SHARE_EVENTS: usize = 4096;
+const MAX_SHARED_SOURCES: usize = 16;
+const CURSOR_PREFIX: &str = "visible1:";
+
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ShareRecord {
+    owner: String,
+    owner_kind: colossus_api::ApplicationKind,
+    recipient: String,
+    enabled: bool,
+    allow_continuation: bool,
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct VisibleCursor {
+    source: usize,
+    token: Option<String>,
+    digest: String,
+}
+
+fn share_stream(recipient: &str) -> String {
+    format!(
+        "api.workspace.sharing:{}",
+        hex::encode(Sha256::digest(recipient.as_bytes()))
+    )
+}
+
+fn same_share(actual: Option<&ShareRecord>, desired: &ShareRecord) -> bool {
+    actual.map_or(!desired.enabled, |record| {
+        record.owner == desired.owner
+            && record.owner_kind == desired.owner_kind
+            && record.recipient == desired.recipient
+            && record.enabled == desired.enabled
+            && record.allow_continuation == desired.allow_continuation
+    })
+}
+
+impl RuntimeAgentRunApi {
+    fn shares(&self, recipient: &CallerContext) -> ApiResult<(Vec<ShareRecord>, u64)> {
+        let (mut records, cursor) = self.latest_shares(recipient)?;
+        records.retain(|record| record.enabled);
+        Ok((records, cursor))
+    }
+
+    fn latest_shares(&self, recipient: &CallerContext) -> ApiResult<(Vec<ShareRecord>, u64)> {
+        recipient.require_scope(scopes::RUNS_READ)?;
+        let journal = self.runtime.journal();
+        let mut records = BTreeMap::new();
+        let mut cursor = 0;
+        let mut count = 0;
+        loop {
+            let events = journal
+                .read_stream_from(
+                    &share_stream(recipient.principal().application_id()),
+                    cursor,
+                    128,
+                )
+                .map_err(|error| ApiError::from_store(&error, recipient.request_id()))?;
+            if events.is_empty() {
+                break;
+            }
+            for event in &events {
+                count += 1;
+                if count > MAX_SHARE_EVENTS {
+                    return Err(capacity_error(recipient));
+                }
+                let record: ShareRecord = serde_json::from_value(
+                    journal
+                        .decrypt_payload(event)
+                        .map_err(|error| ApiError::from_store(&error, recipient.request_id()))?,
+                )
+                .map_err(|_| recovery_invariant(recipient))?;
+                if event.event_type != SHARE_EVENT
+                    || event.actor.actor_type != ActorType::Application
+                    || event.actor.id != record.owner
+                    || record.recipient != recipient.principal().application_id()
+                    || event.stream_version != cursor + 1
+                    || (record.allow_continuation && !record.enabled)
+                {
+                    return Err(recovery_invariant(recipient));
+                }
+                cursor = event.stream_version;
+                records.insert(record.owner.clone(), record.clone());
+            }
+            if events.len() < 128 {
+                break;
+            }
+        }
+        let records = records.into_values().collect::<Vec<_>>();
+        if records.iter().filter(|record| record.enabled).count() > MAX_SHARED_SOURCES {
+            return Err(capacity_error(recipient));
+        }
+        Ok((records, cursor))
+    }
+
+    fn recipient_context(
+        &self,
+        caller: &CallerContext,
+        application: &str,
+    ) -> ApiResult<CallerContext> {
+        let principal = ApplicationPrincipal::authenticated(
+            application,
+            caller.principal().credential_id(),
+            caller.principal().kind(),
+            [colossus_api::ApiScope::new(scopes::RUNS_READ)?],
+            [],
+            [],
+        )?;
+        Ok(CallerContext::authenticated(
+            principal,
+            caller.request_id().clone(),
+        ))
+    }
+
+    fn read_source_context(
+        &self,
+        recipient: &CallerContext,
+        record: &ShareRecord,
+    ) -> ApiResult<CallerContext> {
+        // This is resource authorization only. It contains no execution, control,
+        // interaction, role, or tool authority and cannot create a source-owned run.
+        let principal = ApplicationPrincipal::authenticated(
+            &record.owner,
+            recipient.principal().credential_id(),
+            record.owner_kind,
+            [colossus_api::ApiScope::new(scopes::RUNS_READ)?],
+            [],
+            [],
+        )?;
+        Ok(CallerContext::authenticated(
+            principal,
+            recipient.request_id().clone(),
+        ))
+    }
+
+    pub(super) fn persist_workspace_sharing(
+        &self,
+        caller: &CallerContext,
+        request: SetWorkspaceSharingRequest,
+    ) -> ApiResult<WorkspaceSharingState> {
+        caller.require_scope(scopes::RUNS_CONTROL)?;
+        caller.require_scope(scopes::RUNS_READ)?;
+        if request.allow_continuation {
+            caller.require_scope(scopes::RUNS_EXECUTE)?;
+        }
+        if request.recipient_application_id == caller.principal().application_id()
+            || (request.allow_continuation && !request.enabled)
+        {
+            return Err(ApiError::invalid(
+                ApiErrorReason::InvalidArgument,
+                "recipient_application_id",
+                "invalid workspace sharing relationship",
+            ));
+        }
+        let recipient = self.recipient_context(caller, &request.recipient_application_id)?;
+        let journal = self.runtime.journal();
+        let desired = ShareRecord {
+            owner: caller.principal().application_id().into(),
+            owner_kind: caller.principal().kind(),
+            recipient: request.recipient_application_id.clone(),
+            enabled: request.enabled,
+            allow_continuation: request.allow_continuation,
+        };
+        for _ in 0..32 {
+            let (records, version) = self.latest_shares(&recipient)?;
+            if same_share(
+                records.iter().find(|record| record.owner == desired.owner),
+                &desired,
+            ) {
+                break;
+            }
+            if version >= MAX_SHARE_EVENTS as u64 {
+                return Err(capacity_error(caller));
+            }
+            let event = NewEvent {
+                stream_id: share_stream(&desired.recipient),
+                expected_stream_version: version,
+                event_type: SHARE_EVENT.into(),
+                actor: caller.actor(),
+                event_version: 1,
+                classification: EventClassification::System,
+                context: ExecutionContext {
+                    correlation_id: caller.request_id().as_str().into(),
+                    ..ExecutionContext::default()
+                },
+                payload: serde_json::to_value(&desired).map_err(|_| recovery_invariant(caller))?,
+            };
+            match journal.append(event) {
+                Ok(_) => {
+                    return Ok(WorkspaceSharingState {
+                        recipient_application_id: request.recipient_application_id,
+                        enabled: request.enabled,
+                        allow_continuation: request.allow_continuation,
+                    });
+                }
+                Err(StoreError::Conflict { .. }) => continue,
+                Err(error) => return Err(ApiError::from_store(&error, caller.request_id())),
+            }
+        }
+        let (records, _) = self.latest_shares(&recipient)?;
+        let actual = records.iter().find(|record| record.owner == desired.owner);
+        if !same_share(actual, &desired) {
+            return Err(capacity_error(caller));
+        }
+        Ok(WorkspaceSharingState {
+            recipient_application_id: request.recipient_application_id,
+            enabled: request.enabled,
+            allow_continuation: request.allow_continuation,
+        })
+    }
+
+    pub(super) fn workspace_share_allowed(
+        &self,
+        recipient: &CallerContext,
+        owner: &str,
+        continuation: bool,
+    ) -> ApiResult<bool> {
+        Ok(self
+            .shares(recipient)?
+            .0
+            .iter()
+            .any(|record| record.owner == owner && (!continuation || record.allow_continuation)))
+    }
+
+    pub(super) fn shared_session_continuable(
+        &self,
+        caller: &CallerContext,
+        session_id: &str,
+    ) -> ApiResult<bool> {
+        let events = self
+            .runtime
+            .journal()
+            .read_stream_from(&format!("session:{session_id}"), 0, 1)
+            .map_err(|error| ApiError::from_store(&error, caller.request_id()))?;
+        match events.first() {
+            Some(event)
+                if event.event_type == "session.created.v1"
+                    && event.actor.actor_type == ActorType::Application =>
+            {
+                self.workspace_share_allowed(caller, &event.actor.id, true)
+            }
+            _ => Ok(false),
+        }
+    }
+    pub(super) fn session_history_visible(
+        &self,
+        caller: &CallerContext,
+        session_id: &str,
+    ) -> ApiResult<bool> {
+        let events = self
+            .runtime
+            .journal()
+            .read_stream_from(&format!("session:{session_id}"), 0, 1)
+            .map_err(|error| ApiError::from_store(&error, caller.request_id()))?;
+        match events.first() {
+            Some(event)
+                if event.event_type == "session.created.v1"
+                    && event.actor.actor_type == ActorType::Application =>
+            {
+                if event.actor.id == caller.principal().application_id() {
+                    Ok(true)
+                } else {
+                    self.workspace_share_allowed(caller, &event.actor.id, false)
+                }
+            }
+            _ => Ok(false),
+        }
+    }
+
+    pub(super) fn visible_run_caller(
+        &self,
+        caller: &CallerContext,
+        run_id: &str,
+    ) -> ApiResult<CallerContext> {
+        caller.require_scope(scopes::RUNS_READ)?;
+        if self.repository.get_run(caller, run_id)?.is_some() {
+            return Ok(caller.clone());
+        }
+        for record in self.shares(caller)?.0 {
+            let source = self.read_source_context(caller, &record)?;
+            if self.repository.get_run(&source, run_id)?.is_some() {
+                return Ok(source);
+            }
+        }
+        Err(missing_run(caller))
+    }
+
+    pub(super) fn discover_visible_runs(
+        &self,
+        caller: &CallerContext,
+        mut request: ListRunsRequest,
+    ) -> ApiResult<ListVisibleRunsResponse> {
+        let (shares, version) = self.shares(caller)?;
+        let mut digest = Sha256::new();
+        digest.update(caller.principal().application_id().as_bytes());
+        digest.update(version.to_be_bytes());
+        let mut query = request.clone();
+        query.page_token = None;
+        digest.update(serde_json::to_vec(&query).map_err(|_| recovery_invariant(caller))?);
+        let digest = hex::encode(digest.finalize());
+        let cursor = match request.page_token.take() {
+            Some(token) => {
+                let value = token
+                    .strip_prefix(CURSOR_PREFIX)
+                    .ok_or_else(|| invalid_activity_cursor(caller))?;
+                let decoded = URL_SAFE_NO_PAD
+                    .decode(value)
+                    .map_err(|_| invalid_activity_cursor(caller))?;
+                let cursor: VisibleCursor = serde_json::from_slice(&decoded)
+                    .map_err(|_| invalid_activity_cursor(caller))?;
+                if cursor.digest != digest || cursor.source > shares.len() {
+                    return Err(invalid_activity_cursor(caller));
+                }
+                cursor
+            }
+            None => VisibleCursor {
+                source: 0,
+                token: None,
+                digest: digest.clone(),
+            },
+        };
+        let mut source_index = cursor.source;
+        request.page_token = cursor.token;
+        loop {
+            let source = if source_index == 0 {
+                caller.clone()
+            } else {
+                self.read_source_context(caller, &shares[source_index - 1])?
+            };
+            let page = self.repository.list_runs(&source, &request)?;
+            let next = if let Some(token) = page.next_page_token {
+                Some(VisibleCursor {
+                    source: source_index,
+                    token: Some(token),
+                    digest: digest.clone(),
+                })
+            } else if source_index < shares.len() {
+                Some(VisibleCursor {
+                    source: source_index + 1,
+                    token: None,
+                    digest: digest.clone(),
+                })
+            } else {
+                None
+            };
+            if page.runs.is_empty() && next.as_ref().is_some_and(|next| next.token.is_none()) {
+                source_index += 1;
+                request.page_token = None;
+                continue;
+            }
+            let controllable =
+                source_index == 0 && caller.principal().has_scope(scopes::RUNS_CONTROL);
+            let runs = page
+                .runs
+                .into_iter()
+                .map(|run| VisibleRun {
+                    continuable: caller.principal().has_scope(scopes::RUNS_EXECUTE)
+                        && self.session_id(caller, Some(&run.session_id)).is_ok(),
+                    run,
+                    controllable,
+                })
+                .collect();
+            let next_page_token = next
+                .map(|cursor| {
+                    serde_json::to_vec(&cursor)
+                        .map(|bytes| format!("{CURSOR_PREFIX}{}", URL_SAFE_NO_PAD.encode(bytes)))
+                })
+                .transpose()
+                .map_err(|_| recovery_invariant(caller))?;
+            return Ok(ListVisibleRunsResponse {
+                runs,
+                next_page_token,
+            });
+        }
+    }
+}
diff --git a/crates/colossus-api-runtime/src/service_tests.rs b/crates/colossus-api-runtime/src/service_tests.rs
index 791715ab3..b8a2944df 100644
--- a/crates/colossus-api-runtime/src/service_tests.rs
+++ b/crates/colossus-api-runtime/src/service_tests.rs
@@ -44,6 +44,7 @@ use uuid::Uuid;
 mod plan_interaction;
 mod process_sessions;
 mod schedule_approval;
+mod sharing;
 
 struct RuntimeFixture {
     runtime: Arc<Runtime>,
@@ -683,6 +684,59 @@ fn service(runtime: Arc<Runtime>, admission: RunAdmissionConfig) -> Arc<RuntimeA
     ))
 }
 
+async fn policy_metadata_is_scoped_path_free_and_updates_with_native_mode(runtime: Arc<Runtime>) {
+    let mode = Arc::new(TestPublicApprovalMode::new(PublicApprovalMode::Ask));
+    let router = Arc::new(
+        PublicInteractionRouter::new(Arc::new(DenyApproval), None)
+            .with_public_approval_mode(mode.clone()),
+    );
+    let api = RuntimeAgentRunApi::new(Arc::clone(&runtime), router, "primary", "Metadata fixture");
+    let reader = caller_with_exact_scopes("app:policy-reader", "policy-read", &[scopes::RUNS_READ]);
+    let first = api
+        .get_runtime_policy_posture(&reader)
+        .await
+        .expect("released metadata");
+    assert!(first.validate());
+    assert!(
+        first.allowed_tools.is_empty(),
+        "read permission cannot borrow wider tool authority"
+    );
+    assert_eq!(first.approval_mode, colossus_api::PolicyApprovalMode::Ask);
+    assert!(
+        first.telemetry.denied_requests.is_none(),
+        "unavailable counts are unknown"
+    );
+    let json = serde_json::to_string(&first).expect("metadata");
+    assert!(!json.contains(runtime.workspace().to_string_lossy().as_ref()));
+    for private_field in [
+        "canonical_workspace",
+        "protected_paths",
+        "network_destinations",
+        "resolved_shell",
+        "credentialReference",
+    ] {
+        assert!(!json.contains(private_field));
+    }
+    let denied = caller_with_exact_scopes("app:policy-denied", "policy-denied", &[]);
+    assert_eq!(
+        api.get_runtime_policy_posture(&denied)
+            .await
+            .unwrap_err()
+            .code,
+        colossus_api::ApiErrorCode::PermissionDenied
+    );
+    mode.set(PublicApprovalMode::RiskAuto);
+    let changed = api
+        .get_runtime_policy_posture(&reader)
+        .await
+        .expect("current native mode");
+    assert_eq!(
+        changed.approval_mode,
+        colossus_api::PolicyApprovalMode::RiskAuto
+    );
+    assert_ne!(first.fingerprint, changed.fingerprint);
+}
+
 async fn wait_inactive(service: &RuntimeAgentRunApi) {
     tokio::time::timeout(Duration::from_secs(10), async {
         loop {
@@ -1503,6 +1557,10 @@ fn runtime_service_conformance() {
         .build()
         .expect("test runtime")
         .block_on(async {
+            policy_metadata_is_scoped_path_free_and_updates_with_native_mode(Arc::clone(
+                &fixture.runtime,
+            ))
+            .await;
             process_sessions::inspection_and_control_require_current_scopes(Arc::clone(
                 &fixture.runtime,
             ))
diff --git a/crates/colossus-api-runtime/src/service_tests/sharing.rs b/crates/colossus-api-runtime/src/service_tests/sharing.rs
new file mode 100644
index 000000000..08187f0ae
--- /dev/null
+++ b/crates/colossus-api-runtime/src/service_tests/sharing.rs
@@ -0,0 +1,392 @@
+use super::*;
+use colossus_api::{ApiErrorReason, ListRunsRequest, SetWorkspaceSharingRequest};
+
+fn page(token: Option<String>) -> ListRunsRequest {
+    ListRunsRequest {
+        session_id: None,
+        statuses: vec![],
+        page_size: 1,
+        page_token: token,
+        include_archived: true,
+    }
+}
+fn history(run_id: &str) -> ListSessionActivityRequest {
+    ListSessionActivityRequest {
+        source_run_id: run_id.into(),
+        query: String::new(),
+        lanes: vec![colossus_api::SessionActivityLane::Agent],
+        kinds: vec![
+            colossus_api::SessionActivityKind::User,
+            colossus_api::SessionActivityKind::Assistant,
+        ],
+        statuses: vec![],
+        page_size: 32,
+        page_token: None,
+    }
+}
+
+#[test]
+fn explicit_workspace_sharing_preserves_source_and_recipient_authority() {
+    const CHILD: &str = "COLOSSUS_API_SHARING_TEST_CHILD";
+    if env::var_os(CHILD).is_none() {
+        let status = Command::new(env::current_exe().expect("test executable"))
+            .args(["--exact","service_tests::sharing::explicit_workspace_sharing_preserves_source_and_recipient_authority","--nocapture"])
+            .env(CHILD,"1").env("COLOSSUS_API_RUNTIME_TEST_JOURNAL","11".repeat(32))
+            .env("COLOSSUS_API_RUNTIME_TEST_SIGNING","22".repeat(32)).status().expect("isolated sharing test");
+        assert!(status.success());
+        return;
+    }
+    let fixture = runtime_fixture();
+    let api = service(
+        fixture.runtime.clone(),
+        RunAdmissionConfig::default()
+            .with_list_limits(4, 1, 8, 16, 2, 16)
+            .expect("sharing fixture list admission"),
+    );
+    let owner = caller("app:desktop-sharing", "sharing-owner");
+    let cloud = caller("app:cloud-sharing", "sharing-cloud");
+    let other = caller("app:other-sharing", "sharing-other");
+    let repository = EventSourcedRunRepository::new(fixture.runtime.journal());
+    let sharing_stream = format!(
+        "api.workspace.sharing:{}",
+        hex::encode(Sha256::digest(b"app:cloud-sharing"))
+    );
+    let sharing_events = || {
+        fixture
+            .runtime
+            .journal()
+            .read_stream(&sharing_stream)
+            .expect("canonical sharing events")
+            .len()
+    };
+    for number in 0..2 {
+        let create = request(&format!("sharing-create-{number}"), "Local conversation");
+        let run = NewRun::from_request(
+            format!("sharing-run-{number}"),
+            format!("sharing-session-{number}"),
+            "primary",
+            &create,
+        )
+        .expect("run");
+        repository
+            .create_run(&owner, &create, &run)
+            .expect("source run");
+        fixture
+            .runtime
+            .create_application_session(
+                &format!("sharing-session-{number}"),
+                Some("Local conversation"),
+                owner.actor(),
+            )
+            .expect("session");
+    }
+    for (role, text) in [
+        (
+            ModelMessageRole::User,
+            "Full local question survives history sharing.",
+        ),
+        (ModelMessageRole::Assistant, "Released local answer."),
+        (
+            ModelMessageRole::Tool,
+            "Tool lane must not become cloud conversation.",
+        ),
+    ] {
+        let tool_call_id =
+            matches!(role, ModelMessageRole::Tool).then(|| "shared-history-tool".into());
+        fixture
+            .runtime
+            .append_application_message(
+                "sharing-session-0",
+                "sharing-run-0",
+                colossus_contracts::ModelMessage {
+                    role,
+                    content: ModelContent::from(text),
+                    tool_call_id,
+                    tool_calls: Vec::new(),
+                },
+                owner.actor(),
+            )
+            .expect("canonical released fixture message");
+    }
+    tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .expect("runtime")
+        .block_on(async {
+            assert!(
+                api.list_visible_runs(&cloud, page(None))
+                    .await
+                    .expect("private page")
+                    .runs
+                    .is_empty()
+            );
+            assert!(
+                api.get_run(
+                    &cloud,
+                    GetRunRequest {
+                        run_id: "sharing-run-0".into()
+                    }
+                )
+                .await
+                .is_err()
+            );
+            let read_only =
+                caller_with_exact_scopes("app:desktop-sharing", "read-only", &[scopes::RUNS_READ]);
+            assert_eq!(
+                api.set_workspace_sharing(
+                    &read_only,
+                    SetWorkspaceSharingRequest {
+                        recipient_application_id: "app:cloud-sharing".into(),
+                        enabled: false,
+                        allow_continuation: false
+                    }
+                )
+                .await
+                .expect_err("an idempotent private request still requires source control")
+                .reason,
+                ApiErrorReason::ScopeDenied
+            );
+            for _ in 0..4097 {
+                let private = api
+                    .set_workspace_sharing(
+                        &owner,
+                        SetWorkspaceSharingRequest {
+                            recipient_application_id: "app:cloud-sharing".into(),
+                            enabled: false,
+                            allow_continuation: false,
+                        },
+                    )
+                    .await
+                    .expect(
+                        "private reconnect reconciliation cannot exhaust the 4096-event budget",
+                    );
+                assert!(!private.enabled && !private.allow_continuation);
+            }
+            assert_eq!(
+                sharing_events(),
+                0,
+                "default private requests do not append permission changes"
+            );
+            assert_eq!(
+                api.set_workspace_sharing(
+                    &read_only,
+                    SetWorkspaceSharingRequest {
+                        recipient_application_id: "app:cloud-sharing".into(),
+                        enabled: true,
+                        allow_continuation: false,
+                    }
+                )
+                .await
+                .expect_err("source control scope")
+                .reason,
+                ApiErrorReason::ScopeDenied
+            );
+            api.set_workspace_sharing(
+                &owner,
+                SetWorkspaceSharingRequest {
+                    recipient_application_id: "app:cloud-sharing".into(),
+                    enabled: true,
+                    allow_continuation: false,
+                },
+            )
+            .await
+            .expect("explicit share");
+            assert_eq!(sharing_events(), 1, "an actual enable remains durable");
+            api.set_workspace_sharing(
+                &owner,
+                SetWorkspaceSharingRequest {
+                    recipient_application_id: "app:cloud-sharing".into(),
+                    enabled: true,
+                    allow_continuation: false,
+                },
+            )
+            .await
+            .expect("same enabled tuple");
+            assert_eq!(sharing_events(), 1);
+            let canonical = api
+                .list_session_activity(&cloud, history("sharing-run-0"))
+                .await
+                .expect("shared canonical conversation");
+            assert!(canonical.activities.iter().any(|activity| {
+                activity.input.as_ref().is_some_and(|input| {
+                    input.format == "text" && input.value.contains("Full local question")
+                })
+            }));
+            assert!(canonical.activities.iter().all(|activity| activity.lane
+                == colossus_api::SessionActivityLane::Agent
+                && matches!(
+                    activity.kind,
+                    colossus_api::SessionActivityKind::User
+                        | colossus_api::SessionActivityKind::Assistant
+                )));
+            assert!(!canonical.activities.iter().any(|activity| {
+                activity
+                    .input
+                    .as_ref()
+                    .is_some_and(|input| input.value.contains("Tool lane"))
+                    || activity
+                        .result
+                        .as_ref()
+                        .is_some_and(|result| result.value.contains("Tool lane"))
+            }));
+            let first = api
+                .list_visible_runs(&cloud, page(None))
+                .await
+                .expect("shared page");
+            assert_eq!(first.runs.len(), 1);
+            assert!(!first.runs[0].controllable);
+            assert!(!first.runs[0].continuable);
+            let next = first.next_page_token.expect("shared cursor");
+            assert_eq!(
+                api.list_visible_runs(&cloud, page(Some(next.clone())))
+                    .await
+                    .expect("next page")
+                    .runs
+                    .len(),
+                1
+            );
+            assert!(
+                api.list_visible_runs(&other, page(None))
+                    .await
+                    .expect("other page")
+                    .runs
+                    .is_empty()
+            );
+            let shared = api
+                .get_run(
+                    &cloud,
+                    GetRunRequest {
+                        run_id: "sharing-run-0".into(),
+                    },
+                )
+                .await
+                .expect("shared read");
+            assert_eq!(shared.id, "sharing-run-0");
+            assert_eq!(
+                api.cancel_run(
+                    &cloud,
+                    CancelRunRequest {
+                        run_id: "sharing-run-0".into(),
+                        idempotency_key: IdempotencyKey::new("shared-cancel").expect("key")
+                    }
+                )
+                .await
+                .expect_err("shared runs read only")
+                .reason,
+                ApiErrorReason::RunNotFound
+            );
+            let mut continuation = request("shared-continuation-denied", "Continue");
+            continuation.session_id = Some("sharing-session-0".into());
+            assert_eq!(
+                api.create_run(&cloud, continuation)
+                    .await
+                    .expect_err("read-only share cannot continue")
+                    .reason,
+                ApiErrorReason::RunNotFound
+            );
+            api.set_workspace_sharing(
+                &owner,
+                SetWorkspaceSharingRequest {
+                    recipient_application_id: "app:cloud-sharing".into(),
+                    enabled: true,
+                    allow_continuation: true,
+                },
+            )
+            .await
+            .expect("allow continuation");
+            let visible = api
+                .list_visible_runs(&cloud, page(None))
+                .await
+                .expect("continuable");
+            assert!(visible.runs[0].continuable);
+            let mut continuation = request("shared-continuation-allowed", "Continue");
+            continuation.session_id = Some("sharing-session-0".into());
+            let run = api
+                .create_run(&cloud, continuation)
+                .await
+                .expect("cloud-owned continuation")
+                .run;
+            let execution = repository
+                .execution_request(&cloud, &run.id)
+                .expect("cloud captured grant")
+                .expect("execution");
+            assert_eq!(execution.application_id, "app:cloud-sharing");
+            assert!(execution.allowed_tools.is_empty());
+            assert!(
+                repository
+                    .get_run(&owner, &run.id)
+                    .expect("owner read")
+                    .is_none()
+            );
+            api.set_workspace_sharing(
+                &owner,
+                SetWorkspaceSharingRequest {
+                    recipient_application_id: "app:cloud-sharing".into(),
+                    enabled: false,
+                    allow_continuation: false,
+                },
+            )
+            .await
+            .expect("revoke sharing");
+            assert_eq!(
+                sharing_events(),
+                3,
+                "enable, continuation change and disable each append once"
+            );
+            for _ in 0..4097 {
+                api.set_workspace_sharing(
+                    &owner,
+                    SetWorkspaceSharingRequest {
+                        recipient_application_id: "app:cloud-sharing".into(),
+                        enabled: false,
+                        allow_continuation: false,
+                    },
+                )
+                .await
+                .expect("already-disabled reconnect reconciliation cannot consume journal budget");
+            }
+            assert_eq!(
+                sharing_events(),
+                3,
+                "same disabled tuple preserves audit history and its remaining budget"
+            );
+            assert!(
+                api.list_session_activity(&cloud, history("sharing-run-0"))
+                    .await
+                    .is_err()
+            );
+            assert!(
+                api.list_session_activity(&cloud, history(&run.id))
+                    .await
+                    .is_err(),
+                "cloud-owned continuation cannot bypass source history revocation"
+            );
+            let retained = api
+                .list_visible_runs(&cloud, page(None))
+                .await
+                .expect("cloud-owned run remains visible");
+            assert_eq!(retained.runs[0].run.id, run.id);
+            assert!(retained.runs[0].controllable);
+            assert!(
+                !retained.runs[0].continuable,
+                "canonical source session sharing was revoked"
+            );
+            assert!(
+                api.get_run(
+                    &cloud,
+                    GetRunRequest {
+                        run_id: "sharing-run-0".into()
+                    }
+                )
+                .await
+                .is_err()
+            );
+            assert!(
+                api.list_visible_runs(&cloud, page(Some(next)))
+                    .await
+                    .is_err(),
+                "cursor invalidated on share change"
+            );
+            wait_inactive(&api).await;
+        });
+}
diff --git a/crates/colossus-api/src/lib.rs b/crates/colossus-api/src/lib.rs
index 850317deb..531739731 100644
--- a/crates/colossus-api/src/lib.rs
+++ b/crates/colossus-api/src/lib.rs
@@ -10,9 +10,15 @@ mod artifacts;
 mod error;
 mod identity;
 mod plugins;
+mod posture;
 mod process_sessions;
 mod repository;
 mod runs;
+mod sharing;
+pub use posture::*;
+pub use sharing::{
+    ListVisibleRunsResponse, SetWorkspaceSharingRequest, VisibleRun, WorkspaceSharingState,
+};
 mod validation;
 mod workflows;
 pub use workflows::*;
diff --git a/crates/colossus-api/src/posture.rs b/crates/colossus-api/src/posture.rs
new file mode 100644
index 000000000..3780834ad
--- /dev/null
+++ b/crates/colossus-api/src/posture.rs
@@ -0,0 +1,180 @@
+//! Metadata-only caller-scoped runtime policy reporting.
+use serde::{Deserialize, Serialize};
+
+/// Source of a configuration report, rather than an enforcement attestation.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PolicyProvenance {
+    /// Reported by the authenticated runtime using its public metadata boundary.
+    RuntimeReported,
+}
+
+/// Configured execution boundary; remaining per-effect checks still apply.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PolicySandboxBackend {
+    /// Native operating-system isolation.
+    Native,
+    /// Windows job-based isolation.
+    WindowsJob,
+    /// OCI isolation.
+    Oci,
+    /// Isolation asserted by a trusted external host.
+    External,
+    /// Explicit ambient host authority.
+    DangerFullAccess,
+    /// A backend without this metadata contract.
+    Unknown,
+}
+
+/// Current native-owned approval behavior for public runs.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PolicyApprovalMode {
+    /// Approval obligations are denied.
+    Deny,
+    /// Approval obligations are presented to an authorized operator.
+    Ask,
+    /// Eligible low-risk obligations may be approved automatically.
+    RiskAuto,
+    /// Explicit automatic approval of obligations, subject to hard authority checks.
+    DangerAuto,
+    /// The host does not advertise this behavior.
+    Unknown,
+}
+
+/// Safe model identifiers, without provider connection details.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct PolicyModelLabel {
+    /// Logical model profile identifier.
+    pub profile: String,
+    /// Bounded public model label; never a file, URL, credential, or configuration.
+    pub label: String,
+}
+
+/// Severity of a reported configuration finding, not an observed violation.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PolicyFindingSeverity {
+    /// Configuration carries a known limitation or risk.
+    Warning,
+}
+
+/// Closed configuration finding identifiers omit private explanations and arguments.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct PolicyFinding {
+    /// Stable public configuration-risk identifier.
+    pub code: String,
+    /// Reported risk severity.
+    pub severity: PolicyFindingSeverity,
+}
+
+/// Origin of aggregate telemetry. Missing evidence must not be represented as zero.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PolicyTelemetryProvenance {
+    /// Runtime has no canonical caller-visible aggregate counter contract.
+    Unavailable,
+}
+
+/// Canonical aggregate telemetry, when a supported released counter exists.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct PolicyTelemetry {
+    /// Evidence origin and availability.
+    pub provenance: PolicyTelemetryProvenance,
+    /// Enforced request denials; None means unknown, never zero.
+    pub denied_requests: Option<u64>,
+    /// Approval obligations; None means unknown, never zero.
+    pub approval_requests: Option<u64>,
+    /// Runs with unknown effect outcome; None means unknown, never zero.
+    pub outcome_unknown_runs: Option<u64>,
+}
+
+/// Caller-scoped runtime configuration metadata. This never expands authority.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimePolicyPosture {
+    /// Metadata contract version, currently one.
+    pub schema_version: u32,
+    /// Configuration reporting origin, not a compliance attestation.
+    pub provenance: PolicyProvenance,
+    /// SHA-256 of sorted released metadata only, excluding private configuration.
+    pub fingerprint: String,
+    /// Accepted configuration revision, when provided by runtime composition.
+    pub configuration_revision: Option<u64>,
+    /// Selected access-profile identifier.
+    pub access_profile: String,
+    /// Configured process/effect boundary.
+    pub sandbox_backend: PolicySandboxBackend,
+    /// Named sandbox profile; no resource roots or destinations.
+    pub sandbox_profile: String,
+    /// Whether a boundary requiring explicit local acknowledgment is acknowledged.
+    pub boundary_acknowledged: bool,
+    /// Current native-owned public approval behavior.
+    pub approval_mode: PolicyApprovalMode,
+    /// Logical roles within the dedicated application's authority ceiling.
+    pub allowed_roles: Vec<String>,
+    /// Exposed tools intersected with the caller ceiling; effect policy still applies.
+    pub allowed_tools: Vec<String>,
+    /// Caller-visible public capabilities and selected tool capability identifiers.
+    pub capabilities: Vec<String>,
+    /// Caller-routed model labels only.
+    pub models: Vec<PolicyModelLabel>,
+    /// Known configuration risks; these are not enforcement violations.
+    pub findings: Vec<PolicyFinding>,
+    /// Supported canonical counters, with explicit unknown availability.
+    pub telemetry: PolicyTelemetry,
+}
+
+impl RuntimePolicyPosture {
+    /// Validate all released identifiers, cardinalities and metadata-only shapes.
+    pub fn validate(&self) -> bool {
+        let identifier = |s: &str| {
+            !s.is_empty()
+                && s.len() <= 128
+                && !s.starts_with("sk-")
+                && !s.starts_with("eyJ")
+                && !s.starts_with("AKIA")
+                && s.bytes()
+                    .all(|c| c.is_ascii_alphanumeric() || b"._-".contains(&c))
+        };
+        let list = |items: &[String], max: usize| {
+            items.len() <= max
+                && items.iter().all(|item| identifier(item))
+                && items.windows(2).all(|pair| pair[0] < pair[1])
+        };
+        self.schema_version == 1
+            && self.fingerprint.len() == 64
+            && self
+                .fingerprint
+                .bytes()
+                .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+            && identifier(&self.access_profile)
+            && identifier(&self.sandbox_profile)
+            && list(&self.allowed_roles, 64)
+            && list(&self.allowed_tools, 256)
+            && list(&self.capabilities, 256)
+            && self.models.len() <= 64
+            && self
+                .models
+                .iter()
+                .all(|m| identifier(&m.profile) && identifier(&m.label))
+            && self.findings.len() <= 16
+            && self.findings.iter().all(|f| {
+                matches!(
+                    f.code.as_str(),
+                    "storage.ephemeral"
+                        | "storage.plaintext"
+                        | "sandbox.danger_full_access"
+                        | "observability.sensitive_journal_payloads"
+                        | "credentials.mcp_oauth_plaintext"
+                )
+            })
+            && self.telemetry.denied_requests.is_none()
+            && self.telemetry.approval_requests.is_none()
+            && self.telemetry.outcome_unknown_runs.is_none()
+    }
+}
diff --git a/crates/colossus-api/src/runs.rs b/crates/colossus-api/src/runs.rs
index cfd4e1009..45fe4cadc 100644
--- a/crates/colossus-api/src/runs.rs
+++ b/crates/colossus-api/src/runs.rs
@@ -1571,6 +1571,52 @@ pub trait RunExecutor: Send + Sync {
 /// Public run application service implemented by embedded and remote backends.
 #[async_trait]
 pub trait AgentRunApi: Send + Sync {
+    /// Advertise this optional metadata contract only when implemented by composition.
+    fn supports_runtime_policy_posture(&self) -> bool {
+        false
+    }
+    /// Read caller-scoped metadata-only policy configuration, without effect authority.
+    async fn get_runtime_policy_posture(
+        &self,
+        _caller: &CallerContext,
+    ) -> ApiResult<crate::RuntimePolicyPosture> {
+        Err(ApiError::failed_precondition(
+            ApiErrorReason::InvalidRunTransition,
+            "runtime policy metadata is unavailable",
+        ))
+    }
+    /// Explicitly release only this application's workspace sessions to another application.
+    async fn set_workspace_sharing(
+        &self,
+        _caller: &CallerContext,
+        _request: crate::SetWorkspaceSharingRequest,
+    ) -> ApiResult<crate::WorkspaceSharingState> {
+        Err(ApiError::failed_precondition(
+            ApiErrorReason::InvalidRunTransition,
+            "workspace sharing is unavailable",
+        ))
+    }
+
+    /// List owned and locally shared runs, with runtime-derived mutation authority.
+    async fn list_visible_runs(
+        &self,
+        caller: &CallerContext,
+        request: ListRunsRequest,
+    ) -> ApiResult<crate::ListVisibleRunsResponse> {
+        let page = self.list_runs(caller, request).await?;
+        Ok(crate::ListVisibleRunsResponse {
+            runs: page
+                .runs
+                .into_iter()
+                .map(|run| crate::VisibleRun {
+                    run,
+                    controllable: false,
+                    continuable: false,
+                })
+                .collect(),
+            next_page_token: page.next_page_token,
+        })
+    }
     /// List caller-owned managed shells.
     async fn list_process_sessions(
         &self,
diff --git a/crates/colossus-api/src/sharing.rs b/crates/colossus-api/src/sharing.rs
new file mode 100644
index 000000000..5f506c2ea
--- /dev/null
+++ b/crates/colossus-api/src/sharing.rs
@@ -0,0 +1,49 @@
+//! Explicit application-owned workspace disclosure contracts.
+use crate::Run;
+use serde::{Deserialize, Serialize};
+
+/// Change only the authenticated application's sharing relationship in this workspace.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SetWorkspaceSharingRequest {
+    /// Independently authenticated application receiving released session access.
+    pub recipient_application_id: String,
+    /// Release caller-owned sessions, or revoke future disclosure.
+    pub enabled: bool,
+    /// Permit the recipient to continue shared sessions beneath its own grant.
+    pub allow_continuation: bool,
+}
+
+/// Durable local sharing posture, independent of cloud enrollment.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WorkspaceSharingState {
+    /// Application receiving this explicit local disclosure.
+    pub recipient_application_id: String,
+    /// Whether new reads may disclose the source application's sessions.
+    pub enabled: bool,
+    /// Whether the recipient may submit its own runs in shared sessions.
+    pub allow_continuation: bool,
+}
+
+/// A released run with authority derived by the authenticated runtime.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct VisibleRun {
+    /// Released run projection, never private worker or model content.
+    pub run: Run,
+    /// Whether this caller owns the run's cancel/respond authority.
+    pub controllable: bool,
+    /// Whether this caller may continue the containing session using its own grant.
+    pub continuable: bool,
+}
+
+/// Bounded source-stable page of owned and explicitly shared runs.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ListVisibleRunsResponse {
+    /// Caller-owned and explicitly shared released run projections.
+    pub runs: Vec<VisibleRun>,
+    /// Opaque continuation token bound to the authenticated disclosure relationships.
+    pub next_page_token: Option<String>,
+}
diff --git a/crates/colossus-cli/Cargo.toml b/crates/colossus-cli/Cargo.toml
index ae54d565c..3cc0ccff1 100644
--- a/crates/colossus-cli/Cargo.toml
+++ b/crates/colossus-cli/Cargo.toml
@@ -14,6 +14,8 @@ path = "src/main.rs"
 dictation = ["dep:colossus-native-dictation"]
 
 [dependencies]
+colossus-connector.workspace = true
+colossus-credentials.workspace = true
 colossus-native-dictation = { version = "=0.1.0", path = "../colossus-native-dictation", optional = true, features = ["download"] }
 agent-client-protocol.workspace = true
 shell-words.workspace = true
@@ -26,6 +28,7 @@ colossus-api.workspace = true
 colossus-contracts.workspace = true
 colossus-grpc.workspace = true
 colossus-home.workspace = true
+colossus-journal-redb.workspace = true
 colossus-observability = { workspace = true, features = ["host-exporters"] }
 colossus-policy.workspace = true
 colossus-plugins.workspace = true
diff --git a/crates/colossus-cli/src/commands.rs b/crates/colossus-cli/src/commands.rs
index 9b0777666..de16aaa59 100644
--- a/crates/colossus-cli/src/commands.rs
+++ b/crates/colossus-cli/src/commands.rs
@@ -2,6 +2,13 @@ use super::*;
 
 #[derive(Subcommand)]
 pub(super) enum Command {
+    /// Explicit offline development-only credential preparation and reviewed rewrap.
+    #[command(name = "dev-credentials", hide = !cfg!(debug_assertions))]
+    DevelopmentCredentials(DevelopmentCredentialsCommand),
+    /// Enroll and manage an outbound Control Plane connector with its dedicated local grant.
+    #[command(name = "control-plane", alias = "cloud")]
+    #[command(subcommand)]
+    Cloud(colossus_connector::ConnectorCommand),
     /// Check or apply an install-aware stable Colossus update.
     Update(UpdateCommand),
     /// Create or inspect fresh YAML configuration.
@@ -153,6 +160,20 @@ pub(super) enum UpdateAction {
 
 #[derive(Args)]
 pub(super) struct WorkerCommand {
+    /// Use one existing private Codex auth file for this serving worker only.
+    /// Credential contents stay late-bound inside the permitted provider adapter.
+    #[arg(
+        long,
+        value_name = "ABS_FILE",
+        conflicts_with_all = ["once", "shutdown", "status", "enroll_application", "revoke_credential"]
+    )]
+    pub(super) codex_auth_path: Option<PathBuf>,
+    /// Hide generic model fetch tools while retaining configured provider transport.
+    #[arg(
+        long,
+        conflicts_with_all = ["once", "shutdown", "status", "enroll_application", "revoke_credential"]
+    )]
+    pub(super) no_model_network_tools: bool,
     /// Recover and drain once instead of serving local IPC.
     #[arg(
         long,
@@ -192,6 +213,10 @@ pub(super) struct WorkerCommand {
     /// Absolute current-user 0700 directory for public API discovery.
     #[arg(long, value_name = "ABS_OWNER_PRIVATE_DIR")]
     pub(super) public_api_dir: Option<PathBuf>,
+    /// Explicit headless wrapping-key reference for sealed public API credentials.
+    /// The bearer itself is never supplied in environment or argv.
+    #[arg(long, requires = "public_api_dir")]
+    pub(super) public_api_vault_key_variable: Option<String>,
     /// Enroll an application offline and write its bearer directly to a keyring.
     #[arg(
         long,
diff --git a/crates/colossus-cli/src/dev_credentials.rs b/crates/colossus-cli/src/dev_credentials.rs
new file mode 100644
index 000000000..014e782c1
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials.rs
@@ -0,0 +1,84 @@
+//! Offline CLI translation for explicitly reviewed development credential custody.
+
+use super::{
+    dev_credentials_apply,
+    dev_credentials_args::{DevelopmentCredentialsAction, DevelopmentCredentialsCommand},
+    dev_credentials_plan::{self as plan, Failure, Result},
+    dev_credentials_sources,
+    public_api_admin::OsCredentialStore,
+};
+use colossus_credentials::DevelopmentAuthority;
+use serde_json::json;
+use std::path::Path;
+
+pub(super) fn run(command: &DevelopmentCredentialsCommand, workspace: &Path) -> Result<()> {
+    // Reject release builds before creating directories, opening a private key,
+    // inspecting an OS entry, or acquiring any runtime/configuration authority.
+    if !cfg!(debug_assertions) {
+        return Err(Failure(
+            "development credential custody is unavailable in release builds",
+        ));
+    }
+    match &command.command {
+        DevelopmentCredentialsAction::Init { home, workspace } => {
+            plan::clean_absolute(home)?;
+            let workspace = std::fs::canonicalize(workspace)
+                .map_err(|_| Failure("workspace constraint is unavailable"))?;
+            if !workspace.is_dir() {
+                return Err(Failure("workspace constraint must be a directory"));
+            }
+            let home = colossus_home::ColossusHome::ensure_at(home)
+                .map_err(|_| Failure("development home is unsafe"))?;
+            let _authority = DevelopmentAuthority::initialize(home.confined_root(), std::slice::from_ref(&workspace)).map_err(|_| Failure("development authority could not be prepared; existing or partial custody was not replaced"))?;
+            status(home.confined_root(), &workspace, false)?;
+        }
+        DevelopmentCredentialsAction::Status { home, workspace } => {
+            let home = plan::existing_root(home)?;
+            let workspace = std::fs::canonicalize(workspace)
+                .map_err(|_| Failure("workspace constraint is unavailable"))?;
+            status(&home, &workspace, false)?;
+        }
+        DevelopmentCredentialsAction::Plan { sources, plan_file } => {
+            let selected = dev_credentials_sources::make_plan(sources, workspace)?;
+            if selected.fresh_empty
+                && plan_file.parent()
+                    != Some(
+                        DevelopmentAuthority::path_for_home(&plan::existing_root(&selected.home)?)
+                            .as_path(),
+                    )
+            {
+                return Err(Failure(
+                    "fresh-home plans must be written directly inside the prepared authority directory",
+                ));
+            }
+            let digest = plan::write_plan(plan_file, &selected)?;
+            super::print_json(&json!({ "action": "plan", "planFile": plan_file, "planSha256": digest, "authorityPath": selected.home.join("development-credentials"), "sources": selected.sources, "metadataOnly": true, "sourceUnchanged": true })).map_err(|_| Failure("development plan report could not be written"))?;
+        }
+        DevelopmentCredentialsAction::Rewrap {
+            plan_file,
+            expected_plan_sha256,
+            apply,
+        } => {
+            if !apply {
+                return Err(Failure(
+                    "rewrap requires explicit --apply and the reviewed plan digest",
+                ));
+            }
+            let selected = plan::read_plan(plan_file, expected_plan_sha256)?;
+            let (copied, reused) = dev_credentials_apply::apply(&selected, &OsCredentialStore)?;
+            super::print_json(&json!({ "action": "rewrap", "authorityPath": selected.home.join("development-credentials"), "active": true, "copied": copied, "reused": reused, "sourceEntriesRetained": true, "credentialsReissued": false, "enrollmentsChanged": false })).map_err(|_| Failure("development custody report could not be written"))?;
+        }
+    }
+    Ok(())
+}
+
+fn status(
+    home: &colossus_home::ConfinedRoot,
+    workspace: &Path,
+    activated_by_this_command: bool,
+) -> Result<()> {
+    let path = DevelopmentAuthority::path_for_home(home);
+    let metadata = DevelopmentAuthority::metadata(home, &path, &[workspace.to_owned()])
+        .map_err(|_| Failure("development authority marker is unavailable or invalid"))?;
+    super::print_json(&json!({ "authorityPath": path, "active": metadata.active, "activatedByThisCommand": activated_by_this_command, "sourceUnchanged": true })).map_err(|_| Failure("development authority status could not be written"))
+}
diff --git a/crates/colossus-cli/src/dev_credentials_apply.rs b/crates/colossus-cli/src/dev_credentials_apply.rs
new file mode 100644
index 000000000..7cc88b9bd
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials_apply.rs
@@ -0,0 +1,478 @@
+use super::{
+    dev_credentials_lease::OfflineFileLease,
+    dev_credentials_plan::{self as plan, Failure, Plan, Result, Source},
+    dev_credentials_sources,
+    public_api_admin::{self, SecretStore},
+};
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use colossus_credentials::{
+    DevelopmentAuthority, DevelopmentStoreScope, PlatformCredentialVault, development_journal_key,
+    headless_credential_account, seal_existing, seal_existing_record,
+};
+use colossus_home::ConfinedRoot;
+use std::path::Path;
+use zeroize::Zeroizing;
+
+struct Material {
+    service: String,
+    account: String,
+    journal: bool,
+    kind: MaterialKind,
+}
+#[derive(Clone, Copy, Eq, PartialEq)]
+enum MaterialKind {
+    Seed,
+    Bearer,
+    Anchor,
+}
+
+/// Translate reviewed existing selectors into core seal operations. No runtime,
+/// enrollment, provider creation, source write/delete or credential issuance occurs.
+pub(super) fn apply(plan: &Plan, source_keys: &dyn SecretStore) -> Result<(usize, usize)> {
+    apply_with_vault_keys(
+        plan,
+        source_keys,
+        std::sync::Arc::new(colossus_credentials::SystemKeyStore),
+    )
+}
+
+pub(super) fn apply_with_vault_keys(
+    plan: &Plan,
+    source_keys: &dyn SecretStore,
+    vault_keys: std::sync::Arc<dyn colossus_credentials::PlatformKeyStore>,
+) -> Result<(usize, usize)> {
+    let authority_root = plan::existing_root(&plan.home.join("development-credentials"))?;
+    let operation = authority_root
+        .open_file(Path::new("offline-rewrap.lock"))
+        .map_err(|_| Failure("development rewrap lease is unavailable"))?;
+    let operation_lease = OfflineFileLease::acquire(
+        operation,
+        "development rewrap lease failed",
+        "another offline development rewrap is active",
+    )?;
+    if dev_credentials_sources::rebuild(plan)? != *plan {
+        return Err(Failure("existing sources changed since the reviewed plan"));
+    }
+    let home = plan::existing_root(&plan.home)?;
+    let authority = DevelopmentAuthority::open(
+        &home,
+        &DevelopmentAuthority::path_for_home(&home),
+        std::slice::from_ref(&plan.workspace),
+    )
+    .map_err(|_| Failure("prepared development authority is unavailable"))?;
+    let _source_leases = source_leases(plan)?;
+    if plan
+        .sources
+        .iter()
+        .any(|source| matches!(source, Source::ConnectorEnrollment { .. }))
+    {
+        plan::record_copy_plan(plan)?;
+    }
+    let materials = materials(plan)?;
+    // Read every small platform source before the first target write. Missing or
+    // malformed values do not become permission to generate a new authority.
+    let mut originals = Vec::with_capacity(materials.len());
+    for material in &materials {
+        let original = source_keys
+            .read(&material.service, &material.account)
+            .map_err(|_| Failure("an existing platform source is unavailable"))?
+            .ok_or(Failure(
+                "an existing platform source is missing; no replacement was generated",
+            ))?;
+        validate_material(&material.kind, &original)?;
+        originals.push(original);
+    }
+    let mut copied = 0;
+    let mut reused = 0;
+    let mut held_vaults = Vec::new();
+    let mut source_guards = Vec::new();
+    for source in &plan.sources {
+        if let Source::ConnectorEnrollment {
+            source_home,
+            name,
+            metadata,
+        } = source
+        {
+            let root = plan::existing_root(&source_home.join("cloud-connector"))?;
+            let original = PlatformCredentialVault::with_key_store(
+                root,
+                "cloud-connector",
+                std::sync::Arc::clone(&vault_keys),
+            )
+            .map_err(|_| Failure("selected source enrollment vault could not be bound"))?;
+            source_guards.push(original.source_guard().map_err(|_| {
+                Failure("selected source enrollment custody could not be retained")
+            })?);
+            let target_directory = home
+                .prepare_directory(Path::new("cloud-connector"))
+                .map_err(|_| Failure("isolated connector target could not be prepared"))?;
+            let target_root = plan::existing_root(&target_directory)?;
+            let target_keys = authority
+                .store(DevelopmentStoreScope::ControlPlaneVault)
+                .map_err(|_| Failure("isolated connector key custody is unavailable"))?;
+            let target = PlatformCredentialVault::with_key_store(
+                target_root,
+                "cloud-connector",
+                std::sync::Arc::new(target_keys),
+            )
+            .map_err(|_| Failure("isolated connector vault could not be bound"))?;
+            let key = colossus_connector::EnrollmentStore::credential_key(name)
+                .map_err(|_| Failure("named enrollment selector is invalid"))?;
+            let created = original
+                .copy_existing_record(&target, &key, metadata)
+                .map_err(|_| Failure("exact source enrollment could not be copied and verified"))?;
+            if created {
+                copied += 1;
+            } else {
+                reused += 1;
+            }
+            held_vaults.push(original);
+            held_vaults.push(target);
+        }
+    }
+    for source in &plan.sources {
+        let (path, owner, scope, metadata) = match source {
+            Source::DesktopVault { metadata } => (
+                plan.home.join("desktop"),
+                "desktop-manual",
+                DevelopmentStoreScope::DesktopVault,
+                metadata,
+            ),
+            Source::ControlPlaneVault { metadata } => (
+                plan.home.join("cloud-connector"),
+                "cloud-connector",
+                DevelopmentStoreScope::ControlPlaneVault,
+                metadata,
+            ),
+            Source::RuntimeOAuth {
+                directory,
+                owner_scope,
+                metadata,
+                ..
+            } => (
+                directory.clone(),
+                owner_scope.as_str(),
+                DevelopmentStoreScope::RuntimeOAuthVault,
+                metadata,
+            ),
+            _ => continue,
+        };
+        let root = plan::existing_root(&path)?;
+        let vault = PlatformCredentialVault::with_key_store(
+            root,
+            owner,
+            std::sync::Arc::clone(&vault_keys),
+        )
+        .map_err(|_| Failure("existing vault could not be bound"))?;
+        source_guards.push(
+            vault
+                .source_guard()
+                .map_err(|_| Failure("existing vault source custody could not be retained"))?,
+        );
+        let target = authority
+            .store(scope)
+            .map_err(|_| Failure("prepared sealed target is unavailable"))?;
+        let created = vault.rewrap_key(&target, metadata).map_err(|_| {
+            Failure("existing vault identity or verified key could not be preserved")
+        })?;
+        if created {
+            copied += 1;
+        } else {
+            reused += 1;
+        }
+        held_vaults.push(vault);
+    }
+    let public_api = authority
+        .store(DevelopmentStoreScope::PublicApi)
+        .map_err(|_| Failure("prepared public API target is unavailable"))?;
+    let journal = materials
+        .iter()
+        .any(|material| material.journal)
+        .then(|| authority.journal_vault())
+        .transpose()
+        .map_err(|_| Failure("prepared encrypted journal custody is unavailable"))?;
+    for (material, original) in materials.iter().zip(&originals) {
+        let created = if material.journal {
+            let key = development_journal_key(&material.service, &material.account)
+                .map_err(|_| Failure("journal custody reference is invalid"))?;
+            let vault = journal
+                .as_ref()
+                .ok_or(Failure("journal custody is unavailable"))?;
+            seal_existing_record(vault.as_ref(), &key, original)
+                .map_err(|_| Failure("original journal custody could not be sealed and verified"))?
+        } else {
+            seal_existing(
+                &public_api,
+                &headless_credential_account(&material.service, &material.account),
+                original,
+            )
+            .map_err(|_| Failure("original application custody could not be sealed and verified"))?
+        };
+        if created {
+            copied += 1;
+        } else {
+            reused += 1;
+        }
+    }
+    // Revalidate frozen journal/config fingerprints after all copies and before
+    // activation. Vault source leases remain held until this function returns.
+    for source in &plan.sources {
+        match source {
+            Source::Journal {
+                journal,
+                journal_sha256,
+                config,
+                config_sha256,
+                ..
+            }
+            | Source::PlaintextJournal {
+                journal,
+                journal_sha256,
+                config,
+                config_sha256,
+            } => {
+                if plan::file_digest(journal)? != *journal_sha256
+                    || plan::sha256(&plan::read_private(config, 1024 * 1024)?.1) != *config_sha256
+                {
+                    return Err(Failure("journal source changed during offline rewrap"));
+                }
+            }
+            Source::Client {
+                config,
+                config_sha256,
+                ..
+            } => {
+                if plan::sha256(&plan::read_private(config, 16 * 1024)?.1) != *config_sha256 {
+                    return Err(Failure("client source changed during offline rewrap"));
+                }
+            }
+            Source::PublicApi {
+                directory,
+                certificate_file_sha256: Some(expected),
+                ..
+            } if plan::sha256(
+                &plan::read_private(&directory.join("certificate.pem"), 16 * 1024)?.1,
+            ) != *expected =>
+            {
+                return Err(Failure("public API source changed during offline rewrap"));
+            }
+            _ => {}
+        }
+    }
+    for (root, file) in &_source_leases {
+        file.file()
+            .revalidate(root)
+            .map_err(|_| Failure("source identity changed during offline rewrap"))?;
+    }
+    if plan.fresh_empty {
+        dev_credentials_sources::validate_fresh_home(&plan.home)?;
+    }
+    for guard in &source_guards {
+        guard
+            .revalidate()
+            .map_err(|_| Failure("vault source changed before offline activation"))?;
+    }
+    authority
+        .activate(&home)
+        .map_err(|_| Failure("verified development custody could not be activated"))?;
+    operation_lease
+        .file()
+        .revalidate(&authority_root)
+        .map_err(|_| Failure("development rewrap identity changed"))?;
+    drop(held_vaults);
+    Ok((copied, reused))
+}
+
+fn source_leases(plan: &Plan) -> Result<Vec<(ConfinedRoot, OfflineFileLease)>> {
+    let mut guards = Vec::new();
+    let mut directories = std::collections::BTreeSet::new();
+    for source in &plan.sources {
+        match source {
+            Source::PublicApi { directory, .. } => {
+                directories.insert(directory.clone());
+            }
+            Source::Client { config, .. } => {
+                #[derive(serde::Deserialize)]
+                struct DescriptorReference {
+                    descriptor: std::path::PathBuf,
+                }
+                let (_, bytes) = plan::read_private(config, 16 * 1024)?;
+                let reference: DescriptorReference = serde_json::from_slice(&bytes)
+                    .map_err(|_| Failure("client source reference changed"))?;
+                directories.insert(
+                    reference
+                        .descriptor
+                        .parent()
+                        .ok_or(Failure("client API source root is invalid"))?
+                        .to_owned(),
+                );
+            }
+            Source::Journal {
+                journal,
+                journal_sha256,
+                ..
+            }
+            | Source::PlaintextJournal {
+                journal,
+                journal_sha256,
+                ..
+            } => {
+                let (root, file) = plan::existing_file(journal)?;
+                let file = OfflineFileLease::acquire(
+                    file,
+                    "journal source lease failed",
+                    "stop the source journal writer before rewrapping custody",
+                )?;
+                if plan::file_digest(journal)? != *journal_sha256 {
+                    return Err(Failure("journal source changed before its offline lease"));
+                }
+                file.file()
+                    .revalidate(&root)
+                    .map_err(|_| Failure("journal source identity changed"))?;
+                guards.push((root, file));
+            }
+            _ => {}
+        }
+    }
+    for directory in directories {
+        let root = plan::existing_root(&directory)?;
+        let file = root
+            .open_existing_file_read_write(Path::new(".public-api.lock"))
+            .map_err(|_| Failure("existing public API source lease is unavailable"))?;
+        let file = OfflineFileLease::acquire(
+            file,
+            "public API source lease failed",
+            "stop the source public API before rewrapping custody",
+        )?;
+        file.file()
+            .revalidate(&root)
+            .map_err(|_| Failure("public API source identity changed"))?;
+        guards.push((root, file));
+    }
+    Ok(guards)
+}
+
+fn materials(plan: &Plan) -> Result<Vec<Material>> {
+    let mut materials = Vec::new();
+    let mut references = std::collections::BTreeMap::new();
+    for source in &plan.sources {
+        let mut add =
+            |service: &str, account: String, journal: bool, kind: MaterialKind| -> Result<()> {
+                let reference = (service.to_owned(), account.clone());
+                if let Some(previous) = references.get(&reference) {
+                    if *previous != (journal, kind) {
+                        return Err(Failure(
+                            "source selectors disagree about the same credential material",
+                        ));
+                    }
+                } else {
+                    references.insert(reference, (journal, kind));
+                    materials.push(Material {
+                        service: service.to_owned(),
+                        account,
+                        journal,
+                        kind,
+                    });
+                }
+                Ok(())
+            };
+        match source {
+            Source::PublicApi { service, .. } => {
+                for account in [
+                    public_api_admin::AUTHENTICATION_ROOT_ACCOUNT,
+                    public_api_admin::TLS_SEED_ACCOUNT,
+                    public_api_admin::INSTANCE_SEED_ACCOUNT,
+                ] {
+                    add(service, account.into(), false, MaterialKind::Seed)?;
+                }
+            }
+            Source::Client {
+                service, account, ..
+            } => add(service, account.clone(), false, MaterialKind::Bearer)?,
+            Source::Journal {
+                service,
+                encryption_key_ids,
+                signing_key_ids,
+                anchor_key_id,
+                ..
+            } => {
+                for id in encryption_key_ids {
+                    add(
+                        service,
+                        format!("journal-key:{id}"),
+                        true,
+                        MaterialKind::Seed,
+                    )?;
+                }
+                for id in signing_key_ids {
+                    add(
+                        service,
+                        format!("signing-key:{id}"),
+                        true,
+                        MaterialKind::Seed,
+                    )?;
+                }
+                add(
+                    service,
+                    format!("journal-anchor:{anchor_key_id}"),
+                    true,
+                    MaterialKind::Anchor,
+                )?;
+            }
+            _ => {}
+        }
+    }
+    if materials.len() > 1024 {
+        return Err(Failure("source material selection exceeds its bound"));
+    }
+    Ok(materials)
+}
+
+fn validate_material(kind: &MaterialKind, bytes: &[u8]) -> Result<()> {
+    match kind {
+        MaterialKind::Seed if bytes.len() == 32 => Ok(()),
+        MaterialKind::Bearer => {
+            if bytes.len() > 256 {
+                return Err(Failure(
+                    "existing application bearer exceeds its supported bound",
+                ));
+            }
+            let token = std::str::from_utf8(bytes)
+                .map_err(|_| Failure("existing application bearer is invalid"))?;
+            let mut parts = token.split('.');
+            if parts.next() != Some("cls_v1") {
+                return Err(Failure(
+                    "source reference is not an existing Colossus application bearer",
+                ));
+            }
+            uuid::Uuid::parse_str(
+                parts
+                    .next()
+                    .ok_or(Failure("existing application bearer is invalid"))?,
+            )
+            .map_err(|_| Failure("existing application bearer is invalid"))?;
+            let mut decoded = Zeroizing::new([0_u8; 32]);
+            let encoded = parts
+                .next()
+                .ok_or(Failure("existing application bearer is invalid"))?;
+            if parts.next().is_some()
+                || URL_SAFE_NO_PAD
+                    .decode_slice(encoded, decoded.as_mut())
+                    .map_err(|_| Failure("existing application bearer is invalid"))?
+                    != 32
+            {
+                return Err(Failure("existing application bearer is invalid"));
+            }
+            Ok(())
+        }
+        MaterialKind::Anchor => colossus_journal_redb::decode_secure_anchor(bytes)
+            .map(|_| ())
+            .map_err(|_| Failure("existing journal anchor is malformed or exceeds its bound")),
+        _ => Err(Failure("existing platform seed has an invalid size")),
+    }
+}
+
+#[cfg(test)]
+pub(super) fn validate_test_bearer(bytes: &[u8]) -> Result<()> {
+    validate_material(&MaterialKind::Bearer, bytes)
+}
diff --git a/crates/colossus-cli/src/dev_credentials_args.rs b/crates/colossus-cli/src/dev_credentials_args.rs
new file mode 100644
index 000000000..1a7aa1853
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials_args.rs
@@ -0,0 +1,83 @@
+use clap::{Args, Subcommand};
+use std::path::PathBuf;
+
+/// Explicit offline development custody. No secret is accepted through arguments.
+#[derive(Args)]
+pub(super) struct DevelopmentCredentialsCommand {
+    #[command(subcommand)]
+    pub(super) command: DevelopmentCredentialsAction,
+}
+
+#[derive(Subcommand)]
+pub(super) enum DevelopmentCredentialsAction {
+    /// Prepare an inactive private development authority without reading OS credentials.
+    Init {
+        /// Exact absolute Colossus home; the existing platform custody remains unchanged.
+        #[arg(long, value_name = "DIRECTORY")]
+        home: PathBuf,
+        /// Exact workspace constraint; custody must remain outside this directory.
+        #[arg(long, value_name = "DIRECTORY")]
+        workspace: PathBuf,
+    },
+    /// Inspect only the prepared authority's nonsecret marker, without reading a key.
+    Status {
+        #[arg(long, value_name = "DIRECTORY")]
+        home: PathBuf,
+        #[arg(long, value_name = "DIRECTORY")]
+        workspace: PathBuf,
+    },
+    /// Write a bounded metadata-only plan for explicitly selected existing sources.
+    Plan {
+        #[command(flatten)]
+        sources: DevelopmentCredentialSources,
+        /// New owner-private plan file; an existing file is never replaced.
+        #[arg(long, value_name = "FILE")]
+        plan_file: PathBuf,
+    },
+    /// Seal and verify the exact reviewed plan while retaining all original OS entries.
+    Rewrap {
+        /// Existing owner-private metadata-only plan from the plan command.
+        #[arg(long, value_name = "FILE")]
+        plan_file: PathBuf,
+        /// Exact SHA-256 reported by plan; no different source selection is accepted.
+        #[arg(long, value_name = "SHA256")]
+        expected_plan_sha256: String,
+        /// Explicitly apply the reviewed offline custody change and activate its authority.
+        #[arg(long, required = true)]
+        apply: bool,
+    },
+}
+
+#[derive(Args)]
+pub(super) struct DevelopmentCredentialSources {
+    /// Exact absolute home containing the prepared development authority.
+    #[arg(long, value_name = "DIRECTORY")]
+    pub(super) home: PathBuf,
+    /// Preserve the existing desktop-manual vault master-envelope identity.
+    #[arg(long)]
+    pub(super) desktop_vault: bool,
+    /// Preserve the existing standalone Control Plane connector vault identity.
+    #[arg(long, conflicts_with_all = ["connector_source_home", "connector_enrollment"])]
+    pub(super) control_plane_vault: bool,
+    /// Exact original home for one retained connector enrollment, copied without exporting its master.
+    #[arg(long, value_name = "DIRECTORY", requires = "connector_enrollment")]
+    pub(super) connector_source_home: Option<PathBuf>,
+    /// Exact enrollment name copied into this new isolated home; all source records stay unchanged.
+    #[arg(long, value_name = "NAME", requires = "connector_source_home")]
+    pub(super) connector_enrollment: Option<String>,
+    /// Exact existing owner-private public API directory; selects its three known seed accounts.
+    #[arg(long = "public-api-directory", value_name = "DIRECTORY")]
+    pub(super) public_api_directories: Vec<PathBuf>,
+    /// Existing protected local connector configuration; selects only its exact bound application credential.
+    #[arg(long = "client-config", value_name = "FILE")]
+    pub(super) client_configs: Vec<PathBuf>,
+    /// Existing protected runtime configuration; selects its configured journal encryption/signing/anchor custody.
+    #[arg(long = "journal-config", value_name = "FILE")]
+    pub(super) journal_configs: Vec<PathBuf>,
+    /// Existing runtime storage identity; preserves its exact runtime-owned OAuth vault.
+    #[arg(long = "runtime-oauth-storage", value_name = "PATH")]
+    pub(super) runtime_oauth_storage: Vec<PathBuf>,
+    /// Explicit fresh-home activation plan; refuses any existing source/runtime state.
+    #[arg(long, conflicts_with_all = ["desktop_vault", "control_plane_vault", "public_api_directories", "client_configs", "journal_configs", "runtime_oauth_storage", "connector_source_home", "connector_enrollment"])]
+    pub(super) fresh_empty: bool,
+}
diff --git a/crates/colossus-cli/src/dev_credentials_lease.rs b/crates/colossus-cli/src/dev_credentials_lease.rs
new file mode 100644
index 000000000..bd23cfff7
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials_lease.rs
@@ -0,0 +1,36 @@
+use super::dev_credentials_plan::{Failure, Result};
+use colossus_home::ConfinedFile;
+use fs4::fs_std::FileExt;
+
+// A fork can inherit the same open-file description until exec. Closing only
+// our descriptor can therefore extend an offline custody operation's lock.
+// Construct this guard only after acquisition succeeds: a failed attempt must
+// never unlock the genuinely active owner.
+pub(super) struct OfflineFileLease(ConfinedFile);
+
+impl OfflineFileLease {
+    pub(super) fn acquire(
+        file: ConfinedFile,
+        failed: &'static str,
+        busy: &'static str,
+    ) -> Result<Self> {
+        if !FileExt::try_lock_exclusive(file.file()).map_err(|_| Failure(failed))? {
+            return Err(Failure(busy));
+        }
+        Ok(Self(file))
+    }
+
+    pub(super) fn file(&self) -> &ConfinedFile {
+        &self.0
+    }
+}
+
+impl Drop for OfflineFileLease {
+    fn drop(&mut self) {
+        let _ = FileExt::unlock(self.0.file());
+    }
+}
+
+#[cfg(all(test, unix))]
+#[path = "dev_credentials_lease_tests.rs"]
+mod tests;
diff --git a/crates/colossus-cli/src/dev_credentials_lease_tests.rs b/crates/colossus-cli/src/dev_credentials_lease_tests.rs
new file mode 100644
index 000000000..00f243cd2
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials_lease_tests.rs
@@ -0,0 +1,81 @@
+use super::*;
+use colossus_home::ConfinedRoot;
+use std::{fs::File, os::unix::fs::PermissionsExt, path::Path};
+
+fn private_root() -> (tempfile::TempDir, ConfinedRoot) {
+    let directory = tempfile::tempdir().unwrap();
+    let path = std::fs::canonicalize(directory.path()).unwrap();
+    std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o700)).unwrap();
+    let root = ConfinedRoot::bind(path).unwrap();
+    (directory, root)
+}
+
+fn open(root: &ConfinedRoot, name: &str) -> ConfinedFile {
+    root.open_file(Path::new(name)).unwrap()
+}
+
+#[test]
+fn completed_source_lease_releases_owned_lock_despite_duplicate_descriptor() {
+    let (_directory, root) = private_root();
+    let raw = open(&root, ".public-api.lock");
+    assert!(FileExt::try_lock_exclusive(raw.file()).unwrap());
+    let inherited = raw.file().try_clone().unwrap();
+    drop(raw);
+    let competing = open(&root, ".public-api.lock");
+    assert!(
+        !FileExt::try_lock_exclusive(competing.file()).unwrap(),
+        "a retained duplicate deterministically reproduces raw-close Busy"
+    );
+    FileExt::unlock(&inherited).unwrap();
+    let lease = OfflineFileLease::acquire(competing, "failed", "busy").unwrap();
+    let _inherited = lease.file().file().try_clone().unwrap();
+    drop(lease);
+    let next = OfflineFileLease::acquire(open(&root, ".public-api.lock"), "failed", "busy");
+    assert!(next.is_ok(), "completion releases the logical operation");
+}
+
+#[test]
+fn refused_acquisition_does_not_unlock_competing_owner() {
+    let (_directory, root) = private_root();
+    let owner = OfflineFileLease::acquire(open(&root, "journal.lock"), "failed", "busy").unwrap();
+    let _inherited = owner.file().file().try_clone().unwrap();
+    for _ in 0..2 {
+        let refused = OfflineFileLease::acquire(open(&root, "journal.lock"), "failed", "busy");
+        assert!(matches!(refused, Err(Failure("busy"))));
+    }
+    drop(owner);
+    assert!(OfflineFileLease::acquire(open(&root, "journal.lock"), "failed", "busy").is_ok());
+}
+
+#[test]
+fn partial_acquisition_and_metadata_errors_release_each_successful_source() {
+    let (_directory, root) = private_root();
+    let owner =
+        OfflineFileLease::acquire(open(&root, "active-api.lock"), "failed", "busy").unwrap();
+    let mut inherited: Vec<File> = Vec::new();
+    let partial = (|| -> Result<()> {
+        let journal = OfflineFileLease::acquire(open(&root, "journal.lock"), "failed", "busy")?;
+        inherited.push(journal.file().file().try_clone().unwrap());
+        // The earlier source must be released even though acquiring a later
+        // public API source fails and a fork still holds its duplicate.
+        let _api = OfflineFileLease::acquire(open(&root, "active-api.lock"), "failed", "busy")?;
+        Ok(())
+    })();
+    assert!(matches!(partial, Err(Failure("busy"))));
+    assert!(OfflineFileLease::acquire(open(&root, "journal.lock"), "failed", "busy").is_ok());
+    assert!(matches!(
+        OfflineFileLease::acquire(open(&root, "active-api.lock"), "failed", "busy"),
+        Err(Failure("busy"))
+    ));
+    let failed_metadata = (|| -> Result<()> {
+        let api = OfflineFileLease::acquire(open(&root, "metadata-api.lock"), "failed", "busy")?;
+        inherited.push(api.file().file().try_clone().unwrap());
+        Err(Failure("invalid source metadata"))
+    })();
+    assert!(matches!(
+        failed_metadata,
+        Err(Failure("invalid source metadata"))
+    ));
+    assert!(OfflineFileLease::acquire(open(&root, "metadata-api.lock"), "failed", "busy").is_ok());
+    drop(owner);
+}
diff --git a/crates/colossus-cli/src/dev_credentials_plan.rs b/crates/colossus-cli/src/dev_credentials_plan.rs
new file mode 100644
index 000000000..48e041129
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials_plan.rs
@@ -0,0 +1,284 @@
+use colossus_credentials::{VaultKeyMetadata, VaultRecordMetadata};
+use colossus_home::{ConfinedFile, ConfinedRoot};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest as _, Sha256};
+use std::{
+    io::{Read as _, Write as _},
+    path::{Component, Path, PathBuf},
+};
+use zeroize::Zeroizing;
+
+pub(super) type Result<T> = std::result::Result<T, Failure>;
+
+#[derive(Debug)]
+pub(super) struct Failure(pub(super) &'static str);
+impl std::fmt::Display for Failure {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(self.0)
+    }
+}
+impl std::error::Error for Failure {}
+
+/// Metadata only. No field can represent an envelope, bearer, seed, or key value.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Plan {
+    pub(super) schema_version: u16,
+    pub(super) home: PathBuf,
+    pub(super) workspace: PathBuf,
+    pub(super) fresh_empty: bool,
+    pub(super) sources: Vec<Source>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub(super) enum Source {
+    DesktopVault {
+        metadata: VaultKeyMetadata,
+    },
+    ControlPlaneVault {
+        metadata: VaultKeyMetadata,
+    },
+    ConnectorEnrollment {
+        source_home: PathBuf,
+        name: String,
+        metadata: VaultRecordMetadata,
+    },
+    RuntimeOAuth {
+        storage: PathBuf,
+        directory: PathBuf,
+        owner_scope: String,
+        metadata: VaultKeyMetadata,
+    },
+    PublicApi {
+        directory: PathBuf,
+        certificate_file_sha256: Option<String>,
+        service: String,
+    },
+    Client {
+        config: PathBuf,
+        config_sha256: String,
+        service: String,
+        account: String,
+        instance_id: String,
+        certificate_sha256: String,
+    },
+    Journal {
+        config: PathBuf,
+        config_sha256: String,
+        journal: PathBuf,
+        journal_sha256: String,
+        service: String,
+        encryption_key_ids: Vec<String>,
+        signing_key_ids: Vec<String>,
+        anchor_key_id: String,
+    },
+    PlaintextJournal {
+        config: PathBuf,
+        config_sha256: String,
+        journal: PathBuf,
+        journal_sha256: String,
+    },
+}
+
+pub(super) fn sha256(bytes: &[u8]) -> String {
+    hex::encode(Sha256::digest(bytes))
+}
+
+pub(super) fn plan_digest(plan: &Plan) -> Result<String> {
+    Ok(sha256(&serde_json::to_vec(plan).map_err(|_| {
+        Failure("development plan serialization failed")
+    })?))
+}
+
+pub(super) fn clean_absolute(path: &Path) -> Result<()> {
+    if !path.is_absolute()
+        || path
+            .components()
+            .any(|component| matches!(component, Component::CurDir | Component::ParentDir))
+    {
+        return Err(Failure(
+            "development credential paths must be clean absolute paths",
+        ));
+    }
+    Ok(())
+}
+
+pub(super) fn existing_root(path: &Path) -> Result<ConfinedRoot> {
+    clean_absolute(path)?;
+    let metadata = std::fs::symlink_metadata(path)
+        .map_err(|_| Failure("existing private source directory is unavailable"))?;
+    if !metadata.is_dir() || metadata.file_type().is_symlink() {
+        return Err(Failure("existing private source directory is invalid"));
+    }
+    ConfinedRoot::bind(path).map_err(|_| Failure("existing private source directory is unsafe"))
+}
+
+pub(super) fn existing_file(path: &Path) -> Result<(ConfinedRoot, ConfinedFile)> {
+    clean_absolute(path)?;
+    let root = existing_root(
+        path.parent()
+            .ok_or(Failure("private file parent is invalid"))?,
+    )?;
+    let file = root
+        .open_existing_file(Path::new(
+            path.file_name()
+                .ok_or(Failure("private file name is invalid"))?,
+        ))
+        .map_err(|_| Failure("existing private file is unavailable or unsafe"))?;
+    Ok((root, file))
+}
+
+pub(super) fn read_private(path: &Path, limit: u64) -> Result<(PathBuf, Zeroizing<Vec<u8>>)> {
+    let (root, file) = existing_file(path)?;
+    let mut bytes = Zeroizing::new(Vec::new());
+    file.file()
+        .take(limit + 1)
+        .read_to_end(&mut bytes)
+        .map_err(|_| Failure("private source could not be read"))?;
+    if bytes.len() as u64 > limit {
+        return Err(Failure("private source exceeds its bound"));
+    }
+    file.revalidate(&root)
+        .map_err(|_| Failure("private source identity changed"))?;
+    Ok((file.path().to_owned(), bytes))
+}
+
+pub(super) fn file_digest(path: &Path) -> Result<String> {
+    let (root, file) = existing_file(path)?;
+    if file
+        .file()
+        .metadata()
+        .map_err(|_| Failure("source metadata is unavailable"))?
+        .len()
+        > 8 * 1024 * 1024 * 1024
+    {
+        return Err(Failure("source journal exceeds offline planning bounds"));
+    }
+    let mut hash = Sha256::new();
+    let mut reader = file.file();
+    let mut buffer = [0_u8; 16 * 1024];
+    let mut total = 0_u64;
+    loop {
+        let count = reader
+            .read(&mut buffer)
+            .map_err(|_| Failure("source journal could not be fingerprinted"))?;
+        if count == 0 {
+            break;
+        }
+        total += count as u64;
+        if total > 8 * 1024 * 1024 * 1024 {
+            return Err(Failure("source journal exceeds offline planning bounds"));
+        }
+        hash.update(&buffer[..count]);
+    }
+    file.revalidate(&root)
+        .map_err(|_| Failure("source journal identity changed"))?;
+    Ok(hex::encode(hash.finalize()))
+}
+
+pub(super) fn write_plan(path: &Path, plan: &Plan) -> Result<String> {
+    clean_absolute(path)?;
+    let bytes = serde_json::to_vec_pretty(plan)
+        .map_err(|_| Failure("development plan serialization failed"))?;
+    if bytes.len() > 64 * 1024 {
+        return Err(Failure("development plan exceeds its bound"));
+    }
+    let root = existing_root(
+        path.parent()
+            .ok_or(Failure("private plan parent is invalid"))?,
+    )?;
+    let leaf = Path::new(
+        path.file_name()
+            .ok_or(Failure("private plan name is invalid"))?,
+    );
+    let file = root
+        .open_file(leaf)
+        .map_err(|_| Failure("private plan file is unavailable"))?;
+    if !file.was_created() {
+        return Err(Failure("an existing development plan is never replaced"));
+    }
+    file.file()
+        .write_all(&bytes)
+        .map_err(|_| Failure("development plan could not be written"))?;
+    file.file()
+        .sync_all()
+        .map_err(|_| Failure("development plan could not be synchronized"))?;
+    file.revalidate(&root)
+        .map_err(|_| Failure("development plan identity changed"))?;
+    root.sync_directory()
+        .map_err(|_| Failure("development plan directory could not be synchronized"))?;
+    plan_digest(plan)
+}
+
+pub(super) fn read_plan(path: &Path, expected: &str) -> Result<Plan> {
+    if expected.len() != 64
+        || !expected
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+    {
+        return Err(Failure(
+            "an exact lowercase SHA-256 plan digest is required",
+        ));
+    }
+    let (_, bytes) = read_private(path, 64 * 1024)?;
+    let plan: Plan = serde_json::from_slice(&bytes)
+        .map_err(|_| Failure("development plan is malformed or has unknown fields"))?;
+    if plan.schema_version != 1 || plan.sources.len() > 64 || plan_digest(&plan)? != expected {
+        return Err(Failure(
+            "development plan does not match the reviewed digest",
+        ));
+    }
+    Ok(plan)
+}
+
+const COPY_RECEIPT: &str = "offline-copy-plan.json";
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CopyReceipt {
+    schema_version: u16,
+    plan_sha256: String,
+}
+
+pub(super) fn copy_receipt_matches(plan: &Plan) -> Result<bool> {
+    let path = plan.home.join("development-credentials").join(COPY_RECEIPT);
+    match std::fs::symlink_metadata(&path) {
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(false),
+        Err(_) => return Err(Failure("offline copy receipt is unavailable")),
+        Ok(_) => {}
+    }
+    let (_, bytes) = read_private(&path, 1024)?;
+    let receipt: CopyReceipt =
+        serde_json::from_slice(&bytes).map_err(|_| Failure("offline copy receipt is invalid"))?;
+    Ok(receipt.schema_version == 1 && receipt.plan_sha256 == plan_digest(plan)?)
+}
+
+pub(super) fn record_copy_plan(plan: &Plan) -> Result<()> {
+    if copy_receipt_matches(plan)? {
+        return Ok(());
+    }
+    let root = existing_root(&plan.home.join("development-credentials"))?;
+    let file = root
+        .open_file(Path::new(COPY_RECEIPT))
+        .map_err(|_| Failure("offline copy receipt could not be created"))?;
+    if !file.was_created() {
+        return Err(Failure(
+            "another reviewed copy plan already owns this target",
+        ));
+    }
+    let bytes = serde_json::to_vec(&CopyReceipt {
+        schema_version: 1,
+        plan_sha256: plan_digest(plan)?,
+    })
+    .map_err(|_| Failure("offline copy receipt could not be encoded"))?;
+    file.file()
+        .write_all(&bytes)
+        .map_err(|_| Failure("offline copy receipt could not be written"))?;
+    file.file()
+        .sync_all()
+        .map_err(|_| Failure("offline copy receipt could not be synchronized"))?;
+    file.revalidate(&root)
+        .map_err(|_| Failure("offline copy receipt identity changed"))?;
+    root.sync_directory()
+        .map_err(|_| Failure("offline copy receipt directory could not be synchronized"))
+}
diff --git a/crates/colossus-cli/src/dev_credentials_sources.rs b/crates/colossus-cli/src/dev_credentials_sources.rs
new file mode 100644
index 000000000..6b8d2869a
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials_sources.rs
@@ -0,0 +1,473 @@
+use super::{
+    dev_credentials_args::DevelopmentCredentialSources,
+    dev_credentials_lease::OfflineFileLease,
+    dev_credentials_plan::{self as plan, Failure, Plan, Result, Source},
+    public_api_admin,
+};
+use colossus_credentials::{DevelopmentAuthority, PlatformCredentialVault};
+use colossus_home::{ColossusHome, detect_workspace_identity};
+use colossus_runtime::{KeyConfig, RuntimeConfig, StorageAdapter, StorageLocation};
+use serde::Deserialize;
+use std::{
+    collections::BTreeSet,
+    path::{Path, PathBuf},
+};
+
+const MAX_SOURCES: usize = 64;
+
+pub(super) fn make_plan(args: &DevelopmentCredentialSources, workspace: &Path) -> Result<Plan> {
+    make_plan_inner(args, workspace, false)
+}
+
+fn make_plan_inner(
+    args: &DevelopmentCredentialSources,
+    workspace: &Path,
+    resume_copy: bool,
+) -> Result<Plan> {
+    if args.public_api_directories.len()
+        + args.client_configs.len()
+        + args.journal_configs.len()
+        + args.runtime_oauth_storage.len()
+        + usize::from(args.desktop_vault)
+        + usize::from(args.control_plane_vault)
+        + usize::from(args.connector_source_home.is_some())
+        > MAX_SOURCES
+    {
+        return Err(Failure("development source selection exceeds its bound"));
+    }
+    if !args.fresh_empty
+        && !args.desktop_vault
+        && !args.control_plane_vault
+        && args.public_api_directories.is_empty()
+        && args.client_configs.is_empty()
+        && args.journal_configs.is_empty()
+        && args.runtime_oauth_storage.is_empty()
+        && args.connector_source_home.is_none()
+    {
+        return Err(Failure(
+            "select exact existing sources or explicitly select a fresh empty home",
+        ));
+    }
+    let home_root = plan::existing_root(&args.home)?;
+    let home = ColossusHome::ensure_at(home_root.path())
+        .map_err(|_| Failure("development home is unsafe"))?;
+    let workspace = std::fs::canonicalize(workspace)
+        .map_err(|_| Failure("workspace constraint is unavailable"))?;
+    if !workspace.is_dir() {
+        return Err(Failure("workspace constraint must be a directory"));
+    }
+    let _metadata = DevelopmentAuthority::metadata(
+        home.confined_root(),
+        &DevelopmentAuthority::path_for_home(home.confined_root()),
+        std::slice::from_ref(&workspace),
+    )
+    .map_err(|_| Failure("prepared development authority is unavailable"))?;
+    if args.fresh_empty {
+        validate_fresh_home(home.root())?;
+    }
+    let mut sources = Vec::new();
+    if args.desktop_vault {
+        let root = plan::existing_root(&home.root().join("desktop"))?;
+        let metadata = PlatformCredentialVault::key_metadata(&root, "desktop-manual")
+            .map_err(|_| Failure("existing desktop vault metadata is unavailable or busy"))?
+            .ok_or(Failure("selected desktop vault does not exist"))?;
+        sources.push(Source::DesktopVault { metadata });
+    }
+    if args.control_plane_vault {
+        let root = plan::existing_root(&home.root().join("cloud-connector"))?;
+        let metadata = PlatformCredentialVault::key_metadata(&root, "cloud-connector")
+            .map_err(|_| Failure("existing connector vault metadata is unavailable or busy"))?
+            .ok_or(Failure("selected connector vault does not exist"))?;
+        sources.push(Source::ControlPlaneVault { metadata });
+    }
+    if let Some(source_home) = &args.connector_source_home {
+        let source = plan::existing_root(source_home)?;
+        let canonical_source = std::fs::canonicalize(source.path())
+            .map_err(|_| Failure("source home identity is unavailable"))?;
+        let canonical_target = std::fs::canonicalize(home.root())
+            .map_err(|_| Failure("target home identity is unavailable"))?;
+        source
+            .revalidate()
+            .map_err(|_| Failure("source home identity changed"))?;
+        home.confined_root()
+            .revalidate()
+            .map_err(|_| Failure("target home identity changed"))?;
+        if canonical_source == canonical_target
+            || canonical_source.starts_with(&canonical_target)
+            || canonical_target.starts_with(&canonical_source)
+        {
+            return Err(Failure(
+                "named enrollment copy requires separate non-overlapping source and target homes",
+            ));
+        }
+        let name = args
+            .connector_enrollment
+            .as_deref()
+            .ok_or(Failure("named enrollment selector is missing"))?;
+        let key = colossus_connector::EnrollmentStore::credential_key(name)
+            .map_err(|_| Failure("named enrollment selector is invalid"))?;
+        if !resume_copy
+            && home
+                .root()
+                .join("cloud-connector")
+                .try_exists()
+                .map_err(|_| Failure("isolated connector target cannot be inspected"))?
+        {
+            return Err(Failure(
+                "named enrollment copy requires a new isolated connector target",
+            ));
+        }
+        let source_vault = plan::existing_root(&source.path().join("cloud-connector"))?;
+        let metadata =
+            PlatformCredentialVault::record_metadata(&source_vault, "cloud-connector", &key)
+                .map_err(|_| {
+                    Failure("selected original enrollment metadata is unavailable or busy")
+                })?
+                .ok_or(Failure("the exact named source enrollment does not exist"))?;
+        sources.push(Source::ConnectorEnrollment {
+            source_home: source.path().to_owned(),
+            name: name.to_owned(),
+            metadata,
+        });
+    } else if args.connector_enrollment.is_some() {
+        return Err(Failure(
+            "named enrollment copy requires an explicit source home",
+        ));
+    }
+    for directory in &args.public_api_directories {
+        sources.push(public_api_source(directory)?);
+    }
+    for config in &args.client_configs {
+        sources.push(client_source(config)?);
+    }
+    for config in &args.journal_configs {
+        sources.push(journal_source(config, &home, &workspace)?);
+    }
+    for storage in &args.runtime_oauth_storage {
+        plan::clean_absolute(storage)?;
+        let binding = colossus_runtime::runtime_oauth_vault_binding(storage)
+            .map_err(|_| Failure("existing runtime OAuth binding is unavailable or unsafe"))?;
+        let root = plan::existing_root(&binding.directory)?;
+        let metadata = PlatformCredentialVault::key_metadata(&root, &binding.owner_scope)
+            .map_err(|_| Failure("existing runtime OAuth vault metadata is unavailable or busy"))?
+            .ok_or(Failure("selected runtime OAuth vault does not exist"))?;
+        sources.push(Source::RuntimeOAuth {
+            storage: storage.clone(),
+            directory: binding.directory,
+            owner_scope: binding.owner_scope,
+            metadata,
+        });
+    }
+    let mut identities = BTreeSet::new();
+    for source in &sources {
+        let identity = serde_json::to_string(source)
+            .map_err(|_| Failure("source metadata serialization failed"))?;
+        if !identities.insert(identity) {
+            return Err(Failure("duplicate development source selection is invalid"));
+        }
+    }
+    Ok(Plan {
+        schema_version: 1,
+        home: home.root().to_owned(),
+        workspace,
+        fresh_empty: args.fresh_empty,
+        sources,
+    })
+}
+
+pub(super) fn validate_fresh_home(home: &Path) -> Result<()> {
+    for entry in
+        std::fs::read_dir(home).map_err(|_| Failure("fresh home could not be inspected"))?
+    {
+        let entry = entry.map_err(|_| Failure("fresh home could not be inspected"))?;
+        if entry.file_name() != "development-credentials" {
+            return Err(Failure(
+                "fresh activation refuses existing home state; explicitly plan its rewrap",
+            ));
+        }
+    }
+    for scope in [
+        "desktop-vault",
+        "control-plane-vault",
+        "public-api",
+        "journal",
+        "runtime-oauth-vault",
+    ] {
+        let root = plan::existing_root(&home.join("development-credentials").join(scope))?;
+        if std::fs::read_dir(root.path())
+            .map_err(|_| Failure("prepared store could not be inspected"))?
+            .next()
+            .is_some()
+        {
+            return Err(Failure(
+                "fresh activation refuses existing or partial sealed custody",
+            ));
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn rebuild(plan: &Plan) -> Result<Plan> {
+    let mut args = DevelopmentCredentialSources {
+        home: plan.home.clone(),
+        desktop_vault: false,
+        control_plane_vault: false,
+        connector_source_home: None,
+        connector_enrollment: None,
+        public_api_directories: Vec::new(),
+        client_configs: Vec::new(),
+        journal_configs: Vec::new(),
+        runtime_oauth_storage: Vec::new(),
+        fresh_empty: plan.fresh_empty,
+    };
+    for source in &plan.sources {
+        match source {
+            Source::DesktopVault { .. } => args.desktop_vault = true,
+            Source::ControlPlaneVault { .. } => args.control_plane_vault = true,
+            Source::ConnectorEnrollment {
+                source_home, name, ..
+            } => {
+                if args.connector_source_home.is_some() {
+                    return Err(Failure("only one exact named enrollment may be copied"));
+                }
+                args.connector_source_home = Some(source_home.clone());
+                args.connector_enrollment = Some(name.clone());
+            }
+            Source::RuntimeOAuth { storage, .. } => {
+                args.runtime_oauth_storage.push(storage.clone())
+            }
+            Source::PublicApi { directory, .. } => {
+                args.public_api_directories.push(directory.clone())
+            }
+            Source::Client { config, .. } => args.client_configs.push(config.clone()),
+            Source::Journal { config, .. } => args.journal_configs.push(config.clone()),
+            Source::PlaintextJournal { config, .. } => args.journal_configs.push(config.clone()),
+        }
+    }
+    if args.fresh_empty
+        && (!args.public_api_directories.is_empty()
+            || !args.client_configs.is_empty()
+            || !args.journal_configs.is_empty()
+            || !args.runtime_oauth_storage.is_empty()
+            || args.desktop_vault
+            || args.control_plane_vault
+            || args.connector_source_home.is_some())
+    {
+        return Err(Failure(
+            "fresh activation cannot contain existing source selectors",
+        ));
+    }
+    if args.control_plane_vault && args.connector_source_home.is_some() {
+        return Err(Failure(
+            "whole-vault rewrap and named copy cannot share the same connector target",
+        ));
+    }
+    make_plan_inner(&args, &plan.workspace, plan::copy_receipt_matches(plan)?)
+}
+
+pub(super) fn public_api_source(directory: &Path) -> Result<Source> {
+    let root = plan::existing_root(directory)?;
+    let lock = root
+        .open_existing_file_read_write(Path::new(".public-api.lock"))
+        .map_err(|_| Failure("existing public API source lease is unavailable"))?;
+    let lock = OfflineFileLease::acquire(
+        lock,
+        "public API source lease failed",
+        "stop the source public API before planning or rewrapping its custody",
+    )?;
+    let certificate_file_sha256 =
+        match std::fs::symlink_metadata(root.path().join("certificate.pem")) {
+            Ok(_) => Some(plan::sha256(
+                &plan::read_private(&root.path().join("certificate.pem"), 16 * 1024)?.1,
+            )),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => None,
+            Err(_) => {
+                return Err(Failure(
+                    "existing public API publication metadata is unavailable",
+                ));
+            }
+        };
+    let source = Source::PublicApi {
+        directory: root.path().to_owned(),
+        certificate_file_sha256,
+        service: public_api_admin::namespace_service(root.path()),
+    };
+    lock.file()
+        .revalidate(&root)
+        .map_err(|_| Failure("public API source identity changed"))?;
+    Ok(source)
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ClientConfig {
+    descriptor: PathBuf,
+    certificate: PathBuf,
+    instance_id: String,
+    certificate_sha256: String,
+    keyring_service: String,
+    keyring_account: String,
+    #[serde(default)]
+    headless_authority: Option<HeadlessReference>,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct HeadlessReference {
+    directory: PathBuf,
+    key_variable: String,
+}
+
+fn client_source(path: &Path) -> Result<Source> {
+    let (config_path, bytes) = plan::read_private(path, 16 * 1024)?;
+    let config: ClientConfig = serde_json::from_slice(&bytes)
+        .map_err(|_| Failure("local credential reference is malformed or has unknown fields"))?;
+    if let Some(headless) = config.headless_authority {
+        let _ = (headless.directory, headless.key_variable);
+        return Err(Failure(
+            "this offline plan only selects existing platform custody, not another headless authority",
+        ));
+    }
+    // Worker shutdown removes publication leaves. Retained client references
+    // carry the original instance and independently provisioned pin; reopening
+    // a worker to republish them would violate this offline operation.
+    plan::clean_absolute(&config.certificate)?;
+    plan::clean_absolute(&config.descriptor)?;
+    uuid::Uuid::parse_str(&config.instance_id)
+        .map_err(|_| Failure("local reference instance is invalid"))?;
+    validate_identifier(&config.keyring_service, false)?;
+    validate_identifier(&config.keyring_account, true)?;
+    if !valid_hex(&config.certificate_sha256, 64) {
+        return Err(Failure("local reference certificate pin is invalid"));
+    }
+    if config.keyring_service == "com.obscuritylabs.colossus.desktop.external"
+        && config.keyring_account
+            != format!(
+                "daemon-{}-{}",
+                config.instance_id, config.certificate_sha256
+            )
+    {
+        return Err(Failure(
+            "Desktop external custody must bind the exact existing instance and certificate pin",
+        ));
+    }
+    Ok(Source::Client {
+        config: config_path,
+        config_sha256: plan::sha256(&bytes),
+        service: config.keyring_service,
+        account: config.keyring_account,
+        instance_id: config.instance_id,
+        certificate_sha256: config.certificate_sha256,
+    })
+}
+
+fn journal_source(path: &Path, home: &ColossusHome, workspace: &Path) -> Result<Source> {
+    let (config_path, bytes) = plan::read_private(path, 1024 * 1024)?;
+    let text = std::str::from_utf8(&bytes)
+        .map_err(|_| Failure("journal source configuration is not UTF-8"))?;
+    let config = RuntimeConfig::from_yaml(text)
+        .map_err(|_| Failure("journal source configuration is invalid"))?;
+    if config.storage.adapter != StorageAdapter::Redb {
+        return Err(Failure(
+            "offline development journal rewrap supports frozen existing redb sources only",
+        ));
+    }
+    let journal_path = if config.storage.path.is_absolute() {
+        config.storage.path.clone()
+    } else {
+        let base = match config.storage.location {
+            StorageLocation::Workspace => workspace.to_owned(),
+            StorageLocation::HomeWorkspace => {
+                let identity = detect_workspace_identity(workspace)
+                    .map_err(|_| Failure("journal workspace identity is unavailable"))?;
+                let partition = home
+                    .workspace_partition_id(workspace, identity.as_ref())
+                    .map_err(|_| Failure("journal workspace partition is invalid"))?;
+                // The existing CLI surface only: never call workspace_surface_dir,
+                // which would create state during this read-only plan.
+                home.root().join("workspaces").join(partition).join("cli")
+            }
+        };
+        base.join(&config.storage.path)
+    };
+    let (root, journal_file) = plan::existing_file(&journal_path)?;
+    let metadata =
+        colossus_journal_redb::journal_key_metadata(journal_file.path()).map_err(|_| {
+            Failure("existing journal metadata is unavailable, busy, or needs recovery")
+        })?;
+    if matches!(config.storage.keys, KeyConfig::None) {
+        if !metadata.encryption_key_ids.is_empty() || metadata.checkpoint_key_id.is_some() {
+            return Err(Failure(
+                "plaintext journal selection does not match retained protection metadata",
+            ));
+        }
+        journal_file
+            .revalidate(&root)
+            .map_err(|_| Failure("journal source identity changed"))?;
+        return Ok(Source::PlaintextJournal {
+            config: config_path,
+            config_sha256: plan::sha256(&bytes),
+            journal: journal_file.path().to_owned(),
+            journal_sha256: plan::file_digest(journal_file.path())?,
+        });
+    }
+    let KeyConfig::Platform {
+        service,
+        journal_key_id,
+        signing_key_id,
+    } = &config.storage.keys
+    else {
+        return Err(Failure(
+            "journal rewrap does not select another environment authority",
+        ));
+    };
+    validate_identifier(service, false)?;
+    validate_identifier(journal_key_id, true)?;
+    validate_identifier(signing_key_id, true)?;
+    let mut encryption = BTreeSet::from([journal_key_id.clone()]);
+    encryption.extend(metadata.encryption_key_ids);
+    let mut signing = BTreeSet::from([signing_key_id.clone()]);
+    signing.extend(metadata.checkpoint_key_id);
+    if encryption.len() > 256 || signing.len() > 256 {
+        return Err(Failure(
+            "journal key identifiers exceed offline planning bounds",
+        ));
+    }
+    for id in encryption.iter().chain(signing.iter()) {
+        validate_identifier(id, true)?;
+    }
+    journal_file
+        .revalidate(&root)
+        .map_err(|_| Failure("journal source identity changed"))?;
+    Ok(Source::Journal {
+        config: config_path,
+        config_sha256: plan::sha256(&bytes),
+        journal: journal_file.path().to_owned(),
+        journal_sha256: plan::file_digest(journal_file.path())?,
+        service: service.clone(),
+        encryption_key_ids: encryption.into_iter().collect(),
+        signing_key_ids: signing.into_iter().collect(),
+        anchor_key_id: journal_key_id.clone(),
+    })
+}
+
+pub(super) fn validate_identifier(value: &str, account: bool) -> Result<()> {
+    if value.is_empty()
+        || value.len() > 256
+        || !value.bytes().all(|byte| {
+            byte.is_ascii_alphanumeric()
+                || matches!(byte, b'.' | b'_' | b'-')
+                || account && byte == b':'
+        })
+    {
+        return Err(Failure(
+            "existing credential reference is invalid or exceeds its bound",
+        ));
+    }
+    Ok(())
+}
+pub(super) fn valid_hex(value: &str, count: usize) -> bool {
+    value.len() == count
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
diff --git a/crates/colossus-cli/src/dev_credentials_tests.rs b/crates/colossus-cli/src/dev_credentials_tests.rs
new file mode 100644
index 000000000..f41df19aa
--- /dev/null
+++ b/crates/colossus-cli/src/dev_credentials_tests.rs
@@ -0,0 +1,651 @@
+use super::*;
+use crate::{
+    dev_credentials_apply,
+    dev_credentials_args::{DevelopmentCredentialSources, DevelopmentCredentialsAction},
+    dev_credentials_plan, dev_credentials_sources,
+    public_api_admin::{OsCredentialStore, PublicApiAdminError, SecretStore},
+};
+use colossus_credentials::{
+    DevelopmentAuthority, DevelopmentStoreScope, PlatformKeyStore, headless_credential_account,
+};
+use zeroize::Zeroizing;
+
+struct PrivateRootFixture {
+    _directory: PrivateTempDir,
+    path: PathBuf,
+}
+impl PrivateRootFixture {
+    fn path(&self) -> &Path {
+        &self.path
+    }
+}
+fn private_root() -> PrivateRootFixture {
+    let directory = private_tempdir();
+    let path = fs::canonicalize(directory.path()).unwrap();
+    PrivateRootFixture {
+        _directory: directory,
+        path,
+    }
+}
+
+fn source_args(home: &Path) -> DevelopmentCredentialSources {
+    DevelopmentCredentialSources {
+        home: home.to_owned(),
+        desktop_vault: false,
+        control_plane_vault: false,
+        connector_source_home: None,
+        connector_enrollment: None,
+        public_api_directories: Vec::new(),
+        client_configs: Vec::new(),
+        journal_configs: Vec::new(),
+        runtime_oauth_storage: Vec::new(),
+        fresh_empty: false,
+    }
+}
+
+#[test]
+fn development_commands_accept_metadata_paths_but_require_explicit_reviewed_apply() {
+    let parsed = Cli::try_parse_from([
+        "colossus",
+        "dev-credentials",
+        "init",
+        "--home",
+        "/private/home",
+        "--workspace",
+        "/private/workspace",
+    ])
+    .unwrap();
+    assert!(matches!(
+        parsed.command,
+        Command::DevelopmentCredentials(DevelopmentCredentialsCommand {
+            command: DevelopmentCredentialsAction::Init { .. }
+        })
+    ));
+    assert!(
+        Cli::try_parse_from([
+            "colossus",
+            "dev-credentials",
+            "rewrap",
+            "--plan-file",
+            "/private/plan.json",
+            "--expected-plan-sha256",
+            &"a".repeat(64)
+        ])
+        .is_err()
+    );
+    assert!(
+        Cli::try_parse_from([
+            "colossus",
+            "dev-credentials",
+            "init",
+            "--home",
+            "/private/home",
+            "--workspace",
+            "/private/workspace",
+            "--key",
+            "not-an-accepted-secret-input"
+        ])
+        .is_err()
+    );
+    let source = include_str!("entrypoint.rs");
+    assert!(
+        source
+            .find("if let Command::DevelopmentCredentials")
+            .unwrap()
+            < source.find("ColossusHome::resolve_and_ensure").unwrap()
+    );
+}
+
+#[test]
+fn fresh_activation_is_explicit_metadata_only_and_conflicting_plan_bytes_fail_closed() {
+    let home = private_root();
+    let workspace = private_root();
+    let root = ConfinedRoot::bind(home.path()).unwrap();
+    let authority =
+        DevelopmentAuthority::initialize(&root, &[workspace.path().to_owned()]).unwrap();
+    assert!(
+        !DevelopmentAuthority::metadata(&root, &DevelopmentAuthority::path_for_home(&root), &[])
+            .unwrap()
+            .active
+    );
+    let mut args = source_args(home.path());
+    args.fresh_empty = true;
+    let plan = dev_credentials_sources::make_plan(&args, workspace.path()).unwrap();
+    let file = DevelopmentAuthority::path_for_home(&root).join("fresh.plan.json");
+    let digest = dev_credentials_plan::write_plan(&file, &plan).unwrap();
+    assert_eq!(
+        dev_credentials_plan::read_plan(&file, &digest).unwrap(),
+        plan
+    );
+    assert!(dev_credentials_plan::read_plan(&file, &"b".repeat(64)).is_err());
+    assert!(dev_credentials_plan::write_plan(&file, &plan).is_err());
+    assert_eq!(
+        dev_credentials_apply::apply(&plan, &OsCredentialStore).unwrap(),
+        (0, 0)
+    );
+    assert!(
+        DevelopmentAuthority::metadata(&root, &DevelopmentAuthority::path_for_home(&root), &[])
+            .unwrap()
+            .active
+    );
+    let _ = authority;
+}
+
+#[derive(Default)]
+struct ReadOnlySecrets {
+    values: BTreeMap<(String, String), Vec<u8>>,
+}
+impl SecretStore for ReadOnlySecrets {
+    fn read(
+        &self,
+        service: &str,
+        account: &str,
+    ) -> Result<Option<Zeroizing<Vec<u8>>>, PublicApiAdminError> {
+        Ok(self
+            .values
+            .get(&(service.into(), account.into()))
+            .cloned()
+            .map(Zeroizing::new))
+    }
+    fn write(&self, _: &str, _: &str, _: &[u8]) -> Result<(), PublicApiAdminError> {
+        panic!("source writes are forbidden")
+    }
+    fn delete(&self, _: &str, _: &str) -> Result<(), PublicApiAdminError> {
+        panic!("source deletion is forbidden")
+    }
+}
+
+#[test]
+fn offline_public_api_rewrap_preserves_original_seeds_and_refuses_missing_conflicting_material() {
+    let home = private_root();
+    let workspace = private_root();
+    let root = ConfinedRoot::bind(home.path()).unwrap();
+    let authority =
+        DevelopmentAuthority::initialize(&root, &[workspace.path().to_owned()]).unwrap();
+    let api_dir = root.prepare_directory(Path::new("api")).unwrap();
+    let api = ConfinedRoot::bind(&api_dir).unwrap();
+    api.open_file(Path::new(".public-api.lock")).unwrap();
+    api.open_file(Path::new("certificate.pem"))
+        .unwrap()
+        .file()
+        .write_all(b"synthetic public certificate")
+        .unwrap();
+    let mut args = source_args(home.path());
+    args.public_api_directories.push(api_dir.clone());
+    let plan = dev_credentials_sources::make_plan(&args, workspace.path()).unwrap();
+    let service = public_api_admin::namespace_service(&api_dir);
+    let mut secrets = ReadOnlySecrets::default();
+    for (index, account) in [
+        public_api_admin::AUTHENTICATION_ROOT_ACCOUNT,
+        public_api_admin::TLS_SEED_ACCOUNT,
+        public_api_admin::INSTANCE_SEED_ACCOUNT,
+    ]
+    .iter()
+    .enumerate()
+    {
+        secrets.values.insert(
+            (service.clone(), account.to_string()),
+            vec![(index + 1) as u8; 32],
+        );
+    }
+    let saved = secrets.values.clone();
+    let absent = ReadOnlySecrets::default();
+    assert!(dev_credentials_apply::apply(&plan, &absent).is_err());
+    assert!(
+        !DevelopmentAuthority::metadata(&root, &DevelopmentAuthority::path_for_home(&root), &[])
+            .unwrap()
+            .active
+    );
+    assert_eq!(
+        dev_credentials_apply::apply(&plan, &secrets).unwrap(),
+        (3, 0)
+    );
+    assert_eq!(secrets.values, saved);
+    assert_eq!(
+        dev_credentials_apply::apply(&plan, &secrets).unwrap(),
+        (0, 3)
+    );
+    let target = authority.store(DevelopmentStoreScope::PublicApi).unwrap();
+    for ((service, account), original) in &saved {
+        assert_eq!(
+            target
+                .read(&headless_credential_account(service, account))
+                .unwrap()
+                .unwrap()
+                .as_slice(),
+            original.as_slice()
+        );
+    }
+    secrets.values.insert(
+        (
+            service,
+            public_api_admin::AUTHENTICATION_ROOT_ACCOUNT.into(),
+        ),
+        vec![99; 32],
+    );
+    assert!(dev_credentials_apply::apply(&plan, &secrets).is_err());
+    assert_eq!(
+        target
+            .read(&headless_credential_account(
+                &public_api_admin::namespace_service(&api_dir),
+                public_api_admin::AUTHENTICATION_ROOT_ACCOUNT
+            ))
+            .unwrap()
+            .unwrap()
+            .as_slice(),
+        &[1; 32]
+    );
+    // Normal worker shutdown removes publication leaves, not its three original
+    // OS seed accounts. Offline planning must not restart that worker.
+    secrets.values = saved;
+    fs::remove_file(api_dir.join("certificate.pem")).unwrap();
+    let stopped = dev_credentials_sources::make_plan(&args, workspace.path()).unwrap();
+    assert!(matches!(
+        &stopped.sources[0],
+        dev_credentials_plan::Source::PublicApi {
+            certificate_file_sha256: None,
+            ..
+        }
+    ));
+    assert_eq!(
+        dev_credentials_apply::apply(&stopped, &secrets).unwrap(),
+        (0, 3)
+    );
+    let client = root.open_file(Path::new("client.json")).unwrap();
+    let client_bytes = serde_json::to_vec(&json!({
+        "descriptor": api_dir.join("endpoint.json"),
+        "certificate": api_dir.join("certificate.pem"),
+        "instance_id": "00000000-0000-0000-0000-000000000002",
+        "certificate_sha256": "f".repeat(64),
+        "keyring_service": "synthetic-bound-client",
+        "keyring_account": "original-application"
+    }))
+    .unwrap();
+    client.file().write_all(&client_bytes).unwrap();
+    let bearer = format!(
+        "cls_v1.00000000-0000-0000-0000-000000000003.{}",
+        base64::engine::general_purpose::URL_SAFE_NO_PAD.encode([9_u8; 32])
+    );
+    secrets.values.insert(
+        (
+            "synthetic-bound-client".into(),
+            "original-application".into(),
+        ),
+        bearer.as_bytes().to_vec(),
+    );
+    let retained = secrets.values.clone();
+    args.client_configs.push(client.path().to_owned());
+    let stopped = dev_credentials_sources::make_plan(&args, workspace.path()).unwrap();
+    assert_eq!(
+        dev_credentials_apply::apply(&stopped, &secrets).unwrap(),
+        (1, 3)
+    );
+    assert_eq!(secrets.values, retained);
+    assert_eq!(fs::read(client.path()).unwrap(), client_bytes);
+    assert_eq!(
+        target
+            .read(&headless_credential_account(
+                "synthetic-bound-client",
+                "original-application"
+            ))
+            .unwrap()
+            .unwrap()
+            .as_slice(),
+        bearer.as_bytes()
+    );
+}
+
+#[test]
+fn invalid_existing_bearers_are_never_replaced_or_exposed() {
+    assert!(dev_credentials_apply::validate_test_bearer(b"not-a-Colossus-bearer").is_err());
+    let valid = format!(
+        "cls_v1.00000000-0000-0000-0000-000000000001.{}",
+        base64::engine::general_purpose::URL_SAFE_NO_PAD.encode([7_u8; 32])
+    );
+    assert!(dev_credentials_apply::validate_test_bearer(valid.as_bytes()).is_ok());
+}
+
+#[test]
+fn plaintext_journal_plan_requires_frozen_canonical_metadata_and_retains_source_bytes() {
+    use colossus_journal_redb::{DisabledCheckpointSigner, PlaintextKeyProvider, RedbEventJournal};
+    let home = private_root();
+    let workspace = private_root();
+    let root = ConfinedRoot::bind(home.path()).unwrap();
+    DevelopmentAuthority::initialize(&root, &[workspace.path().to_owned()]).unwrap();
+    let journal_path = root
+        .open_file(Path::new("state.redb"))
+        .unwrap()
+        .path()
+        .to_owned();
+    let journal = RedbEventJournal::open(
+        &journal_path,
+        Arc::new(PlaintextKeyProvider),
+        Arc::new(DisabledCheckpointSigner),
+    )
+    .unwrap();
+    let config = root.open_file(Path::new("config.yaml")).unwrap();
+    let config_text = format!(
+        "schemaVersion: 3\nstorage:\n  path: {}\n",
+        serde_json::to_string(&journal_path).unwrap()
+    );
+    config.file().write_all(config_text.as_bytes()).unwrap();
+    let mut args = source_args(home.path());
+    args.journal_configs.push(config.path().to_owned());
+    assert!(dev_credentials_sources::make_plan(&args, workspace.path()).is_err());
+    drop(journal);
+    let original = fs::read(&journal_path).unwrap();
+    let planned = dev_credentials_sources::make_plan(&args, workspace.path()).unwrap();
+    assert!(matches!(
+        planned.sources[0],
+        dev_credentials_plan::Source::PlaintextJournal { .. }
+    ));
+    assert_eq!(fs::read(&journal_path).unwrap(), original);
+    assert_eq!(
+        dev_credentials_apply::apply(&planned, &ReadOnlySecrets::default()).unwrap(),
+        (0, 0)
+    );
+    assert_eq!(fs::read(&journal_path).unwrap(), original);
+    assert_eq!(fs::read(config.path()).unwrap(), config_text.as_bytes());
+}
+
+type KeyReadHook = Arc<dyn Fn(&str) + Send + Sync>;
+#[derive(Default)]
+struct MemoryVaultKeys(
+    std::sync::Mutex<BTreeMap<String, Vec<u8>>>,
+    std::sync::Mutex<Option<KeyReadHook>>,
+);
+impl PlatformKeyStore for MemoryVaultKeys {
+    fn read(
+        &self,
+        account: &str,
+    ) -> Result<Option<Zeroizing<Vec<u8>>>, colossus_contracts::CredentialError> {
+        let hook = self.1.lock().unwrap().clone();
+        if let Some(hook) = hook {
+            hook(account);
+        }
+        Ok(self
+            .0
+            .lock()
+            .unwrap()
+            .get(account)
+            .cloned()
+            .map(Zeroizing::new))
+    }
+    fn write(
+        &self,
+        account: &str,
+        bytes: &[u8],
+    ) -> Result<(), colossus_contracts::CredentialError> {
+        self.0
+            .lock()
+            .unwrap()
+            .insert(account.into(), bytes.to_vec());
+        Ok(())
+    }
+}
+
+#[test]
+fn cli_retains_named_source_lease_while_later_vault_sources_are_sealed() {
+    use colossus_contracts::{CredentialError, VaultRecord};
+    use colossus_credentials::PlatformCredentialVault;
+    use colossus_ports::CredentialVault as _;
+    use std::sync::atomic::{AtomicBool, Ordering};
+    let source_home = private_root();
+    let target_home = private_root();
+    let workspace = private_root();
+    let source_root = ConfinedRoot::bind(source_home.path()).unwrap();
+    let source_directory = source_root
+        .prepare_directory(Path::new("cloud-connector"))
+        .unwrap();
+    let source_root = ConfinedRoot::bind(&source_directory).unwrap();
+    let keys = Arc::new(MemoryVaultKeys::default());
+    let selected = colossus_connector::EnrollmentStore::credential_key("cloud-e2e-cli").unwrap();
+    let source = PlatformCredentialVault::with_key_store(
+        source_root.clone(),
+        "cloud-connector",
+        keys.clone(),
+    )
+    .unwrap();
+    source
+        .write(
+            &selected,
+            &VaultRecord::new(b"original-selected-record".to_vec()).unwrap(),
+        )
+        .unwrap();
+    drop(source);
+    let target_root = ConfinedRoot::bind(target_home.path()).unwrap();
+    DevelopmentAuthority::initialize(&target_root, &[workspace.path().to_owned()]).unwrap();
+    let desktop = target_root.prepare_directory(Path::new("desktop")).unwrap();
+    let desktop_root = ConfinedRoot::bind(&desktop).unwrap();
+    let vault = PlatformCredentialVault::with_key_store(
+        desktop_root.clone(),
+        "desktop-manual",
+        keys.clone(),
+    )
+    .unwrap();
+    vault
+        .write(
+            &selected,
+            &VaultRecord::new(b"second-isolated-vault-record".to_vec()).unwrap(),
+        )
+        .unwrap();
+    drop(vault);
+    let metadata = PlatformCredentialVault::key_metadata(&desktop_root, "desktop-manual")
+        .unwrap()
+        .unwrap();
+    let observed = Arc::new(AtomicBool::new(false));
+    let check = Arc::clone(&observed);
+    let weak_keys = Arc::downgrade(&keys);
+    *keys.1.lock().unwrap() = Some(Arc::new(move |account| {
+        if account == metadata.account {
+            let source = PlatformCredentialVault::with_key_store(
+                source_root.clone(),
+                "cloud-connector",
+                weak_keys.upgrade().unwrap(),
+            )
+            .unwrap();
+            assert!(matches!(
+                source.write(
+                    &selected,
+                    &VaultRecord::new(b"must-not-replace-source".to_vec()).unwrap()
+                ),
+                Err(CredentialError::Busy)
+            ));
+            check.store(true, Ordering::SeqCst);
+        }
+    }));
+    let mut args = source_args(target_home.path());
+    args.connector_source_home = Some(source_home.path().to_owned());
+    args.connector_enrollment = Some("cloud-e2e-cli".into());
+    args.desktop_vault = true;
+    let plan = dev_credentials_sources::make_plan(&args, workspace.path()).unwrap();
+    assert_eq!(
+        dev_credentials_apply::apply_with_vault_keys(&plan, &ReadOnlySecrets::default(), keys)
+            .unwrap(),
+        (2, 0)
+    );
+    assert!(observed.load(Ordering::SeqCst));
+}
+
+#[test]
+fn exact_named_enrollment_copy_never_exports_global_master_or_sibling_records() {
+    use colossus_contracts::VaultRecord;
+    use colossus_credentials::PlatformCredentialVault;
+    use colossus_ports::{CredentialKey, CredentialVault as _};
+    let source_home = private_root();
+    let target_home = private_root();
+    let workspace = private_root();
+    let source_root = ConfinedRoot::bind(source_home.path()).unwrap();
+    let source_directory = source_root
+        .prepare_directory(Path::new("cloud-connector"))
+        .unwrap();
+    let keys = Arc::new(MemoryVaultKeys::default());
+    let source_vault = PlatformCredentialVault::with_key_store(
+        ConfinedRoot::bind(&source_directory).unwrap(),
+        "cloud-connector",
+        keys.clone(),
+    )
+    .unwrap();
+    let selected = colossus_connector::EnrollmentStore::credential_key("cloud-e2e-cli").unwrap();
+    let sibling = CredentialKey::new("cloud-connector", "unrelated-enrollment").unwrap();
+    source_vault
+        .write(
+            &selected,
+            &VaultRecord::new(
+                b"synthetic-selected-enrollment-with-original-node-grant-and-TLS".to_vec(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+    source_vault
+        .write(
+            &sibling,
+            &VaultRecord::new(b"unrelated-record-is-not-copied".to_vec()).unwrap(),
+        )
+        .unwrap();
+    drop(source_vault);
+    let original_keys = keys.0.lock().unwrap().clone();
+    let target_root = ConfinedRoot::bind(target_home.path()).unwrap();
+    let authority =
+        DevelopmentAuthority::initialize(&target_root, &[workspace.path().to_owned()]).unwrap();
+    let mut args = source_args(target_home.path());
+    args.connector_source_home = Some(source_home.path().to_owned());
+    args.connector_enrollment = Some("cloud-e2e-cli".into());
+    let plan = dev_credentials_sources::make_plan(&args, workspace.path()).unwrap();
+    assert!(matches!(
+        plan.sources[0],
+        dev_credentials_plan::Source::ConnectorEnrollment { .. }
+    ));
+    let source_metadata = PlatformCredentialVault::key_metadata(
+        &ConfinedRoot::bind(&source_directory).unwrap(),
+        "cloud-connector",
+    )
+    .unwrap()
+    .unwrap();
+    assert_eq!(
+        dev_credentials_apply::apply_with_vault_keys(
+            &plan,
+            &ReadOnlySecrets::default(),
+            keys.clone()
+        )
+        .unwrap(),
+        (1, 0)
+    );
+    assert_eq!(keys.0.lock().unwrap().clone(), original_keys);
+    let target_keys = Arc::new(
+        authority
+            .store(DevelopmentStoreScope::ControlPlaneVault)
+            .unwrap(),
+    );
+    assert!(
+        target_keys
+            .read(&source_metadata.account)
+            .unwrap()
+            .is_none()
+    );
+    let target_directory = target_home.path().join("cloud-connector");
+    let target_vault = PlatformCredentialVault::with_key_store(
+        ConfinedRoot::bind(&target_directory).unwrap(),
+        "cloud-connector",
+        target_keys,
+    )
+    .unwrap();
+    assert_eq!(
+        target_vault.read(&selected).unwrap().unwrap().expose(),
+        b"synthetic-selected-enrollment-with-original-node-grant-and-TLS"
+    );
+    assert!(target_vault.read(&sibling).unwrap().is_none());
+    drop(target_vault);
+    let target_metadata = PlatformCredentialVault::key_metadata(
+        &ConfinedRoot::bind(&target_directory).unwrap(),
+        "cloud-connector",
+    )
+    .unwrap()
+    .unwrap();
+    assert_ne!(source_metadata.vault_id, target_metadata.vault_id);
+    assert_eq!(
+        dev_credentials_apply::apply_with_vault_keys(
+            &plan,
+            &ReadOnlySecrets::default(),
+            keys.clone()
+        )
+        .unwrap(),
+        (0, 1)
+    );
+    let conflicting = PlatformCredentialVault::with_key_store(
+        ConfinedRoot::bind(&target_directory).unwrap(),
+        "cloud-connector",
+        Arc::new(
+            authority
+                .store(DevelopmentStoreScope::ControlPlaneVault)
+                .unwrap(),
+        ),
+    )
+    .unwrap();
+    conflicting
+        .write(
+            &selected,
+            &VaultRecord::new(b"different-existing-target-record".to_vec()).unwrap(),
+        )
+        .unwrap();
+    drop(conflicting);
+    assert!(
+        dev_credentials_apply::apply_with_vault_keys(
+            &plan,
+            &ReadOnlySecrets::default(),
+            keys.clone()
+        )
+        .is_err()
+    );
+    let conflicting = PlatformCredentialVault::with_key_store(
+        ConfinedRoot::bind(&target_directory).unwrap(),
+        "cloud-connector",
+        Arc::new(
+            authority
+                .store(DevelopmentStoreScope::ControlPlaneVault)
+                .unwrap(),
+        ),
+    )
+    .unwrap();
+    assert_eq!(
+        conflicting.read(&selected).unwrap().unwrap().expose(),
+        b"different-existing-target-record"
+    );
+    drop(conflicting);
+    let retained = PlatformCredentialVault::with_key_store(
+        ConfinedRoot::bind(&source_directory).unwrap(),
+        "cloud-connector",
+        keys.clone(),
+    )
+    .unwrap();
+    assert_eq!(
+        retained.read(&selected).unwrap().unwrap().expose(),
+        b"synthetic-selected-enrollment-with-original-node-grant-and-TLS"
+    );
+    assert_eq!(
+        retained.read(&sibling).unwrap().unwrap().expose(),
+        b"unrelated-record-is-not-copied"
+    );
+    drop(retained);
+    assert_eq!(keys.0.lock().unwrap().clone(), original_keys);
+    args.home = source_home.path().to_owned();
+    DevelopmentAuthority::initialize(&source_root, &[workspace.path().to_owned()]).unwrap();
+    assert!(
+        dev_credentials_sources::make_plan(&args, workspace.path())
+            .unwrap_err()
+            .to_string()
+            .contains("non-overlapping")
+    );
+    let nested = source_root
+        .prepare_directory(Path::new("nested-home"))
+        .unwrap();
+    let nested_root = ConfinedRoot::bind(&nested).unwrap();
+    DevelopmentAuthority::initialize(&nested_root, &[workspace.path().to_owned()]).unwrap();
+    args.home = nested;
+    assert!(
+        dev_credentials_sources::make_plan(&args, workspace.path())
+            .unwrap_err()
+            .to_string()
+            .contains("non-overlapping")
+    );
+}
diff --git a/crates/colossus-cli/src/entrypoint.rs b/crates/colossus-cli/src/entrypoint.rs
index d5fc0b2bb..3f5fa26a1 100644
--- a/crates/colossus-cli/src/entrypoint.rs
+++ b/crates/colossus-cli/src/entrypoint.rs
@@ -69,6 +69,28 @@ pub(super) async fn runtime_main() -> Result<(), Box<dyn Error>> {
         Err(error) => error.exit(),
     };
     set_output_mode(cli.output);
+    if let Command::DevelopmentCredentials(command) = &cli.command {
+        if cli.worker_required
+            || cli.desktop_worker_auth
+            || cli.approval_mode.is_some()
+            || cli.config.is_some()
+        {
+            return Err("development credential operations are offline and do not accept runtime/authentication flags".into());
+        }
+        return dev_credentials::run(command, &cli.workspace)
+            .map_err(|error| Box::new(error) as Box<dyn Error>);
+    }
+    if let Command::Cloud(command) = cli.command {
+        return colossus_connector::run_cli(command).await;
+    }
+    // Metadata validation precedes home/runtime/worker acquisition. The selected
+    // account remains native-only and no credential is loaded until a provider permit.
+    let worker_codex_auth = match &cli.command {
+        Command::Worker(worker) => {
+            worker_codex_auth::select(worker.codex_auth_path.as_deref(), &cli.workspace)?
+        }
+        _ => None,
+    };
     let home = ColossusHome::resolve_and_ensure()?;
     if let Command::Update(update) = &cli.command {
         match update.command.as_ref() {
@@ -220,35 +242,45 @@ pub(super) async fn runtime_main() -> Result<(), Box<dyn Error>> {
                 ApprovalMode::FullAccess => WorkerApprovalMode::FullAccess,
             };
             let server =
-                WorkerServer::open_with_mode_at_workspace(&config, mode, runtime_options.clone())
-                    .map_err(worker_open_error)?
-                    .with_observability_diagnostics(move || {
-                        serde_json::to_value(observability_diagnostics.force_flush())
-                            .unwrap_or_else(|_| {
-                                serde_json::json!({
-                                    "ready": false,
-                                    "checks": [{
-                                        "name": "host",
-                                        "status": "fail",
-                                        "detail": "The exporter diagnostic failed safely."
-                                    }]
-                                })
+                WorkerServer::open_with_mode_at_workspace_and_provider_credentials_and_codex_auth(
+                    &config,
+                    mode,
+                    worker_codex_auth::runtime_options(worker, runtime_options.clone()),
+                    Arc::new(colossus_runtime::EnvironmentCredentialResolver),
+                    worker_codex_auth,
+                )
+                .map_err(worker_open_error)?
+                .with_observability_diagnostics(move || {
+                    serde_json::to_value(observability_diagnostics.force_flush()).unwrap_or_else(
+                        |_| {
+                            serde_json::json!({
+                                "ready": false,
+                                "checks": [{
+                                    "name": "host",
+                                    "status": "fail",
+                                    "detail": "The exporter diagnostic failed safely."
+                                }]
                             })
-                    });
-            let (server, public_environment) =
-                if let Some(directory) = worker.public_api_dir.as_deref() {
-                    let environment = PublicApiEnvironment::open(directory, &OsCredentialStore)?;
-                    let credentials = environment.credential_manager(&server);
-                    let options = environment.host_options(&credentials)?;
-                    let server = server.enable_public_api(options).await?;
-                    eprintln!(
-                        "public API discovery published in {}",
-                        environment.directory().display()
-                    );
-                    (server, Some(environment))
-                } else {
-                    (server, None)
-                };
+                        },
+                    )
+                });
+            let (server, public_environment) = if let Some(directory) =
+                worker.public_api_dir.as_deref()
+            {
+                let store =
+                    credential_store(directory, worker.public_api_vault_key_variable.as_deref())?;
+                let environment = PublicApiEnvironment::open(directory, store.as_ref())?;
+                let credentials = environment.credential_manager(&server);
+                let options = environment.host_options(&credentials)?;
+                let server = server.enable_public_api(options).await?;
+                eprintln!(
+                    "public API discovery published in {}",
+                    environment.directory().display()
+                );
+                (server, Some(environment))
+            } else {
+                (server, None)
+            };
             eprintln!("worker listening on {}", server.endpoint());
             let result = server.serve().await;
             drop(public_environment);
@@ -290,7 +322,9 @@ pub(super) async fn runtime_main() -> Result<(), Box<dyn Error>> {
                 .public_api_dir
                 .as_deref()
                 .ok_or(PublicApiAdminError::InvalidDirectory)?;
-            let environment = PublicApiEnvironment::open(directory, &OsCredentialStore)?;
+            let store =
+                credential_store(directory, worker.public_api_vault_key_variable.as_deref())?;
+            let environment = PublicApiEnvironment::open(directory, store.as_ref())?;
             if let Some(application_id) = worker.enroll_application.as_deref() {
                 let destination_service = worker
                     .credential_keyring_service
@@ -313,7 +347,7 @@ pub(super) async fn runtime_main() -> Result<(), Box<dyn Error>> {
                 let metadata = enroll_application(
                     &environment,
                     &server,
-                    &OsCredentialStore,
+                    store.as_ref(),
                     EnrollmentRequest {
                         application_id,
                         scopes: &worker.scope,
@@ -417,6 +451,8 @@ pub(super) async fn runtime_main() -> Result<(), Box<dyn Error>> {
             Arc::clone(&runtime), &acp_workspace,
             acp_approvals.as_ref().ok_or("ACP approval bridge is unavailable")?.clone(),
         ).await?,
+        Command::Cloud(_) => unreachable!("handled before runtime construction"),
+        Command::DevelopmentCredentials(_) => unreachable!("handled before runtime construction"),
         Command::Update(_) => unreachable!("handled before runtime construction"),
         Command::Config(ConfigCommand {
             command: ConfigAction::Effective,
diff --git a/crates/colossus-cli/src/main.rs b/crates/colossus-cli/src/main.rs
index 9811b6042..fbf7d649f 100644
--- a/crates/colossus-cli/src/main.rs
+++ b/crates/colossus-cli/src/main.rs
@@ -70,6 +70,12 @@ mod codex_commands;
 mod commands;
 mod configuration;
 mod desktop_tui_auth;
+mod dev_credentials;
+mod dev_credentials_apply;
+mod dev_credentials_args;
+mod dev_credentials_lease;
+mod dev_credentials_plan;
+mod dev_credentials_sources;
 mod dictation;
 mod entrypoint;
 mod extension_args;
@@ -89,6 +95,7 @@ mod terminal_io;
 mod update_commands;
 mod webhooks;
 mod work_args;
+mod worker_codex_auth;
 mod worker_dispatch;
 mod worker_shell;
 mod workflow_args;
@@ -101,6 +108,7 @@ use codex_commands::*;
 use commands::*;
 use configuration::*;
 use desktop_tui_auth::*;
+use dev_credentials_args::*;
 use entrypoint::*;
 use extension_args::*;
 use herdr::{AgentState, HerdrReporter};
diff --git a/crates/colossus-cli/src/public_api_admin.rs b/crates/colossus-cli/src/public_api_admin.rs
index e95cd30eb..04c61bf82 100644
--- a/crates/colossus-cli/src/public_api_admin.rs
+++ b/crates/colossus-cli/src/public_api_admin.rs
@@ -1,19 +1,17 @@
 use colossus_api::{ApiScope, ApplicationKind, scopes};
 use colossus_grpc::ApplicationGrant;
-#[cfg(unix)]
 use colossus_grpc::{TlsIdentity, TlsKeySeed};
 use colossus_worker::{
     PublicApiAuthenticationKey, PublicApiCredentialManager, PublicApiHostOptions, WorkerServer,
 };
-#[cfg(unix)]
 use fs4::fs_std::FileExt as _;
 use serde::Serialize;
-#[cfg(unix)]
 use sha2::{Digest as _, Sha256};
 use std::{
     error::Error,
     fmt,
     fs::File,
+    net::{Ipv4Addr, SocketAddr},
     path::{Path, PathBuf},
 };
 use uuid::Uuid;
@@ -22,7 +20,6 @@ use zeroize::Zeroizing;
 #[cfg(unix)]
 use std::{
     fs,
-    net::{Ipv4Addr, SocketAddr},
     os::unix::fs::{DirBuilderExt as _, MetadataExt as _},
 };
 
@@ -30,23 +27,15 @@ use std::{
 const DIRECTORY_MODE: u32 = 0o700;
 #[cfg(unix)]
 const LOCK_FILE_MODE: u32 = 0o600;
-#[cfg(unix)]
 const DESCRIPTOR_FILENAME: &str = "endpoint.json";
-#[cfg(unix)]
 const CERTIFICATE_FILENAME: &str = "certificate.pem";
-#[cfg(unix)]
 const LOCK_FILENAME: &str = ".public-api.lock";
-#[cfg(unix)]
 const KEYRING_SERVICE_PREFIX: &str = "dev.obscuritylabs.colossus.public-api";
 const DESKTOP_EXTERNAL_KEYRING_SERVICE: &str = "com.obscuritylabs.colossus.desktop.external";
 const DESKTOP_BOUND_ACCOUNT_REQUEST: &str = "auto";
-#[cfg(unix)]
-const AUTHENTICATION_ROOT_ACCOUNT: &str = "authentication-root-v1";
-#[cfg(unix)]
-const TLS_SEED_ACCOUNT: &str = "tls-seed-v1";
-#[cfg(unix)]
-const INSTANCE_SEED_ACCOUNT: &str = "instance-identity-seed-v1";
-#[cfg(unix)]
+pub(super) const AUTHENTICATION_ROOT_ACCOUNT: &str = "authentication-root-v1";
+pub(super) const TLS_SEED_ACCOUNT: &str = "tls-seed-v1";
+pub(super) const INSTANCE_SEED_ACCOUNT: &str = "instance-identity-seed-v1";
 const INSTANCE_ID_DOMAIN: &[u8] = b"colossus-public-api-instance-id-v1\0";
 
 const KNOWN_SCOPES: [&str; 5] = [
@@ -65,13 +54,11 @@ const UNSUPPORTED_PUBLIC_TOOLS: [&str; 1] = ["agent.delegate"];
 /// material.
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub(super) enum PublicApiAdminError {
-    #[cfg(not(unix))]
+    #[cfg(not(any(unix, windows)))]
     UnsupportedPlatform,
     InvalidDirectory,
-    #[cfg(unix)]
     DirectoryBusy,
     SecretStoreUnavailable,
-    #[cfg(unix)]
     SecretStoreValueInvalid,
     InvalidKeyringIdentifier,
     ReservedKeyringNamespace,
@@ -106,17 +93,15 @@ pub(super) enum PublicApiAdminError {
 impl fmt::Display for PublicApiAdminError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         let message = match self {
-            #[cfg(not(unix))]
+            #[cfg(not(any(unix, windows)))]
             Self::UnsupportedPlatform => {
                 "native owner-only public API administration is unsupported on this platform"
             }
             Self::InvalidDirectory => {
                 "public API directory must be an absolute current-user 0700 directory"
             }
-            #[cfg(unix)]
             Self::DirectoryBusy => "public API directory is already owned by another process",
             Self::SecretStoreUnavailable => "OS credential store operation failed",
-            #[cfg(unix)]
             Self::SecretStoreValueInvalid => {
                 "OS credential store contains invalid public API key material"
             }
@@ -241,30 +226,147 @@ impl SecretStore for OsCredentialStore {
     }
 }
 
+struct HeadlessSecretStore(colossus_credentials::EnvironmentKeyStore);
+impl SecretStore for HeadlessSecretStore {
+    fn read(
+        &self,
+        service: &str,
+        account: &str,
+    ) -> Result<Option<Zeroizing<Vec<u8>>>, PublicApiAdminError> {
+        use colossus_credentials::PlatformKeyStore as _;
+        self.0
+            .read(&colossus_connector::headless_credential_account(
+                service, account,
+            ))
+            .map_err(|_| PublicApiAdminError::SecretStoreUnavailable)
+    }
+    fn write(
+        &self,
+        service: &str,
+        account: &str,
+        secret: &[u8],
+    ) -> Result<(), PublicApiAdminError> {
+        use colossus_credentials::PlatformKeyStore as _;
+        self.0
+            .write(
+                &colossus_connector::headless_credential_account(service, account),
+                secret,
+            )
+            .map_err(|_| PublicApiAdminError::SecretStoreUnavailable)
+    }
+    fn delete(&self, service: &str, account: &str) -> Result<(), PublicApiAdminError> {
+        use colossus_credentials::PlatformKeyStore as _;
+        self.0
+            .delete(&colossus_connector::headless_credential_account(
+                service, account,
+            ))
+            .map_err(|_| PublicApiAdminError::SecretStoreUnavailable)
+    }
+}
+
+pub(super) fn credential_store(
+    directory: &Path,
+    variable: Option<&str>,
+) -> Result<Box<dyn SecretStore>, PublicApiAdminError> {
+    if std::env::var_os(colossus_credentials::DEVELOPMENT_AUTHORITY_VARIABLE).is_some() {
+        if !cfg!(debug_assertions) || variable.is_some() {
+            return Err(PublicApiAdminError::InvalidDirectory);
+        }
+        let home = colossus_home::ColossusHome::resolve_and_ensure()
+            .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+        let authority =
+            colossus_credentials::DevelopmentAuthority::selected(home.confined_root(), &[])
+                .map_err(|_| PublicApiAdminError::SecretStoreUnavailable)?
+                .ok_or(PublicApiAdminError::SecretStoreUnavailable)?;
+        let store = authority
+            .store(colossus_credentials::DevelopmentStoreScope::PublicApi)
+            .map_err(|_| PublicApiAdminError::SecretStoreUnavailable)?;
+        return Ok(Box::new(HeadlessSecretStore(store)));
+    }
+    match variable {
+        None => Ok(Box::new(OsCredentialStore)),
+        Some(variable) => {
+            let root = colossus_home::ConfinedRoot::bind(directory)
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            let private = root
+                .prepare_directory(Path::new("headless-credentials"))
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            let root = colossus_home::ConfinedRoot::bind(private)
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            Ok(Box::new(HeadlessSecretStore(
+                colossus_credentials::EnvironmentKeyStore::new(root, variable.into())
+                    .map_err(|_| PublicApiAdminError::SecretStoreUnavailable)?,
+            )))
+        }
+    }
+}
+
 /// Locked, canonical owner-private public API directory and its stable secret material.
 pub(super) struct PublicApiEnvironment {
     directory: PathBuf,
     namespace_service: String,
     authentication_root: Zeroizing<[u8; 32]>,
-    #[cfg(unix)]
     tls_seed: Zeroizing<[u8; 32]>,
-    #[cfg(unix)]
     instance_seed: Zeroizing<[u8; 32]>,
     _lease: File,
     #[cfg(unix)]
     directory_device: u64,
     #[cfg(unix)]
     directory_inode: u64,
+    #[cfg(windows)]
+    confined_root: colossus_home::ConfinedRoot,
 }
 
 impl PublicApiEnvironment {
     pub(super) fn open(path: &Path, store: &dyn SecretStore) -> Result<Self, PublicApiAdminError> {
-        #[cfg(not(unix))]
+        #[cfg(not(any(unix, windows)))]
         {
             let _ = (path, store);
             Err(PublicApiAdminError::UnsupportedPlatform)
         }
 
+        #[cfg(windows)]
+        {
+            let confined_root = colossus_home::ConfinedRoot::bind(path)
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            let directory = confined_root.path().to_owned();
+            let checked = confined_root
+                .open_file(Path::new(LOCK_FILENAME))
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            if !checked
+                .file()
+                .try_lock_exclusive()
+                .map_err(|_| PublicApiAdminError::DirectoryBusy)?
+            {
+                return Err(PublicApiAdminError::DirectoryBusy);
+            }
+            checked
+                .revalidate(&confined_root)
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            let lease = checked
+                .file()
+                .try_clone()
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            let namespace_service = namespace_service(&directory);
+            let authentication_root =
+                load_or_create_exact_key(store, &namespace_service, AUTHENTICATION_ROOT_ACCOUNT)?;
+            let tls_seed = load_or_create_exact_key(store, &namespace_service, TLS_SEED_ACCOUNT)?;
+            let instance_seed =
+                load_or_create_exact_key(store, &namespace_service, INSTANCE_SEED_ACCOUNT)?;
+            confined_root
+                .revalidate()
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            Ok(Self {
+                directory,
+                namespace_service,
+                authentication_root,
+                tls_seed,
+                instance_seed,
+                _lease: lease,
+                confined_root,
+            })
+        }
+
         #[cfg(unix)]
         {
             let directory = prepare_owner_private_directory(path)?;
@@ -302,12 +404,28 @@ impl PublicApiEnvironment {
         &self,
         credentials: &PublicApiCredentialManager,
     ) -> Result<PublicApiHostOptions, PublicApiAdminError> {
-        #[cfg(not(unix))]
+        #[cfg(not(any(unix, windows)))]
         {
             let _ = credentials;
             Err(PublicApiAdminError::UnsupportedPlatform)
         }
 
+        #[cfg(windows)]
+        {
+            self.confined_root
+                .revalidate()
+                .map_err(|_| PublicApiAdminError::InvalidDirectory)?;
+            PublicApiHostOptions::new(
+                SocketAddr::from((Ipv4Addr::LOCALHOST, 0)),
+                stable_instance_id(&self.instance_seed),
+                self.directory.join(DESCRIPTOR_FILENAME),
+                self.directory.join(CERTIFICATE_FILENAME),
+                self.tls_identity()?,
+                credentials,
+            )
+            .map_err(|_| PublicApiAdminError::WorkerUnavailable)
+        }
+
         #[cfg(unix)]
         {
             revalidate_exact_directory(
@@ -329,12 +447,12 @@ impl PublicApiEnvironment {
     }
 
     fn public_identity(&self) -> Result<(Uuid, String), PublicApiAdminError> {
-        #[cfg(not(unix))]
+        #[cfg(not(any(unix, windows)))]
         {
             Err(PublicApiAdminError::UnsupportedPlatform)
         }
 
-        #[cfg(unix)]
+        #[cfg(any(unix, windows))]
         {
             let tls = self.tls_identity()?;
             Ok((
@@ -344,7 +462,6 @@ impl PublicApiEnvironment {
         }
     }
 
-    #[cfg(unix)]
     fn tls_identity(&self) -> Result<TlsIdentity, PublicApiAdminError> {
         TlsIdentity::from_seed(TlsKeySeed::new(*self.tls_seed))
             .map_err(|_| PublicApiAdminError::WorkerUnavailable)
@@ -870,7 +987,6 @@ fn normalize_scopes(scopes: &[String]) -> Result<Vec<ApiScope>, PublicApiAdminEr
     Ok(scopes)
 }
 
-#[cfg(unix)]
 fn load_or_create_exact_key(
     store: &dyn SecretStore,
     service: &str,
@@ -893,7 +1009,6 @@ fn load_or_create_exact_key(
     Ok(stored)
 }
 
-#[cfg(unix)]
 fn exact_key(value: Zeroizing<Vec<u8>>) -> Result<Zeroizing<[u8; 32]>, PublicApiAdminError> {
     if value.len() != 32 {
         return Err(PublicApiAdminError::SecretStoreValueInvalid);
@@ -903,13 +1018,11 @@ fn exact_key(value: Zeroizing<Vec<u8>>) -> Result<Zeroizing<[u8; 32]>, PublicApi
     Ok(key)
 }
 
-#[cfg(unix)]
-fn namespace_service(directory: &Path) -> String {
+pub(super) fn namespace_service(directory: &Path) -> String {
     let digest = Sha256::digest(directory.as_os_str().as_encoded_bytes());
     format!("{KEYRING_SERVICE_PREFIX}.{}", lowercase_hex(&digest))
 }
 
-#[cfg(unix)]
 fn stable_instance_id(seed: &[u8; 32]) -> Uuid {
     let mut hasher = Sha256::new();
     hasher.update(INSTANCE_ID_DOMAIN);
@@ -923,7 +1036,6 @@ fn stable_instance_id(seed: &[u8; 32]) -> Uuid {
     Uuid::from_bytes(bytes)
 }
 
-#[cfg(unix)]
 fn lowercase_hex(bytes: &[u8]) -> String {
     const HEX: &[u8; 16] = b"0123456789abcdef";
     let mut encoded = String::with_capacity(bytes.len() * 2);
diff --git a/crates/colossus-cli/src/tests.rs b/crates/colossus-cli/src/tests.rs
index 1c12b0b82..b0a6a4dd8 100644
--- a/crates/colossus-cli/src/tests.rs
+++ b/crates/colossus-cli/src/tests.rs
@@ -4,6 +4,12 @@ use std::collections::BTreeSet;
 #[path = "terminal_command_tests.rs"]
 mod terminal_commands;
 
+#[path = "dev_credentials_tests.rs"]
+mod development_credentials;
+
+#[path = "worker_codex_auth_tests.rs"]
+mod worker_codex_auth;
+
 struct PrivateTempDir {
     #[cfg(windows)]
     path: PathBuf,
diff --git a/crates/colossus-cli/src/worker_codex_auth.rs b/crates/colossus-cli/src/worker_codex_auth.rs
new file mode 100644
index 000000000..6ef133ad5
--- /dev/null
+++ b/crates/colossus-cli/src/worker_codex_auth.rs
@@ -0,0 +1,79 @@
+//! Trusted worker-only account selection; no credential bytes are read at startup.
+
+use colossus_codex_auth::CodexAuthStore;
+use colossus_home::ConfinedRoot;
+use std::{
+    fs, io,
+    path::{Component, Path},
+};
+
+pub(super) fn runtime_options(
+    worker: &super::WorkerCommand,
+    options: colossus_runtime::RuntimeOpenOptions,
+) -> colossus_runtime::RuntimeOpenOptions {
+    if worker.no_model_network_tools {
+        options.without_model_network_tools()
+    } else {
+        options
+    }
+}
+
+const MAX_AUTH_FILE_BYTES: u64 = 256 * 1024;
+
+pub(super) fn select(path: Option<&Path>, workspace: &Path) -> io::Result<Option<CodexAuthStore>> {
+    let Some(path) = path else {
+        return Ok(None);
+    };
+    if !path.is_absolute()
+        || path
+            .to_str()
+            .is_none_or(|value| value.len() > 4096 || value.chars().any(char::is_control))
+        || path
+            .components()
+            .any(|component| matches!(component, Component::CurDir | Component::ParentDir))
+    {
+        return Err(invalid());
+    }
+    let parent = path.parent().ok_or_else(invalid)?;
+    // ConfinedRoot::bind may prepare a missing directory for other callers. This
+    // selection only observes an existing private store and never creates a path.
+    let parent_metadata = fs::symlink_metadata(parent).map_err(|_| invalid())?;
+    if !parent_metadata.is_dir() || parent_metadata.file_type().is_symlink() {
+        return Err(invalid());
+    }
+    let root = ConfinedRoot::bind(parent).map_err(|_| invalid())?;
+    let file = root
+        .open_existing_file(Path::new(path.file_name().ok_or_else(invalid)?))
+        .map_err(|_| invalid())?;
+    let metadata = file.file().metadata().map_err(|_| invalid())?;
+    if metadata.len() > MAX_AUTH_FILE_BYTES {
+        return Err(invalid());
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        if metadata.permissions().mode() & 0o077 != 0 {
+            return Err(invalid());
+        }
+    }
+    file.revalidate(&root).map_err(|_| invalid())?;
+    let workspace = fs::canonicalize(workspace).map_err(|_| invalid())?;
+    let canonical_file = fs::canonicalize(file.path()).map_err(|_| invalid())?;
+    if canonical_file.starts_with(&workspace) {
+        return Err(invalid());
+    }
+    file.revalidate(&root).map_err(|_| invalid())?;
+    // CodexAuthStore rechecks file ownership/privacy at each permit-bearing load
+    // and refresh. No environment selector or default store replaces this choice.
+    Ok(Some(
+        CodexAuthStore::confined(root, Path::new(path.file_name().ok_or_else(invalid)?))
+            .map_err(|_| invalid())?,
+    ))
+}
+
+fn invalid() -> io::Error {
+    io::Error::new(
+        io::ErrorKind::InvalidInput,
+        "--codex-auth-path requires an existing absolute private owner-held regular file outside the workspace and without links; selection failed without account fallback",
+    )
+}
diff --git a/crates/colossus-cli/src/worker_codex_auth_tests.rs b/crates/colossus-cli/src/worker_codex_auth_tests.rs
new file mode 100644
index 000000000..953faa69e
--- /dev/null
+++ b/crates/colossus-cli/src/worker_codex_auth_tests.rs
@@ -0,0 +1,163 @@
+use super::*;
+use crate::worker_codex_auth;
+
+fn private_auth_file(directory: &Path) -> PathBuf {
+    let path = directory.join("auth.json");
+    // Deliberately not an auth document: selection must not load or parse contents.
+    fs::write(&path, b"synthetic metadata-only fixture").unwrap();
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).unwrap();
+    }
+    path
+}
+
+#[test]
+fn worker_auth_selection_forwards_exact_private_path_without_loading_credentials() {
+    let directory = private_tempdir();
+    let parent = fs::canonicalize(directory.path()).unwrap();
+    let path = private_auth_file(&parent);
+    let cli = Cli::try_parse_from([
+        "colossus",
+        "worker",
+        "--codex-auth-path",
+        path.to_str().unwrap(),
+    ])
+    .unwrap();
+    let Command::Worker(worker) = cli.command else {
+        panic!("worker");
+    };
+    let store = worker_codex_auth::select(worker.codex_auth_path.as_deref(), Path::new("."))
+        .unwrap()
+        .unwrap();
+    assert_eq!(store.path(), path);
+    assert_eq!(fs::read(&path).unwrap(), b"synthetic metadata-only fixture");
+    assert!(
+        worker_codex_auth::select(None, Path::new("missing-default-workspace"))
+            .unwrap()
+            .is_none()
+    );
+}
+
+#[test]
+fn auth_path_is_serve_only_and_conflicts_with_other_worker_operations() {
+    for operation in ["--once", "--status", "--shutdown"] {
+        let error = Cli::try_parse_from([
+            "colossus",
+            "worker",
+            "--codex-auth-path",
+            "/private/auth.json",
+            operation,
+        ])
+        .err()
+        .unwrap();
+        assert_eq!(error.kind(), ErrorKind::ArgumentConflict);
+        let error =
+            Cli::try_parse_from(["colossus", "worker", "--no-model-network-tools", operation])
+                .err()
+                .unwrap();
+        assert_eq!(error.kind(), ErrorKind::ArgumentConflict);
+    }
+}
+
+#[test]
+fn worker_model_network_opt_out_is_host_only_and_preserves_provider_account_selection() {
+    let directory = private_tempdir();
+    let parent = fs::canonicalize(directory.path()).unwrap();
+    let path = private_auth_file(&parent);
+    let cli = Cli::try_parse_from([
+        "colossus",
+        "worker",
+        "--no-model-network-tools",
+        "--codex-auth-path",
+        path.to_str().unwrap(),
+    ])
+    .unwrap();
+    let Command::Worker(worker) = cli.command else {
+        panic!("worker");
+    };
+    let options = RuntimeOpenOptions::for_workspace(&parent).unwrap();
+    let configured = worker_codex_auth::runtime_options(&worker, options);
+    assert!(!configured.model_network_tools_enabled());
+    assert_eq!(configured.workspace, parent);
+    let auth = worker_codex_auth::select(worker.codex_auth_path.as_deref(), Path::new("."))
+        .unwrap()
+        .unwrap();
+    assert_eq!(auth.path(), path);
+    let Command::Worker(default) = Cli::try_parse_from(["colossus", "worker"]).unwrap().command
+    else {
+        panic!("worker");
+    };
+    let default = worker_codex_auth::runtime_options(
+        &default,
+        RuntimeOpenOptions::for_workspace(&parent).unwrap(),
+    );
+    assert!(default.model_network_tools_enabled());
+}
+
+#[test]
+fn invalid_auth_selection_never_creates_paths_or_falls_back() {
+    let directory = private_tempdir();
+    let parent = fs::canonicalize(directory.path()).unwrap();
+    let missing = parent.join("must-remain-absent/auth.json");
+    let overlong = PathBuf::from(format!("/{}", "x".repeat(4096)));
+    for path in [
+        Path::new("relative/auth.json"),
+        Path::new("/private/auth\ninvalid.json"),
+        overlong.as_path(),
+        missing.as_path(),
+        parent.as_path(),
+    ] {
+        let error = worker_codex_auth::select(Some(path), Path::new("."))
+            .err()
+            .unwrap();
+        assert_eq!(error.kind(), io::ErrorKind::InvalidInput);
+        assert!(!error.to_string().contains(&path.display().to_string()));
+    }
+    assert!(!missing.parent().unwrap().exists());
+    assert_eq!(fs::read_dir(&parent).unwrap().count(), 0);
+}
+
+#[test]
+fn oversized_selected_file_is_refused_without_loading_or_modifying_it() {
+    let directory = private_tempdir();
+    let parent = fs::canonicalize(directory.path()).unwrap();
+    let path = private_auth_file(&parent);
+    fs::OpenOptions::new()
+        .write(true)
+        .open(&path)
+        .unwrap()
+        .set_len(256 * 1024 + 1)
+        .unwrap();
+    assert!(worker_codex_auth::select(Some(&path), Path::new(".")).is_err());
+    assert_eq!(fs::metadata(path).unwrap().len(), 256 * 1024 + 1);
+}
+
+#[cfg(unix)]
+#[test]
+fn unsafe_private_file_permissions_and_link_aliases_are_refused() {
+    use std::os::unix::fs::{PermissionsExt as _, symlink};
+    let directory = private_tempdir();
+    let parent = fs::canonicalize(directory.path()).unwrap();
+    let path = private_auth_file(&parent);
+    fs::set_permissions(&path, fs::Permissions::from_mode(0o644)).unwrap();
+    assert!(worker_codex_auth::select(Some(&path), Path::new(".")).is_err());
+    fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).unwrap();
+    let alias = parent.join("alias.json");
+    symlink(&path, &alias).unwrap();
+    assert!(worker_codex_auth::select(Some(&alias), Path::new(".")).is_err());
+    fs::remove_file(&alias).unwrap();
+    fs::hard_link(&path, &alias).unwrap();
+    assert!(worker_codex_auth::select(Some(&path), Path::new(".")).is_err());
+    assert!(worker_codex_auth::select(Some(&alias), Path::new(".")).is_err());
+}
+
+#[test]
+fn selected_account_file_cannot_be_inside_the_tool_workspace() {
+    let directory = private_tempdir();
+    let parent = fs::canonicalize(directory.path()).unwrap();
+    let path = private_auth_file(&parent);
+    assert!(worker_codex_auth::select(Some(&path), &parent).is_err());
+    assert_eq!(fs::read(path).unwrap(), b"synthetic metadata-only fixture");
+}
diff --git a/crates/colossus-cli/src/worker_dispatch.rs b/crates/colossus-cli/src/worker_dispatch.rs
index c1f3d05db..cc307d029 100644
--- a/crates/colossus-cli/src/worker_dispatch.rs
+++ b/crates/colossus-cli/src/worker_dispatch.rs
@@ -1238,7 +1238,9 @@ pub(super) async fn dispatch_to_worker_if_active(
         | Command::Worker(_)
         | Command::Config(_)
         | Command::Codex(_)
-        | Command::SandboxHelper => Ok(false),
+        | Command::SandboxHelper
+        | Command::Cloud(_)
+        | Command::DevelopmentCredentials(_) => Ok(false),
     }
 }
 
diff --git a/crates/colossus-cli/tests/bootstrap_install_smoke.rs b/crates/colossus-cli/tests/bootstrap_install_smoke.rs
index 7c53de4b9..0c01948ae 100644
--- a/crates/colossus-cli/tests/bootstrap_install_smoke.rs
+++ b/crates/colossus-cli/tests/bootstrap_install_smoke.rs
@@ -56,6 +56,15 @@ impl Fixture {
         fs::create_dir(&stage).expect("package stage");
         let packaged_binary = stage.join("colossus");
         fs::copy(env!("CARGO_BIN_EXE_colossus"), &packaged_binary).expect("package binary");
+        // Match release packaging: debug symbols otherwise exhaust the installer's
+        // expanded-archive bound as the runtime and its adapters grow.
+        assert!(
+            Command::new("strip")
+                .arg(&packaged_binary)
+                .status()
+                .expect("strip packaged fixture")
+                .success()
+        );
         fs::set_permissions(&packaged_binary, fs::Permissions::from_mode(0o755))
             .expect("binary permissions");
         let tools = stage.join("tools");
diff --git a/crates/colossus-cli/tests/bundle_distribution_smoke.rs b/crates/colossus-cli/tests/bundle_distribution_smoke.rs
index d240a1e80..805359df7 100644
--- a/crates/colossus-cli/tests/bundle_distribution_smoke.rs
+++ b/crates/colossus-cli/tests/bundle_distribution_smoke.rs
@@ -82,6 +82,16 @@ fn trusted_bundle_is_built_verified_installed_and_executed_without_network() {
     let artifact = artifact_path(&staged, target);
     fs::create_dir_all(artifact.parent().expect("artifact parent")).expect("artifact directory");
     fs::copy(source_binary, &artifact).expect("stage binary");
+    // Bundles ship stripped Unix release executables. Keep the real test-built
+    // program while removing debug sections that exceed the distribution bound.
+    #[cfg(unix)]
+    assert!(
+        Command::new("strip")
+            .arg(&artifact)
+            .status()
+            .expect("strip packaged fixture")
+            .success()
+    );
     fs::write(staged.join("LICENSE"), b"Apache-2.0\n").expect("stage license");
     fs::write(
         root.join("config.yaml"),
diff --git a/crates/colossus-cli/tests/ci_contract.rs b/crates/colossus-cli/tests/ci_contract.rs
index 92c311311..58f5bf1ed 100644
--- a/crates/colossus-cli/tests/ci_contract.rs
+++ b/crates/colossus-cli/tests/ci_contract.rs
@@ -578,7 +578,7 @@ fn premerge_requires_an_authorized_label_and_representative_platforms() {
     );
     assert_eq!(
         field(job(jobs, "windows-desktop"), "timeout-minutes").as_u64(),
-        Some(65),
+        Some(75),
         "Windows Desktop acceptance must allow a cold native build"
     );
     assert_eq!(
@@ -593,6 +593,7 @@ fn premerge_requires_an_authorized_label_and_representative_platforms() {
     let gate_needs = strings(field(job(jobs, "gate"), "needs"), "pre-merge gate needs");
     for name in [
         "linux-rust-integration",
+        "linux-desktop",
         "macos-desktop-acceptance",
         "macos-desktop-bundle",
         "windows-runtime",
@@ -605,6 +606,7 @@ fn premerge_requires_an_authorized_label_and_representative_platforms() {
     }
     for name in [
         "linux-rust-integration",
+        "linux-desktop",
         "macos-native",
         "macos-desktop-acceptance",
         "macos-desktop-bundle",
@@ -802,12 +804,14 @@ fn release_signs_windows_artifacts_for_stable_and_preview_tags() {
         [
             "artifacts",
             "bootstrap_installers",
+            "control_plane",
             "desktop_macos",
             "desktop_macos_build",
             "desktop_windows_preview",
             "desktop_windows_signed",
             "sdk_release",
             "validate",
+            "vscode",
             "windows_cli_sign",
         ]
         .into_iter()
@@ -837,6 +841,8 @@ fn release_signs_windows_artifacts_for_stable_and_preview_tags() {
         "test \"$WINDOWS_DESKTOP_RESULT\" = skipped",
         "windows_cli_sign=\"$WINDOWS_CLI_SIGN_RESULT\"",
         "desktop_windows_signed=\"$WINDOWS_SIGNED_DESKTOP_RESULT\"",
+        "control_plane=${{ needs.control_plane.result }}",
+        "vscode=${{ needs.vscode.result }}",
         "test \"$SDK_RELEASE_RESULT\" = skipped",
         "obscuritylabs-colossus-sdk-${RELEASE_VERSION}.tgz",
         "obscuritylabs_colossus_sdk-${RELEASE_VERSION}-py3-none-any.whl",
@@ -869,9 +875,9 @@ fn release_signs_windows_artifacts_for_stable_and_preview_tags() {
         "codeSigning = 'azure_artifact_signing'",
         "Colossus-Desktop-STABLE-${RELEASE_TAG}-x86_64-pc-windows-msvc-setup.exe",
         "Colossus-Desktop-DEVELOPER-PREVIEW-${RELEASE_TAG}-x86_64-pc-windows-msvc-setup.exe",
-        "-eq 25",
-        "expected_assets=22",
-        "expected_assets=18",
+        "-eq 45",
+        "expected_assets=42",
+        "expected_assets=38",
     ] {
         assert!(
             source.contains(required),
@@ -896,14 +902,14 @@ fn release_signs_windows_artifacts_for_stable_and_preview_tags() {
         .find("  desktop_windows_signed:")
         .map(|offset| windows_start + offset)
         .expect("Windows signed job");
-    let gate_start = source[signed_windows_start..]
-        .find("  gate:")
+    let control_plane_start = source[signed_windows_start..]
+        .find("  control_plane:")
         .map(|offset| signed_windows_start + offset)
-        .expect("gate job");
+        .expect("Control Plane job");
     let build_job = &source[build_start..sign_start];
     let sign_job = &source[sign_start..windows_start];
     let windows_job = &source[windows_start..signed_windows_start];
-    let signed_windows_job = &source[signed_windows_start..gate_start];
+    let signed_windows_job = &source[signed_windows_start..control_plane_start];
     for forbidden in [
         "${{ secrets.",
         "MACOS_DEVELOPER_ID_P12",
diff --git a/crates/colossus-cli/tests/native_sandbox.rs b/crates/colossus-cli/tests/native_sandbox.rs
index 636d7f75e..f5caef881 100644
--- a/crates/colossus-cli/tests/native_sandbox.rs
+++ b/crates/colossus-cli/tests/native_sandbox.rs
@@ -578,23 +578,33 @@ sandbox:
             &format!("  networkDestinations:\n    - {origin}"),
         );
         fs::write(&config, updated).expect("network config");
+        let families: &[&str] = if cfg!(target_os = "macos") {
+            &["", "--ipv4", "--ipv6"]
+        } else {
+            &[""]
+        };
+        let requests = families.len();
         let server = thread::spawn(move || {
-            let (mut stream, _) = listener.accept().expect("network accept");
-            let mut request = Vec::new();
-            let mut chunk = [0_u8; 1024];
-            while !request.windows(4).any(|window| window == b"\r\n\r\n") {
-                let count = stream.read(&mut chunk).expect("network read");
-                assert_ne!(count, 0, "network request ended before its header");
-                request.extend_from_slice(&chunk[..count]);
-                assert!(request.len() <= 16 * 1024, "network request is oversized");
+            for _ in 0..requests {
+                let (mut stream, _) = listener.accept().expect("network accept");
+                let mut request = Vec::new();
+                let mut chunk = [0_u8; 1024];
+                while !request.windows(4).any(|window| window == b"\r\n\r\n") {
+                    let count = stream.read(&mut chunk).expect("network read");
+                    assert_ne!(count, 0, "network request ended before its header");
+                    request.extend_from_slice(&chunk[..count]);
+                    assert!(request.len() <= 16 * 1024, "network request is oversized");
+                }
+                stream
+                    .write_all(
+                        b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok",
+                    )
+                    .expect("network write");
+                stream.flush().expect("network flush");
+                stream
+                    .shutdown(Shutdown::Write)
+                    .expect("network response shutdown");
             }
-            stream
-                .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok")
-                .expect("network write");
-            stream.flush().expect("network flush");
-            stream
-                .shutdown(Shutdown::Write)
-                .expect("network response shutdown");
         });
         let denied_url = format!("http://{denied_address}/");
         let denied_network = run(
@@ -633,10 +643,8 @@ sandbox:
         );
         let allowed_url = format!("{origin}/");
         let allowed_response = allowed.join("allowed-network-response.txt");
-        let allowed_network = run(
-            &binary,
-            &config,
-            &[
+        for family in families {
+            let mut arguments = vec![
                 "process",
                 "run",
                 "/usr/bin/curl",
@@ -658,31 +666,36 @@ sandbox:
                 "--output",
                 allowed_response.to_str().expect("allowed response path"),
                 &allowed_url,
-            ],
-        );
-        assert!(
-            allowed_network.status.success(),
-            "{}",
-            String::from_utf8_lossy(&allowed_network.stderr)
-        );
-        let result: Value =
-            serde_json::from_slice(&allowed_network.stdout).expect("network result");
-        assert_eq!(
-            result["success"],
-            true,
-            "allowed network command failed: {result}; stderr: {}",
-            String::from_utf8_lossy(
-                &BASE64
-                    .decode(result["stderr_base64"].as_str().expect("stderr"))
-                    .expect("decoded stderr")
-            )
-        );
-        assert_eq!(result["exit_code"], 0);
-        assert_eq!(result["output_truncated"], false);
+            ];
+            if !family.is_empty() {
+                arguments.push(*family);
+            }
+            let allowed_network = run(&binary, &config, &arguments);
+            assert!(
+                allowed_network.status.success(),
+                "{}",
+                String::from_utf8_lossy(&allowed_network.stderr)
+            );
+            let result: Value =
+                serde_json::from_slice(&allowed_network.stdout).expect("network result");
+            assert_eq!(
+                result["success"],
+                true,
+                "allowed network command ({family:?}) failed: {result}; stderr: {}",
+                String::from_utf8_lossy(
+                    &BASE64
+                        .decode(result["stderr_base64"].as_str().expect("stderr"))
+                        .expect("decoded stderr")
+                )
+            );
+            assert_eq!(result["exit_code"], 0);
+            assert_eq!(result["output_truncated"], false);
+            assert_eq!(result["observed_origins"], serde_json::json!([origin]));
+            assert_eq!(
+                fs::read(&allowed_response).expect("allowed network response"),
+                b"ok"
+            );
+        }
         server.join().expect("server thread");
-        assert_eq!(
-            fs::read(&allowed_response).expect("allowed network response"),
-            b"ok"
-        );
     }
 }
diff --git a/crates/colossus-cli/tests/release_contract.rs b/crates/colossus-cli/tests/release_contract.rs
index 45ab5cc05..ee893c3c8 100644
--- a/crates/colossus-cli/tests/release_contract.rs
+++ b/crates/colossus-cli/tests/release_contract.rs
@@ -109,9 +109,9 @@ fn tag_validation_and_draft_publication_fail_closed() {
         "release_channel=validation_only",
         "--draft --verify-tag --generate-notes",
         "refusing to retain unexpected draft asset",
-        "test \"$(find dist -maxdepth 1 -type f | wc -l | tr -d ' ')\" -eq 25",
-        "expected_assets=22",
-        "expected_assets=18",
+        "test \"$(find dist -maxdepth 1 -type f | wc -l | tr -d ' ')\" -eq 45",
+        "expected_assets=42",
+        "expected_assets=38",
         "test \"$(find dist -maxdepth 1 -type f | wc -l | tr -d ' ')\" -eq \"$expected_assets\"",
         "if [ \"$TEST_RELEASE\" = true ]; then",
         "node scripts/ci/release-source-version.mjs \"$tag\" \"$workspace_version\"",
@@ -664,8 +664,8 @@ fn temporary_lru_advisory_exception_is_exact_documented_and_consistent() {
         );
     }
     assert!(
-        deny.contains("[advisories]\nignore = []"),
-        "cargo-deny must retain its fail-closed empty advisory ignore list"
+        !deny.contains(ADVISORY),
+        "cargo-deny must not ignore the informational lru advisory"
     );
     for required in ["LruCache<usize, Block>", "Tantivy PR #3034", "`lru` 0.18.2"] {
         assert!(
@@ -677,6 +677,32 @@ fn temporary_lru_advisory_exception_is_exact_documented_and_consistent() {
     assert!(!lock.contains("name = \"lru\"\nversion = \"0.18.1\""));
 }
 
+#[test]
+fn oidc_public_verification_exception_is_exact_and_scoped() {
+    const ADVISORY: &str = "RUSTSEC-2023-0071";
+    let root = repository_root();
+    let deny = fs::read_to_string(root.join("deny.toml")).unwrap();
+    assert_eq!(
+        deny.matches("RUSTSEC-").count(),
+        1,
+        "the policy permits only the reviewed RSA exception"
+    );
+    assert!(deny.contains(ADVISORY));
+    assert!(deny.contains("no application RSA private-key operations"));
+    for path in [
+        "xtask/src/checks/surfaces.rs",
+        "release/verify-release-readiness.sh",
+        "docs/develop/adr/0006-cloud-control-plane.md",
+    ] {
+        assert!(
+            fs::read_to_string(root.join(path))
+                .unwrap()
+                .contains(ADVISORY),
+            "{path} must document the exact exception"
+        );
+    }
+}
+
 #[test]
 fn linux_profile_and_release_package_remain_hardened() {
     let template = fs::read_to_string(repository_root().join("release/colossus.apparmor.in"))
diff --git a/crates/colossus-cloud-postgres/Cargo.toml b/crates/colossus-cloud-postgres/Cargo.toml
new file mode 100644
index 000000000..02353c8f1
--- /dev/null
+++ b/crates/colossus-cloud-postgres/Cargo.toml
@@ -0,0 +1,38 @@
+[package]
+name = "colossus-cloud-postgres"
+publish = false
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[dependencies]
+async-trait.workspace = true
+colossus-cloud.workspace = true
+colossus-network.workspace = true
+colossus-ports.workspace = true
+diesel.workspace = true
+diesel-async.workspace = true
+hex.workspace = true
+futures.workspace = true
+ed25519-dalek.workspace = true
+time.workspace = true
+rustls.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+tokio.workspace = true
+tokio-postgres.workspace = true
+tokio-postgres-rustls.workspace = true
+uuid.workspace = true
+webpki-roots.workspace = true
+zeroize.workspace = true
+
+[dev-dependencies]
+serde_json = {workspace=true,features=["preserve_order"]}
+colossus-cloud-protocol.workspace = true
+colossus-sdk = {workspace=true,features=["serialization"]}
+
+[lints]
+workspace = true
diff --git a/crates/colossus-cloud-postgres/README.md b/crates/colossus-cloud-postgres/README.md
new file mode 100644
index 000000000..d338541b9
--- /dev/null
+++ b/crates/colossus-cloud-postgres/README.md
@@ -0,0 +1,170 @@
+# Cloud PostgreSQL adapter
+
+This adapter implements the cloud-owned asynchronous `CloudStore` port with Diesel
+and diesel-async. It never implements `EventJournal` and never opens a runtime's
+database. Production cloud composition uses this adapter; `MemoryCloudStore` is a
+deterministic test fixture.
+
+The domain has separate tables for projects, memberships, hosts, runtime agents,
+workspaces, conversations/messages, tasks, commands/receipts, source-session/run
+mappings, admission counters, invitations and certificate renewals. Each table has
+its domain columns, project-scoped keys and indexes. A JSONB service representation
+retains versioned SDK snapshots alongside those indexed columns. Foreign keys are
+project-scoped and deferred until transaction commit so related records can be
+written together.
+
+Entity revisions use compare-and-swap and row locks. Released feeds use independent
+stream heads; there is no cloud-wide journal-head lock. Commands, domain mutations,
+received events and source cursors commit with audit and delivery-outbox records in
+one PostgreSQL transaction. Changed duplicates and stream gaps fail. An uncertain
+connection failure preserves `StoreError::OutcomeUnknown` so application code must
+reconcile the immutable request identity before retrying.
+
+Lists fetch records and audit metadata in one bounded query. Creation/update times
+have indexed `TIMESTAMPTZ` columns and cursor ordering uses timestamp plus identifier.
+Conversation task queries filter the task's `thread_id`, while message queries use
+their thread parent. Source inventory and released events remain caller authorized.
+
+The asynchronous pool defaults to 16 connections, plus one dedicated notification
+listener per replica. Pool acquisition, connection, SQL statements and lock waits
+are bounded. LISTEN reconnects with a 500 ms to 30 second backoff. Notifications
+carry only project identifiers; consumers always reload durable state from their
+cursor, including after notification loss or broadcast lag. A transaction commits
+its outbox before publishing its notification. Notifications do not constitute
+durable delivery acknowledgements.
+
+One pending outbox hint per project coalesces changing entities and streams. Existing
+pending hints use conflict-do-nothing, so ordinary events do not serialize on a
+shared project row. The listener batches project wakeups every 100 ms, retaining at
+most 1,024 distinct pending project identifiers per interval. Missed or coalesced
+wakeups are recovered from the durable source cursor.
+
+`CloudStore::maintain` publishes and marks up to 256 pending hints per default pass,
+then removes at most 256 expired rows from each operational collection. Published
+outbox hints default to one day of retention. Expired browser sessions and OIDC
+flows are removed; flow consumption and maintenance counts are audited. Markers
+without an expiry, including offline imports, remain. The host runs bounded passes
+every minute. Canonical messages, released events, tasks, receipts, cursors and audit
+history are never automatically deleted by this janitor.
+
+Human accounts, issuer/subject bindings and local password credentials have dedicated
+tables. Local credentials retain salted Argon2id PHC hashes; browser APIs release only
+account metadata. Project roles are database authority after the audited one-time
+configuration bootstrap. Project parents describe display nesting and never inherit
+membership. Archived projects retain read/management access while removing execution,
+control and approval permissions. Structural administration transactions prevent
+hierarchy cycles and removal of the last active administrator; ordinary runtime/event
+transactions do not take that administration lock.
+
+Browser sessions retain cookie/CSRF hashes, stable account identity and a revocation
+epoch. Credential rotation and disable/reenable invalidate earlier epochs across
+replicas. OIDC flow values must be encrypted by host composition. Shared login budgets
+are checked before creating personal attempt counters, so public login traffic cannot
+produce unlimited expired-flow metadata. Connection leases use monotonic fencing
+generations; runtime transactions check the generation and expiry under the same
+transaction's lease-row lock. A stale replica cannot commit runtime output after a
+replacement owner acquires its lease. Tombstones retain consumed entity revisions,
+preventing a single-use authorization-flow key from being recreated.
+
+## Transport and migration
+
+`CloudDatabaseConfig` references the URL through an environment-variable name. The
+adapter never includes URLs or raw PostgreSQL diagnostics in errors. TLS requires
+hostname and CA verification using rustls. Custom CA bundles and configured client
+identities are supported. Disabling TLS explicitly is restricted to loopback and
+Unix-socket acceptance fixtures.
+
+Numbered SQL migrations are applied transactionally under a schema-specific advisory
+lock. Applied SQL checksums are retained and changed migration files fail startup.
+This lock is used only during migration, never during normal cloud mutations.
+Schema rollback SQL is intentionally destructive and requires an explicit operator
+decision; application startup never runs it. Keep runtime-journal import separate
+from ordinary service writes and retain an independently restorable source backup.
+
+## Audit boundary
+
+Retained cloud entities and released feeds have per-resource SHA-256 audit chains.
+Reads verify the retained content against audit metadata; malformed or changed
+content fails closed. Transactionally committed audit entries describe source cursor
+advancement. These checks provide tamper evidence within the retained database and
+do **not** reproduce the runtime journal's independent secure-anchor rollback
+protection. A database administrator can replace or roll back the database and its
+hashes together. Production operation needs independently retained audit checkpoints,
+restricted database roles, backups and tested restore procedures. Retention must
+preserve the chain/checkpoint boundary when pruning historical audit or outbox rows.
+
+## Focused acceptance
+
+Use the explicit disposable PostgreSQL fixture's connection reference:
+
+```sh
+cargo test --locked -p colossus-cloud-postgres --lib
+cargo test --locked -p colossus-cloud-postgres --lib \
+  postgres_atomic_recovery_and_replica_conformance -- --ignored
+```
+
+The ignored test requires `COLOSSUS_CLOUD_TEST_DATABASE_URL` and owns one generated
+`cloud_acceptance_*` schema, which it removes on success. It checks transactions,
+optimistic contention, released replay/gaps, project isolation, chronological pages,
+replica notifications, durable sessions, fencing, one-use consumption and detected
+record changes. This is correctness evidence; fleet capacity requires measured load
+at representative event rates and history-query concurrency.
+
+## Independently retained audit checkpoints
+
+The source operator helper verifies retained project chains in a repeatable-read
+snapshot and signs metadata-only heads with a separately provisioned Ed25519 seed:
+
+```sh
+cargo run --locked -p colossus-cloud-postgres --example audit_checkpoint -- \
+  export --config database-reference.json --project project-a \
+  --audit-key-variable COLOSSUS_CLOUD_AUDIT_SIGNING_SEED --output checkpoint.json
+cargo run --locked -p colossus-cloud-postgres --example audit_checkpoint -- \
+  verify-file --anchor checkpoint.json --public-key PINNED_PUBLIC_KEY_HEX
+cargo run --locked -p colossus-cloud-postgres --example audit_checkpoint -- \
+  verify-db --config database-reference.json --anchor checkpoint.json \
+  --public-key PINNED_PUBLIC_KEY_HEX
+```
+
+`database-reference.json` contains `CloudDatabaseConfig`, with a connection-variable
+reference rather than a URL. The audit variable contains a distinct 32-byte seed in
+hexadecimal. Never reuse browser authentication, encryption or certificate keys.
+Pin the verification key and archive the checkpoint outside this PostgreSQL database;
+trusting the public key embedded in an arbitrary checkpoint provides no identity
+assurance. Exports contain opaque entity/feed identities, revisions and hashes, never
+released conversation text or credentials. `verify-db` rejects missing or changed
+anchored entries and state/feed revisions below their retained heads. Export bounds
+are 100,000 heads and two million retained audit records per project per pass.
+
+The same helper supports `maintain --config database-reference.json`. Publication
+means a project wakeup was committed, independently of runtime command acceptance.
+
+## Reproducible database load measurement
+
+The `fleet_load` example exercises the real `CloudRepository` path, including native
+authority checks, fixed task/thread placement, released run and thread feeds,
+cursor advancement, audit/outbox writes, concurrent history reads and recovery:
+
+```sh
+cargo run --locked -p colossus-cloud-postgres --example fleet_load -- \
+  --streams 300 --rate 1000 --seconds 20 --pool 16 \
+  --report /tmp/cloud-load.json
+```
+
+Set `COLOSSUS_CLOUD_TEST_DATABASE_URL` for the explicit loopback fixture. This example
+creates and removes one generated `cloud_load_*` namespace; `--keep` retains it for
+operator inspection, with its name included in the report. Its default workload uses
+90% 512-byte output deltas, 5% 2-KiB released assistant messages and 5% state updates.
+Offered traffic is paced, while each source preserves sequence order. The JSON report
+includes achieved throughput, operation/history p50/p95 latency, offered queue lag,
+pool wait/timeouts, failures/unattempted events and ten-stream reconnect/backfill,
+exact replay and continuation checks. It also enables bounded numeric transaction
+profiling after setup: transaction/pool-checkout time, awaited mutation SQL wall
+time/count and synchronous JSON/audit preparation time. These are aggregate times
+across concurrent workers; SQL wall time includes client scheduling/decoding and
+does not mean PostgreSQL server execution time alone. Profiling remains disabled
+in ordinary adapter construction. Run on an otherwise quiet host and state the
+build profile, fixture resources and payload mix with any reported results.
+
+This is a local database/application measurement. It does not establish capacity for
+gRPC connections, SSE browsers, OIDC, Kubernetes replicas or actual runtime execution.
diff --git a/crates/colossus-cloud-postgres/examples/audit_checkpoint.rs b/crates/colossus-cloud-postgres/examples/audit_checkpoint.rs
new file mode 100644
index 000000000..f06f4afe9
--- /dev/null
+++ b/crates/colossus-cloud-postgres/examples/audit_checkpoint.rs
@@ -0,0 +1,180 @@
+//! Operator-owned audit export/verification and bounded operational maintenance.
+use colossus_cloud::storage::{CloudMaintenancePolicy, CloudStore};
+use colossus_cloud_postgres::{
+    CloudDatabaseConfig, CloudPostgresStore, SignedCloudAuditCheckpoint,
+    verify_checkpoint_signature,
+};
+use colossus_network::AdditionalRootCertificates;
+use std::{
+    path::{Path, PathBuf},
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+struct Options {
+    action: String,
+    config: Option<PathBuf>,
+    project: Option<String>,
+    signing_variable: Option<String>,
+    output: Option<PathBuf>,
+    anchor: Option<PathBuf>,
+    public_key: Option<String>,
+}
+fn options() -> Result<Options, &'static str> {
+    let mut args = std::env::args().skip(1);
+    let action = args.next().ok_or("action required")?;
+    let mut options = Options {
+        action,
+        config: None,
+        project: None,
+        signing_variable: None,
+        output: None,
+        anchor: None,
+        public_key: None,
+    };
+    while let Some(arg) = args.next() {
+        let value = args.next().ok_or("option value required")?;
+        match arg.as_str() {
+            "--config" => options.config = Some(value.into()),
+            "--project" => options.project = Some(value),
+            "--audit-key-variable" => options.signing_variable = Some(value),
+            "--output" => options.output = Some(value.into()),
+            "--anchor" => options.anchor = Some(value.into()),
+            "--public-key" => options.public_key = Some(value),
+            _ => return Err("unknown option"),
+        }
+    }
+    Ok(options)
+}
+fn read<T: serde::de::DeserializeOwned>(path: &Path, max: u64) -> Result<T, &'static str> {
+    if std::fs::metadata(path)
+        .map_err(|_| "file unavailable")?
+        .len()
+        > max
+    {
+        return Err("file bound exceeded");
+    }
+    serde_json::from_slice(&std::fs::read(path).map_err(|_| "file unavailable")?)
+        .map_err(|_| "file format invalid")
+}
+fn write<T: serde::Serialize>(path: &Path, value: &T) -> Result<(), &'static str> {
+    let bytes = serde_json::to_vec_pretty(value).map_err(|_| "output serialization failed")?;
+    let mut options = std::fs::OpenOptions::new();
+    options.create_new(true).write(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        options.mode(0o600);
+    }
+    let mut file = options
+        .open(path)
+        .map_err(|_| "new output file cannot be created")?;
+    use std::io::Write;
+    file.write_all(&bytes)
+        .and_then(|_| file.sync_all())
+        .map_err(|_| "output write unavailable")
+}
+async fn run() -> Result<(), &'static str> {
+    let options = options()?;
+    if options.action == "verify-file" {
+        let anchor: SignedCloudAuditCheckpoint = read(
+            options.anchor.as_deref().ok_or("anchor required")?,
+            32 * 1024 * 1024,
+        )?;
+        verify_checkpoint_signature(
+            &anchor,
+            options
+                .public_key
+                .as_deref()
+                .ok_or("pinned public key required")?,
+        )
+        .map_err(|_| "checkpoint signature invalid")?;
+        println!("checkpoint signature verified");
+        return Ok(());
+    }
+    let config: CloudDatabaseConfig = read(
+        options
+            .config
+            .as_deref()
+            .ok_or("database reference config required")?,
+        65536,
+    )?;
+    let store = CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+        .await
+        .map_err(|_| "database unavailable")?;
+    match options.action.as_str() {
+        "export" => {
+            let checkpoint = store
+                .export_audit_checkpoint(
+                    options.project.as_deref().ok_or("project required")?,
+                    options
+                        .signing_variable
+                        .as_deref()
+                        .ok_or("distinct audit key reference required")?,
+                )
+                .await
+                .map_err(|_| "checkpoint export unavailable")?;
+            write(
+                options
+                    .output
+                    .as_deref()
+                    .ok_or("new output path required")?,
+                &checkpoint,
+            )?;
+            println!(
+                "{}",
+                serde_json::json!({"checkpoint_sha256":checkpoint.checkpoint_sha256,"public_key":checkpoint.public_key,"heads":checkpoint.checkpoint.heads.len(),"verified_audit_records":checkpoint.checkpoint.verified_audit_records})
+            );
+        }
+        "verify-db" => {
+            let anchor: SignedCloudAuditCheckpoint = read(
+                options.anchor.as_deref().ok_or("anchor required")?,
+                32 * 1024 * 1024,
+            )?;
+            store
+                .verify_audit_checkpoint(
+                    &anchor,
+                    options
+                        .public_key
+                        .as_deref()
+                        .ok_or("pinned public key required")?,
+                )
+                .await
+                .map_err(|_| "database differs from retained checkpoint")?;
+            println!("database checkpoint verified");
+        }
+        "maintain" => {
+            let now = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .map_err(|_| "clock unavailable")?
+                .as_secs();
+            let report = store
+                .maintain(now, &CloudMaintenancePolicy::default())
+                .await
+                .map_err(|_| "bounded maintenance unavailable")?;
+            println!(
+                "{}",
+                serde_json::to_string(&report).map_err(|_| "maintenance summary unavailable")?
+            );
+        }
+        "cleanup-fixture" => {
+            store
+                .remove_fixture_schema(&config.schema)
+                .await
+                .map_err(|_| "selected schema is not an owned fixture")?;
+            println!("selected generated fixture removed");
+        }
+        _ => {
+            return Err(
+                "action must be export, verify-file, verify-db, maintain or cleanup-fixture",
+            );
+        }
+    }
+    Ok(())
+}
+#[tokio::main]
+async fn main() {
+    if let Err(error) = run().await {
+        eprintln!("cloud audit helper failed: {error}");
+        std::process::exit(1);
+    }
+}
diff --git a/crates/colossus-cloud-postgres/examples/fleet_load.rs b/crates/colossus-cloud-postgres/examples/fleet_load.rs
new file mode 100644
index 000000000..9cf0295b3
--- /dev/null
+++ b/crates/colossus-cloud-postgres/examples/fleet_load.rs
@@ -0,0 +1,11 @@
+//! Explicit disposable PostgreSQL cloud-service measurement, without runtime/network claims.
+#[path = "load/harness.rs"]
+mod harness;
+
+#[tokio::main]
+async fn main() {
+    if let Err(error) = harness::run().await {
+        eprintln!("cloud load fixture failed: {error}");
+        std::process::exit(1);
+    }
+}
diff --git a/crates/colossus-cloud-postgres/examples/load/harness.rs b/crates/colossus-cloud-postgres/examples/load/harness.rs
new file mode 100644
index 000000000..cdbb02fb1
--- /dev/null
+++ b/crates/colossus-cloud-postgres/examples/load/harness.rs
@@ -0,0 +1,526 @@
+use colossus_cloud::{CloudCaller, CloudNode, CloudPermission, CloudRepository, storage::*};
+use colossus_cloud_postgres::{CloudDatabaseConfig, CloudDatabaseTls, CloudPostgresStore};
+use colossus_cloud_protocol::CloudReply;
+use colossus_network::AdditionalRootCertificates;
+use colossus_sdk::*;
+use futures::{StreamExt, stream};
+use serde::Serialize;
+use serde_json::json;
+use std::{
+    collections::BTreeSet,
+    path::PathBuf,
+    sync::Arc,
+    time::{Duration, Instant, SystemTime, UNIX_EPOCH},
+};
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+
+const PROJECT: &str = "load-project";
+
+#[derive(Clone)]
+struct Options {
+    streams: usize,
+    rate: usize,
+    seconds: usize,
+    pool: u32,
+    payload: usize,
+    keep: bool,
+    report: Option<PathBuf>,
+}
+fn options() -> Result<Options, &'static str> {
+    let mut options = Options {
+        streams: 300,
+        rate: 1000,
+        seconds: 20,
+        pool: 16,
+        payload: 512,
+        keep: false,
+        report: None,
+    };
+    let mut args = std::env::args().skip(1);
+    while let Some(arg) = args.next() {
+        match arg.as_str() {
+            "--streams" => {
+                options.streams = args
+                    .next()
+                    .ok_or("streams required")?
+                    .parse()
+                    .map_err(|_| "invalid streams")?
+            }
+            "--rate" => {
+                options.rate = args
+                    .next()
+                    .ok_or("rate required")?
+                    .parse()
+                    .map_err(|_| "invalid rate")?
+            }
+            "--seconds" => {
+                options.seconds = args
+                    .next()
+                    .ok_or("seconds required")?
+                    .parse()
+                    .map_err(|_| "invalid seconds")?
+            }
+            "--pool" => {
+                options.pool = args
+                    .next()
+                    .ok_or("pool required")?
+                    .parse()
+                    .map_err(|_| "invalid pool")?
+            }
+            "--payload-bytes" => {
+                options.payload = args
+                    .next()
+                    .ok_or("payload required")?
+                    .parse()
+                    .map_err(|_| "invalid payload")?
+            }
+            "--keep" => options.keep = true,
+            "--report" => options.report = Some(args.next().ok_or("report path required")?.into()),
+            _ => return Err("unknown option"),
+        }
+    }
+    if !(1..=1000).contains(&options.streams)
+        || !(1..=10000).contains(&options.rate)
+        || !(1..=120).contains(&options.seconds)
+        || !(1..=128).contains(&options.pool)
+        || !(64..=8192).contains(&options.payload)
+        || options.rate * options.seconds > 250_000
+    {
+        return Err("measurement bounds exceeded");
+    }
+    Ok(options)
+}
+fn timestamp() -> Result<String, &'static str> {
+    OffsetDateTime::now_utc()
+        .format(&Rfc3339)
+        .map_err(|_| "clock format failed")
+}
+fn now() -> Result<u64, &'static str> {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .map_err(|_| "clock unavailable")
+}
+fn request(index: usize) -> CreateRunRequest {
+    CreateRunRequest {
+        plugin_skill_ids: vec![],
+        input: vec![InputContentPart::Text(format!(
+            "Load fixture conversation {index}"
+        ))],
+        session_id: None,
+        end_user_id: None,
+        role: "primary".into(),
+        mode: RunMode::Execute,
+        research_depth: None,
+        research_sources: vec![],
+        plan_action: None,
+        branch: None,
+        max_turns: 4,
+        idempotency_key: IdempotencyKey::new(format!("load-{index}")).unwrap(),
+    }
+}
+fn snapshot(index: usize, created: String) -> GetRunResponse {
+    GetRunResponse {
+        run: Run {
+            plugin_skill_ids: vec![],
+            run_id: format!("run-{index}"),
+            session_id: format!("session-{index}"),
+            title: format!("Load fixture {index}"),
+            role: "primary".into(),
+            mode: RunMode::Execute,
+            status: RunStatus::Running,
+            created_at: created.clone(),
+            updated_at: created,
+            started_at: None,
+            finished_at: None,
+            last_sequence: 0,
+            pending_interaction_count: 0,
+            terminal: None,
+            etag: "v1".into(),
+            archived: false,
+        },
+        pending_interactions: vec![],
+    }
+}
+#[derive(Clone)]
+struct Placement {
+    node: CloudNode,
+    task_id: String,
+    thread_id: String,
+    repo: CloudRepository,
+    index: usize,
+}
+
+async fn placement(
+    repo: CloudRepository,
+    store: Arc<CloudPostgresStore>,
+    caller: CloudCaller,
+    index: usize,
+) -> Result<Placement, &'static str> {
+    let node = repo
+        .register_node(
+            &caller,
+            CloudNode {
+                node_id: format!("node-{index}"),
+                project_id: PROJECT.into(),
+                instance_id: format!("instance-{index}"),
+                label: format!("Load runtime {index}"),
+                certificate_sha256: format!("{index:064x}"),
+                roles: BTreeSet::from(["primary".into()]),
+                revoked: false,
+                host_id: None,
+                workspace_id: None,
+                workspace_label: None,
+                runtime_ready: true,
+                policy: None,
+                policy_observed_at: None,
+                revision: 0,
+            },
+        )
+        .await
+        .map_err(|_| "node enrollment failed")?;
+    let (thread, task) = repo
+        .create_thread(
+            &caller,
+            &node.node_id,
+            Some(format!("Load thread {index}")),
+            request(index),
+        )
+        .await
+        .map_err(|_| "thread creation failed")?;
+    let lease = store
+        .claim_lease(PROJECT, &node.node_id, "load-replica", now()?, 120)
+        .await
+        .map_err(|_| "lease claim failed")?;
+    let bound = repo.with_lease(lease);
+    bound
+        .record_receipt(
+            &node,
+            &task.task_id,
+            &task.task_id,
+            CloudReply::Run {
+                run: Box::new(snapshot(index, timestamp()?)),
+            },
+        )
+        .await
+        .map_err(|_| "run allocation failed")?;
+    Ok(Placement {
+        node,
+        task_id: task.task_id,
+        thread_id: thread.thread_id,
+        repo: bound,
+        index,
+    })
+}
+
+#[derive(Default)]
+struct WriterResult {
+    latencies: Vec<f64>,
+    lag: Vec<f64>,
+    committed: usize,
+    errors: usize,
+    final_update: Option<RunUpdate>,
+}
+fn update(placement: &Placement, sequence: u64, payload: usize) -> Result<RunUpdate, &'static str> {
+    let created_at = timestamp()?;
+    let kind = if sequence.is_multiple_of(20) {
+        RunUpdateKind::Message(SessionMessage {
+            session_id: format!("session-{}", placement.index),
+            run_id: format!("run-{}", placement.index),
+            sequence,
+            role: MessageRole::Assistant,
+            content: vec![MessageContentPart::Text("m".repeat(payload * 4))],
+            created_at: created_at.clone(),
+        })
+    } else if sequence % 20 == 10 {
+        RunUpdateKind::State(RunStatus::Running)
+    } else {
+        RunUpdateKind::OutputDelta("x".repeat(payload))
+    };
+    Ok(RunUpdate {
+        run_id: format!("run-{}", placement.index),
+        sequence,
+        created_at,
+        update: kind,
+    })
+}
+async fn writer(
+    placement: Placement,
+    options: Options,
+    rounds: usize,
+    start: tokio::time::Instant,
+) -> WriterResult {
+    let mut result = WriterResult::default();
+    for round in 0..rounds {
+        let ordinal = round * options.streams + placement.index;
+        let deadline = start + Duration::from_secs_f64(ordinal as f64 / options.rate as f64);
+        tokio::time::sleep_until(deadline).await;
+        result.lag.push(
+            tokio::time::Instant::now()
+                .saturating_duration_since(deadline)
+                .as_secs_f64()
+                * 1000.0,
+        );
+        let Ok(update) = update(&placement, (round + 1) as u64, options.payload) else {
+            result.errors += 1;
+            break;
+        };
+        let began = Instant::now();
+        match placement
+            .repo
+            .record_update(&placement.node, &placement.task_id, update.clone())
+            .await
+        {
+            Ok(_) => {
+                result.committed += 1;
+                result.final_update = Some(update);
+            }
+            Err(_) => {
+                result.errors += 1;
+                break;
+            }
+        }
+        result
+            .latencies
+            .push(began.elapsed().as_secs_f64() * 1000.0);
+    }
+    result
+}
+#[derive(Default)]
+struct ReaderResult {
+    latencies: Vec<f64>,
+    queries: usize,
+    errors: usize,
+}
+async fn reader(
+    repo: CloudRepository,
+    caller: CloudCaller,
+    placement: Placement,
+    start: tokio::time::Instant,
+    duration: Duration,
+) -> ReaderResult {
+    let mut result = ReaderResult::default();
+    let end = start + duration;
+    while tokio::time::Instant::now() < end {
+        let began = Instant::now();
+        let read = if result.queries.is_multiple_of(2) {
+            repo.list_threads(&caller, None, None, Some(false), None, 100)
+                .await
+                .map(|_| ())
+        } else {
+            repo.thread_detail(&caller, &placement.thread_id, None, None)
+                .await
+                .map(|_| ())
+        };
+        result
+            .latencies
+            .push(began.elapsed().as_secs_f64() * 1000.0);
+        result.queries += 1;
+        if read.is_err() {
+            result.errors += 1;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    result
+}
+#[derive(Serialize)]
+struct Distribution {
+    samples: usize,
+    p50_ms: f64,
+    p95_ms: f64,
+    max_ms: f64,
+}
+fn distribution(mut values: Vec<f64>) -> Distribution {
+    values.sort_by(f64::total_cmp);
+    let at = |p: f64| {
+        if values.is_empty() {
+            0.0
+        } else {
+            values[((values.len() - 1) as f64 * p).round() as usize]
+        }
+    };
+    Distribution {
+        samples: values.len(),
+        p50_ms: at(0.5),
+        p95_ms: at(0.95),
+        max_ms: at(1.0),
+    }
+}
+
+pub async fn run() -> Result<(), &'static str> {
+    let options = options()?;
+    let rounds = (options.rate * options.seconds).div_ceil(options.streams);
+    let offered = rounds * options.streams;
+    let config = CloudDatabaseConfig {
+        connection_variable: "COLOSSUS_CLOUD_TEST_DATABASE_URL".into(),
+        schema: format!("cloud_load_{}", uuid::Uuid::now_v7().simple()),
+        tls: CloudDatabaseTls::Disabled,
+        max_connections: options.pool,
+        connection_timeout_ms: 5000,
+        statement_timeout_ms: 15000,
+    };
+    let store = Arc::new(
+        CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+            .await
+            .map_err(|_| "database fixture open failed")?,
+    );
+    store
+        .commit(CloudTransaction {
+            entities: vec![EntityMutation {
+                key: EntityKey {
+                    kind: EntityKind::Project,
+                    project_id: PROJECT.into(),
+                    parent_id: None,
+                    id: PROJECT.into(),
+                },
+                expected_revision: 0,
+                value: json!({"project_id":PROJECT,"label":"Load project"}),
+                actor: "load-fixture".into(),
+                operation: "cloud.load.fixture-created.v1".into(),
+            }],
+            ..Default::default()
+        })
+        .await
+        .map_err(|_| "project bootstrap failed")?;
+    let repo = CloudRepository::new(store.clone()).map_err(|_| "repository setup failed")?;
+    let caller = CloudCaller::new(
+        "load-operator".into(),
+        PROJECT.into(),
+        BTreeSet::from([
+            CloudPermission::Administer,
+            CloudPermission::Read,
+            CloudPermission::Execute,
+            CloudPermission::Control,
+        ]),
+    )
+    .map_err(|_| "fixture authority failed")?;
+    let placements: Vec<_> = stream::iter(0..options.streams)
+        .map(|index| placement(repo.clone(), store.clone(), caller.clone(), index))
+        .buffer_unordered(options.pool as usize)
+        .collect::<Vec<_>>()
+        .await
+        .into_iter()
+        .collect::<Result<_, _>>()?;
+    store.enable_transaction_profiling();
+    let before = store.pool_statistics();
+    let start = tokio::time::Instant::now() + Duration::from_millis(100);
+    let began = Instant::now();
+    let mut readers = tokio::task::JoinSet::new();
+    for index in 0..4 {
+        readers.spawn(reader(
+            repo.clone(),
+            caller.clone(),
+            placements[index % placements.len()].clone(),
+            start,
+            Duration::from_secs(options.seconds as u64),
+        ));
+    }
+    let mut writers = tokio::task::JoinSet::new();
+    for placement in &placements {
+        writers.spawn(writer(placement.clone(), options.clone(), rounds, start));
+    }
+    let mut commits = Vec::new();
+    let mut lag = Vec::new();
+    let mut committed = 0;
+    let mut errors = 0;
+    let mut final_updates = Vec::new();
+    while let Some(result) = writers.join_next().await {
+        let result = result.map_err(|_| "writer task failed")?;
+        committed += result.committed;
+        errors += result.errors;
+        commits.extend(result.latencies);
+        lag.extend(result.lag);
+        if let Some(update) = result.final_update {
+            final_updates.push(update);
+        }
+    }
+    let elapsed = began.elapsed().as_secs_f64();
+    let after = store.pool_statistics();
+    let mut queries = 0;
+    let mut query_errors = 0;
+    let mut query_latencies = Vec::new();
+    while let Some(result) = readers.join_next().await {
+        let result = result.map_err(|_| "history reader task failed")?;
+        queries += result.queries;
+        query_errors += result.errors;
+        query_latencies.extend(result.latencies);
+    }
+    // Reopen through a new pool and verify retained history and exact replay before continuation.
+    let reopened = Arc::new(
+        CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+            .await
+            .map_err(|_| "reconnect failed")?,
+    );
+    let resumed =
+        CloudRepository::new(reopened.clone()).map_err(|_| "reconnect repository failed")?;
+    let mut recovered = 0;
+    let mut replayed = 0;
+    let mut continued = 0;
+    for placement in placements.iter().take(10) {
+        let lease = reopened
+            .claim_lease(
+                PROJECT,
+                &placement.node.node_id,
+                "load-replica",
+                now()?,
+                120,
+            )
+            .await
+            .map_err(|_| "reconnect lease failed")?;
+        let bound = resumed.with_lease(lease);
+        let task = resumed
+            .get_task(&caller, &placement.task_id)
+            .await
+            .map_err(|_| "retained task read failed")?;
+        let events = resumed
+            .updates(
+                &caller,
+                &placement.task_id,
+                task.last_sequence.saturating_sub(10),
+                100,
+            )
+            .await
+            .map_err(|_| "history backfill failed")?;
+        if events.len() == task.last_sequence.min(10) as usize {
+            recovered += 1;
+        }
+        if let Some(update) = final_updates
+            .iter()
+            .find(|u| u.run_id == format!("run-{}", placement.index))
+        {
+            bound
+                .record_update(&placement.node, &placement.task_id, update.clone())
+                .await
+                .map_err(|_| "exact replay failed")?;
+            replayed += 1;
+        }
+        let next = update(placement, task.last_sequence + 1, options.payload)?;
+        bound
+            .record_update(&placement.node, &placement.task_id, next)
+            .await
+            .map_err(|_| "continued stream failed")?;
+        continued += 1;
+    }
+    let waited = after
+        .waited_acquisitions
+        .saturating_sub(before.waited_acquisitions);
+    let wait_ms = after.total_wait_ms - before.total_wait_ms;
+    let report = json!({"transaction_profile":store.transaction_profile(),"host_os":std::env::consts::OS,"host_arch":std::env::consts::ARCH,"available_parallelism":std::thread::available_parallelism().map(|v|v.get()).unwrap_or(0),"debug_assertions":cfg!(debug_assertions),"scope":"local PostgreSQL and actual cloud repository; excludes gRPC/SSE/OIDC and runtime execution","streams":options.streams,"pool_connections":options.pool,"offered_updates_per_second":options.rate,"configured_seconds":options.seconds,"output_payload_bytes":options.payload,"message_payload_bytes":options.payload*4,"mix":"90% output delta / 5% released assistant message / 5% state","offered_updates":offered,"committed_updates":committed,"failed_writer_operations":errors,"unattempted_updates":offered.saturating_sub(committed+errors),"error_rate":if offered==0{0.0}else{(offered-committed)as f64/offered as f64},"elapsed_seconds":elapsed,"actual_updates_per_second":committed as f64/elapsed,"target_met":committed as f64/elapsed>=options.rate as f64*0.95&&errors==0,"event_operation_latency":distribution(commits),"offered_queue_lag":distribution(lag),"history_queries":queries,"history_query_errors":query_errors,"history_query_latency":distribution(query_latencies),"pool_acquisitions":after.acquisitions-before.acquisitions,"pool_waited_acquisitions":waited,"pool_total_wait_ms":wait_ms,"pool_mean_waited_acquisition_ms":if waited==0{0.0}else{wait_ms/waited as f64},"pool_timeouts":after.timed_out_acquisitions-before.timed_out_acquisitions,"pool_connections_established":after.connections,"reconnect_history_streams_verified":recovered,"exact_replay_streams_verified":replayed,"continued_streams_verified":continued,"retained_schema":if options.keep{Some(config.schema.clone())}else{None}});
+    let text = serde_json::to_string_pretty(&report).map_err(|_| "report serialization failed")?;
+    if let Some(path) = &options.report {
+        std::fs::OpenOptions::new()
+            .create_new(true)
+            .write(true)
+            .open(path)
+            .and_then(|mut file| std::io::Write::write_all(&mut file, text.as_bytes()))
+            .map_err(|_| "report file cannot be created")?;
+    }
+    println!("{text}");
+    if !options.keep {
+        store
+            .remove_fixture_schema(&config.schema)
+            .await
+            .map_err(|_| "fixture cleanup failed")?;
+    }
+    Ok(())
+}
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000001_cloud_relational/down.sql b/crates/colossus-cloud-postgres/migrations/00000000000001_cloud_relational/down.sql
new file mode 100644
index 000000000..9570b4c12
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000001_cloud_relational/down.sql
@@ -0,0 +1,24 @@
+DROP TABLE thread_sources CASCADE;
+-- Destructive rollback requires an explicit operator decision.
+DROP TABLE connection_leases CASCADE;
+DROP TABLE browser_sessions CASCADE;
+DROP TABLE delivery_outbox CASCADE;
+DROP TABLE cloud_audit CASCADE;
+DROP TABLE sync_cursors CASCADE;
+DROP TABLE released_event_heads CASCADE;
+DROP TABLE released_events CASCADE;
+DROP TABLE certificate_renewals CASCADE;
+DROP TABLE enrollment_invitations CASCADE;
+DROP TABLE admission_counters CASCADE;
+DROP TABLE node_task_placements CASCADE;
+DROP TABLE run_allocations CASCADE;
+DROP TABLE commands CASCADE;
+DROP TABLE tasks CASCADE;
+DROP TABLE conversation_messages CASCADE;
+DROP TABLE conversation_threads CASCADE;
+DROP TABLE workspaces CASCADE;
+DROP TABLE runtime_agents CASCADE;
+DROP TABLE hosts CASCADE;
+DROP TABLE oidc_flows CASCADE;
+DROP TABLE project_memberships CASCADE;
+DROP TABLE projects CASCADE;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000001_cloud_relational/up.sql b/crates/colossus-cloud-postgres/migrations/00000000000001_cloud_relational/up.sql
new file mode 100644
index 000000000..5abb67b1a
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000001_cloud_relational/up.sql
@@ -0,0 +1,343 @@
+-- Cloud relational schema v1. No runtime journal tables or global write-head lock.
+
+
+CREATE TABLE projects (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    project_name TEXT GENERATED ALWAYS AS (record->>'name') STORED, UNIQUE (project_id)
+);
+CREATE INDEX projects_project_page ON projects(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE project_memberships (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    subject TEXT GENERATED ALWAYS AS (record->>'subject') STORED, permissions JSONB GENERATED ALWAYS AS (record->'permissions') STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX project_memberships_project_page ON project_memberships(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE oidc_flows (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    expires_at BIGINT GENERATED ALWAYS AS ((record->>'expires_at')::BIGINT) STORED
+);
+CREATE INDEX oidc_flows_project_page ON oidc_flows(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE hosts (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    host_name TEXT GENERATED ALWAYS AS (record->>'label') STORED, platform TEXT GENERATED ALWAYS AS (record->>'platform') STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX hosts_project_page ON hosts(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE runtime_agents (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    host_id TEXT GENERATED ALWAYS AS (record->>'host_id') STORED, instance_id TEXT GENERATED ALWAYS AS (record->>'instance_id') STORED, certificate_sha256 TEXT GENERATED ALWAYS AS (record->>'certificate_sha256') STORED, revoked BOOLEAN GENERATED ALWAYS AS (COALESCE((record->>'revoked')::BOOLEAN,FALSE)) STORED, UNIQUE(project_id,id),
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX runtime_agents_project_page ON runtime_agents(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE workspaces (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (record->>'node_id') STORED, sharing_mode TEXT GENERATED ALWAYS AS (record->>'sharing') STORED, workspace_name TEXT GENERATED ALWAYS AS (record->>'label') STORED, shared BOOLEAN GENERATED ALWAYS AS (COALESCE((record->>'shared')::BOOLEAN,FALSE)) STORED, UNIQUE(project_id,id),
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX workspaces_project_page ON workspaces(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE conversation_threads (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (record->>'node_id') STORED, workspace_id TEXT GENERATED ALWAYS AS (record->>'workspace_id') STORED, title TEXT GENERATED ALWAYS AS (record->>'title') STORED, archived BOOLEAN GENERATED ALWAYS AS (COALESCE((record->>'archived')::BOOLEAN,FALSE)) STORED, local_session_id TEXT GENERATED ALWAYS AS (record->>'local_session_id') STORED, UNIQUE(project_id,id),
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX conversation_threads_project_page ON conversation_threads(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE conversation_messages (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    thread_id TEXT GENERATED ALWAYS AS (parent_id) STORED, role TEXT GENERATED ALWAYS AS (record->>'role') STORED, source_sequence BIGINT GENERATED ALWAYS AS ((record->>'sequence')::BIGINT) STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX conversation_messages_project_page ON conversation_messages(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE tasks (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (record->>'node_id') STORED, thread_id TEXT GENERATED ALWAYS AS (record->>'thread_id') STORED, run_id TEXT GENERATED ALWAYS AS (record->>'run_id') STORED, subject TEXT GENERATED ALWAYS AS (record->>'subject') STORED, status TEXT GENERATED ALWAYS AS (CASE WHEN record#>>'{dispatch_error,code}'='outcome_unknown' THEN 'outcome_unknown' WHEN record->'dispatch_error' IS NOT NULL AND record->'dispatch_error'<>'null'::JSONB THEN 'failed' ELSE COALESCE(record->>'status',record#>>'{snapshot,run,status}','queued') END) STORED, last_sequence BIGINT GENERATED ALWAYS AS ((record->>'last_sequence')::BIGINT) STORED, UNIQUE(project_id,id),
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX tasks_project_page ON tasks(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE commands (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (parent_id) STORED, task_id TEXT GENERATED ALWAYS AS (record->>'task_id') STORED, operation JSONB GENERATED ALWAYS AS (record->'command') STORED, reply JSONB GENERATED ALWAYS AS (record->'reply') STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX commands_project_page ON commands(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE run_allocations (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (parent_id) STORED, local_run_id TEXT GENERATED ALWAYS AS (id) STORED, task_id TEXT GENERATED ALWAYS AS (CASE WHEN jsonb_typeof(record)='string' THEN record#>>'{}' ELSE record->>'task_id' END) STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX run_allocations_project_page ON run_allocations(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE node_task_placements (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (parent_id) STORED, task_id TEXT GENERATED ALWAYS AS (id) STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX node_task_placements_project_page ON node_task_placements(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE admission_counters (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (id) STORED, active_count INTEGER GENERATED ALWAYS AS (jsonb_array_length(COALESCE(record->'active','[]'::JSONB))) STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX admission_counters_project_page ON admission_counters(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE enrollment_invitations (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    token_hash TEXT GENERATED ALWAYS AS (id) STORED, node_id TEXT GENERATED ALWAYS AS (record->>'node_id') STORED, expires_at BIGINT GENERATED ALWAYS AS ((record->>'expires_at')::BIGINT) STORED, UNIQUE(id),
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX enrollment_invitations_project_page ON enrollment_invitations(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE TABLE certificate_renewals (
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '',
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK (revision > 0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY (project_id, parent_id, id),
+    node_id TEXT GENERATED ALWAYS AS (id) STORED, certificate_sha256 TEXT GENERATED ALWAYS AS (record->>'certificate_sha256') STORED, issued_at BIGINT GENERATED ALWAYS AS ((record->>'issued_at')::BIGINT) STORED,
+    FOREIGN KEY(project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX certificate_renewals_project_page ON certificate_renewals(project_id,domain_updated_at DESC,id DESC) WHERE NOT deleted;
+
+CREATE INDEX agents_host ON runtime_agents(project_id,host_id,id) WHERE NOT deleted;
+CREATE INDEX workspace_node ON workspaces(project_id,node_id,id) WHERE NOT deleted;
+CREATE INDEX thread_workspace ON conversation_threads(project_id,node_id,workspace_id,id) WHERE NOT deleted;
+CREATE INDEX thread_archive_page ON conversation_threads(project_id,archived,updated_at DESC,id DESC) WHERE NOT deleted;
+CREATE INDEX task_node_status ON tasks(project_id,node_id,status,id) WHERE NOT deleted;
+CREATE INDEX task_thread ON tasks(project_id,thread_id,id) WHERE NOT deleted;
+CREATE INDEX command_pending ON commands(project_id,node_id,id) WHERE NOT deleted AND reply IS NULL;
+ALTER TABLE commands ADD FOREIGN KEY(project_id,task_id) REFERENCES tasks(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE run_allocations ADD FOREIGN KEY(project_id,task_id) REFERENCES tasks(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE node_task_placements ADD FOREIGN KEY(project_id,task_id) REFERENCES tasks(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE conversation_messages ADD FOREIGN KEY(project_id,thread_id) REFERENCES conversation_threads(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+CREATE TABLE released_events (
+    project_id TEXT NOT NULL, scope_id TEXT NOT NULL, sequence BIGINT NOT NULL CHECK(sequence>0),
+    record JSONB NOT NULL, digest TEXT NOT NULL, previous_hash TEXT NOT NULL,chain_hash TEXT NOT NULL, received_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY(project_id,scope_id,sequence)
+);
+CREATE TABLE released_event_heads (
+    project_id TEXT NOT NULL,scope_id TEXT NOT NULL,last_sequence BIGINT NOT NULL DEFAULT 0,last_hash TEXT NOT NULL DEFAULT '',
+    PRIMARY KEY(project_id,scope_id)
+);
+CREATE TABLE sync_cursors (
+    project_id TEXT NOT NULL,source_id TEXT NOT NULL,scope_id TEXT NOT NULL,sequence BIGINT NOT NULL CHECK(sequence>=0),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),PRIMARY KEY(project_id,source_id,scope_id)
+);
+CREATE TABLE cloud_audit (
+    project_id TEXT NOT NULL,entity_kind TEXT NOT NULL,parent_id TEXT NOT NULL,id TEXT NOT NULL,revision BIGINT NOT NULL,
+    actor TEXT NOT NULL,operation TEXT NOT NULL,content_digest TEXT NOT NULL,previous_hash TEXT NOT NULL,chain_hash TEXT NOT NULL,
+    recorded_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),PRIMARY KEY(project_id,entity_kind,parent_id,id,revision)
+);
+CREATE TABLE delivery_outbox (
+    outbox_id BIGSERIAL PRIMARY KEY,project_id TEXT NOT NULL,scope_id TEXT NOT NULL,event_kind TEXT NOT NULL,
+    revision BIGINT NOT NULL,created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),delivered_at TIMESTAMPTZ
+);
+CREATE INDEX outbox_pending ON delivery_outbox(outbox_id) WHERE delivered_at IS NULL;
+CREATE TABLE browser_sessions (
+    session_hash TEXT PRIMARY KEY CHECK(length(session_hash)=64),subject TEXT NOT NULL,csrf_hash TEXT NOT NULL,
+    created_at BIGINT NOT NULL,expires_at BIGINT NOT NULL CHECK(expires_at>created_at)
+);
+CREATE INDEX browser_session_expiry ON browser_sessions(expires_at);
+CREATE TABLE connection_leases (
+    project_id TEXT NOT NULL,node_id TEXT NOT NULL,owner_id TEXT NOT NULL,generation BIGINT NOT NULL CHECK(generation>0),
+    expires_at BIGINT NOT NULL,PRIMARY KEY(project_id,node_id)
+);
+
+
+CREATE TABLE thread_sources (
+ project_id TEXT NOT NULL,parent_id TEXT NOT NULL DEFAULT '',id TEXT NOT NULL,revision BIGINT NOT NULL CHECK(revision>0),
+ record JSONB NOT NULL,audit_hash TEXT NOT NULL,deleted BOOLEAN NOT NULL DEFAULT FALSE,
+ created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+ node_id TEXT GENERATED ALWAYS AS (parent_id) STORED,
+ local_session_id TEXT GENERATED ALWAYS AS (id) STORED,
+ thread_id TEXT GENERATED ALWAYS AS (CASE WHEN jsonb_typeof(record)='string' THEN record#>>'{}' ELSE record->>'thread_id' END) STORED,
+ PRIMARY KEY(project_id,parent_id,id),
+ FOREIGN KEY(project_id,thread_id) REFERENCES conversation_threads(project_id,id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX thread_sources_thread ON thread_sources(project_id,thread_id) WHERE NOT deleted;
+
+CREATE INDEX membership_subject ON project_memberships(subject,project_id) WHERE NOT deleted;
+
+CREATE INDEX task_created_page ON tasks(project_id,domain_created_at DESC,id DESC) WHERE NOT deleted;
+CREATE INDEX message_created_page ON conversation_messages(project_id,parent_id,domain_created_at DESC,id DESC) WHERE NOT deleted;
+ALTER TABLE hosts ADD UNIQUE(project_id,id);
+ALTER TABLE runtime_agents ADD FOREIGN KEY(project_id,host_id) REFERENCES hosts(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE workspaces ADD FOREIGN KEY(project_id,node_id) REFERENCES runtime_agents(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE conversation_threads ADD FOREIGN KEY(project_id,node_id) REFERENCES runtime_agents(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE conversation_threads ADD FOREIGN KEY(project_id,workspace_id) REFERENCES workspaces(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE tasks ADD FOREIGN KEY(project_id,node_id) REFERENCES runtime_agents(project_id,id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE certificate_renewals ADD FOREIGN KEY(project_id,node_id) REFERENCES runtime_agents(project_id,id) DEFERRABLE INITIALLY DEFERRED;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000002_operational_retention/down.sql b/crates/colossus-cloud-postgres/migrations/00000000000002_operational_retention/down.sql
new file mode 100644
index 000000000..170b558ff
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000002_operational_retention/down.sql
@@ -0,0 +1,2 @@
+DROP INDEX oidc_flow_expiry;
+DROP INDEX outbox_delivered_expiry;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000002_operational_retention/up.sql b/crates/colossus-cloud-postgres/migrations/00000000000002_operational_retention/up.sql
new file mode 100644
index 000000000..6d92f63df
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000002_operational_retention/up.sql
@@ -0,0 +1,3 @@
+-- Bound operational retention scans; canonical history/audit remains operator-retained.
+CREATE INDEX outbox_delivered_expiry ON delivery_outbox(delivered_at,outbox_id) WHERE delivered_at IS NOT NULL;
+CREATE INDEX oidc_flow_expiry ON oidc_flows(expires_at,id) WHERE expires_at IS NOT NULL;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000003_coalesced_hints/down.sql b/crates/colossus-cloud-postgres/migrations/00000000000003_coalesced_hints/down.sql
new file mode 100644
index 000000000..a8cf351c3
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000003_coalesced_hints/down.sql
@@ -0,0 +1 @@
+DROP INDEX outbox_pending_scope;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000003_coalesced_hints/up.sql b/crates/colossus-cloud-postgres/migrations/00000000000003_coalesced_hints/up.sql
new file mode 100644
index 000000000..e479bfa8f
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000003_coalesced_hints/up.sql
@@ -0,0 +1,10 @@
+-- Outbox entries are publication hints, never commands or released event authority.
+-- Keep the newest pending hint for each scope; every source commit already publishes
+-- its original notification. Repeated source output must not grow an unconsumed queue.
+WITH duplicates AS (
+    SELECT outbox_id,ROW_NUMBER() OVER(PARTITION BY project_id,scope_id ORDER BY outbox_id DESC) AS ordinal
+    FROM delivery_outbox WHERE delivered_at IS NULL
+)
+UPDATE delivery_outbox SET delivered_at=clock_timestamp()
+WHERE outbox_id IN(SELECT outbox_id FROM duplicates WHERE ordinal>1);
+CREATE UNIQUE INDEX outbox_pending_scope ON delivery_outbox(project_id,scope_id) WHERE delivered_at IS NULL;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000004_project_hints/down.sql b/crates/colossus-cloud-postgres/migrations/00000000000004_project_hints/down.sql
new file mode 100644
index 000000000..c981fcee9
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000004_project_hints/down.sql
@@ -0,0 +1,2 @@
+DROP INDEX outbox_pending_project;
+CREATE UNIQUE INDEX outbox_pending_scope ON delivery_outbox(project_id,scope_id) WHERE delivered_at IS NULL;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000004_project_hints/up.sql b/crates/colossus-cloud-postgres/migrations/00000000000004_project_hints/up.sql
new file mode 100644
index 000000000..2b568e540
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000004_project_hints/up.sql
@@ -0,0 +1,10 @@
+-- Publication carries only a project hint; aggregate changing entities into one
+-- pending project wakeup so retained publication metadata follows projects, not tokens.
+WITH duplicates AS (
+    SELECT outbox_id,ROW_NUMBER() OVER(PARTITION BY project_id ORDER BY outbox_id DESC) AS ordinal
+    FROM delivery_outbox WHERE delivered_at IS NULL
+)
+UPDATE delivery_outbox SET delivered_at=clock_timestamp()
+WHERE outbox_id IN(SELECT outbox_id FROM duplicates WHERE ordinal>1);
+DROP INDEX outbox_pending_scope;
+CREATE UNIQUE INDEX outbox_pending_project ON delivery_outbox(project_id) WHERE delivered_at IS NULL;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000005_pending_commands/down.sql b/crates/colossus-cloud-postgres/migrations/00000000000005_pending_commands/down.sql
new file mode 100644
index 000000000..129bdd210
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000005_pending_commands/down.sql
@@ -0,0 +1,2 @@
+DROP INDEX command_pending;
+CREATE INDEX command_pending ON commands(project_id,node_id,id) WHERE NOT deleted AND reply IS NULL;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000005_pending_commands/up.sql b/crates/colossus-cloud-postgres/migrations/00000000000005_pending_commands/up.sql
new file mode 100644
index 000000000..527acf018
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000005_pending_commands/up.sql
@@ -0,0 +1,4 @@
+-- Serde absent replies are JSON null, which differs from a SQL NULL value.
+DROP INDEX command_pending;
+CREATE INDEX command_pending ON commands(project_id,node_id,id)
+WHERE NOT deleted AND (reply IS NULL OR reply='null'::JSONB);
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000006_thread_sync_status/down.sql b/crates/colossus-cloud-postgres/migrations/00000000000006_thread_sync_status/down.sql
new file mode 100644
index 000000000..e20e7f789
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000006_thread_sync_status/down.sql
@@ -0,0 +1 @@
+DROP INDEX task_incomplete_thread;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000006_thread_sync_status/up.sql b/crates/colossus-cloud-postgres/migrations/00000000000006_thread_sync_status/up.sql
new file mode 100644
index 000000000..206e2212b
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000006_thread_sync_status/up.sql
@@ -0,0 +1,8 @@
+-- A thread's oldest incomplete source must remain visible in its aggregate status.
+CREATE INDEX task_incomplete_thread ON tasks(project_id,thread_id,id)
+WHERE NOT deleted AND (
+    COALESCE((record->>'output_limited')::BOOLEAN,FALSE)
+    OR COALESCE((record->>'history_bounded')::BOOLEAN,FALSE)
+    OR (record->>'subject'='runtime' AND NOT COALESCE((record->>'history_complete')::BOOLEAN,FALSE))
+    OR COALESCE((record#>>'{snapshot,run,last_sequence}')::BIGINT,0)>COALESCE(last_sequence,0)
+);
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000007_identity_projects/down.sql b/crates/colossus-cloud-postgres/migrations/00000000000007_identity_projects/down.sql
new file mode 100644
index 000000000..792304331
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000007_identity_projects/down.sql
@@ -0,0 +1,6 @@
+ALTER TABLE browser_sessions DROP COLUMN security_epoch;
+ALTER TABLE projects DROP COLUMN parent_project_id CASCADE;
+ALTER TABLE projects DROP COLUMN archived;
+ALTER TABLE project_memberships DROP COLUMN user_id CASCADE;
+ALTER TABLE project_memberships DROP COLUMN project_role;
+DROP TABLE control_plane_settings,local_credentials,user_identities,cloud_users;
diff --git a/crates/colossus-cloud-postgres/migrations/00000000000007_identity_projects/up.sql b/crates/colossus-cloud-postgres/migrations/00000000000007_identity_projects/up.sql
new file mode 100644
index 000000000..70de63649
--- /dev/null
+++ b/crates/colossus-cloud-postgres/migrations/00000000000007_identity_projects/up.sql
@@ -0,0 +1,94 @@
+-- Dedicated product identities; project hierarchy remains display-only authority.
+CREATE TABLE cloud_users(
+    project_id TEXT NOT NULL CHECK(project_id='__identity'),
+    parent_id TEXT NOT NULL DEFAULT '' CHECK(parent_id=''),
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK(revision>0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY(project_id,parent_id,id),
+    display_name TEXT GENERATED ALWAYS AS(record#>>'{user,display_name}') STORED,
+    active BOOLEAN GENERATED ALWAYS AS(COALESCE((record#>>'{user,active}')::BOOLEAN,FALSE)) STORED,
+    is_admin BOOLEAN GENERATED ALWAYS AS(COALESCE((record#>>'{user,is_admin}')::BOOLEAN,FALSE)) STORED,
+    security_epoch BIGINT GENERATED ALWAYS AS((record->>'security_epoch')::BIGINT) STORED,
+    UNIQUE(id)
+);
+CREATE INDEX cloud_users_page ON cloud_users(project_id,id) WHERE NOT deleted;
+CREATE TABLE user_identities(
+    project_id TEXT NOT NULL CHECK(project_id='__identity'),
+    parent_id TEXT NOT NULL DEFAULT '' CHECK(parent_id=''),
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK(revision>0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY(project_id,parent_id,id),
+    user_id TEXT GENERATED ALWAYS AS(record->>'user_id') STORED,
+    issuer TEXT GENERATED ALWAYS AS(record->>'issuer') STORED,
+    subject TEXT GENERATED ALWAYS AS(record->>'subject') STORED,
+    UNIQUE(issuer,subject),
+    FOREIGN KEY(user_id) REFERENCES cloud_users(id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX user_identities_page ON user_identities(project_id,id) WHERE NOT deleted;
+CREATE TABLE local_credentials(
+    project_id TEXT NOT NULL CHECK(project_id='__identity'),
+    parent_id TEXT NOT NULL DEFAULT '' CHECK(parent_id=''),
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK(revision>0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY(project_id,parent_id,id),
+    user_id TEXT GENERATED ALWAYS AS(record->>'user_id') STORED,
+    username TEXT GENERATED ALWAYS AS(record->>'username') STORED,
+    password_hash TEXT GENERATED ALWAYS AS(record->>'password_hash') STORED,
+    UNIQUE(username),
+    FOREIGN KEY(user_id) REFERENCES cloud_users(id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX local_credentials_page ON local_credentials(project_id,id) WHERE NOT deleted;
+CREATE TABLE control_plane_settings(
+    project_id TEXT NOT NULL,
+    parent_id TEXT NOT NULL DEFAULT '' CHECK(parent_id=''),
+    id TEXT NOT NULL,
+    revision BIGINT NOT NULL CHECK(revision>0),
+    record JSONB NOT NULL,
+    audit_hash TEXT NOT NULL,
+    deleted BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    domain_updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+    PRIMARY KEY(project_id,parent_id,id),
+    setting_name TEXT GENERATED ALWAYS AS(id) STORED,
+    scope_project_id TEXT GENERATED ALWAYS AS(CASE WHEN project_id='__identity' THEN NULL ELSE project_id END) STORED,
+    FOREIGN KEY(scope_project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX control_plane_settings_page ON control_plane_settings(project_id,id) WHERE NOT deleted;
+CREATE INDEX cloud_users_active_admin ON cloud_users(id) WHERE active AND is_admin AND NOT deleted;
+CREATE INDEX cloud_users_display_search ON cloud_users(lower(display_name),id) WHERE NOT deleted;
+ALTER TABLE project_memberships ADD COLUMN user_id TEXT GENERATED ALWAYS AS(record->>'user_id') STORED;
+ALTER TABLE project_memberships ADD COLUMN project_role TEXT GENERATED ALWAYS AS(record->>'role') STORED;
+ALTER TABLE project_memberships ADD FOREIGN KEY(user_id) REFERENCES cloud_users(id) DEFERRABLE INITIALLY DEFERRED;
+CREATE UNIQUE INDEX project_user_membership ON project_memberships(project_id,user_id) WHERE NOT deleted AND user_id IS NOT NULL;
+ALTER TABLE projects ADD COLUMN parent_project_id TEXT GENERATED ALWAYS AS(record->>'parent_project_id') STORED;
+ALTER TABLE projects ADD COLUMN archived BOOLEAN GENERATED ALWAYS AS(COALESCE((record->>'archived')::BOOLEAN,FALSE)) STORED;
+ALTER TABLE projects ADD FOREIGN KEY(parent_project_id) REFERENCES projects(project_id) DEFERRABLE INITIALLY DEFERRED;
+ALTER TABLE projects ADD CHECK(parent_project_id IS NULL OR parent_project_id<>project_id);
+CREATE INDEX project_hierarchy ON projects(parent_project_id,project_id) WHERE NOT deleted;
+ALTER TABLE browser_sessions ADD COLUMN security_epoch BIGINT NOT NULL DEFAULT 0 CHECK(security_epoch>=0);
+
+CREATE INDEX local_credential_account ON local_credentials(user_id) WHERE NOT deleted;
+CREATE INDEX provider_identity_account ON user_identities(user_id) WHERE NOT deleted;
diff --git a/crates/colossus-cloud-postgres/src/canonical.rs b/crates/colossus-cloud-postgres/src/canonical.rs
new file mode 100644
index 000000000..d8ad45b6e
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/canonical.rs
@@ -0,0 +1,46 @@
+//! Persisted hash encoding independent of serde_json's feature-unified map order.
+use colossus_ports::StoreError;
+use serde::{
+    Serialize, Serializer,
+    ser::{SerializeMap, SerializeSeq},
+};
+use serde_json::Value;
+
+struct SortedValue<'a>(&'a Value);
+impl Serialize for SortedValue<'_> {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        match self.0 {
+            Value::Object(object) => {
+                let mut keys: Vec<_> = object.keys().collect();
+                keys.sort_unstable();
+                let mut map = serializer.serialize_map(Some(object.len()))?;
+                for key in keys {
+                    map.serialize_entry(key, &SortedValue(&object[key]))?;
+                }
+                map.end()
+            }
+            Value::Array(array) => {
+                let mut sequence = serializer.serialize_seq(Some(array.len()))?;
+                for value in array {
+                    sequence.serialize_element(&SortedValue(value))?;
+                }
+                sequence.end()
+            }
+            Value::Number(number)
+                if number.is_f64()
+                    && number
+                        .as_f64()
+                        .is_some_and(|value| value == 0.0 && value.is_sign_negative()) =>
+            {
+                0.0_f64.serialize(serializer)
+            }
+            // Keep exact integer and floating-number representations. In particular,
+            // never convert u64 revisions/sequences through an IEEE-754 value.
+            value => value.serialize(serializer),
+        }
+    }
+}
+pub(super) fn bytes(value: &Value) -> Result<Vec<u8>, StoreError> {
+    serde_json::to_vec(&SortedValue(value))
+        .map_err(|_| StoreError::Adapter("cloud value serialization failed".into()))
+}
diff --git a/crates/colossus-cloud-postgres/src/checkpoint.rs b/crates/colossus-cloud-postgres/src/checkpoint.rs
new file mode 100644
index 000000000..771e94b30
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/checkpoint.rs
@@ -0,0 +1,299 @@
+use crate::{CloudPostgresStore, entities, store::TransactionError};
+use colossus_cloud::{
+    CloudError, CloudResult,
+    storage::{EntityKey, EntityKind},
+};
+use colossus_ports::StoreError;
+use diesel::{
+    sql_query,
+    sql_types::{BigInt, Text},
+};
+use diesel_async::RunQueryDsl;
+use ed25519_dalek::{Signature, Signer, SigningKey, VerifyingKey};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+use zeroize::Zeroizing;
+
+/// Retained per-entity/feed audit identity, without released message or credential content.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudAuditHead {
+    /// Closed cloud table or released-feed namespace.
+    pub entity_kind: String,
+    /// Runtime/thread parent, empty for root resources.
+    pub parent_id: String,
+    /// Opaque entity/feed identity.
+    pub id: String,
+    /// Highest retained audit revision or source sequence.
+    pub revision: u64,
+    /// Exact retained chain head.
+    pub chain_hash: String,
+}
+/// Metadata-only snapshot retained independently of PostgreSQL.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudAuditCheckpoint {
+    /// Current checkpoint envelope version.
+    pub format_version: u32,
+    /// Exact project protected by the export.
+    pub project_id: String,
+    /// UTC operator export time.
+    pub generated_at: String,
+    /// Number of checked retained audit records.
+    pub verified_audit_records: u64,
+    /// Deterministically ordered retained heads.
+    pub heads: Vec<CloudAuditHead>,
+}
+/// An Ed25519 signed checkpoint. The independent key must never be an auth/flow key.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SignedCloudAuditCheckpoint {
+    /// Metadata-only checkpoint contents.
+    pub checkpoint: CloudAuditCheckpoint,
+    /// SHA-256 of canonical serialized checkpoint contents.
+    pub checkpoint_sha256: String,
+    /// Public verification key, hexadecimal; operators must pin it independently.
+    pub public_key: String,
+    /// Ed25519 signature over the exact canonical checkpoint bytes.
+    pub signature: String,
+}
+
+#[derive(diesel::QueryableByName)]
+struct AuditRow {
+    #[diesel(sql_type=Text)]
+    entity_kind: String,
+    #[diesel(sql_type=Text)]
+    parent_id: String,
+    #[diesel(sql_type=Text)]
+    id: String,
+    #[diesel(sql_type=BigInt)]
+    revision: i64,
+    #[diesel(sql_type=Text)]
+    actor: String,
+    #[diesel(sql_type=Text)]
+    operation: String,
+    #[diesel(sql_type=Text)]
+    content_digest: String,
+    #[diesel(sql_type=Text)]
+    previous_hash: String,
+    #[diesel(sql_type=Text)]
+    chain_hash: String,
+}
+fn kind(table: &str) -> Option<EntityKind> {
+    match table {
+        "cloud_users" => Some(EntityKind::User),
+        "user_identities" => Some(EntityKind::OidcIdentity),
+        "local_credentials" => Some(EntityKind::LocalCredential),
+        "control_plane_settings" => Some(EntityKind::Setting),
+        "projects" => Some(EntityKind::Project),
+        "project_memberships" => Some(EntityKind::Membership),
+        "oidc_flows" => Some(EntityKind::AuthFlow),
+        "hosts" => Some(EntityKind::Host),
+        "runtime_agents" => Some(EntityKind::Node),
+        "workspaces" => Some(EntityKind::Workspace),
+        "conversation_threads" => Some(EntityKind::Thread),
+        "conversation_messages" => Some(EntityKind::ThreadMessage),
+        "thread_sources" => Some(EntityKind::SessionMapping),
+        "tasks" => Some(EntityKind::Task),
+        "commands" => Some(EntityKind::Command),
+        "run_allocations" => Some(EntityKind::Run),
+        "node_task_placements" => Some(EntityKind::NodeTask),
+        "admission_counters" => Some(EntityKind::Admission),
+        "enrollment_invitations" => Some(EntityKind::Invitation),
+        "certificate_renewals" => Some(EntityKind::Renewal),
+        _ => None,
+    }
+}
+fn verify_row(project: &str, row: &AuditRow) -> Result<(), StoreError> {
+    let computed = match row.entity_kind.as_str() {
+        "released_events" => entities::digest(&serde_json::json!([
+            "released_events",
+            project,
+            row.id,
+            row.revision,
+            row.content_digest,
+            row.previous_hash
+        ]))?,
+        "sync_cursors" => entities::digest(&serde_json::json!([
+            "sync_cursors",
+            project,
+            row.parent_id,
+            row.id,
+            row.revision,
+            row.content_digest,
+            row.previous_hash
+        ]))?,
+        table => {
+            let key = EntityKey {
+                kind: kind(table).ok_or_else(|| {
+                    StoreError::Verification("unknown cloud audit namespace".into())
+                })?,
+                project_id: project.into(),
+                parent_id: (!row.parent_id.is_empty()).then(|| row.parent_id.clone()),
+                id: row.id.clone(),
+            };
+            entities::chain(
+                &key,
+                row.revision as u64,
+                &row.actor,
+                &row.operation,
+                &row.content_digest,
+                &row.previous_hash,
+            )?
+        }
+    };
+    if computed != row.chain_hash {
+        return Err(StoreError::Verification(
+            "cloud audit checkpoint chain mismatch".into(),
+        ));
+    }
+    Ok(())
+}
+impl CloudPostgresStore {
+    /// Verify retained project audit chains in a consistent snapshot and sign only heads.
+    /// The explicit signing reference must resolve a separately provisioned 32-byte seed.
+    pub async fn export_audit_checkpoint(
+        &self,
+        project: &str,
+        signing_key_variable: &str,
+    ) -> CloudResult<SignedCloudAuditCheckpoint> {
+        colossus_cloud::validate_identifier(project)?;
+        if signing_key_variable.is_empty()
+            || signing_key_variable.len() > 128
+            || !signing_key_variable
+                .bytes()
+                .enumerate()
+                .all(|(i, b)| b == b'_' || b.is_ascii_alphabetic() || (i > 0 && b.is_ascii_digit()))
+            || ["AUTH", "SESSION", "OIDC", "ENCRYPT"]
+                .iter()
+                .any(|reserved| signing_key_variable.to_ascii_uppercase().contains(reserved))
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        let secret =
+            Zeroizing::new(std::env::var(signing_key_variable).map_err(|_| CloudError::Storage)?);
+        let decoded =
+            Zeroizing::new(hex::decode(secret.as_str()).map_err(|_| CloudError::InvalidArgument)?);
+        let seed =
+            <&[u8; 32]>::try_from(decoded.as_slice()).map_err(|_| CloudError::InvalidArgument)?;
+        let signing = SigningKey::from_bytes(seed);
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        let (heads,count)=conn.build_transaction().repeatable_read().read_only().run(async|conn|{
+            let mut heads:BTreeMap<(String,String,String),CloudAuditHead>=BTreeMap::new();let mut count=0_u64;
+            let(mut after_kind,mut after_parent,mut after_id,mut after_revision)=(String::new(),String::new(),String::new(),0_i64);
+            loop{
+                let rows=sql_query("SELECT entity_kind,parent_id,id,revision,actor,operation,content_digest,previous_hash,chain_hash FROM cloud_audit WHERE project_id=$1 AND (entity_kind,parent_id,id,revision)>($2,$3,$4,$5) ORDER BY entity_kind,parent_id,id,revision LIMIT 1000")
+                    .bind::<Text,_>(project).bind::<Text,_>(&after_kind).bind::<Text,_>(&after_parent).bind::<Text,_>(&after_id).bind::<BigInt,_>(after_revision).load::<AuditRow>(conn).await?;
+                if rows.is_empty(){break;}
+                for row in rows {
+                    count+=1;if count>2_000_000||heads.len()>100_000{return Err(TransactionError::Store(StoreError::Adapter("checkpoint export bound exceeded".into())));}
+                    verify_row(project,&row)?;
+                    let identity=(row.entity_kind.clone(),row.parent_id.clone(),row.id.clone());
+                    let prior=heads.get(&identity);
+                    if prior.map_or(!row.previous_hash.is_empty(),|head|head.chain_hash!=row.previous_hash||row.revision as u64<=head.revision){return Err(TransactionError::Store(StoreError::Verification("cloud audit chain gap".into())));}
+                    if row.entity_kind!="sync_cursors"&&row.revision as u64!=prior.map_or(1,|head|head.revision+1){return Err(TransactionError::Store(StoreError::Verification("cloud audit revision gap".into())));}
+                    after_kind=row.entity_kind.clone();after_parent=row.parent_id.clone();after_id=row.id.clone();after_revision=row.revision;
+                    heads.insert(identity,CloudAuditHead{entity_kind:row.entity_kind,parent_id:row.parent_id,id:row.id,revision:row.revision as u64,chain_hash:row.chain_hash});
+                }
+            }
+            Ok::<_,TransactionError>((heads.into_values().collect::<Vec<_>>(),count))
+        }).await.map_err(|error|CloudError::from(error.into_store()))?;
+        if heads.is_empty() {
+            return Err(CloudError::NotFound);
+        }
+        let checkpoint = CloudAuditCheckpoint {
+            format_version: 1,
+            project_id: project.into(),
+            generated_at: OffsetDateTime::now_utc()
+                .format(&Rfc3339)
+                .map_err(|_| CloudError::Storage)?,
+            verified_audit_records: count,
+            heads,
+        };
+        let bytes = crate::canonical::bytes(
+            &serde_json::to_value(&checkpoint).map_err(|_| CloudError::Storage)?,
+        )
+        .map_err(|_| CloudError::Storage)?;
+        let hash =
+            entities::digest(&serde_json::to_value(&checkpoint).map_err(|_| CloudError::Storage)?)
+                .map_err(|_| CloudError::Storage)?;
+        Ok(SignedCloudAuditCheckpoint {
+            checkpoint,
+            checkpoint_sha256: hash,
+            public_key: hex::encode(signing.verifying_key().as_bytes()),
+            signature: hex::encode(signing.sign(&bytes).to_bytes()),
+        })
+    }
+    /// Compare a separately retained signed anchor with the current database, detecting
+    /// missing/changed anchored audit entries and resource/feed rollback below their heads.
+    pub async fn verify_audit_checkpoint(
+        &self,
+        anchor: &SignedCloudAuditCheckpoint,
+        pinned_public_key: &str,
+    ) -> CloudResult<()> {
+        verify_checkpoint_signature(anchor, pinned_public_key)?;
+        if anchor.checkpoint.heads.len() > 100_000 {
+            return Err(CloudError::ResourceExhausted);
+        }
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        #[derive(diesel::QueryableByName)]
+        struct Hash {
+            #[diesel(sql_type=Text)]
+            chain_hash: String,
+            #[diesel(sql_type=Text)]
+            operation: String,
+        }
+        #[derive(diesel::QueryableByName)]
+        struct Revision {
+            #[diesel(sql_type=BigInt)]
+            revision: i64,
+        }
+        for head in &anchor.checkpoint.heads {
+            let audit=sql_query("SELECT chain_hash,operation FROM cloud_audit WHERE project_id=$1 AND entity_kind=$2 AND parent_id=$3 AND id=$4 AND revision=$5").bind::<Text,_>(&anchor.checkpoint.project_id).bind::<Text,_>(&head.entity_kind).bind::<Text,_>(&head.parent_id).bind::<Text,_>(&head.id).bind::<BigInt,_>(entities::integer(head.revision).map_err(|_|CloudError::InvalidArgument)?).get_result::<Hash>(&mut conn).await.map_err(|_|CloudError::Storage)?;
+            if audit.chain_hash != head.chain_hash {
+                return Err(CloudError::Storage);
+            }
+            let revision=match head.entity_kind.as_str(){
+                "released_events"=>sql_query("SELECT last_sequence AS revision FROM released_event_heads WHERE project_id=$1 AND scope_id=$2").bind::<Text,_>(&anchor.checkpoint.project_id).bind::<Text,_>(&head.id).get_result::<Revision>(&mut conn).await,
+                "sync_cursors"=>sql_query("SELECT sequence AS revision FROM sync_cursors WHERE project_id=$1 AND source_id=$2 AND scope_id=$3").bind::<Text,_>(&anchor.checkpoint.project_id).bind::<Text,_>(&head.parent_id).bind::<Text,_>(&head.id).get_result::<Revision>(&mut conn).await,
+                table=>{let kind=kind(table).ok_or(CloudError::InvalidArgument)?;sql_query(format!("SELECT revision FROM {} WHERE project_id=$1 AND parent_id=$2 AND id=$3",entities::table(kind))).bind::<Text,_>(&anchor.checkpoint.project_id).bind::<Text,_>(&head.parent_id).bind::<Text,_>(&head.id).get_result::<Revision>(&mut conn).await},
+            };
+            match revision {
+                Ok(row) if row.revision as u64 >= head.revision => {}
+                Err(diesel::result::Error::NotFound)
+                    if head.entity_kind == "oidc_flows"
+                        && audit.operation == "cloud.entity.consumed.v1" => {}
+                _ => return Err(CloudError::Storage),
+            }
+        }
+        Ok(())
+    }
+}
+/// Verify an exported anchor against an independently pinned public key before use.
+pub fn verify_checkpoint_signature(
+    anchor: &SignedCloudAuditCheckpoint,
+    pinned_public_key: &str,
+) -> CloudResult<()> {
+    if anchor.checkpoint.format_version != 1 || anchor.public_key != pinned_public_key {
+        return Err(CloudError::InvalidArgument);
+    }
+    let key = hex::decode(pinned_public_key).map_err(|_| CloudError::InvalidArgument)?;
+    let key = <&[u8; 32]>::try_from(key.as_slice()).map_err(|_| CloudError::InvalidArgument)?;
+    let verifying = VerifyingKey::from_bytes(key).map_err(|_| CloudError::InvalidArgument)?;
+    let signature = hex::decode(&anchor.signature).map_err(|_| CloudError::InvalidArgument)?;
+    let signature = Signature::from_slice(&signature).map_err(|_| CloudError::InvalidArgument)?;
+    let value =
+        serde_json::to_value(&anchor.checkpoint).map_err(|_| CloudError::InvalidArgument)?;
+    if entities::digest(&value).map_err(|_| CloudError::InvalidArgument)?
+        != anchor.checkpoint_sha256
+    {
+        return Err(CloudError::InvalidArgument);
+    }
+    verifying
+        .verify_strict(
+            &crate::canonical::bytes(&value).map_err(|_| CloudError::InvalidArgument)?,
+            &signature,
+        )
+        .map_err(|_| CloudError::InvalidArgument)
+}
diff --git a/crates/colossus-cloud-postgres/src/config.rs b/crates/colossus-cloud-postgres/src/config.rs
new file mode 100644
index 000000000..be2cd3c6e
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/config.rs
@@ -0,0 +1,77 @@
+use colossus_cloud::{CloudError, CloudResult};
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+
+/// Verified database transport policy, independent of runtime journal configuration.
+#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(
+    tag = "kind",
+    rename_all = "snake_case",
+    rename_all_fields = "camelCase",
+    deny_unknown_fields
+)]
+pub enum CloudDatabaseTls {
+    /// Require rustls hostname verification against WebPKI and configured runtime roots.
+    #[default]
+    WebpkiRoots,
+    /// Require rustls hostname verification against this explicit CA bundle.
+    CustomCa {
+        /// Native adapter-owned PEM trust path.
+        ca_pem_path: PathBuf,
+    },
+    /// Explicit isolated loopback/Unix fixture only; remote plaintext is rejected.
+    Disabled,
+}
+
+/// Credential-reference-only, bounded cloud PostgreSQL pool configuration.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CloudDatabaseConfig {
+    /// Environment variable containing the connection URL; never copied into logs.
+    pub connection_variable: String,
+    /// Dedicated cloud relational schema.
+    pub schema: String,
+    /// Verified TLS policy.
+    #[serde(default)]
+    pub tls: CloudDatabaseTls,
+    /// At most this many open connections per cloud replica.
+    #[serde(default = "max_connections")]
+    pub max_connections: u32,
+    /// Connection/pool acquisition deadline.
+    #[serde(default = "connection_timeout_ms")]
+    pub connection_timeout_ms: u64,
+    /// Per-connection SQL statement and lock deadline.
+    #[serde(default = "statement_timeout_ms")]
+    pub statement_timeout_ms: u64,
+}
+const fn max_connections() -> u32 {
+    16
+}
+const fn connection_timeout_ms() -> u64 {
+    5000
+}
+const fn statement_timeout_ms() -> u64 {
+    15000
+}
+
+impl CloudDatabaseConfig {
+    /// Validate the nonsecret configuration before resolving credential references.
+    pub fn validate(&self) -> CloudResult<()> {
+        if !identifier(&self.connection_variable, 128)
+            || !identifier(&self.schema, 63)
+            || !(1..=128).contains(&self.max_connections)
+            || !(100..=60000).contains(&self.connection_timeout_ms)
+            || !(100..=300000).contains(&self.statement_timeout_ms)
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        Ok(())
+    }
+}
+fn identifier(value: &str, max: usize) -> bool {
+    !value.is_empty()
+        && value.len() <= max
+        && value.bytes().enumerate().all(|(index, b)| {
+            b == b'_' || b.is_ascii_alphabetic() || (index > 0 && b.is_ascii_digit())
+        })
+}
diff --git a/crates/colossus-cloud-postgres/src/connection.rs b/crates/colossus-cloud-postgres/src/connection.rs
new file mode 100644
index 000000000..15ecf264d
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/connection.rs
@@ -0,0 +1,129 @@
+use crate::{CloudDatabaseConfig, CloudDatabaseTls};
+use colossus_cloud::{CloudError, CloudResult};
+use colossus_network::AdditionalRootCertificates;
+use diesel::ConnectionResult;
+use diesel_async::{AsyncPgConnection, SimpleAsyncConnection};
+use rustls::{
+    ClientConfig, RootCertStore,
+    pki_types::{CertificateDer, pem::PemObject},
+};
+use std::{sync::Arc, time::Duration};
+use tokio_postgres::{
+    Config, NoTls,
+    config::{Host, SslMode},
+};
+use tokio_postgres_rustls::MakeRustlsConnect;
+
+fn categorical_connection_error() -> diesel::ConnectionError {
+    diesel::ConnectionError::BadConnection("cloud PostgreSQL connection is unavailable".into())
+}
+
+pub(super) fn trust(
+    config: &CloudDatabaseConfig,
+    additional: &AdditionalRootCertificates,
+) -> CloudResult<Option<MakeRustlsConnect>> {
+    let mut roots = match &config.tls {
+        CloudDatabaseTls::Disabled => return Ok(None),
+        CloudDatabaseTls::WebpkiRoots => {
+            let mut roots = RootCertStore {
+                roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+            };
+            additional
+                .add_to_rustls(&mut roots)
+                .map_err(|_| CloudError::InvalidArgument)?;
+            roots
+        }
+        CloudDatabaseTls::CustomCa { ca_pem_path } => {
+            let bytes = std::fs::read(ca_pem_path).map_err(|_| CloudError::InvalidArgument)?;
+            let mut roots = RootCertStore::empty();
+            for cert in CertificateDer::pem_slice_iter(&bytes) {
+                roots
+                    .add(cert.map_err(|_| CloudError::InvalidArgument)?)
+                    .map_err(|_| CloudError::InvalidArgument)?;
+            }
+            if roots.is_empty() {
+                return Err(CloudError::InvalidArgument);
+            }
+            roots
+        }
+    };
+    // The configured roots remain verified; no certificate/hostname bypass is exposed.
+    roots.roots.shrink_to_fit();
+    let builder =
+        ClientConfig::builder_with_provider(Arc::new(rustls::crypto::ring::default_provider()))
+            .with_safe_default_protocol_versions()
+            .map_err(|_| CloudError::InvalidArgument)?
+            .with_root_certificates(roots);
+    let tls = match additional.client_identity() {
+        Some(identity) => {
+            let (certs, key) = identity.rustls_material();
+            builder
+                .with_client_auth_cert(certs, key)
+                .map_err(|_| CloudError::InvalidArgument)?
+        }
+        None => builder.with_no_client_auth(),
+    };
+    Ok(Some(MakeRustlsConnect::new(tls)))
+}
+
+pub(super) fn parse(value: &str, config: &CloudDatabaseConfig) -> CloudResult<Config> {
+    let mut pg = value
+        .parse::<Config>()
+        .map_err(|_| CloudError::InvalidArgument)?;
+    pg.application_name("colossus-cloud");
+    pg.connect_timeout(Duration::from_millis(config.connection_timeout_ms));
+    if config.tls == CloudDatabaseTls::Disabled {
+        if !pg.get_hosts().iter().all(|host| match host {
+            Host::Tcp(host) => {
+                host.eq_ignore_ascii_case("localhost")
+                    || host
+                        .parse::<std::net::IpAddr>()
+                        .is_ok_and(|ip| ip.is_loopback())
+            }
+            #[cfg(unix)]
+            Host::Unix(_) => true,
+        }) {
+            return Err(CloudError::InvalidArgument);
+        }
+        pg.ssl_mode(SslMode::Disable);
+    } else {
+        pg.ssl_mode(SslMode::Require);
+    }
+    Ok(pg)
+}
+
+pub(super) async fn establish(
+    value: &str,
+    config: &CloudDatabaseConfig,
+    tls: Option<MakeRustlsConnect>,
+) -> ConnectionResult<AsyncPgConnection> {
+    let pg = parse(value, config).map_err(|_| categorical_connection_error())?;
+    let mut connection = match tls {
+        Some(tls) => {
+            let (client, connection) = pg
+                .connect(tls)
+                .await
+                .map_err(|_| categorical_connection_error())?;
+            AsyncPgConnection::try_from_client_and_connection(client, connection)
+                .await
+                .map_err(|_| categorical_connection_error())?
+        }
+        None => {
+            let (client, connection) = pg
+                .connect(NoTls)
+                .await
+                .map_err(|_| categorical_connection_error())?;
+            AsyncPgConnection::try_from_client_and_connection(client, connection)
+                .await
+                .map_err(|_| categorical_connection_error())?
+        }
+    };
+    connection
+        .batch_execute(&format!(
+            "SET search_path TO \"{}\"; SET statement_timeout = {}; SET lock_timeout = {}",
+            config.schema, config.statement_timeout_ms, config.statement_timeout_ms
+        ))
+        .await
+        .map_err(|_| categorical_connection_error())?;
+    Ok(connection)
+}
diff --git a/crates/colossus-cloud-postgres/src/entities.rs b/crates/colossus-cloud-postgres/src/entities.rs
new file mode 100644
index 000000000..c1947b45d
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/entities.rs
@@ -0,0 +1,514 @@
+use colossus_cloud::{
+    CloudError, CloudResult,
+    storage::{
+        EntityKey, EntityKind, EntityMutation, EntityOrder, EntityQuery, EntityRecord, conflict,
+        decode_page_cursor, encode_page_cursor,
+    },
+};
+use colossus_ports::StoreError;
+use diesel::{
+    QueryableByName, sql_query,
+    sql_types::{Array, BigInt, Bool, Jsonb, Nullable, Text},
+};
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+
+#[derive(diesel::QueryableByName)]
+pub(super) struct Row {
+    #[diesel(sql_type=Text)]
+    pub project_id: String,
+    #[diesel(sql_type=Text)]
+    pub parent_id: String,
+    #[diesel(sql_type=Text)]
+    pub id: String,
+    #[diesel(sql_type=BigInt)]
+    pub revision: i64,
+    #[diesel(sql_type=Jsonb)]
+    pub record: Value,
+    #[diesel(sql_type=Text)]
+    pub audit_hash: String,
+}
+#[derive(diesel::QueryableByName)]
+struct VerifiedRow {
+    #[diesel(embed)]
+    entity: Row,
+    #[diesel(embed)]
+    audit: Audit,
+}
+#[derive(diesel::QueryableByName)]
+struct PageRow {
+    #[diesel(embed)]
+    verified: VerifiedRow,
+    #[diesel(sql_type=Text)]
+    page_time: String,
+}
+
+pub(super) fn table(kind: EntityKind) -> &'static str {
+    match kind {
+        EntityKind::User => "cloud_users",
+        EntityKind::OidcIdentity => "user_identities",
+        EntityKind::LocalCredential => "local_credentials",
+        EntityKind::Setting => "control_plane_settings",
+        EntityKind::Project => "projects",
+        EntityKind::Membership => "project_memberships",
+        EntityKind::AuthFlow => "oidc_flows",
+        EntityKind::Host => "hosts",
+        EntityKind::Node => "runtime_agents",
+        EntityKind::Workspace => "workspaces",
+        EntityKind::Thread => "conversation_threads",
+        EntityKind::ThreadMessage => "conversation_messages",
+        EntityKind::SessionMapping => "thread_sources",
+        EntityKind::Task => "tasks",
+        EntityKind::Command => "commands",
+        EntityKind::Run => "run_allocations",
+        EntityKind::NodeTask => "node_task_placements",
+        EntityKind::Admission => "admission_counters",
+        EntityKind::Invitation => "enrollment_invitations",
+        EntityKind::Renewal => "certificate_renewals",
+    }
+}
+pub(super) fn integer(value: u64) -> Result<i64, StoreError> {
+    i64::try_from(value).map_err(|_| StoreError::Adapter("cloud numeric bound exceeded".into()))
+}
+pub(super) fn db_error(error: diesel::result::Error) -> StoreError {
+    match error {
+        diesel::result::Error::DatabaseError(
+            diesel::result::DatabaseErrorKind::ClosedConnection,
+            _,
+        ) => StoreError::OutcomeUnknown(
+            "cloud database commit outcome requires reconciliation".into(),
+        ),
+        _ => StoreError::Adapter("cloud database operation failed".into()),
+    }
+}
+pub(super) fn digest(value: &Value) -> Result<String, StoreError> {
+    crate::canonical::bytes(value).map(|bytes| hex::encode(Sha256::digest(bytes)))
+}
+
+pub(super) async fn read(
+    conn: &mut AsyncPgConnection,
+    key: &EntityKey,
+) -> CloudResult<EntityRecord> {
+    let table = table(key.kind);
+    let verified=sql_query(format!("SELECT r.project_id,r.parent_id,r.id,r.revision,r.record,r.audit_hash,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM {table} r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='{table}' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision WHERE ($1 = r.project_id OR ($1 = '' AND $4)) AND r.parent_id=$2 AND r.id=$3 AND NOT r.deleted"))
+        .bind::<Text,_>(&key.project_id).bind::<Text,_>(key.parent_id.as_deref().unwrap_or_default()).bind::<Text,_>(&key.id).bind::<Bool,_>(key.kind==EntityKind::Invitation)
+        .get_result::<VerifiedRow>(conn).await.map_err(|error|if matches!(error,diesel::result::Error::NotFound){CloudError::NotFound}else{CloudError::Storage})?;
+    verify_audit(key.kind, &verified.entity, &verified.audit)?;
+    record(key.kind, verified.entity)
+}
+
+pub(super) async fn projects(
+    conn: &mut AsyncPgConnection,
+    after: Option<&str>,
+    limit: usize,
+) -> CloudResult<Vec<EntityRecord>> {
+    if !(1..=100).contains(&limit) {
+        return Err(CloudError::InvalidArgument);
+    }
+    let rows=sql_query("SELECT r.project_id,r.parent_id,r.id,r.revision,r.record,r.audit_hash,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM projects r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='projects' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision WHERE NOT r.deleted AND ($1::TEXT IS NULL OR r.id>$1) ORDER BY r.id LIMIT $2")
+        .bind::<Nullable<Text>,_>(after).bind::<BigInt,_>(limit as i64).load::<VerifiedRow>(conn).await.map_err(|_|CloudError::Storage)?;
+    rows.into_iter()
+        .map(|row| {
+            verify_audit(EntityKind::Project, &row.entity, &row.audit)?;
+            record(EntityKind::Project, row.entity)
+        })
+        .collect()
+}
+
+pub(super) async fn identities(
+    conn: &mut AsyncPgConnection,
+    user: &str,
+) -> CloudResult<Vec<EntityRecord>> {
+    let mut result = Vec::new();
+    for kind in [EntityKind::LocalCredential, EntityKind::OidcIdentity] {
+        let table = table(kind);
+        let rows=sql_query(format!("SELECT r.project_id,r.parent_id,r.id,r.revision,r.record,r.audit_hash,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM {table} r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='{table}' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision WHERE r.user_id=$1 AND NOT r.deleted ORDER BY r.id LIMIT 16"))
+            .bind::<Text,_>(user).load::<VerifiedRow>(conn).await.map_err(|_|CloudError::Storage)?;
+        for row in rows {
+            verify_audit(kind, &row.entity, &row.audit)?;
+            result.push(record(kind, row.entity)?);
+        }
+    }
+    Ok(result)
+}
+
+pub(super) async fn accounts(
+    conn: &mut AsyncPgConnection,
+    users: &[String],
+) -> CloudResult<Vec<EntityRecord>> {
+    if users.len() > 100 {
+        return Err(CloudError::InvalidArgument);
+    }
+    let rows=sql_query("SELECT r.project_id,r.parent_id,r.id,r.revision,r.record,r.audit_hash,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM cloud_users r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='cloud_users' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision WHERE r.id=ANY($1) AND NOT r.deleted ORDER BY r.id")
+        .bind::<Array<Text>,_>(users).load::<VerifiedRow>(conn).await.map_err(|_|CloudError::Storage)?;
+    rows.into_iter()
+        .map(|row| {
+            verify_audit(EntityKind::User, &row.entity, &row.audit)?;
+            record(EntityKind::User, row.entity)
+        })
+        .collect()
+}
+
+pub(super) async fn list(
+    conn: &mut AsyncPgConnection,
+    query: &EntityQuery,
+) -> CloudResult<Vec<EntityRecord>> {
+    let table = table(query.kind);
+    let parent = if query.kind == EntityKind::Task {
+        "thread_id"
+    } else {
+        "parent_id"
+    };
+    let node = match query.kind {
+        EntityKind::Node => "id",
+        EntityKind::Workspace
+        | EntityKind::Thread
+        | EntityKind::Task
+        | EntityKind::Command
+        | EntityKind::Run
+        | EntityKind::NodeTask
+        | EntityKind::Admission
+        | EntityKind::Invitation
+        | EntityKind::Renewal
+        | EntityKind::SessionMapping => "node_id",
+        _ => "record->>'node_id'",
+    };
+    let status = if query.kind == EntityKind::User {
+        "CASE WHEN active THEN 'active' ELSE 'disabled' END"
+    } else if query.kind == EntityKind::Membership {
+        "CASE WHEN user_id IS NOT NULL AND jsonb_array_length(COALESCE(permissions,'[]'::JSONB))>0 THEN 'active' ELSE 'removed' END"
+    } else if query.kind == EntityKind::Task {
+        "status"
+    } else if query.kind == EntityKind::Command {
+        "CASE WHEN reply IS NULL OR reply='null'::JSONB THEN 'pending' ELSE 'reconciled' END"
+    } else {
+        "COALESCE(record->>'status','')"
+    };
+    let archived = if query.kind == EntityKind::Thread {
+        "archived"
+    } else {
+        "COALESCE((record->>'archived')::BOOLEAN,FALSE)"
+    };
+    let status_filter = if query.kind == EntityKind::User
+        && query.status.as_deref() == Some("administrator")
+    {
+        "($6::TEXT='administrator' AND active AND is_admin)".to_owned()
+    } else if query.kind == EntityKind::Command {
+        match query.status.as_deref() {
+            Some("pending") => {
+                "($6::TEXT='pending' AND (reply IS NULL OR reply='null'::JSONB))".to_owned()
+            }
+            Some("reconciled") => {
+                "($6::TEXT='reconciled' AND reply IS NOT NULL AND reply<>'null'::JSONB)".to_owned()
+            }
+            _ => "$6::TEXT IS NULL".to_owned(),
+        }
+    } else {
+        format!("($6 IS NULL OR {status}=$6)")
+    };
+    let position = decode_page_cursor(query)?;
+    let after_id = if matches!(query.order, EntityOrder::IdAsc | EntityOrder::IdDesc) {
+        query.after.as_deref()
+    } else {
+        position.as_ref().map(|position| position.id.as_str())
+    };
+    let after_time = position
+        .as_ref()
+        .map(|position| position.timestamp.as_str());
+    let after_parent = position
+        .as_ref()
+        .map(|position| position.parent_id.as_str());
+    let (comparison, order, time_column) = match query.order {
+        EntityOrder::IdAsc => (
+            "id > $3 AND $9::TEXT IS NULL AND $10::TEXT IS NULL",
+            "id ASC,parent_id ASC",
+            "domain_created_at",
+        ),
+        EntityOrder::IdDesc => (
+            "id < $3 AND $9::TEXT IS NULL AND $10::TEXT IS NULL",
+            "id DESC,parent_id DESC",
+            "domain_created_at",
+        ),
+        EntityOrder::UpdatedDesc => (
+            "(domain_updated_at,id,parent_id)<($9::TIMESTAMPTZ,$3,$10)",
+            "domain_updated_at DESC,id DESC,parent_id DESC",
+            "domain_updated_at",
+        ),
+        EntityOrder::CreatedAsc => (
+            "(domain_created_at,id,parent_id)>($9::TIMESTAMPTZ,$3,$10)",
+            "domain_created_at ASC,id ASC,parent_id ASC",
+            "domain_created_at",
+        ),
+        EntityOrder::CreatedDesc => (
+            "(domain_created_at,id,parent_id)<($9::TIMESTAMPTZ,$3,$10)",
+            "domain_created_at DESC,id DESC,parent_id DESC",
+            "domain_created_at",
+        ),
+    };
+    let page_time =
+        format!("to_char({time_column} AT TIME ZONE 'UTC','YYYY-MM-DD\"T\"HH24:MI:SS.US\"Z\"')");
+    let page = format!(
+        "SELECT project_id,parent_id,id,revision,record,audit_hash,{page_time} AS page_time,ROW_NUMBER() OVER (ORDER BY {order}) AS page_ordinal FROM {table} WHERE project_id=$1 AND ($2 IS NULL OR {parent}=$2) AND ($3 IS NULL OR {comparison}) AND NOT deleted AND ($4 IS NULL OR {node}=$4) AND ($5 IS NULL OR strpos(lower(COALESCE(record#>>'{{user,display_name}}',record->>'title',record->>'label',record->>'name',record#>>'{{request,prompt}}','')),lower($5))>0) AND {status_filter} AND ($7 IS NULL OR {archived}=$7) ORDER BY {order} LIMIT $8"
+    );
+    let sql = format!(
+        "SELECT r.*,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM ({page}) r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='{table}' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision ORDER BY r.page_ordinal"
+    );
+    let rows = sql_query(sql)
+        .bind::<Text, _>(&query.project_id)
+        .bind::<Nullable<Text>, _>(&query.parent_id)
+        .bind::<Nullable<Text>, _>(after_id)
+        .bind::<Nullable<Text>, _>(&query.node_id)
+        .bind::<Nullable<Text>, _>(&query.query)
+        .bind::<Nullable<Text>, _>(&query.status)
+        .bind::<Nullable<Bool>, _>(query.archived)
+        .bind::<BigInt, _>(query.limit.min(100) as i64)
+        .bind::<Nullable<Text>, _>(after_time)
+        .bind::<Nullable<Text>, _>(after_parent)
+        .load::<PageRow>(conn)
+        .await
+        .map_err(|_| CloudError::Storage)?;
+    let mut result = Vec::with_capacity(rows.len());
+    for page in rows {
+        let verified = page.verified;
+        verify_audit(query.kind, &verified.entity, &verified.audit)?;
+        let cursor = encode_page_cursor(
+            query,
+            &page.page_time,
+            &verified.entity.id,
+            &verified.entity.parent_id,
+        )?;
+        let mut value = record(query.kind, verified.entity)?;
+        value.page_cursor = Some(cursor);
+        result.push(value);
+    }
+    Ok(result)
+}
+fn record(kind: EntityKind, row: Row) -> CloudResult<EntityRecord> {
+    Ok(EntityRecord {
+        key: EntityKey {
+            kind,
+            project_id: row.project_id,
+            parent_id: (!row.parent_id.is_empty()).then_some(row.parent_id),
+            id: row.id,
+        },
+        revision: u64::try_from(row.revision).map_err(|_| CloudError::Storage)?,
+        value: row.record,
+        page_cursor: None,
+    })
+}
+pub(super) async fn thread_incomplete(
+    conn: &mut AsyncPgConnection,
+    project: &str,
+    thread: &str,
+) -> CloudResult<bool> {
+    let candidate=sql_query("SELECT r.project_id,r.parent_id,r.id,r.revision,r.record,r.audit_hash,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM (SELECT project_id,parent_id,id,revision,record,audit_hash FROM tasks WHERE project_id=$1 AND thread_id=$2 AND NOT deleted AND (COALESCE((record->>'output_limited')::BOOLEAN,FALSE) OR COALESCE((record->>'history_bounded')::BOOLEAN,FALSE) OR (record->>'subject'='runtime' AND NOT COALESCE((record->>'history_complete')::BOOLEAN,FALSE)) OR COALESCE((record#>>'{snapshot,run,last_sequence}')::BIGINT,0)>COALESCE(last_sequence,0)) ORDER BY id LIMIT 1) r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='tasks' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision")
+        .bind::<Text,_>(project).bind::<Text,_>(thread).get_result::<VerifiedRow>(conn).await;
+    match candidate {
+        Ok(candidate) => {
+            verify_audit(EntityKind::Task, &candidate.entity, &candidate.audit)?;
+            Ok(true)
+        }
+        Err(diesel::result::Error::NotFound) => Ok(false),
+        Err(_) => Err(CloudError::Storage),
+    }
+}
+pub(super) async fn memberships(
+    conn: &mut AsyncPgConnection,
+    subject: &str,
+) -> CloudResult<Vec<EntityRecord>> {
+    let rows=sql_query("SELECT r.project_id,r.parent_id,r.id,r.revision,r.record,r.audit_hash,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM project_memberships r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='project_memberships' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision WHERE r.subject=$1 AND NOT r.deleted ORDER BY r.project_id LIMIT 1024").bind::<Text,_>(subject).load::<VerifiedRow>(conn).await.map_err(|_|CloudError::Storage)?;
+    let mut result = Vec::with_capacity(rows.len());
+    for verified in rows {
+        verify_audit(EntityKind::Membership, &verified.entity, &verified.audit)?;
+        result.push(record(EntityKind::Membership, verified.entity)?);
+    }
+    Ok(result)
+}
+
+#[derive(diesel::QueryableByName)]
+struct Audit {
+    #[diesel(sql_type=Text)]
+    actor: String,
+    #[diesel(sql_type=Text)]
+    operation: String,
+    #[diesel(sql_type=Text)]
+    content_digest: String,
+    #[diesel(sql_type=Text)]
+    previous_hash: String,
+    #[diesel(sql_type=Text)]
+    chain_hash: String,
+}
+pub(super) fn chain(
+    key: &EntityKey,
+    revision: u64,
+    actor: &str,
+    operation: &str,
+    content: &str,
+    previous: &str,
+) -> Result<String, StoreError> {
+    digest(&serde_json::json!([
+        key, revision, actor, operation, content, previous
+    ]))
+}
+
+fn verify_audit(kind: EntityKind, row: &Row, audit: &Audit) -> CloudResult<()> {
+    // Tombstones are never released even if their mutable deletion flag was altered.
+    if audit.operation == "cloud.entity.consumed.v1" {
+        return Err(CloudError::Storage);
+    }
+    let key = EntityKey {
+        kind,
+        project_id: row.project_id.clone(),
+        parent_id: (!row.parent_id.is_empty()).then(|| row.parent_id.clone()),
+        id: row.id.clone(),
+    };
+    let content = digest(&row.record).map_err(|_| CloudError::Storage)?;
+    let computed = chain(
+        &key,
+        row.revision as u64,
+        &audit.actor,
+        &audit.operation,
+        &content,
+        &audit.previous_hash,
+    )
+    .map_err(|_| CloudError::Storage)?;
+    if content != audit.content_digest || computed != audit.chain_hash || computed != row.audit_hash
+    {
+        return Err(CloudError::Storage);
+    }
+    Ok(())
+}
+
+#[derive(diesel::QueryableByName)]
+struct Changed {
+    #[diesel(sql_type=BigInt)]
+    count: i64,
+}
+
+pub(super) async fn mutate(
+    conn: &mut AsyncPgConnection,
+    mutation: EntityMutation,
+) -> Result<(), StoreError> {
+    mutate_profiled(conn, mutation, &crate::profiling::Profiler::default()).await
+}
+pub(super) async fn mutate_profiled(
+    conn: &mut AsyncPgConnection,
+    mutation: EntityMutation,
+    profile: &crate::profiling::Profiler,
+) -> Result<(), StoreError> {
+    let key = &mutation.key;
+    let table = table(key.kind);
+    let parent = key.parent_id.as_deref().unwrap_or_default();
+    let expected = integer(mutation.expected_revision)?;
+    let sql_span = profile.span(crate::profiling::Stage::Sql);
+    let prior=sql_query(format!("SELECT r.project_id,r.parent_id,r.id,r.revision,r.record,r.audit_hash,a.actor,a.operation,a.content_digest,a.previous_hash,a.chain_hash FROM {table} r LEFT JOIN cloud_audit a ON a.project_id=r.project_id AND a.entity_kind='{table}' AND a.parent_id=r.parent_id AND a.id=r.id AND a.revision=r.revision WHERE r.project_id=$1 AND r.parent_id=$2 AND r.id=$3 FOR UPDATE OF r"))
+        .bind::<Text,_>(&key.project_id).bind::<Text,_>(parent).bind::<Text,_>(&key.id).get_result::<VerifiedRow>(conn).await;
+    drop(sql_span);
+    let cpu_span = profile.span(crate::profiling::Stage::Cpu);
+    let (actual, previous) = match prior {
+        Ok(verified) => {
+            if verified.entity.revision != expected {
+                return Err(conflict(
+                    key,
+                    mutation.expected_revision,
+                    verified.entity.revision as u64,
+                ));
+            }
+            verify_audit(key.kind, &verified.entity, &verified.audit)
+                .map_err(|_| StoreError::Verification("cloud record audit mismatch".into()))?;
+            (verified.entity.revision, verified.entity.audit_hash)
+        }
+        Err(diesel::result::Error::NotFound) => (0, String::new()),
+        Err(error) => return Err(db_error(error)),
+    };
+    if actual != expected {
+        return Err(conflict(key, mutation.expected_revision, actual as u64));
+    }
+    let revision = actual + 1;
+    let created = mutation
+        .value
+        .get("created_at")
+        .or_else(|| mutation.value.pointer("/snapshot/run/created_at"))
+        .and_then(Value::as_str);
+    let updated = mutation.value.get("updated_at").and_then(Value::as_str);
+    let content = digest(&mutation.value)?;
+    let hash = chain(
+        key,
+        revision as u64,
+        &mutation.actor,
+        &mutation.operation,
+        &content,
+        &previous,
+    )?;
+    let change = if actual == 0 {
+        format!(
+            "INSERT INTO {table}(project_id,parent_id,id,revision,record,audit_hash,domain_created_at,domain_updated_at) SELECT $1,$2,$3,$4,$5,$6,COALESCE(NULLIF($12,'')::TIMESTAMPTZ,clock_timestamp()),COALESCE(NULLIF($13,'')::TIMESTAMPTZ,clock_timestamp()) WHERE $11=0 ON CONFLICT DO NOTHING RETURNING project_id,parent_id,id,revision"
+        )
+    } else {
+        format!(
+            "UPDATE {table} SET revision=$4,record=$5,audit_hash=$6,updated_at=clock_timestamp(),domain_created_at=COALESCE(NULLIF($12,'')::TIMESTAMPTZ,domain_created_at),domain_updated_at=COALESCE(NULLIF($13,'')::TIMESTAMPTZ,clock_timestamp()) WHERE project_id=$1 AND parent_id=$2 AND id=$3 AND revision=$11 AND NOT deleted RETURNING project_id,parent_id,id,revision"
+        )
+    };
+    let sql = format!(
+        "WITH changed AS({change}),audited AS(INSERT INTO cloud_audit(project_id,entity_kind,parent_id,id,revision,actor,operation,content_digest,previous_hash,chain_hash) SELECT project_id,'{table}',parent_id,id,revision,$7,$8,$9,$10,$6 FROM changed RETURNING project_id,id,revision),hinted AS(INSERT INTO delivery_outbox(project_id,scope_id,event_kind,revision) SELECT project_id,id,$8,revision FROM audited ON CONFLICT(project_id) WHERE delivered_at IS NULL DO NOTHING) SELECT COUNT(*)::BIGINT AS count FROM audited"
+    );
+    drop(cpu_span);
+    let _sql_span = profile.span(crate::profiling::Stage::Sql);
+    let changed = sql_query(sql)
+        .bind::<Text, _>(&key.project_id)
+        .bind::<Text, _>(parent)
+        .bind::<Text, _>(&key.id)
+        .bind::<BigInt, _>(revision)
+        .bind::<Jsonb, _>(&mutation.value)
+        .bind::<Text, _>(&hash)
+        .bind::<Text, _>(&mutation.actor)
+        .bind::<Text, _>(&mutation.operation)
+        .bind::<Text, _>(&content)
+        .bind::<Text, _>(&previous)
+        .bind::<BigInt, _>(expected)
+        .bind::<Nullable<Text>, _>(created)
+        .bind::<Nullable<Text>, _>(updated)
+        .get_result::<Changed>(conn)
+        .await
+        .map_err(db_error)?;
+    if changed.count != 1 {
+        return Err(conflict(key, mutation.expected_revision, revision as u64));
+    }
+    Ok(())
+}
+
+pub(super) async fn delete(
+    conn: &mut AsyncPgConnection,
+    key: &EntityKey,
+    expected: u64,
+) -> Result<(), StoreError> {
+    let current = read(conn, key)
+        .await
+        .map_err(|_| StoreError::NotFound("cloud resource".into()))?;
+    if current.revision != expected {
+        return Err(conflict(key, expected, current.revision));
+    }
+    mutate(
+        conn,
+        EntityMutation {
+            key: key.clone(),
+            expected_revision: expected,
+            value: current.value,
+            actor: "cloud".into(),
+            operation: "cloud.entity.consumed.v1".into(),
+        },
+    )
+    .await?;
+    sql_query(format!(
+        "UPDATE {} SET deleted=TRUE WHERE project_id=$1 AND parent_id=$2 AND id=$3",
+        table(key.kind)
+    ))
+    .bind::<Text, _>(&key.project_id)
+    .bind::<Text, _>(key.parent_id.as_deref().unwrap_or_default())
+    .bind::<Text, _>(&key.id)
+    .execute(conn)
+    .await
+    .map_err(db_error)?;
+    Ok(())
+}
diff --git a/crates/colossus-cloud-postgres/src/identity_guard.rs b/crates/colossus-cloud-postgres/src/identity_guard.rs
new file mode 100644
index 000000000..9eed240fc
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/identity_guard.rs
@@ -0,0 +1,68 @@
+//! Low-rate structural administration invariants, never a normal event write-head lock.
+use crate::store::TransactionError;
+use colossus_cloud::storage::{EntityKind, EntityMutation};
+use colossus_ports::StoreError;
+use diesel::{sql_query, sql_types::Bool};
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+
+#[derive(diesel::QueryableByName)]
+struct Flag {
+    #[diesel(sql_type=Bool)]
+    present: bool,
+}
+pub(super) async fn begin(
+    conn: &mut AsyncPgConnection,
+    mutations: &[EntityMutation],
+) -> Result<Option<bool>, TransactionError> {
+    if !mutations
+        .iter()
+        .any(|m| matches!(m.key.kind, EntityKind::User | EntityKind::Project))
+    {
+        return Ok(None);
+    }
+    sql_query(
+        "SELECT pg_advisory_xact_lock(hashtext(current_schema()||':product-administration'))",
+    )
+    .execute(conn)
+    .await?;
+    let admins=sql_query("SELECT EXISTS(SELECT 1 FROM cloud_users WHERE active AND is_admin AND NOT deleted) AS present").get_result::<Flag>(conn).await?;
+    if admins.present
+        && mutations.iter().any(|m| {
+            m.key.kind == EntityKind::User
+                && m.actor == "operator-bootstrap"
+                && m.value
+                    .pointer("/user/is_admin")
+                    .and_then(serde_json::Value::as_bool)
+                    == Some(true)
+        })
+    {
+        return Err(StoreError::Conflict {
+            stream_id: "cloud.administrator-bootstrap".into(),
+            expected: 0,
+            actual: 1,
+        }
+        .into());
+    }
+    Ok(Some(admins.present))
+}
+pub(super) async fn finish(
+    conn: &mut AsyncPgConnection,
+    prior: Option<bool>,
+) -> Result<(), TransactionError> {
+    let Some(had_admin) = prior else {
+        return Ok(());
+    };
+    if had_admin&&!sql_query("SELECT EXISTS(SELECT 1 FROM cloud_users WHERE active AND is_admin AND NOT deleted) AS present").get_result::<Flag>(conn).await?.present {
+        return Err(StoreError::Conflict{stream_id:"cloud.last-administrator".into(),expected:1,actual:0}.into());
+    }
+    let cycle=sql_query("WITH RECURSIVE lineage AS(SELECT project_id AS origin,parent_project_id AS next,ARRAY[project_id] AS path,FALSE AS cycle,1 AS depth FROM projects WHERE NOT deleted UNION ALL SELECT l.origin,p.parent_project_id,l.path||p.project_id,p.project_id=ANY(l.path),l.depth+1 FROM lineage l JOIN projects p ON p.project_id=l.next WHERE NOT l.cycle AND l.depth<65 AND NOT p.deleted) SELECT EXISTS(SELECT 1 FROM lineage WHERE cycle OR depth>=65) AS present").get_result::<Flag>(conn).await?;
+    if cycle.present {
+        return Err(StoreError::Conflict {
+            stream_id: "cloud.project-hierarchy".into(),
+            expected: 0,
+            actual: 1,
+        }
+        .into());
+    }
+    Ok(())
+}
diff --git a/crates/colossus-cloud-postgres/src/lib.rs b/crates/colossus-cloud-postgres/src/lib.rs
new file mode 100644
index 000000000..64b3f3a7b
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/lib.rs
@@ -0,0 +1,31 @@
+//! Pooled PostgreSQL storage for the cloud application's relational domain.
+//!
+//! Runtime journals retain their independent durability and authority boundaries.
+//! Cloud writes serialize only the changed entity/feed, never a global head row.
+//! Audit hashes detect changes to retained per-entity chains, but PostgreSQL alone
+//! cannot prove rollback or deletion by a database administrator. Production operators
+//! must separately retain exported audit checkpoints and protect database backups.
+
+mod canonical;
+mod checkpoint;
+mod config;
+mod connection;
+mod entities;
+mod identity_guard;
+mod maintenance;
+mod metrics;
+mod observability;
+mod operational;
+mod profiling;
+mod store;
+
+pub use checkpoint::{
+    CloudAuditCheckpoint, CloudAuditHead, SignedCloudAuditCheckpoint, verify_checkpoint_signature,
+};
+pub use config::{CloudDatabaseConfig, CloudDatabaseTls};
+pub use metrics::CloudPoolStatistics;
+pub use profiling::CloudTransactionProfile;
+pub use store::CloudPostgresStore;
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/colossus-cloud-postgres/src/maintenance.rs b/crates/colossus-cloud-postgres/src/maintenance.rs
new file mode 100644
index 000000000..c1abd6de4
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/maintenance.rs
@@ -0,0 +1,105 @@
+use crate::{CloudPostgresStore, entities, store::TransactionError};
+use colossus_cloud::{CloudError, CloudResult, storage::*};
+use colossus_ports::StoreError;
+use diesel::{
+    sql_query,
+    sql_types::{Array, BigInt, Bool, Text},
+};
+use diesel_async::{AsyncConnection, RunQueryDsl, SimpleAsyncConnection};
+
+impl CloudPostgresStore {
+    pub(super) async fn maintain_operational(
+        &self,
+        now: u64,
+        policy: &CloudMaintenancePolicy,
+    ) -> CloudResult<CloudMaintenanceReport> {
+        if !(1..=1024).contains(&policy.batch_limit)
+            || !(60..=2592000).contains(&policy.delivered_outbox_retention_seconds)
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        conn.transaction(async|conn|{
+            #[derive(diesel::QueryableByName)]struct Outbox{#[diesel(sql_type=BigInt)]outbox_id:i64,#[diesel(sql_type=Text)]project_id:String}
+            let pending=sql_query("SELECT outbox_id,project_id FROM delivery_outbox WHERE delivered_at IS NULL ORDER BY outbox_id LIMIT $1 FOR UPDATE SKIP LOCKED").bind::<BigInt,_>(policy.batch_limit as i64).load::<Outbox>(conn).await?;
+            let projects:std::collections::BTreeSet<_>=pending.iter().map(|entry|entry.project_id.as_str()).collect();
+            for project in projects{sql_query("SELECT pg_notify('colossus_cloud_changed',$1)").bind::<Text,_>(project).execute(conn).await?;}
+            let ids:Vec<_>=pending.iter().map(|entry|entry.outbox_id).collect();
+            let published=sql_query("UPDATE delivery_outbox SET delivered_at=clock_timestamp() WHERE outbox_id=ANY($1)").bind::<Array<BigInt>,_>(&ids).execute(conn).await?;
+            let before=entities::integer(now.saturating_sub(policy.delivered_outbox_retention_seconds))?;
+            let removed=sql_query("WITH expired AS(SELECT outbox_id FROM delivery_outbox WHERE delivered_at<to_timestamp($1) ORDER BY delivered_at,outbox_id LIMIT $2 FOR UPDATE SKIP LOCKED) DELETE FROM delivery_outbox WHERE outbox_id IN(SELECT outbox_id FROM expired)").bind::<BigInt,_>(before).bind::<BigInt,_>(policy.batch_limit as i64).execute(conn).await?;
+            let now=entities::integer(now)?;
+            let sessions=sql_query("WITH expired AS(SELECT session_hash FROM browser_sessions WHERE expires_at<=$1 ORDER BY expires_at LIMIT $2 FOR UPDATE SKIP LOCKED) DELETE FROM browser_sessions WHERE session_hash IN(SELECT session_hash FROM expired)").bind::<BigInt,_>(now).bind::<BigInt,_>(policy.batch_limit as i64).execute(conn).await?;
+            #[derive(diesel::QueryableByName)]struct Flow{#[diesel(sql_type=Text)]project_id:String,#[diesel(sql_type=Text)]parent_id:String,#[diesel(sql_type=Text)]id:String,#[diesel(sql_type=BigInt)]revision:i64,#[diesel(sql_type=Bool)]deleted:bool}
+            let flows=sql_query("SELECT project_id,parent_id,id,revision,deleted FROM oidc_flows WHERE expires_at<=$1 ORDER BY expires_at,id LIMIT $2 FOR UPDATE SKIP LOCKED").bind::<BigInt,_>(now).bind::<BigInt,_>(policy.batch_limit as i64).load::<Flow>(conn).await?;
+            for flow in &flows{let key=EntityKey{kind:EntityKind::AuthFlow,project_id:flow.project_id.clone(),parent_id:(!flow.parent_id.is_empty()).then(||flow.parent_id.clone()),id:flow.id.clone()};if !flow.deleted{entities::delete(conn,&key,flow.revision as u64).await?;}
+                sql_query("DELETE FROM oidc_flows WHERE project_id=$1 AND parent_id=$2 AND id=$3").bind::<Text,_>(&flow.project_id).bind::<Text,_>(&flow.parent_id).bind::<Text,_>(&flow.id).execute(conn).await?;
+            }
+            let report=CloudMaintenanceReport{published_outbox:published,removed_outbox:removed,expired_sessions:sessions,expired_auth_flows:flows.len()};
+            if published+removed+sessions+flows.len()>0 {
+                let key=EntityKey{kind:EntityKind::AuthFlow,project_id:"__maintenance".into(),parent_id:None,id:"operational".into()};
+                let revision=match entities::read(conn,&key).await{Ok(record)=>record.revision,Err(CloudError::NotFound)=>0,Err(_)=>return Err(TransactionError::Store(StoreError::Adapter("maintenance audit unavailable".into())))};
+                entities::mutate(conn,EntityMutation{key,expected_revision:revision,value:serde_json::json!({"observed_at":now,"published_outbox":published,"removed_outbox":removed,"expired_sessions":sessions,"expired_auth_flows":flows.len()}),actor:"cloud-maintenance".into(),operation:"cloud.operational-maintenance.v1".into()}).await?;
+            }
+            Ok::<_,TransactionError>(report)
+        }).await.map_err(|error|CloudError::from(error.into_store()))
+    }
+    /// Begin or reconcile an explicit offline legacy import into a provably empty schema.
+    /// The source anchor binds retries; ordinary host startup must reject a running marker.
+    pub async fn begin_journal_import(
+        &self,
+        source_head_hash: &str,
+        source_sequence: u64,
+    ) -> CloudResult<EntityRecord> {
+        if source_head_hash.len() != 64 || !source_head_hash.bytes().all(|b| b.is_ascii_hexdigit())
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        let key = EntityKey {
+            kind: EntityKind::AuthFlow,
+            project_id: "__migration".into(),
+            parent_id: None,
+            id: "journal-import".into(),
+        };
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        let result=conn.transaction(async|conn|{
+            sql_query("SELECT pg_advisory_xact_lock(hashtext($1))").bind::<Text,_>(format!("colossus-cloud-import:{}",self.schema)).execute(conn).await?;
+            match entities::read(conn,&key).await{
+                Ok(record)=>{
+                    if record.value.get("source_head_hash").and_then(serde_json::Value::as_str)!=Some(source_head_hash)||record.value.get("source_sequence").and_then(serde_json::Value::as_u64)!=Some(source_sequence)||!record.value.get("status").and_then(serde_json::Value::as_str).is_some_and(|status|matches!(status,"running"|"complete")){return Err(TransactionError::Store(StoreError::Conflict{stream_id:key.conflict_id(),expected:0,actual:record.revision}));}
+                    return Ok(record);
+                },
+                Err(CloudError::NotFound)=>{},
+                Err(_)=>return Err(TransactionError::Store(StoreError::Adapter("import marker unavailable".into()))),
+            }
+            #[derive(diesel::QueryableByName)]struct Occupied{#[diesel(sql_type=Bool)]occupied:bool}
+            for table in ["cloud_users","user_identities","local_credentials","control_plane_settings","projects","project_memberships","oidc_flows","hosts","runtime_agents","workspaces","conversation_threads","conversation_messages","thread_sources","tasks","commands","run_allocations","node_task_placements","admission_counters","enrollment_invitations","certificate_renewals","released_events","released_event_heads","sync_cursors","cloud_audit","delivery_outbox","browser_sessions","connection_leases"]{
+                let occupied=sql_query(format!("SELECT EXISTS(SELECT 1 FROM {table} LIMIT 1) AS occupied")).get_result::<Occupied>(conn).await?;
+                if occupied.occupied{return Err(TransactionError::Store(StoreError::Conflict{stream_id:"cloud.import.destination".into(),expected:0,actual:1}));}
+            }
+            entities::mutate(conn,EntityMutation{key:key.clone(),expected_revision:0,value:serde_json::json!({"source_head_hash":source_head_hash,"source_sequence":source_sequence,"status":"running"}),actor:"offline-import".into(),operation:"cloud.import.started.v1".into()}).await?;
+            entities::read(conn,&key).await.map_err(|_|TransactionError::Store(StoreError::Adapter("import marker unavailable".into())))
+        }).await;
+        result.map_err(|error| CloudError::from(error.into_store()))
+    }
+
+    /// Remove only this adapter's explicitly generated local measurement namespace.
+    /// Ordinary cloud schema names are rejected, and a caller cannot nominate another schema.
+    pub async fn remove_fixture_schema(&self, schema: &str) -> CloudResult<()> {
+        let suffix = schema
+            .strip_prefix("cloud_load_")
+            .or_else(|| schema.strip_prefix("cloud_acceptance_"));
+        if schema != self.schema
+            || !suffix.is_some_and(|suffix| {
+                suffix.len() == 32 && suffix.bytes().all(|b| b.is_ascii_hexdigit())
+            })
+        {
+            return Err(CloudError::PermissionDenied);
+        }
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        conn.batch_execute(&format!("DROP SCHEMA \"{schema}\" CASCADE"))
+            .await
+            .map_err(|_| CloudError::Storage)?;
+        Ok(())
+    }
+}
diff --git a/crates/colossus-cloud-postgres/src/metrics.rs b/crates/colossus-cloud-postgres/src/metrics.rs
new file mode 100644
index 000000000..758ea0644
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/metrics.rs
@@ -0,0 +1,36 @@
+use crate::CloudPostgresStore;
+use serde::Serialize;
+
+/// Credential-free cumulative connection-pool diagnostics.
+#[derive(Clone, Debug, Serialize)]
+pub struct CloudPoolStatistics {
+    /// Currently established pooled connections; notification listener is additional.
+    pub connections: u32,
+    /// Available connections at the instant of observation.
+    pub idle_connections: u32,
+    /// Number of attempted pool acquisitions since adapter startup.
+    pub acquisitions: u64,
+    /// Number of acquisitions that waited for a connection.
+    pub waited_acquisitions: u64,
+    /// Acquisitions that exhausted their bounded deadline.
+    pub timed_out_acquisitions: u64,
+    /// Current acquisition queue depth.
+    pub pending_acquisitions: u64,
+    /// Aggregate wait time for all queued acquisitions, milliseconds.
+    pub total_wait_ms: f64,
+}
+impl CloudPostgresStore {
+    /// Inspect bounded pool diagnostics without connection or domain payloads.
+    pub fn pool_statistics(&self) -> CloudPoolStatistics {
+        let state = self.pool.state();
+        CloudPoolStatistics {
+            connections: state.connections,
+            idle_connections: state.idle_connections,
+            acquisitions: state.statistics.get_started,
+            waited_acquisitions: state.statistics.get_waited,
+            timed_out_acquisitions: state.statistics.get_timed_out,
+            pending_acquisitions: state.statistics.pending_gets(),
+            total_wait_ms: state.statistics.get_wait_time.as_secs_f64() * 1000.0,
+        }
+    }
+}
diff --git a/crates/colossus-cloud-postgres/src/observability.rs b/crates/colossus-cloud-postgres/src/observability.rs
new file mode 100644
index 000000000..141e22537
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/observability.rs
@@ -0,0 +1,83 @@
+//! Relational operational aggregates. These read projections are never authority inputs.
+use crate::CloudPostgresStore;
+use colossus_cloud::{CloudError, CloudResult, observability::OperationalStatistics};
+use diesel::{
+    sql_query,
+    sql_types::{BigInt, Jsonb, Nullable, Text},
+};
+use diesel_async::RunQueryDsl;
+
+#[derive(diesel::QueryableByName)]
+struct StatisticsRow {
+    #[diesel(sql_type=Jsonb)]
+    value: serde_json::Value,
+}
+
+impl CloudPostgresStore {
+    pub(super) async fn operational_statistics(
+        &self,
+        project: &str,
+        node: Option<&str>,
+        now: u64,
+        days: u16,
+    ) -> CloudResult<OperationalStatistics> {
+        if !(1..=90).contains(&days) {
+            return Err(CloudError::InvalidArgument);
+        }
+        let now = i64::try_from(now).map_err(|_| CloudError::InvalidArgument)?;
+        let first = (now / 86_400 - i64::from(days) + 1) * 86_400;
+        let mut connection = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        let row = sql_query(SQL)
+            .bind::<Text, _>(project)
+            .bind::<Nullable<Text>, _>(node)
+            .bind::<BigInt, _>(first)
+            .bind::<BigInt, _>(now)
+            .get_result::<StatisticsRow>(&mut connection)
+            .await
+            .map_err(|_| CloudError::Storage)?;
+        serde_json::from_value(row.value).map_err(|_| CloudError::Storage)
+    }
+}
+
+const SQL: &str = r#"
+WITH agent_set AS (
+    SELECT id,host_id,record FROM runtime_agents WHERE project_id=$1 AND NOT deleted AND NOT revoked AND ($2::TEXT IS NULL OR id=$2)
+), thread_set AS (
+    SELECT id FROM conversation_threads WHERE project_id=$1 AND NOT deleted AND ($2::TEXT IS NULL OR node_id=$2)
+), task_set AS (
+    SELECT id,status,domain_created_at,record FROM tasks WHERE project_id=$1 AND NOT deleted AND ($2::TEXT IS NULL OR node_id=$2)
+), recent AS (
+    SELECT * FROM task_set WHERE domain_created_at>=to_timestamp($3) AND domain_created_at<=to_timestamp($4)
+), usage_events AS (
+    SELECT t.id,t.domain_created_at,e.record#>'{update,usage}' AS usage FROM recent t JOIN released_events e ON e.project_id=$1 AND e.scope_id=t.id
+    WHERE e.record#>'{update,usage}' IS NOT NULL AND e.record#>'{update,usage}'<>'null'::JSONB
+), usage_totals AS (
+    SELECT SUM((usage->>'input_tokens')::NUMERIC) AS input_tokens,SUM((usage->>'output_tokens')::NUMERIC) AS output_tokens FROM usage_events
+), dates AS (
+    SELECT generate_series((to_timestamp($3) AT TIME ZONE 'UTC')::DATE,(to_timestamp($4) AT TIME ZONE 'UTC')::DATE,'1 day')::DATE AS day
+), daily_runs AS (
+    SELECT (domain_created_at AT TIME ZONE 'UTC')::DATE AS day,COUNT(*) AS runs,COUNT(*) FILTER(WHERE status='completed') AS completed,COUNT(*) FILTER(WHERE status='failed') AS failed FROM recent GROUP BY 1
+), daily_usage AS (
+    SELECT (domain_created_at AT TIME ZONE 'UTC')::DATE AS day,SUM((usage->>'input_tokens')::NUMERIC) AS input_tokens,SUM((usage->>'output_tokens')::NUMERIC) AS output_tokens FROM usage_events GROUP BY 1
+)
+SELECT jsonb_build_object(
+    'complete',TRUE,
+    'counts',jsonb_build_object(
+        'projects',0,
+        'hosts',CASE WHEN $2::TEXT IS NULL THEN (SELECT COUNT(*) FROM hosts WHERE project_id=$1 AND NOT deleted) ELSE (SELECT COUNT(DISTINCT host_id) FROM agent_set WHERE host_id IS NOT NULL) END,
+        'agents',(SELECT COUNT(*) FROM agent_set),
+        'online_agents',(SELECT COUNT(*) FROM agent_set a JOIN connection_leases l ON l.project_id=$1 AND l.node_id=a.id AND l.expires_at>$4 WHERE COALESCE((a.record->>'runtime_ready')::BOOLEAN,FALSE)),
+        'threads',(SELECT COUNT(*) FROM thread_set),
+        'runs',(SELECT COUNT(*) FROM recent),
+        'completed',(SELECT COUNT(*) FROM recent WHERE status='completed'),
+        'failed',(SELECT COUNT(*) FROM recent WHERE status='failed'),
+        'cancelled',(SELECT COUNT(*) FROM recent WHERE status='cancelled'),
+        'interrupted',(SELECT COUNT(*) FROM recent WHERE status='interrupted'),
+        'outcome_unknown',(SELECT COUNT(*) FROM recent WHERE status='outcome_unknown'),
+        'active',(SELECT COUNT(*) FROM task_set WHERE status IN('running','waiting','cancelling')),
+        'queued',(SELECT COUNT(*) FROM task_set WHERE status='queued')
+    ),
+    'activity',(SELECT COALESCE(jsonb_agg(jsonb_build_object('date',to_char(d.day,'YYYY-MM-DD'),'runs',COALESCE(r.runs,0),'completed',COALESCE(r.completed,0),'failed',COALESCE(r.failed,0),'input_tokens',u.input_tokens,'output_tokens',u.output_tokens) ORDER BY d.day),'[]'::JSONB) FROM dates d LEFT JOIN daily_runs r ON r.day=d.day LEFT JOIN daily_usage u ON u.day=d.day),
+    'usage',(SELECT jsonb_build_object('input_tokens',input_tokens,'output_tokens',output_tokens,'estimated_cost',NULL,'coverage','Only retained provider usage reports are counted; imported or bounded history may omit usage. Pricing is not configured.') FROM usage_totals)
+) AS value
+"#;
diff --git a/crates/colossus-cloud-postgres/src/operational.rs b/crates/colossus-cloud-postgres/src/operational.rs
new file mode 100644
index 000000000..c54dcf735
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/operational.rs
@@ -0,0 +1,422 @@
+use super::entities::{db_error, digest, integer};
+use colossus_cloud::{
+    CloudError, CloudResult,
+    storage::{
+        AuthSession, ConnectionLease, CursorMutation, ReleasedEvent, validate_lease_ttl,
+        validate_session,
+    },
+};
+use colossus_ports::StoreError;
+use diesel::{
+    sql_query,
+    sql_types::{BigInt, Jsonb, Text},
+};
+use diesel_async::{AsyncPgConnection, RunQueryDsl};
+use serde_json::Value;
+
+#[derive(diesel::QueryableByName)]
+struct Sequence {
+    #[diesel(sql_type=BigInt)]
+    sequence: i64,
+}
+#[derive(diesel::QueryableByName)]
+struct EventRow {
+    #[diesel(sql_type=BigInt)]
+    sequence: i64,
+    #[diesel(sql_type=Jsonb)]
+    record: Value,
+    #[diesel(sql_type=Text)]
+    digest: String,
+    #[diesel(sql_type=Text)]
+    previous_hash: String,
+    #[diesel(sql_type=Text)]
+    chain_hash: String,
+}
+#[derive(diesel::QueryableByName)]
+struct EventHead {
+    #[diesel(sql_type=BigInt)]
+    sequence: i64,
+    #[diesel(sql_type=Text)]
+    last_hash: String,
+}
+fn event_hash(
+    project: &str,
+    scope: &str,
+    sequence: u64,
+    content: &str,
+    previous: &str,
+) -> Result<String, StoreError> {
+    digest(&serde_json::json!([
+        "released_events",
+        project,
+        scope,
+        sequence,
+        content,
+        previous
+    ]))
+}
+pub(super) async fn append_event(
+    conn: &mut AsyncPgConnection,
+    event: ReleasedEvent,
+    profile: &crate::profiling::Profiler,
+) -> Result<(), StoreError> {
+    let sql_span = profile.span(crate::profiling::Stage::Sql);
+    let head_row=sql_query("INSERT INTO released_event_heads(project_id,scope_id) VALUES($1,$2) ON CONFLICT(project_id,scope_id) DO UPDATE SET last_sequence=released_event_heads.last_sequence RETURNING last_sequence AS sequence,last_hash").bind::<Text,_>(&event.project_id).bind::<Text,_>(&event.scope_id).get_result::<EventHead>(conn).await.map_err(db_error)?;
+    drop(sql_span);
+    let head = head_row.sequence;
+    let sequence = integer(event.sequence)?;
+    let hash = {
+        let _cpu_span = profile.span(crate::profiling::Stage::Cpu);
+        digest(&event.value)?
+    };
+    if sequence <= head {
+        let sql_span = profile.span(crate::profiling::Stage::Sql);
+        let existing=sql_query("SELECT sequence,record,digest,previous_hash,chain_hash FROM released_events WHERE project_id=$1 AND scope_id=$2 AND sequence=$3").bind::<Text,_>(&event.project_id).bind::<Text,_>(&event.scope_id).bind::<BigInt,_>(sequence).get_result::<EventRow>(conn).await.map_err(db_error)?;
+        drop(sql_span);
+        let _cpu_span = profile.span(crate::profiling::Stage::Cpu);
+        return if existing.digest == hash
+            && existing.record == event.value
+            && event_hash(
+                &event.project_id,
+                &event.scope_id,
+                event.sequence,
+                &hash,
+                &existing.previous_hash,
+            )? == existing.chain_hash
+        {
+            Ok(())
+        } else {
+            Err(StoreError::Conflict {
+                stream_id: event.scope_id,
+                expected: event.sequence,
+                actual: head as u64,
+            })
+        };
+    }
+    if sequence != head + 1 {
+        return Err(StoreError::Conflict {
+            stream_id: event.scope_id,
+            expected: (head + 1) as u64,
+            actual: event.sequence,
+        });
+    }
+    let cpu_span = profile.span(crate::profiling::Stage::Cpu);
+    let chain_hash = event_hash(
+        &event.project_id,
+        &event.scope_id,
+        event.sequence,
+        &hash,
+        &head_row.last_hash,
+    )?;
+    drop(cpu_span);
+    let _sql_span = profile.span(crate::profiling::Stage::Sql);
+    sql_query("WITH released AS(INSERT INTO released_events(project_id,scope_id,sequence,record,digest,previous_hash,chain_hash) VALUES($1,$2,$3,$4,$5,$6,$7) RETURNING project_id,scope_id,sequence),audited AS(INSERT INTO cloud_audit(project_id,entity_kind,parent_id,id,revision,actor,operation,content_digest,previous_hash,chain_hash) SELECT project_id,'released_events','',scope_id,sequence,'runtime','cloud.output.released.v1',$5,$6,$7 FROM released RETURNING project_id,id,revision),hinted AS(INSERT INTO delivery_outbox(project_id,scope_id,event_kind,revision) SELECT project_id,id,'cloud.output.released.v1',revision FROM audited ON CONFLICT(project_id) WHERE delivered_at IS NULL DO NOTHING) UPDATE released_event_heads SET last_sequence=$3,last_hash=$7 WHERE project_id=$1 AND scope_id=$2")
+        .bind::<Text,_>(&event.project_id).bind::<Text,_>(&event.scope_id).bind::<BigInt,_>(sequence).bind::<Jsonb,_>(&event.value).bind::<Text,_>(&hash).bind::<Text,_>(&head_row.last_hash).bind::<Text,_>(&chain_hash).execute(conn).await.map_err(db_error)?;
+    Ok(())
+}
+
+pub(super) async fn events(
+    conn: &mut AsyncPgConnection,
+    project: &str,
+    scope: &str,
+    after: u64,
+    limit: usize,
+) -> CloudResult<Vec<ReleasedEvent>> {
+    let rows=sql_query("SELECT sequence,record,digest,previous_hash,chain_hash FROM released_events WHERE project_id=$1 AND scope_id=$2 AND sequence>$3 ORDER BY sequence LIMIT $4").bind::<Text,_>(project).bind::<Text,_>(scope).bind::<BigInt,_>(integer(after).map_err(|_|CloudError::InvalidArgument)?).bind::<BigInt,_>(limit.min(100)as i64).load::<EventRow>(conn).await.map_err(|_|CloudError::Storage)?;
+    let mut result = Vec::with_capacity(rows.len());
+    let mut previous: Option<String> = None;
+    for (expected, row) in (after + 1..).zip(rows) {
+        if row.sequence as u64 != expected
+            || previous.as_ref().is_some_and(|p| *p != row.previous_hash)
+            || digest(&row.record).map_err(|_| CloudError::Storage)? != row.digest
+            || event_hash(
+                project,
+                scope,
+                row.sequence as u64,
+                &row.digest,
+                &row.previous_hash,
+            )
+            .map_err(|_| CloudError::Storage)?
+                != row.chain_hash
+        {
+            return Err(CloudError::Storage);
+        }
+        previous = Some(row.chain_hash);
+        result.push(ReleasedEvent {
+            project_id: project.into(),
+            scope_id: scope.into(),
+            sequence: row.sequence as u64,
+            value: row.record,
+        });
+    }
+    Ok(result)
+}
+pub(super) async fn cursor(
+    conn: &mut AsyncPgConnection,
+    project: &str,
+    source: &str,
+    scope: &str,
+) -> CloudResult<u64> {
+    match sql_query(
+        "SELECT sequence FROM sync_cursors WHERE project_id=$1 AND source_id=$2 AND scope_id=$3",
+    )
+    .bind::<Text, _>(project)
+    .bind::<Text, _>(source)
+    .bind::<Text, _>(scope)
+    .get_result::<Sequence>(conn)
+    .await
+    {
+        Ok(row) => Ok(row.sequence as u64),
+        Err(diesel::result::Error::NotFound) => Ok(0),
+        Err(_) => Err(CloudError::Storage),
+    }
+}
+pub(super) async fn advance_cursor(
+    conn: &mut AsyncPgConnection,
+    cursor: CursorMutation,
+    profile: &crate::profiling::Profiler,
+) -> Result<(), StoreError> {
+    if cursor.sequence < cursor.expected_sequence {
+        return Err(StoreError::Adapter("cloud cursor cannot regress".into()));
+    }
+    let expected = integer(cursor.expected_sequence)?;
+    let sequence = integer(cursor.sequence)?;
+    if sequence == expected {
+        let actual = self::cursor(
+            conn,
+            &cursor.project_id,
+            &cursor.source_id,
+            &cursor.scope_id,
+        )
+        .await
+        .map_err(|_| StoreError::Adapter("cloud cursor unavailable".into()))?;
+        return if actual == cursor.expected_sequence {
+            Ok(())
+        } else {
+            Err(StoreError::Conflict {
+                stream_id: cursor.scope_id,
+                expected: cursor.expected_sequence,
+                actual,
+            })
+        };
+    }
+    #[derive(diesel::QueryableByName)]
+    struct CursorHead {
+        #[diesel(sql_type=BigInt)]
+        sequence: i64,
+        #[diesel(sql_type=Text)]
+        previous_hash: String,
+    }
+    let sql_span = profile.span(crate::profiling::Stage::Sql);
+    let head=sql_query("WITH held AS(INSERT INTO sync_cursors(project_id,source_id,scope_id,sequence) VALUES($1,$2,$3,0) ON CONFLICT(project_id,source_id,scope_id) DO UPDATE SET sequence=sync_cursors.sequence RETURNING sequence) SELECT held.sequence,COALESCE(a.chain_hash,'') AS previous_hash FROM held LEFT JOIN cloud_audit a ON a.project_id=$1 AND a.entity_kind='sync_cursors' AND a.parent_id=$2 AND a.id=$3 AND a.revision=held.sequence")
+        .bind::<Text,_>(&cursor.project_id).bind::<Text,_>(&cursor.source_id).bind::<Text,_>(&cursor.scope_id).get_result::<CursorHead>(conn).await.map_err(db_error)?;
+    drop(sql_span);
+    let cpu_span = profile.span(crate::profiling::Stage::Cpu);
+    if head.sequence != expected {
+        return Err(StoreError::Conflict {
+            stream_id: cursor.scope_id,
+            expected: cursor.expected_sequence,
+            actual: head.sequence as u64,
+        });
+    }
+    if head.sequence > 0 && head.previous_hash.is_empty() {
+        return Err(StoreError::Verification(
+            "cloud cursor audit is absent".into(),
+        ));
+    }
+    let content = digest(&serde_json::json!([
+        cursor.project_id,
+        cursor.source_id,
+        cursor.scope_id,
+        cursor.sequence
+    ]))?;
+    let hash = digest(&serde_json::json!([
+        "sync_cursors",
+        cursor.project_id,
+        cursor.source_id,
+        cursor.scope_id,
+        cursor.sequence,
+        content,
+        head.previous_hash
+    ]))?;
+    drop(cpu_span);
+    let _sql_span = profile.span(crate::profiling::Stage::Sql);
+    let changed=sql_query("WITH changed AS(UPDATE sync_cursors SET sequence=$4,updated_at=clock_timestamp() WHERE project_id=$1 AND source_id=$2 AND scope_id=$3 AND sequence=$5 RETURNING project_id,source_id,scope_id,sequence),audited AS(INSERT INTO cloud_audit(project_id,entity_kind,parent_id,id,revision,actor,operation,content_digest,previous_hash,chain_hash) SELECT project_id,'sync_cursors',source_id,scope_id,sequence,'runtime','cloud.sync.advanced.v1',$6,$7,$8 FROM changed RETURNING project_id,id,revision),hinted AS(INSERT INTO delivery_outbox(project_id,scope_id,event_kind,revision) SELECT project_id,id,'cloud.sync.advanced.v1',revision FROM audited ON CONFLICT(project_id) WHERE delivered_at IS NULL DO NOTHING) SELECT COUNT(*)::BIGINT AS sequence FROM changed")
+        .bind::<Text,_>(&cursor.project_id).bind::<Text,_>(&cursor.source_id).bind::<Text,_>(&cursor.scope_id).bind::<BigInt,_>(sequence).bind::<BigInt,_>(expected).bind::<Text,_>(&content).bind::<Text,_>(&head.previous_hash).bind::<Text,_>(&hash).get_result::<Sequence>(conn).await.map_err(db_error)?;
+    if changed.sequence != 1 {
+        return Err(StoreError::Adapter("cloud cursor mutation failed".into()));
+    }
+    Ok(())
+}
+
+#[derive(diesel::QueryableByName)]
+struct SessionRow {
+    #[diesel(sql_type=BigInt)]
+    security_epoch: i64,
+    #[diesel(sql_type=Text)]
+    session_hash: String,
+    #[diesel(sql_type=Text)]
+    subject: String,
+    #[diesel(sql_type=Text)]
+    csrf_hash: String,
+    #[diesel(sql_type=BigInt)]
+    created_at: i64,
+    #[diesel(sql_type=BigInt)]
+    expires_at: i64,
+}
+pub(super) async fn put_session(
+    conn: &mut AsyncPgConnection,
+    session: AuthSession,
+) -> CloudResult<()> {
+    validate_session(&session)?;
+    sql_query("INSERT INTO browser_sessions(session_hash,subject,csrf_hash,created_at,expires_at,security_epoch) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(session_hash) DO UPDATE SET subject=$2,csrf_hash=$3,created_at=$4,expires_at=$5,security_epoch=$6")
+        .bind::<Text,_>(&session.session_hash).bind::<Text,_>(&session.subject).bind::<Text,_>(&session.csrf_hash).bind::<BigInt,_>(integer(session.created_at).map_err(|_|CloudError::InvalidArgument)?).bind::<BigInt,_>(integer(session.expires_at).map_err(|_|CloudError::InvalidArgument)?).bind::<BigInt,_>(integer(session.security_epoch).map_err(|_|CloudError::InvalidArgument)?).execute(conn).await.map_err(|_|CloudError::Storage)?;
+    Ok(())
+}
+pub(super) async fn read_session(
+    conn: &mut AsyncPgConnection,
+    hash: &str,
+    now: u64,
+) -> CloudResult<AuthSession> {
+    let row=sql_query("SELECT session_hash,subject,csrf_hash,created_at,expires_at,security_epoch FROM browser_sessions WHERE session_hash=$1 AND expires_at>$2").bind::<Text,_>(hash).bind::<BigInt,_>(integer(now).map_err(|_|CloudError::InvalidArgument)?).get_result::<SessionRow>(conn).await.map_err(|e|if matches!(e,diesel::result::Error::NotFound){CloudError::NotFound}else{CloudError::Storage})?;
+    Ok(AuthSession {
+        session_hash: row.session_hash,
+        security_epoch: row.security_epoch as u64,
+        subject: row.subject,
+        csrf_hash: row.csrf_hash,
+        created_at: row.created_at as u64,
+        expires_at: row.expires_at as u64,
+    })
+}
+pub(super) async fn delete_session(conn: &mut AsyncPgConnection, hash: &str) -> CloudResult<()> {
+    sql_query("DELETE FROM browser_sessions WHERE session_hash=$1")
+        .bind::<Text, _>(hash)
+        .execute(conn)
+        .await
+        .map_err(|_| CloudError::Storage)?;
+    Ok(())
+}
+
+#[derive(diesel::QueryableByName)]
+struct LeaseRow {
+    #[diesel(sql_type=Text)]
+    project_id: String,
+    #[diesel(sql_type=Text)]
+    node_id: String,
+    #[diesel(sql_type=Text)]
+    owner_id: String,
+    #[diesel(sql_type=BigInt)]
+    generation: i64,
+    #[diesel(sql_type=BigInt)]
+    expires_at: i64,
+}
+impl From<LeaseRow> for ConnectionLease {
+    fn from(row: LeaseRow) -> Self {
+        Self {
+            project_id: row.project_id,
+            node_id: row.node_id,
+            owner_id: row.owner_id,
+            generation: row.generation as u64,
+            expires_at: row.expires_at as u64,
+        }
+    }
+}
+pub(super) async fn claim(
+    conn: &mut AsyncPgConnection,
+    project: &str,
+    node: &str,
+    owner: &str,
+    now: u64,
+    ttl: u64,
+) -> CloudResult<ConnectionLease> {
+    validate_lease_ttl(ttl)?;
+    let row=sql_query("INSERT INTO connection_leases(project_id,node_id,owner_id,generation,expires_at) SELECT project_id,id,$3,1,$4 FROM (SELECT project_id,id FROM runtime_agents WHERE project_id=$1 AND parent_id='' AND id=$2 AND NOT revoked AND NOT deleted FOR SHARE) enrolled WHERE TRUE ON CONFLICT(project_id,node_id) DO UPDATE SET owner_id=$3,generation=connection_leases.generation+1,expires_at=$4 WHERE connection_leases.expires_at <= $5 OR connection_leases.owner_id=$3 RETURNING project_id,node_id,owner_id,generation,expires_at")
+        .bind::<Text,_>(project).bind::<Text,_>(node).bind::<Text,_>(owner).bind::<BigInt,_>(integer(now.saturating_add(ttl)).map_err(|_|CloudError::InvalidArgument)?).bind::<BigInt,_>(integer(now).map_err(|_|CloudError::InvalidArgument)?).get_result::<LeaseRow>(conn).await;
+    let row = match row {
+        Ok(row) => row,
+        Err(diesel::result::Error::NotFound) => {
+            #[derive(diesel::QueryableByName)]
+            struct Enrolled {
+                #[diesel(sql_type=diesel::sql_types::Bool)]
+                live: bool,
+            }
+            let enrolled=sql_query("SELECT EXISTS(SELECT 1 FROM runtime_agents WHERE project_id=$1 AND parent_id='' AND id=$2 AND NOT revoked AND NOT deleted) AS live").bind::<Text,_>(project).bind::<Text,_>(node).get_result::<Enrolled>(conn).await.map_err(|_|CloudError::Storage)?;
+            return Err(if enrolled.live {
+                CloudError::Conflict
+            } else {
+                CloudError::PermissionDenied
+            });
+        }
+        Err(_) => return Err(CloudError::Storage),
+    };
+    Ok(row.into())
+}
+pub(super) async fn read_lease(
+    conn: &mut AsyncPgConnection,
+    project: &str,
+    node: &str,
+    now: u64,
+) -> CloudResult<ConnectionLease> {
+    let row=sql_query("SELECT l.project_id,l.node_id,l.owner_id,l.generation,l.expires_at FROM connection_leases l JOIN runtime_agents n ON n.project_id=l.project_id AND n.parent_id='' AND n.id=l.node_id WHERE l.project_id=$1 AND l.node_id=$2 AND l.expires_at>$3 AND NOT n.revoked AND NOT n.deleted").bind::<Text,_>(project).bind::<Text,_>(node).bind::<BigInt,_>(integer(now).map_err(|_|CloudError::InvalidArgument)?).get_result::<LeaseRow>(conn).await.map_err(|e|if matches!(e,diesel::result::Error::NotFound){CloudError::NotFound}else{CloudError::Storage})?;
+    Ok(row.into())
+}
+pub(super) async fn renew(
+    conn: &mut AsyncPgConnection,
+    lease: &ConnectionLease,
+    now: u64,
+    ttl: u64,
+) -> CloudResult<ConnectionLease> {
+    validate_lease_ttl(ttl)?;
+    let row=sql_query("UPDATE connection_leases l SET expires_at=$5 FROM runtime_agents n WHERE n.project_id=l.project_id AND n.parent_id='' AND n.id=l.node_id AND NOT n.revoked AND NOT n.deleted AND l.project_id=$1 AND l.node_id=$2 AND l.owner_id=$3 AND l.generation=$4 AND l.expires_at>$6 RETURNING l.project_id,l.node_id,l.owner_id,l.generation,l.expires_at")
+        .bind::<Text,_>(&lease.project_id).bind::<Text,_>(&lease.node_id).bind::<Text,_>(&lease.owner_id).bind::<BigInt,_>(integer(lease.generation).map_err(|_|CloudError::InvalidArgument)?).bind::<BigInt,_>(integer(now.saturating_add(ttl)).map_err(|_|CloudError::InvalidArgument)?).bind::<BigInt,_>(integer(now).map_err(|_|CloudError::InvalidArgument)?).get_result::<LeaseRow>(conn).await.map_err(lease_error)?;
+    Ok(row.into())
+}
+pub(super) async fn release(
+    conn: &mut AsyncPgConnection,
+    lease: &ConnectionLease,
+) -> CloudResult<()> {
+    sql_query("UPDATE connection_leases SET expires_at=0 WHERE project_id=$1 AND node_id=$2 AND owner_id=$3 AND generation=$4").bind::<Text,_>(&lease.project_id).bind::<Text,_>(&lease.node_id).bind::<Text,_>(&lease.owner_id).bind::<BigInt,_>(integer(lease.generation).map_err(|_|CloudError::InvalidArgument)?).execute(conn).await.map_err(|_|CloudError::Storage)?;
+    Ok(())
+}
+pub(super) async fn verify(
+    conn: &mut AsyncPgConnection,
+    lease: &ConnectionLease,
+    now: Option<u64>,
+    locked: bool,
+) -> CloudResult<()> {
+    let query = if locked {
+        "SELECT l.generation AS sequence FROM connection_leases l JOIN runtime_agents n ON n.project_id=l.project_id AND n.parent_id='' AND n.id=l.node_id WHERE l.project_id=$1 AND l.node_id=$2 AND l.owner_id=$3 AND l.generation=$4 AND l.expires_at>EXTRACT(EPOCH FROM clock_timestamp()) AND NOT n.revoked AND NOT n.deleted FOR UPDATE OF l FOR SHARE OF n"
+    } else {
+        "SELECT l.generation AS sequence FROM connection_leases l JOIN runtime_agents n ON n.project_id=l.project_id AND n.parent_id='' AND n.id=l.node_id WHERE l.project_id=$1 AND l.node_id=$2 AND l.owner_id=$3 AND l.generation=$4 AND l.expires_at>$5 AND NOT n.revoked AND NOT n.deleted"
+    };
+    if locked {
+        sql_query(query)
+            .bind::<Text, _>(&lease.project_id)
+            .bind::<Text, _>(&lease.node_id)
+            .bind::<Text, _>(&lease.owner_id)
+            .bind::<BigInt, _>(integer(lease.generation).map_err(|_| CloudError::InvalidArgument)?)
+            .get_result::<Sequence>(conn)
+            .await
+            .map_err(lease_error)?;
+    } else {
+        sql_query(query)
+            .bind::<Text, _>(&lease.project_id)
+            .bind::<Text, _>(&lease.node_id)
+            .bind::<Text, _>(&lease.owner_id)
+            .bind::<BigInt, _>(integer(lease.generation).map_err(|_| CloudError::InvalidArgument)?)
+            .bind::<BigInt, _>(
+                integer(now.unwrap_or_default()).map_err(|_| CloudError::InvalidArgument)?,
+            )
+            .get_result::<Sequence>(conn)
+            .await
+            .map_err(lease_error)?;
+    }
+    Ok(())
+}
+fn lease_error(error: diesel::result::Error) -> CloudError {
+    if matches!(error, diesel::result::Error::NotFound) {
+        CloudError::Conflict
+    } else {
+        CloudError::Storage
+    }
+}
diff --git a/crates/colossus-cloud-postgres/src/profiling.rs b/crates/colossus-cloud-postgres/src/profiling.rs
new file mode 100644
index 000000000..38922884d
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/profiling.rs
@@ -0,0 +1,92 @@
+use crate::CloudPostgresStore;
+use serde::Serialize;
+use std::{
+    sync::atomic::{AtomicBool, AtomicU64, Ordering},
+    time::Instant,
+};
+
+/// Aggregate transaction-stage timing. Disabled by default; no domain payloads retained.
+#[derive(Clone, Debug, Serialize)]
+pub struct CloudTransactionProfile {
+    /// Number of complete adapter transaction attempts observed.
+    pub transactions: u64,
+    /// Combined transaction wall time, including pool checkout and PostgreSQL commit.
+    pub transaction_total_ms: f64,
+    /// Combined pool checkout wall time, including connection recycling checks.
+    pub pool_checkout_ms: f64,
+    /// Number of measured mutation SQL round trips.
+    pub mutation_sql_round_trips: u64,
+    /// Combined awaited wall time of those SQL round trips.
+    pub mutation_sql_wall_ms: f64,
+    /// Combined synchronous JSON/audit preparation time inside mutation helpers.
+    pub audit_json_cpu_ms: f64,
+}
+#[derive(Default)]
+pub(super) struct Profiler {
+    enabled: AtomicBool,
+    transaction: Counter,
+    pool: Counter,
+    sql: Counter,
+    cpu: Counter,
+}
+#[derive(Default)]
+struct Counter {
+    count: AtomicU64,
+    nanos: AtomicU64,
+}
+pub(super) enum Stage {
+    Transaction,
+    Pool,
+    Sql,
+    Cpu,
+}
+pub(super) struct Span<'a> {
+    counter: &'a Counter,
+    start: Option<Instant>,
+}
+impl Drop for Span<'_> {
+    fn drop(&mut self) {
+        if let Some(start) = self.start {
+            self.counter.count.fetch_add(1, Ordering::Relaxed);
+            self.counter.nanos.fetch_add(
+                start.elapsed().as_nanos().min(u64::MAX as u128) as u64,
+                Ordering::Relaxed,
+            );
+        }
+    }
+}
+impl Profiler {
+    pub(super) fn span(&self, stage: Stage) -> Span<'_> {
+        let counter = match stage {
+            Stage::Transaction => &self.transaction,
+            Stage::Pool => &self.pool,
+            Stage::Sql => &self.sql,
+            Stage::Cpu => &self.cpu,
+        };
+        Span {
+            counter,
+            start: self.enabled.load(Ordering::Relaxed).then(Instant::now),
+        }
+    }
+    fn snapshot(&self) -> CloudTransactionProfile {
+        let ms = |counter: &Counter| counter.nanos.load(Ordering::Relaxed) as f64 / 1_000_000.0;
+        CloudTransactionProfile {
+            transactions: self.transaction.count.load(Ordering::Relaxed),
+            transaction_total_ms: ms(&self.transaction),
+            pool_checkout_ms: ms(&self.pool),
+            mutation_sql_round_trips: self.sql.count.load(Ordering::Relaxed),
+            mutation_sql_wall_ms: ms(&self.sql),
+            audit_json_cpu_ms: ms(&self.cpu),
+        }
+    }
+}
+impl CloudPostgresStore {
+    /// Enable bounded numeric stage profiling for an explicit measurement fixture.
+    pub fn enable_transaction_profiling(&self) {
+        self.profiler.enabled.store(true, Ordering::Relaxed);
+    }
+    /// Inspect aggregate SQL/audit timings without private request or credential data.
+    pub fn transaction_profile(&self) -> CloudTransactionProfile {
+        self.profiler.snapshot()
+    }
+}
diff --git a/crates/colossus-cloud-postgres/src/store.rs b/crates/colossus-cloud-postgres/src/store.rs
new file mode 100644
index 000000000..eae40d9e0
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/store.rs
@@ -0,0 +1,361 @@
+use crate::{CloudDatabaseConfig, connection, entities, operational};
+use colossus_cloud::{CloudError, CloudResult, storage::*};
+use colossus_network::AdditionalRootCertificates;
+use colossus_ports::StoreError;
+use diesel::{
+    sql_query,
+    sql_types::{BigInt, Bool, Text},
+};
+use diesel_async::{
+    AsyncConnection, AsyncPgConnection, RunQueryDsl, SimpleAsyncConnection,
+    pooled_connection::{AsyncDieselConnectionManager, ManagerConfig, bb8::Pool},
+};
+use std::{sync::Arc, time::Duration};
+
+/// Relational cloud adapter with bounded asynchronous connections and per-domain CAS.
+#[derive(Clone)]
+pub struct CloudPostgresStore {
+    pub(super) pool: Pool<AsyncPgConnection>,
+    pub(super) schema: String,
+    pub(super) profiler: Arc<crate::profiling::Profiler>,
+    notifications: tokio::sync::broadcast::Sender<String>,
+    _pump: Arc<NotificationPump>,
+}
+struct NotificationPump(tokio::task::JoinHandle<()>);
+impl Drop for NotificationPump {
+    fn drop(&mut self) {
+        self.0.abort();
+    }
+}
+
+impl CloudPostgresStore {
+    /// Resolve the native credential reference, establish verified transport, and migrate.
+    /// Connection URLs and database diagnostic payloads are never included in errors.
+    pub async fn open(
+        config: CloudDatabaseConfig,
+        roots: &AdditionalRootCertificates,
+    ) -> CloudResult<Self> {
+        config.validate()?;
+        let url = std::env::var(&config.connection_variable).map_err(|_| CloudError::Storage)?;
+        connection::parse(&url, &config)?;
+        let tls = connection::trust(&config, roots)?;
+        let setup_config = config.clone();
+        let listener_url = url.clone();
+        let listener_tls = tls.clone();
+        let mut manager = ManagerConfig::default();
+        manager.custom_setup = Box::new(move |url| {
+            let config = setup_config.clone();
+            let tls = tls.clone();
+            Box::pin(async move { connection::establish(url, &config, tls).await })
+        });
+        let manager =
+            AsyncDieselConnectionManager::<AsyncPgConnection>::new_with_config(url, manager);
+        let pool = Pool::builder()
+            .max_size(config.max_connections)
+            .connection_timeout(Duration::from_millis(config.connection_timeout_ms))
+            .build(manager)
+            .await
+            .map_err(|_| CloudError::Storage)?;
+        let (notifications, _) = tokio::sync::broadcast::channel(256);
+        let pump_notifications = notifications.clone();
+        let listener_config = config.clone();
+        let pump = tokio::spawn(async move {
+            use futures::StreamExt;
+            let mut delay = Duration::from_millis(500);
+            loop {
+                if let Ok(mut conn) =
+                    connection::establish(&listener_url, &listener_config, listener_tls.clone())
+                        .await
+                    && conn
+                        .batch_execute("LISTEN colossus_cloud_changed")
+                        .await
+                        .is_ok()
+                {
+                    delay = Duration::from_millis(500);
+                    let stream = conn.notifications_stream();
+                    tokio::pin!(stream);
+                    let mut pending = std::collections::BTreeSet::new();
+                    let mut publication = tokio::time::interval(Duration::from_millis(100));
+                    publication.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+                    loop {
+                        tokio::select! {
+                            notification=stream.next()=>{
+                                let Some(Ok(notification))=notification else{break;};
+                                let payload=&notification.payload;
+                                if pending.len()<1024&&!payload.is_empty()&&payload.len()<=128&&payload.bytes().all(|b|b.is_ascii_alphanumeric()||matches!(b,b'_'|b'-'|b'.')){pending.insert(payload.to_owned());}
+                            },
+                            _=publication.tick()=>{for project in std::mem::take(&mut pending){let _=pump_notifications.send(project);}}
+                        }
+                    }
+                }
+                tokio::time::sleep(delay).await;
+                delay = (delay * 2).min(Duration::from_secs(30));
+            }
+        });
+        let store = Self {
+            pool,
+            schema: config.schema.clone(),
+            profiler: Arc::new(crate::profiling::Profiler::default()),
+            notifications,
+            _pump: Arc::new(NotificationPump(pump)),
+        };
+        let mut conn = store.pool.get().await.map_err(|_| CloudError::Storage)?;
+        // Schema setup is operator-owned; only migration execution takes a schema lock.
+        conn.batch_execute(&format!(
+            "CREATE SCHEMA IF NOT EXISTS \"{}\"; SET search_path TO \"{}\"",
+            config.schema, config.schema
+        ))
+        .await
+        .map_err(|_| CloudError::Storage)?;
+        conn.transaction(async |conn|{
+            sql_query("SELECT pg_advisory_xact_lock(hashtext($1))").bind::<Text,_>(format!("colossus-cloud-migrate:{}",config.schema)).execute(conn).await?;
+            #[derive(diesel::QueryableByName)]struct Legacy{#[diesel(sql_type=Bool)]present:bool}
+            let legacy=sql_query("SELECT to_regclass('journal_metadata') IS NOT NULL OR to_regclass('journal_events') IS NOT NULL AS present").get_result::<Legacy>(conn).await?;
+            if legacy.present{return Err(TransactionError::Store(StoreError::Adapter("legacy journal schema requires explicit offline migration into a distinct cloud schema".into())));}
+            conn.batch_execute("CREATE TABLE IF NOT EXISTS cloud_schema_migrations(version BIGINT PRIMARY KEY,checksum TEXT NOT NULL,applied_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp())").await?;
+            #[derive(diesel::QueryableByName)]struct Applied{#[diesel(sql_type=Text)]checksum:String}
+            for (version,sql) in [(1_i64,include_str!("../migrations/00000000000001_cloud_relational/up.sql")),(2_i64,include_str!("../migrations/00000000000002_operational_retention/up.sql")),(3_i64,include_str!("../migrations/00000000000003_coalesced_hints/up.sql")),(4_i64,include_str!("../migrations/00000000000004_project_hints/up.sql")),(5_i64,include_str!("../migrations/00000000000005_pending_commands/up.sql")),(6_i64,include_str!("../migrations/00000000000006_thread_sync_status/up.sql")),(7_i64,include_str!("../migrations/00000000000007_identity_projects/up.sql"))] {
+            let checksum=entities::digest(&serde_json::Value::String(sql.into())).map_err(TransactionError::Store)?;
+            match sql_query("SELECT checksum FROM cloud_schema_migrations WHERE version=$1").bind::<BigInt,_>(version).get_result::<Applied>(conn).await{
+                Ok(applied) if applied.checksum==checksum=>{},
+                Ok(_)=>return Err(TransactionError::Store(StoreError::Verification("cloud migration checksum changed".into()))),
+                Err(diesel::result::Error::NotFound)=>{conn.batch_execute(sql).await?;sql_query("INSERT INTO cloud_schema_migrations(version,checksum) VALUES($1,$2)").bind::<BigInt,_>(version).bind::<Text,_>(&checksum).execute(conn).await?;},
+                Err(error)=>return Err(error.into()),
+            }}Ok::<_,TransactionError>(())
+        }).await.map_err(|_|CloudError::Storage)?;
+        drop(conn);
+        Ok(store)
+    }
+}
+
+pub(super) enum TransactionError {
+    Store(StoreError),
+    Database(diesel::result::Error),
+}
+impl From<diesel::result::Error> for TransactionError {
+    fn from(error: diesel::result::Error) -> Self {
+        Self::Database(error)
+    }
+}
+impl From<StoreError> for TransactionError {
+    fn from(error: StoreError) -> Self {
+        Self::Store(error)
+    }
+}
+impl TransactionError {
+    pub(super) fn into_store(self) -> StoreError {
+        match self {
+            Self::Store(error) => error,
+            Self::Database(error) => entities::db_error(error),
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl CloudStore for CloudPostgresStore {
+    async fn user_accounts(&self, user_ids: &[String]) -> CloudResult<Vec<EntityRecord>> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        entities::accounts(&mut conn, user_ids).await
+    }
+    async fn user_identities(&self, user_id: &str) -> CloudResult<Vec<EntityRecord>> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        entities::identities(&mut conn, user_id).await
+    }
+    async fn statistics(
+        &self,
+        project: &str,
+        node: Option<&str>,
+        now: u64,
+        days: u16,
+    ) -> CloudResult<colossus_cloud::observability::OperationalStatistics> {
+        self.operational_statistics(project, node, now, days).await
+    }
+    async fn maintain(
+        &self,
+        now: u64,
+        policy: &CloudMaintenancePolicy,
+    ) -> CloudResult<CloudMaintenanceReport> {
+        self.maintain_operational(now, policy).await
+    }
+    fn subscribe(&self) -> tokio::sync::broadcast::Receiver<String> {
+        self.notifications.subscribe()
+    }
+    async fn readiness(&self) -> CloudResult<()> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        sql_query("SELECT 1")
+            .execute(&mut conn)
+            .await
+            .map_err(|_| CloudError::Storage)?;
+        Ok(())
+    }
+    async fn list_projects(
+        &self,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<EntityRecord>> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        entities::projects(&mut conn, after, limit).await
+    }
+    async fn read(&self, key: &EntityKey) -> CloudResult<EntityRecord> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        entities::read(&mut conn, key).await
+    }
+    async fn delete_entity(&self, key: &EntityKey, revision: u64) -> CloudResult<()> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        conn.transaction(async |conn| {
+            entities::delete(conn, key, revision).await?;
+            Ok::<_, TransactionError>(())
+        })
+        .await
+        .map_err(|e| CloudError::from(e.into_store()))
+    }
+    async fn list(&self, query: &EntityQuery) -> CloudResult<Vec<EntityRecord>> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        entities::list(&mut conn, query).await
+    }
+    async fn memberships(&self, subject: &str) -> CloudResult<Vec<EntityRecord>> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        entities::memberships(&mut conn, subject).await
+    }
+    async fn thread_incomplete(&self, project: &str, thread: &str) -> CloudResult<bool> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        entities::thread_incomplete(&mut conn, project, thread).await
+    }
+    async fn commit(&self, mut transaction: CloudTransaction) -> Result<(), StoreError> {
+        let _transaction_span = self.profiler.span(crate::profiling::Stage::Transaction);
+        let acquisition_span = self.profiler.span(crate::profiling::Stage::Pool);
+        let mut conn = self
+            .pool
+            .get()
+            .await
+            .map_err(|_| StoreError::Adapter("cloud connection pool unavailable".into()))?;
+        drop(acquisition_span);
+        // Stable entity acquisition order prevents lock inversion across batched updates.
+        transaction.entities.sort_by(|a, b| a.key.cmp(&b.key));
+        transaction.events.sort_by(|a, b| {
+            (&a.project_id, &a.scope_id, a.sequence).cmp(&(&b.project_id, &b.scope_id, b.sequence))
+        });
+        transaction.cursors.sort_by(|a, b| {
+            (&a.project_id, &a.source_id, &a.scope_id).cmp(&(
+                &b.project_id,
+                &b.source_id,
+                &b.scope_id,
+            ))
+        });
+        let projects: std::collections::BTreeSet<_> = transaction
+            .entities
+            .iter()
+            .map(|m| m.key.project_id.clone())
+            .chain(transaction.events.iter().map(|e| e.project_id.clone()))
+            .chain(transaction.cursors.iter().map(|c| c.project_id.clone()))
+            .collect();
+        if transaction
+            .lease
+            .as_ref()
+            .is_some_and(|lease| projects.iter().any(|project| *project != lease.project_id))
+        {
+            return Err(StoreError::Adapter(
+                "cloud connection cannot mutate another project".into(),
+            ));
+        }
+        conn.transaction(async |conn| {
+            let administration = crate::identity_guard::begin(conn, &transaction.entities).await?;
+            if let Some(lease) = transaction.lease {
+                operational::verify(conn, &lease, None, true)
+                    .await
+                    .map_err(|error| {
+                        TransactionError::Store(if error == CloudError::Conflict {
+                            StoreError::WriterLeaseHeld
+                        } else {
+                            StoreError::Adapter(
+                                "cloud connection lease verification unavailable".into(),
+                            )
+                        })
+                    })?;
+            }
+            for mutation in transaction.entities {
+                entities::mutate_profiled(conn, mutation, &self.profiler).await?;
+            }
+            for event in transaction.events {
+                operational::append_event(conn, event, &self.profiler).await?;
+            }
+            for cursor in transaction.cursors {
+                operational::advance_cursor(conn, cursor, &self.profiler).await?;
+            }
+            crate::identity_guard::finish(conn, administration).await?;
+            // Notifications are wakeups; durable outbox and rows remain the source of truth.
+            for project in projects {
+                sql_query("SELECT pg_notify('colossus_cloud_changed',$1)")
+                    .bind::<Text, _>(project)
+                    .execute(conn)
+                    .await?;
+            }
+            Ok::<_, TransactionError>(())
+        })
+        .await
+        .map_err(TransactionError::into_store)
+    }
+    async fn events(
+        &self,
+        project: &str,
+        scope: &str,
+        after: u64,
+        limit: usize,
+    ) -> CloudResult<Vec<ReleasedEvent>> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::events(&mut conn, project, scope, after, limit).await
+    }
+    async fn cursor(&self, project: &str, source: &str, scope: &str) -> CloudResult<u64> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::cursor(&mut conn, project, source, scope).await
+    }
+    async fn put_session(&self, session: AuthSession) -> CloudResult<()> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::put_session(&mut conn, session).await
+    }
+    async fn read_session(&self, hash: &str, now: u64) -> CloudResult<AuthSession> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::read_session(&mut conn, hash, now).await
+    }
+    async fn delete_session(&self, hash: &str) -> CloudResult<()> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::delete_session(&mut conn, hash).await
+    }
+    async fn claim_lease(
+        &self,
+        project: &str,
+        node: &str,
+        owner: &str,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::claim(&mut conn, project, node, owner, now, ttl).await
+    }
+    async fn read_lease(
+        &self,
+        project: &str,
+        node: &str,
+        now: u64,
+    ) -> CloudResult<ConnectionLease> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::read_lease(&mut conn, project, node, now).await
+    }
+    async fn renew_lease(
+        &self,
+        lease: &ConnectionLease,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::renew(&mut conn, lease, now, ttl).await
+    }
+    async fn release_lease(&self, lease: &ConnectionLease) -> CloudResult<()> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::release(&mut conn, lease).await
+    }
+    async fn verify_lease(&self, lease: &ConnectionLease, now: u64) -> CloudResult<()> {
+        let mut conn = self.pool.get().await.map_err(|_| CloudError::Storage)?;
+        operational::verify(&mut conn, lease, Some(now), false).await
+    }
+}
diff --git a/crates/colossus-cloud-postgres/src/tests.rs b/crates/colossus-cloud-postgres/src/tests.rs
new file mode 100644
index 000000000..91d953638
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/tests.rs
@@ -0,0 +1,732 @@
+use crate::{CloudDatabaseConfig, CloudDatabaseTls, CloudPostgresStore};
+use colossus_cloud::{CloudError, storage::*};
+use colossus_network::AdditionalRootCertificates;
+use colossus_ports::StoreError;
+use diesel_async::SimpleAsyncConnection;
+use serde_json::json;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+mod identity;
+
+fn key(kind: EntityKind, id: &str) -> EntityKey {
+    EntityKey {
+        kind,
+        project_id: "acceptance-project".into(),
+        parent_id: None,
+        id: id.into(),
+    }
+}
+fn write(kind: EntityKind, id: &str, expected: u64, value: serde_json::Value) -> EntityMutation {
+    EntityMutation {
+        key: key(kind, id),
+        expected_revision: expected,
+        value,
+        actor: "acceptance".into(),
+        operation: "cloud.acceptance.v1".into(),
+    }
+}
+fn config() -> CloudDatabaseConfig {
+    CloudDatabaseConfig {
+        connection_variable: "COLOSSUS_CLOUD_TEST_DATABASE_URL".into(),
+        schema: format!("cloud_acceptance_{}", uuid::Uuid::now_v7().simple()),
+        tls: CloudDatabaseTls::Disabled,
+        max_connections: 4,
+        connection_timeout_ms: 5000,
+        statement_timeout_ms: 15000,
+    }
+}
+
+#[tokio::test]
+#[ignore = "requires an explicit isolated local PostgreSQL fixture"]
+async fn postgres_atomic_recovery_and_replica_conformance() {
+    let config = config();
+    let store = CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+        .await
+        .unwrap();
+    store.commit(CloudTransaction{entities:vec![write(EntityKind::Project,"acceptance-project",0,json!({"project_id":"acceptance-project","label":"Acceptance"})),write(EntityKind::Node,"runtime",0,json!({"node_id":"runtime","instance_id":"local-instance","label":"Runtime","revoked":false}))],..Default::default()}).await.unwrap();
+    let host = write(
+        EntityKind::Host,
+        "host",
+        0,
+        json!({"label":"Acceptance host"}),
+    );
+    store
+        .commit(CloudTransaction {
+            entities: vec![host.clone()],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    let results = tokio::join!(
+        store.commit(CloudTransaction {
+            entities: vec![write(
+                EntityKind::Host,
+                "host",
+                1,
+                json!({"label":"Writer one"})
+            )],
+            ..Default::default()
+        }),
+        store.commit(CloudTransaction {
+            entities: vec![write(
+                EntityKind::Host,
+                "host",
+                1,
+                json!({"label":"Writer two"})
+            )],
+            ..Default::default()
+        })
+    );
+    assert_ne!(results.0.is_ok(), results.1.is_ok());
+    assert_eq!(store.read(&host.key).await.unwrap().revision, 2);
+    // A conflict after another domain write rolls the complete transaction back.
+    assert!(matches!(
+        store
+            .commit(CloudTransaction {
+                entities: vec![
+                    write(
+                        EntityKind::Node,
+                        "must-rollback",
+                        0,
+                        json!({"label":"Rollback"})
+                    ),
+                    write(EntityKind::Host, "host", 0, json!({"label":"Invalid"}))
+                ],
+                ..Default::default()
+            })
+            .await,
+        Err(StoreError::Conflict { .. })
+    ));
+    assert_eq!(
+        store
+            .read(&key(EntityKind::Node, "must-rollback"))
+            .await
+            .unwrap_err(),
+        CloudError::NotFound
+    );
+    let event = ReleasedEvent {
+        project_id: "acceptance-project".into(),
+        scope_id: "scope".into(),
+        sequence: 1,
+        value: json!({"released":"first"}),
+    };
+    store
+        .commit(CloudTransaction {
+            events: vec![event.clone()],
+            cursors: vec![CursorMutation {
+                project_id: event.project_id.clone(),
+                source_id: "runtime".into(),
+                scope_id: event.scope_id.clone(),
+                expected_sequence: 0,
+                sequence: 1,
+            }],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    store
+        .commit(CloudTransaction {
+            events: vec![event.clone()],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    assert_eq!(
+        store
+            .cursor("acceptance-project", "runtime", "scope")
+            .await
+            .unwrap(),
+        1
+    );
+    assert!(
+        store
+            .commit(CloudTransaction {
+                events: vec![ReleasedEvent {
+                    sequence: 3,
+                    ..event.clone()
+                }],
+                ..Default::default()
+            })
+            .await
+            .is_err()
+    );
+    assert!(
+        store
+            .commit(CloudTransaction {
+                events: vec![ReleasedEvent {
+                    value: json!({"released":"changed"}),
+                    ..event.clone()
+                }],
+                ..Default::default()
+            })
+            .await
+            .is_err()
+    );
+    assert!(
+        store
+            .events("other-project", "scope", 0, 100)
+            .await
+            .unwrap()
+            .is_empty()
+    );
+    assert_eq!(
+        store
+            .events("acceptance-project", "scope", 0, 100)
+            .await
+            .unwrap(),
+        vec![event.clone()]
+    );
+    store.commit(CloudTransaction{entities:vec![write(EntityKind::Workspace,"workspace",0,json!({"node_id":"runtime","label":"Workspace"})),write(EntityKind::Thread,"thread",0,json!({"node_id":"runtime","workspace_id":"workspace","title":"Conversation","created_at":"2026-10-05T12:00:00Z","updated_at":"2026-10-05T12:00:00Z"}))],..Default::default()}).await.unwrap();
+    let mut older = write(
+        EntityKind::ThreadMessage,
+        "z-older",
+        0,
+        json!({"role":"user","created_at":"2026-10-05T12:00:01Z"}),
+    );
+    older.key.parent_id = Some("thread".into());
+    let mut newer = write(
+        EntityKind::ThreadMessage,
+        "a-newer",
+        0,
+        json!({"role":"assistant","created_at":"2026-10-05T12:00:02Z"}),
+    );
+    newer.key.parent_id = Some("thread".into());
+    store
+        .commit(CloudTransaction {
+            entities: vec![older, newer],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    let query = EntityQuery {
+        kind: EntityKind::ThreadMessage,
+        project_id: "acceptance-project".into(),
+        parent_id: Some("thread".into()),
+        order: EntityOrder::CreatedDesc,
+        limit: 1,
+        ..Default::default()
+    };
+    let page = store.list(&query).await.unwrap();
+    assert_eq!(page[0].key.id, "a-newer");
+    let page = store
+        .list(&EntityQuery {
+            after: page[0].page_cursor.clone(),
+            ..query
+        })
+        .await
+        .unwrap();
+    assert_eq!(page[0].key.id, "z-older");
+    assert_stable_page_boundary(&store).await;
+    assert!(
+        !store
+            .thread_incomplete("acceptance-project", "thread")
+            .await
+            .unwrap()
+    );
+    let mut turns = Vec::new();
+    turns.push(write(EntityKind::Task,"old-incomplete",0,json!({"node_id":"runtime","thread_id":"thread","subject":"human","last_sequence":0,"output_limited":true,"created_at":"2025-01-01T00:00:00Z"})));
+    for index in 0..105 {
+        turns.push(write(EntityKind::Task,&format!("new-complete-{index:03}"),0,json!({"node_id":"runtime","thread_id":"thread","subject":"human","last_sequence":0,"output_limited":false,"created_at":"2026-01-01T00:00:00Z"})));
+    }
+    store
+        .commit(CloudTransaction {
+            entities: turns,
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    assert!(
+        store
+            .thread_incomplete("acceptance-project", "thread")
+            .await
+            .unwrap()
+    );
+    assert!(
+        !store
+            .thread_incomplete("other-project", "thread")
+            .await
+            .unwrap()
+    );
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    let session = AuthSession {
+        security_epoch: 0,
+        session_hash: "a".repeat(64),
+        subject: "acceptance-user".into(),
+        csrf_hash: "b".repeat(64),
+        created_at: now,
+        expires_at: now + 120,
+    };
+    store.put_session(session.clone()).await.unwrap();
+    let lease = store
+        .claim_lease("acceptance-project", "runtime", "replica-one", now, 30)
+        .await
+        .unwrap();
+    assert_eq!(
+        store
+            .claim_lease("acceptance-project", "runtime", "replica-two", now, 30)
+            .await
+            .unwrap_err(),
+        CloudError::Conflict
+    );
+    let fenced = store
+        .claim_lease("acceptance-project", "runtime", "replica-one", now, 30)
+        .await
+        .unwrap();
+    assert!(fenced.generation > lease.generation);
+    assert_eq!(
+        store.verify_lease(&lease, now).await.unwrap_err(),
+        CloudError::Conflict
+    );
+    assert!(matches!(
+        store
+            .commit(CloudTransaction {
+                entities: vec![write(
+                    EntityKind::Host,
+                    "stale-owner",
+                    0,
+                    json!({"label":"Stale"})
+                )],
+                lease: Some(lease),
+                ..Default::default()
+            })
+            .await,
+        Err(StoreError::WriterLeaseHeld)
+    ));
+    store.release_lease(&fenced).await.unwrap();
+    assert_eq!(
+        store
+            .claim_lease("acceptance-project", "missing-node", "replica", now, 30)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let revoked_lease = store
+        .claim_lease("acceptance-project", "runtime", "revocation-case", now, 30)
+        .await
+        .unwrap();
+    let current = store.read(&key(EntityKind::Node, "runtime")).await.unwrap();
+    let mut revoked = current.value;
+    revoked["revoked"] = json!(true);
+    store
+        .commit(CloudTransaction {
+            entities: vec![write(
+                EntityKind::Node,
+                "runtime",
+                current.revision,
+                revoked,
+            )],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    assert!(matches!(
+        store
+            .commit(CloudTransaction {
+                entities: vec![write(
+                    EntityKind::Host,
+                    "revoked-owner",
+                    0,
+                    json!({"label":"Must not persist"})
+                )],
+                lease: Some(revoked_lease),
+                ..Default::default()
+            })
+            .await,
+        Err(StoreError::WriterLeaseHeld)
+    ));
+    assert_eq!(
+        store
+            .read(&key(EntityKind::Host, "revoked-owner"))
+            .await
+            .unwrap_err(),
+        CloudError::NotFound
+    );
+    assert_eq!(
+        store
+            .read_lease("acceptance-project", "runtime", now)
+            .await
+            .unwrap_err(),
+        CloudError::NotFound
+    );
+    let replica = CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+        .await
+        .unwrap();
+    assert_eq!(
+        replica
+            .read_session(&session.session_hash, now)
+            .await
+            .unwrap(),
+        session
+    );
+    assert_eq!(
+        replica
+            .events("acceptance-project", "scope", 0, 100)
+            .await
+            .unwrap(),
+        vec![event]
+    );
+    let mut notifications = replica.subscribe();
+    // Dedicated LISTEN connections connect asynchronously; this is acceptance synchronization.
+    tokio::time::sleep(Duration::from_millis(100)).await;
+    store
+        .commit(CloudTransaction {
+            entities: vec![write(
+                EntityKind::Host,
+                "notification",
+                0,
+                json!({"label":"Notification"}),
+            )],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    assert_eq!(
+        tokio::time::timeout(Duration::from_secs(3), notifications.recv())
+            .await
+            .unwrap()
+            .unwrap(),
+        "acceptance-project"
+    );
+    store
+        .delete_entity(&key(EntityKind::Host, "notification"), 1)
+        .await
+        .unwrap();
+    assert_eq!(
+        store
+            .read(&key(EntityKind::Host, "notification"))
+            .await
+            .unwrap_err(),
+        CloudError::NotFound
+    );
+    assert!(
+        store
+            .commit(CloudTransaction {
+                entities: vec![write(
+                    EntityKind::Host,
+                    "notification",
+                    0,
+                    json!({"label":"Cannot reuse"})
+                )],
+                ..Default::default()
+            })
+            .await
+            .is_err()
+    );
+    let mut conn = store.pool.get().await.unwrap();
+    conn.batch_execute("UPDATE hosts SET record='{}'::JSONB WHERE id='host'")
+        .await
+        .unwrap();
+    assert_eq!(
+        store.read(&host.key).await.unwrap_err(),
+        CloudError::Storage
+    );
+    // Only the generated acceptance namespace is removed.
+    assert!(config.schema.starts_with("cloud_acceptance_"));
+    conn.batch_execute(&format!("DROP SCHEMA \"{}\" CASCADE", config.schema))
+        .await
+        .unwrap();
+}
+
+#[test]
+fn config_rejects_identifiers_and_remote_plaintext() {
+    let mut config = config();
+    config.schema = "cloud;DROP TABLE".into();
+    assert_eq!(config.validate().unwrap_err(), CloudError::InvalidArgument);
+    config.schema = "cloud".into();
+    assert_eq!(
+        crate::connection::parse("postgres://fixture:fixture@example.com/cloud", &config)
+            .unwrap_err(),
+        CloudError::InvalidArgument
+    );
+}
+
+#[test]
+fn stored_hashes_ignore_object_order_without_losing_large_integers() {
+    let first: serde_json::Value =
+        serde_json::from_str(r#"{"z":{"long":18446744073709551615,"a":[{"z":true,"a":1}]},"a":0}"#)
+            .unwrap();
+    let reordered: serde_json::Value =
+        serde_json::from_str(r#"{"a":0,"z":{"a":[{"a":1,"z":true}],"long":18446744073709551615}}"#)
+            .unwrap();
+    // Exercise the exact feature union that previously made JSONB reads reject audits.
+    assert_eq!(first.as_object().unwrap().keys().next().unwrap(), "z");
+    let expected = br#"{"a":0,"z":{"a":[{"a":1,"z":true}],"long":18446744073709551615}}"#;
+    assert_eq!(crate::canonical::bytes(&first).unwrap(), expected);
+    assert_eq!(
+        crate::entities::digest(&first).unwrap(),
+        crate::entities::digest(&reordered).unwrap()
+    );
+    let changed: serde_json::Value =
+        serde_json::from_str(r#"{"a":0,"z":{"a":[{"a":1,"z":true}],"long":18446744073709551614}}"#)
+            .unwrap();
+    assert_ne!(
+        crate::entities::digest(&first).unwrap(),
+        crate::entities::digest(&changed).unwrap()
+    );
+    let negative_zero: serde_json::Value =
+        serde_json::from_str(r#"{"z":-0.0,"a":0,"nested":[0.0,-0.0]}"#).unwrap();
+    assert_eq!(
+        crate::canonical::bytes(&negative_zero).unwrap(),
+        br#"{"a":0,"nested":[0.0,0.0],"z":0.0}"#
+    );
+}
+
+async fn assert_stable_page_boundary(store: &dyn CloudStore) {
+    let value = |time: &str| json!({"node_id":"runtime","workspace_id":"workspace","title":"CursorRegression","created_at":"2026-01-01T00:00:00Z","updated_at":time});
+    store
+        .commit(CloudTransaction {
+            entities: vec![
+                write(
+                    EntityKind::Thread,
+                    "page-first",
+                    0,
+                    value("2026-10-05T12:00:03Z"),
+                ),
+                write(
+                    EntityKind::Thread,
+                    "page-boundary",
+                    0,
+                    value("2026-10-05T12:00:02Z"),
+                ),
+                write(
+                    EntityKind::Thread,
+                    "page-older",
+                    0,
+                    value("2026-10-05T12:00:01Z"),
+                ),
+            ],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    let query = EntityQuery {
+        kind: EntityKind::Thread,
+        project_id: "acceptance-project".into(),
+        query: Some("CursorRegression".into()),
+        order: EntityOrder::UpdatedDesc,
+        limit: 2,
+        ..Default::default()
+    };
+    let first = store.list(&query).await.unwrap();
+    assert_eq!(
+        first
+            .iter()
+            .map(|record| record.key.id.as_str())
+            .collect::<Vec<_>>(),
+        vec!["page-first", "page-boundary"]
+    );
+    let after = first[1].page_cursor.clone();
+    assert!(after.as_ref().unwrap().starts_with("cp1_"));
+    store
+        .commit(CloudTransaction {
+            entities: vec![write(
+                EntityKind::Thread,
+                "page-boundary",
+                1,
+                value("2026-10-05T12:00:05Z"),
+            )],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    let second = store
+        .list(&EntityQuery {
+            after: after.clone(),
+            ..query.clone()
+        })
+        .await
+        .unwrap();
+    assert_eq!(
+        second
+            .iter()
+            .map(|record| record.key.id.as_str())
+            .collect::<Vec<_>>(),
+        vec!["page-older"]
+    );
+    assert_eq!(
+        store
+            .read(&key(EntityKind::Thread, "page-boundary"))
+            .await
+            .unwrap()
+            .page_cursor,
+        None
+    );
+    assert_eq!(
+        store
+            .list(&EntityQuery {
+                project_id: "other-project".into(),
+                after,
+                ..query
+            })
+            .await
+            .unwrap_err(),
+        CloudError::InvalidArgument
+    );
+}
+
+#[tokio::test]
+async fn memory_page_cursor_preserves_position_when_boundary_changes() {
+    let store = MemoryCloudStore::default();
+    assert_stable_page_boundary(&store).await;
+}
+
+#[tokio::test]
+#[ignore = "requires isolated PostgreSQL and a separate synthetic audit signing reference"]
+async fn postgres_checkpoint_and_maintenance_conformance() {
+    let config = config();
+    let store = CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+        .await
+        .unwrap();
+    let body:serde_json::Value=serde_json::from_str(r#"{"verifier":"synthetic-opaque-pkce","nonce":"synthetic-nonce","expires_at":9999999999,"metadata":{"z":18446744073709551615,"a":[1,2,3],"zero":[-0.0,0.0]}}"#).unwrap();
+    let body_key = EntityKey {
+        kind: EntityKind::AuthFlow,
+        project_id: "__auth".into(),
+        parent_id: None,
+        id: "preserve-order-proof".into(),
+    };
+    store
+        .commit(CloudTransaction {
+            entities: vec![EntityMutation {
+                key: body_key.clone(),
+                expected_revision: 0,
+                value: body.clone(),
+                actor: "acceptance".into(),
+                operation: "cloud.auth.flow-created.v2".into(),
+            }],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    assert_eq!(store.read(&body_key).await.unwrap().value, body);
+    store
+        .commit(CloudTransaction {
+            entities: vec![
+                write(
+                    EntityKind::Project,
+                    "acceptance-project",
+                    0,
+                    json!({"project_id":"acceptance-project","label":"Acceptance"}),
+                ),
+                write(
+                    EntityKind::Host,
+                    "anchor-host",
+                    0,
+                    json!({"label":"Anchored host"}),
+                ),
+            ],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    store
+        .commit(CloudTransaction {
+            entities: vec![write(
+                EntityKind::Host,
+                "anchor-host",
+                1,
+                json!({"label":"Anchored revision two"}),
+            )],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    let anchor = store
+        .export_audit_checkpoint(
+            "acceptance-project",
+            "COLOSSUS_CLOUD_TEST_AUDIT_SIGNING_SEED",
+        )
+        .await
+        .unwrap();
+    crate::verify_checkpoint_signature(&anchor, &anchor.public_key).unwrap();
+    store
+        .verify_audit_checkpoint(&anchor, &anchor.public_key)
+        .await
+        .unwrap();
+    let mut changed = anchor.clone();
+    changed.checkpoint.heads[0].chain_hash = "0".repeat(64);
+    assert!(crate::verify_checkpoint_signature(&changed, &anchor.public_key).is_err());
+    assert!(crate::verify_checkpoint_signature(&anchor, &"0".repeat(64)).is_err());
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    store
+        .put_session(AuthSession {
+            security_epoch: 0,
+            session_hash: "d".repeat(64),
+            subject: "expired".into(),
+            csrf_hash: String::new(),
+            created_at: now - 60,
+            expires_at: now - 1,
+        })
+        .await
+        .unwrap();
+    let expired = EntityMutation {
+        key: EntityKey {
+            kind: EntityKind::AuthFlow,
+            project_id: "__auth".into(),
+            parent_id: None,
+            id: "expired-flow".into(),
+        },
+        expected_revision: 0,
+        value: json!({"nonce":"synthetic","ciphertext":"opaque-synthetic-ciphertext","expires_at":now-1}),
+        actor: "acceptance".into(),
+        operation: "cloud.auth-flow.created.v1".into(),
+    };
+    let marker = EntityMutation {
+        key: EntityKey {
+            kind: EntityKind::AuthFlow,
+            project_id: "__migration".into(),
+            parent_id: None,
+            id: "retained-marker".into(),
+        },
+        expected_revision: 0,
+        value: json!({"status":"running"}),
+        actor: "acceptance".into(),
+        operation: "cloud.import.started.v1".into(),
+    };
+    store
+        .commit(CloudTransaction {
+            entities: vec![expired.clone(), marker.clone()],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    let report = store
+        .maintain(now, &CloudMaintenancePolicy::default())
+        .await
+        .unwrap();
+    assert!(report.published_outbox >= 1);
+    assert_eq!(report.expired_sessions, 1);
+    assert_eq!(report.expired_auth_flows, 1);
+    assert_eq!(
+        store.read(&expired.key).await.unwrap_err(),
+        CloudError::NotFound
+    );
+    assert_eq!(store.read(&marker.key).await.unwrap().value, marker.value);
+    let report = store
+        .maintain(now + 86402, &CloudMaintenancePolicy::default())
+        .await
+        .unwrap();
+    assert!(report.removed_outbox >= 1);
+    store
+        .verify_audit_checkpoint(&anchor, &anchor.public_key)
+        .await
+        .unwrap();
+    let mut conn = store.pool.get().await.unwrap();
+    conn.batch_execute("UPDATE hosts SET revision=1 WHERE id='anchor-host'")
+        .await
+        .unwrap();
+    assert_eq!(
+        store
+            .verify_audit_checkpoint(&anchor, &anchor.public_key)
+            .await
+            .unwrap_err(),
+        CloudError::Storage
+    );
+    conn.batch_execute(&format!("DROP SCHEMA \"{}\" CASCADE", config.schema))
+        .await
+        .unwrap();
+}
diff --git a/crates/colossus-cloud-postgres/src/tests/identity.rs b/crates/colossus-cloud-postgres/src/tests/identity.rs
new file mode 100644
index 000000000..36c75ca27
--- /dev/null
+++ b/crates/colossus-cloud-postgres/src/tests/identity.rs
@@ -0,0 +1,170 @@
+use super::*;
+use colossus_cloud::{
+    CloudCaller, CloudPermission, CloudProject, CloudRepository, CloudUser, OidcIdentity,
+    ProjectRole, UserAccount,
+};
+use std::sync::Arc;
+fn account(id: &str, admin: bool) -> UserAccount {
+    let now = time::OffsetDateTime::now_utc()
+        .format(&time::format_description::well_known::Rfc3339)
+        .unwrap();
+    UserAccount {
+        user: CloudUser {
+            id: id.into(),
+            display_name: format!("Fixture {id}"),
+            email: None,
+            active: true,
+            is_admin: admin,
+            revision: 1,
+            created_at: now.clone(),
+            updated_at: now,
+            identities: Vec::new(),
+        },
+        security_epoch: 1,
+    }
+}
+fn project(id: &str, parent: Option<&str>) -> CloudProject {
+    CloudProject {
+        id: id.into(),
+        name: id.into(),
+        description: String::new(),
+        parent_project_id: parent.map(str::to_owned),
+        archived: false,
+        revision: 0,
+        created_at: String::new(),
+        updated_at: String::new(),
+    }
+}
+#[tokio::test]
+#[ignore = "requires an explicit isolated local PostgreSQL fixture"]
+async fn postgres_identity_membership_hierarchy_and_administrator_invariants() {
+    let config = config();
+    let store = Arc::new(
+        CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+            .await
+            .unwrap(),
+    );
+    let repo = CloudRepository::new(store.clone()).unwrap();
+    for (id, is_admin) in [("administrator", true), ("operator", false)] {
+        repo.create_account(
+            "fixture",
+            account(id, is_admin),
+            Some(OidcIdentity {
+                user_id: id.into(),
+                issuer: "https://issuer.example.test".into(),
+                subject: id.into(),
+            }),
+            None,
+        )
+        .await
+        .unwrap();
+    }
+    let admin = repo.account("administrator").await.unwrap().user;
+    let first = repo
+        .save_project(&admin, project("parent-project", None))
+        .await
+        .unwrap();
+    let second = repo
+        .save_project(&admin, project("child-project", Some("parent-project")))
+        .await
+        .unwrap();
+    let mut cycle = first.clone();
+    cycle.parent_project_id = Some(second.id.clone());
+    assert_eq!(
+        repo.save_project(&admin, cycle).await.unwrap_err(),
+        CloudError::Conflict
+    );
+    assert_eq!(
+        repo.project("parent-project")
+            .await
+            .unwrap()
+            .parent_project_id,
+        None
+    );
+    let caller = CloudCaller::new(
+        admin.id.clone(),
+        first.id.clone(),
+        [CloudPermission::Read, CloudPermission::Administer].into(),
+    )
+    .unwrap();
+    let role = repo
+        .save_membership(&caller, "operator", ProjectRole::Operator, 0)
+        .await
+        .unwrap();
+    assert_eq!(repo.user_memberships("operator").await.unwrap().len(), 1);
+    assert_eq!(
+        repo.project_members(&caller, None, 100).await.unwrap()[0].user_id,
+        "operator"
+    );
+    let names = store.user_accounts(&["operator".into()]).await.unwrap();
+    assert_eq!(names.len(), 1);
+    assert_eq!(
+        names[0].value.pointer("/user/display_name"),
+        Some(&json!("Fixture operator"))
+    );
+    repo.remove_membership(&caller, "operator", role.revision)
+        .await
+        .unwrap();
+    assert!(
+        repo.project_members(&caller, None, 100)
+            .await
+            .unwrap()
+            .is_empty()
+    );
+    let restored = repo
+        .save_membership(&caller, "operator", ProjectRole::ProjectAdmin, 0)
+        .await
+        .unwrap();
+    assert!(restored.permissions.contains(&CloudPermission::Execute));
+    assert!(!restored.permissions.contains(&CloudPermission::Approve));
+    let mut disabled = admin.clone();
+    disabled.active = false;
+    assert_eq!(
+        repo.update_account(&admin, disabled).await.unwrap_err(),
+        CloudError::Conflict
+    );
+    assert!(repo.account("administrator").await.unwrap().user.active);
+    let mut demoted = admin.clone();
+    demoted.is_admin = false;
+    assert_eq!(
+        repo.update_account(&admin, demoted).await.unwrap_err(),
+        CloudError::Conflict
+    );
+    // A concurrent/differently configured bootstrap cannot create a second administrator after the winner.
+    assert_eq!(
+        repo.create_account(
+            "operator-bootstrap",
+            account("late-bootstrap", true),
+            Some(OidcIdentity {
+                user_id: "late-bootstrap".into(),
+                issuer: "https://issuer.example.test".into(),
+                subject: "late-bootstrap".into()
+            }),
+            None
+        )
+        .await
+        .unwrap_err(),
+        CloudError::Conflict
+    );
+    assert_eq!(
+        repo.account("late-bootstrap").await.unwrap_err(),
+        CloudError::NotFound
+    );
+    let projects = repo.projects_page(&admin, None, 100).await.unwrap();
+    assert_eq!(projects.len(), 2);
+    let mut child = second;
+    child.archived = true;
+    repo.save_project(&admin, child).await.unwrap();
+    let reopened = CloudPostgresStore::open(config.clone(), &AdditionalRootCertificates::default())
+        .await
+        .unwrap();
+    assert!(
+        CloudRepository::new(Arc::new(reopened))
+            .unwrap()
+            .project("child-project")
+            .await
+            .unwrap()
+            .archived
+    );
+    store.remove_fixture_schema(&config.schema).await.unwrap();
+}
diff --git a/crates/colossus-cloud-protocol/Cargo.toml b/crates/colossus-cloud-protocol/Cargo.toml
new file mode 100644
index 000000000..cd88abe66
--- /dev/null
+++ b/crates/colossus-cloud-protocol/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "colossus-cloud-protocol"
+publish = false
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+colossus-sdk = { workspace = true, features = ["serialization"] }
+prost.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tonic.workspace = true
+tonic-prost.workspace = true
+
+[build-dependencies]
+protoc-bin-vendored.workspace = true
+tonic-prost-build.workspace = true
+
+[lints]
+workspace = true
diff --git a/crates/colossus-cloud-protocol/build.rs b/crates/colossus-cloud-protocol/build.rs
new file mode 100644
index 000000000..5caaee82e
--- /dev/null
+++ b/crates/colossus-cloud-protocol/build.rs
@@ -0,0 +1,12 @@
+//! Generate the independently versioned outbound connection contract.
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let proto = "proto/colossus/cloud/v1alpha1/connector.proto";
+    println!("cargo:rerun-if-changed={proto}");
+    let mut config = tonic_prost_build::Config::new();
+    config.protoc_executable(protoc_bin_vendored::protoc_bin_path()?);
+    tonic_prost_build::configure()
+        .build_transport(false)
+        .compile_with_config(config, &[proto], &["proto"])?;
+    Ok(())
+}
diff --git a/crates/colossus-cloud-protocol/proto/colossus/cloud/v1alpha1/connector.proto b/crates/colossus-cloud-protocol/proto/colossus/cloud/v1alpha1/connector.proto
new file mode 100644
index 000000000..a0ae7a221
--- /dev/null
+++ b/crates/colossus-cloud-protocol/proto/colossus/cloud/v1alpha1/connector.proto
@@ -0,0 +1,123 @@
+syntax = "proto3";
+package colossus.cloud.v1alpha1;
+
+// Connect is initiated by the machine. Both directions are authenticated and
+// bounded; stream loss never cancels a run or permits reassignment of a task.
+service RuntimeConnection {
+  rpc Connect(stream RuntimeFrame) returns (stream ControlFrame);
+  // Existing client certificate authorizes exact fixed-node certificate rotation.
+  rpc RenewCertificate(CertificateRenewal) returns (RenewedCertificate);
+  // A native enrollment can reduce only its own authority using its pinned leaf.
+  rpc RevokeEnrollment(EnrollmentIdentity) returns (EnrollmentRevoked);
+}
+
+message EnrollmentIdentity {
+  string project_id = 1;
+  string node_id = 2;
+  string instance_id = 3;
+}
+message EnrollmentRevoked {}
+
+message CertificateRenewal {
+  string project_id = 1;
+  string node_id = 2;
+  string instance_id = 3;
+  string renewal_id = 4;
+  string csr_pem = 5;
+}
+message RenewedCertificate {
+  string certificate_pem = 1;
+}
+
+message RuntimeFrame {
+  oneof body {
+    RuntimeHello hello = 1;
+    CommandReceipt receipt = 2;
+    ReleasedRunEvent event = 3;
+    RuntimeHeartbeat heartbeat = 4;
+    RuntimeSnapshot snapshot = 5;
+    ReleasedOutputLimit output_limit = 6;
+    ReleasedDiscoveryPage discovery = 7;
+  }
+}
+// The local SDK released an event larger than the cloud frame budget. The host
+// retains its current exclusive cursor and continues snapshots/control only.
+message ReleasedOutputLimit {
+  string task_id = 1;
+  string run_id = 2;
+  uint64 after_sequence = 3;
+}
+message RuntimeHello {
+  uint32 protocol_major = 1;
+  string node_id = 2;
+  string instance_id = 3;
+  repeated string capabilities = 4;
+  string project_id = 5;
+  // Strict RuntimeInventory JSON. Informational grouping never grants authority.
+  bytes inventory_json = 6;
+}
+// Cloud requests only caller-visible runs beneath the dedicated native grant.
+message DiscoverRuns {
+  string sync_id = 1;
+  string page_token = 2;
+  uint32 page_size = 3;
+  bool include_archived = 4;
+}
+message ReleasedDiscoveryPage {
+  string sync_id = 1;
+  string page_token = 2;
+  // Strict JSON Vec<ReleasedRunInventory>, with runtime-derived authority flags.
+  bytes runs_json = 3;
+  string next_page_token = 4;
+}
+// Sent only after runs and their cloud source mappings commit durably.
+message DiscoveryAcknowledgement {
+  string sync_id = 1;
+  string page_token = 2;
+}
+message RuntimeSnapshot {
+  string task_id = 1;
+  bytes snapshot_json = 2;
+}
+message RuntimeHeartbeat {
+  bool ready = 1;
+  // Current strict RuntimeInventory JSON after public metadata release. Old peers ignore this field.
+  bytes inventory_json = 2;
+}
+message CommandReceipt {
+  string command_id = 1;
+  string task_id = 2;
+  // Versioned, strict JSON CloudReply. No credentials or unreleased output.
+  bytes reply_json = 3;
+}
+message ReleasedRunEvent {
+  string task_id = 1;
+  string run_id = 2;
+  uint64 sequence = 3;
+  // Versioned, strict JSON of the SDK's policy-released RunUpdate.
+  bytes update_json = 4;
+}
+message ControlFrame {
+  oneof body {
+    ConnectionWelcome welcome = 1;
+    CloudCommand command = 2;
+    EventAcknowledgement acknowledgement = 3;
+    DiscoverRuns discover = 4;
+    DiscoveryAcknowledgement discovery_acknowledgement = 5;
+  }
+}
+message ConnectionWelcome {
+  uint32 protocol_major = 1;
+  string connection_id = 2;
+}
+message CloudCommand {
+  string command_id = 1;
+  string task_id = 2;
+  // Versioned, closed Command enum, never an arbitrary RPC or executable.
+  bytes command_json = 3;
+  uint64 after_sequence = 4;
+}
+message EventAcknowledgement {
+  string task_id = 1;
+  uint64 sequence = 2;
+}
diff --git a/crates/colossus-cloud-protocol/src/lib.rs b/crates/colossus-cloud-protocol/src/lib.rs
new file mode 100644
index 000000000..6565c5e3d
--- /dev/null
+++ b/crates/colossus-cloud-protocol/src/lib.rs
@@ -0,0 +1,13 @@
+//! Independently versioned, bounded cloud connection messages and released DTOs.
+
+mod messages;
+pub use messages::*;
+
+/// Generated Protobuf connection envelope. Authentication is outside the payload.
+pub mod v1alpha1 {
+    #![allow(missing_docs)]
+    tonic::include_proto!("colossus.cloud.v1alpha1");
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/colossus-cloud-protocol/src/messages.rs b/crates/colossus-cloud-protocol/src/messages.rs
new file mode 100644
index 000000000..49d5e0d0f
--- /dev/null
+++ b/crates/colossus-cloud-protocol/src/messages.rs
@@ -0,0 +1,195 @@
+use colossus_sdk::{
+    ApiError, CancelRunResponse, CreateRunRequest, GetRunResponse, RespondInteractionRequest,
+    RespondInteractionResponse, RunUpdate,
+};
+use serde::{Deserialize, Serialize};
+
+/// Supported major of the closed JSON and Protobuf connection contract.
+pub const PROTOCOL_MAJOR: u32 = 1;
+/// Maximum command, receipt, or released update payload.
+pub const MAX_PAYLOAD_BYTES: usize = 2 * 1024 * 1024;
+/// Maximum frames queued in either direction before applying backpressure.
+pub const MAX_QUEUED_FRAMES: usize = 32;
+/// Maximum concurrently watched tasks on one enrolled runtime.
+pub const MAX_ACTIVE_TASKS: usize = 16;
+/// Maximum runs released by one inventory discovery page.
+pub const MAX_DISCOVERY_PAGE_SIZE: u32 = 32;
+/// Caller-visible runtime metadata with authority derived by its public SDK.
+pub type ReleasedRunInventory = colossus_sdk::VisibleRun;
+
+/// Native placement advertised by an enrolled runtime, without machine paths.
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum DeploymentKind {
+    /// An independently managed installed runtime.
+    #[default]
+    Cli,
+    /// A workspace runtime supervised by Colossus Desktop.
+    Desktop,
+}
+
+/// Explicit local disclosure posture; enrollment does not imply session sharing.
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum WorkspaceSharing {
+    /// Only sessions owned by the independent cloud application are visible.
+    #[default]
+    CloudOwned,
+    /// Local ownership has explicitly released workspace sessions to the connector.
+    SharedVisibleSessions,
+}
+
+/// Non-secret native inventory. Grouping fields never change application authority.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimeInventory {
+    /// Runtime-released caller-scoped configuration posture; absent means unknown.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy: Option<colossus_sdk::RuntimePolicyPosture>,
+    /// Installation identity persisted in the owner-private native Colossus home.
+    pub host_id: String,
+    /// Operator-visible host label, never an automatically discovered hostname.
+    pub host_label: String,
+    /// Bounded native platform identifier such as linux, windows, or macos.
+    pub platform: String,
+    /// Independently supervised CLI or Desktop workspace runtime.
+    pub deployment_kind: DeploymentKind,
+    /// Opaque runtime/workspace identity; never a filesystem path.
+    pub workspace_id: String,
+    /// Native-sourced workspace presentation label.
+    pub workspace_label: String,
+    /// Explicit local disclosure posture.
+    pub sharing: WorkspaceSharing,
+}
+
+impl RuntimeInventory {
+    /// Validate grouping labels and opaque identities before persisting inventory.
+    pub fn validate(&self) -> Result<(), PayloadError> {
+        let identity = |value: &str| {
+            !value.is_empty()
+                && value.len() <= 128
+                && value
+                    .bytes()
+                    .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+        };
+        let label = |value: &str| {
+            !value.trim().is_empty() && value.len() <= 256 && !value.chars().any(char::is_control)
+        };
+        if self.policy.as_ref().is_none_or(|policy| policy.validate())
+            && identity(&self.host_id)
+            && identity(&self.workspace_id)
+            && label(&self.host_label)
+            && label(&self.workspace_label)
+            && matches!(
+                self.platform.as_str(),
+                "linux" | "windows" | "macos" | "freebsd" | "unknown"
+            )
+        {
+            Ok(())
+        } else {
+            Err(PayloadError)
+        }
+    }
+}
+
+/// Closed runtime operation set. The server assigns all durable idempotency keys.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "operation", rename_all = "snake_case", deny_unknown_fields)]
+pub enum Command {
+    /// Read canonical released conversation history under local sharing authority.
+    History {
+        /// Runtime-owned source run already mapped by the controller to this node/session.
+        source_run_id: String,
+        /// Opaque SDK activity cursor; callers cannot select an application owner.
+        page_token: Option<String>,
+        /// At most 32 canonical activity records.
+        page_size: u32,
+    },
+    /// Create or reconcile one exact caller-bound request, then watch its run.
+    Create {
+        /// Complete SDK request beneath the dedicated local application grant.
+        request: Box<CreateRunRequest>,
+    },
+    /// Resume observing the exact run already assigned to this node.
+    Watch {
+        /// Local runtime run identity.
+        run_id: String,
+        /// Observe state/control only after the host's released-output retention bound.
+        #[serde(default)]
+        snapshot_only: bool,
+    },
+    /// Cooperatively cancel the assigned run, using a stable mutation identity.
+    Cancel {
+        /// Local runtime run identity.
+        run_id: String,
+        /// Cloud-assigned, caller-scoped idempotency key.
+        idempotency_key: colossus_sdk::IdempotencyKey,
+    },
+    /// Answer an exact pending interaction beneath explicit response authority.
+    Respond {
+        /// Runtime-bound interaction, revision, response, and idempotency key.
+        request: Box<RespondInteractionRequest>,
+    },
+}
+
+/// Receipt for a command. Success is sent only after the local durable result exists.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum CloudReply {
+    /// Canonical caller-visible user/assistant activity page; no tools or system lanes.
+    History {
+        /// Released bounded SDK history and its continuation/projection watermark.
+        response: colossus_sdk::ListSessionActivityResponse,
+    },
+    /// Full caller-visible snapshot, including the exact run identity and revision.
+    Run {
+        /// Released local run state.
+        run: Box<GetRunResponse>,
+    },
+    /// Durable cooperative cancellation result.
+    Cancelled {
+        /// Released cancellation state.
+        response: CancelRunResponse,
+    },
+    /// Durable one-use interaction response.
+    Responded {
+        /// Released response receipt.
+        response: RespondInteractionResponse,
+    },
+    /// Sanitized SDK error; unknown outcomes require reconciliation.
+    Failed {
+        /// Released categorical error without transport/provider diagnostics.
+        error: ApiError,
+    },
+}
+
+/// Reject empty, oversized, malformed, or unknown-operation payloads before dispatch.
+pub fn decode<T: serde::de::DeserializeOwned>(bytes: &[u8]) -> Result<T, PayloadError> {
+    if bytes.is_empty() || bytes.len() > MAX_PAYLOAD_BYTES {
+        return Err(PayloadError);
+    }
+    serde_json::from_slice(bytes).map_err(|_| PayloadError)
+}
+
+/// Encode one bounded typed payload, never private worker frames or credentials.
+pub fn encode<T: Serialize>(value: &T) -> Result<Vec<u8>, PayloadError> {
+    let bytes = serde_json::to_vec(value).map_err(|_| PayloadError)?;
+    if bytes.is_empty() || bytes.len() > MAX_PAYLOAD_BYTES {
+        return Err(PayloadError);
+    }
+    Ok(bytes)
+}
+
+/// Verify both identities/cursors before accepting a released runtime update.
+pub fn decode_update(bytes: &[u8], run_id: &str, sequence: u64) -> Result<RunUpdate, PayloadError> {
+    let update: RunUpdate = decode(bytes)?;
+    if sequence == 0 || update.run_id != run_id || update.sequence != sequence {
+        return Err(PayloadError);
+    }
+    Ok(update)
+}
+
+/// A categorical error that intentionally does not include untrusted input bytes.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, thiserror::Error)]
+#[error("cloud payload is invalid or exceeds its bound")]
+pub struct PayloadError;
diff --git a/crates/colossus-cloud-protocol/src/tests.rs b/crates/colossus-cloud-protocol/src/tests.rs
new file mode 100644
index 000000000..840926811
--- /dev/null
+++ b/crates/colossus-cloud-protocol/src/tests.rs
@@ -0,0 +1,19 @@
+use super::*;
+
+#[test]
+fn unknown_operations_and_fields_are_rejected() {
+    assert!(decode::<Command>(br#"{"operation":"shell","program":"sh"}"#).is_err());
+    assert!(
+        decode::<Command>(br#"{"operation":"watch","run_id":"run-1","actor":"admin"}"#).is_err()
+    );
+}
+
+#[test]
+fn empty_and_oversized_payloads_are_rejected_without_echoing_input() {
+    assert!(decode::<Command>(&[]).is_err());
+    let oversized = vec![b'x'; MAX_PAYLOAD_BYTES + 1];
+    assert_eq!(
+        decode::<Command>(&oversized).unwrap_err().to_string(),
+        "cloud payload is invalid or exceeds its bound"
+    );
+}
diff --git a/crates/colossus-cloud-server/Cargo.toml b/crates/colossus-cloud-server/Cargo.toml
new file mode 100644
index 000000000..576e6491e
--- /dev/null
+++ b/crates/colossus-cloud-server/Cargo.toml
@@ -0,0 +1,63 @@
+[package]
+name = "colossus-cloud-server"
+default-run = "colossus-control-plane"
+publish = false
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+argon2.workspace = true
+axum.workspace = true
+chrono.workspace = true
+async-trait.workspace = true
+colossus-cloud.workspace = true
+colossus-cloud-postgres.workspace = true
+colossus-journal-redb.workspace = true
+colossus-journal-postgres.workspace = true
+colossus-contracts.workspace = true
+colossus-network.workspace = true
+chacha20poly1305.workspace = true
+colossus-cloud-protocol.workspace = true
+colossus-ports.workspace = true
+colossus-home.workspace = true
+colossus-sdk = { workspace = true, features = ["serialization"] }
+futures.workspace = true
+hex.workspace = true
+openidconnect.workspace = true
+rcgen = { workspace = true, features = ["x509-parser"] }
+reqwest.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+tokio.workspace = true
+tokio-rustls.workspace = true
+rustls.workspace = true
+tower-http = { version = "0.6.11", features = ["fs", "set-header"] }
+tokio-stream = { workspace = true, features = ["net"] }
+tonic = { workspace = true, features = ["transport", "tls-ring"] }
+getrandom.workspace = true
+time.workspace = true
+url.workspace = true
+uuid.workspace = true
+zeroize.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+tower.workspace = true
+colossus-connector.workspace = true
+colossus-testkit.workspace = true
+colossus-runtime.workspace = true
+serde-saphyr.workspace = true
+base64.workspace = true
+p256.workspace = true
+colossus-api-runtime.workspace = true
+colossus-api.workspace = true
+colossus-policy.workspace = true
+colossus-credentials.workspace = true
+colossus-sdk = { workspace = true, features = ["embedded", "serialization", "sidecar"] }
+keyring.workspace = true
+
+[lints]
+workspace = true
diff --git a/crates/colossus-cloud-server/examples/init_local.rs b/crates/colossus-cloud-server/examples/init_local.rs
new file mode 100644
index 000000000..f44423e2f
--- /dev/null
+++ b/crates/colossus-cloud-server/examples/init_local.rs
@@ -0,0 +1,111 @@
+//! Generate owner-private local TLS and OIDC configuration without production secrets.
+use colossus_cloud::CloudPermission;
+use colossus_cloud_server::config::{BootstrapAdmin, Config, Membership, OidcConfig};
+use colossus_home::ColossusHome;
+use rcgen::{
+    BasicConstraints, CertificateParams, ExtendedKeyUsagePurpose, IsCa, Issuer, KeyPair,
+    KeyUsagePurpose,
+};
+use std::{
+    collections::BTreeSet,
+    io::Write,
+    path::{Path, PathBuf},
+};
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let path = PathBuf::from(
+        std::env::args_os()
+            .nth(1)
+            .ok_or("usage: init_local ABSOLUTE_PRIVATE_DIR")?,
+    );
+    let home = ColossusHome::ensure_at(path)?;
+    let root = home.confined_root();
+    if root.path().join("cloud.json").exists() {
+        return Err("local cloud configuration already exists".into());
+    }
+    let ca_key = KeyPair::generate()?;
+    let mut ca = CertificateParams::default();
+    ca.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+    ca.key_usages = vec![
+        KeyUsagePurpose::KeyCertSign,
+        KeyUsagePurpose::DigitalSignature,
+        KeyUsagePurpose::CrlSign,
+    ];
+    let ca_cert = ca.self_signed(&ca_key)?;
+    let issuer = Issuer::new(ca, ca_key);
+    let server_key = KeyPair::generate()?;
+    let mut server = CertificateParams::new(vec!["localhost".into(), "127.0.0.1".into()])?;
+    server.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
+    let server_cert = server.signed_by(&server_key, &issuer)?;
+    for (name, bytes) in [
+        ("ca.pem", ca_cert.pem()),
+        ("ca-key.pem", issuer.key().serialize_pem()),
+        ("server.pem", server_cert.pem()),
+        ("server-key.pem", server_key.serialize_pem()),
+    ] {
+        let file = root.open_file(Path::new(name))?;
+        file.file().write_all(bytes.as_bytes())?;
+        file.file().sync_all()?;
+    }
+    let config = Config {
+        http_bind: "127.0.0.1:8090".parse()?,
+        grpc_bind: "127.0.0.1:8443".parse()?,
+        public_origin: "http://127.0.0.1:5180".into(),
+        grpc_endpoint: "https://localhost:8443".into(),
+        ca_certificate: root.path().join("ca.pem"),
+        ca_key: root.path().join("ca-key.pem"),
+        server_certificate: root.path().join("server.pem"),
+        server_key: root.path().join("server-key.pem"),
+        local_auth: None,
+        bootstrap_admin: Some(BootstrapAdmin {
+            display_name: "Local administrator".into(),
+            email: None,
+            oidc_subject: Some("11111111-1111-4111-8111-111111111111".into()),
+            username: None,
+            password_variable: None,
+        }),
+        classification: None,
+        oidc: Some(OidcConfig {
+            label: "Local identity".into(),
+            issuer: "http://127.0.0.1:8180/realms/colossus".into(),
+            client_id: "colossus-cloud".into(),
+            client_secret_file: None,
+        }),
+        memberships: vec![Membership {
+            subject: "11111111-1111-4111-8111-111111111111".into(),
+            project_id: "local-project".into(),
+            permissions: BTreeSet::from([
+                CloudPermission::Read,
+                CloudPermission::Execute,
+                CloudPermission::Control,
+                CloudPermission::Approve,
+                CloudPermission::Administer,
+            ]),
+        }],
+        web_root: std::env::current_dir()?.join("apps/web/dist"),
+        database: colossus_cloud_postgres::CloudDatabaseConfig {
+            connection_variable: "COLOSSUS_CLOUD_DATABASE".into(),
+            schema: "colossus_cloud".into(),
+            tls: colossus_cloud_postgres::CloudDatabaseTls::Disabled,
+            max_connections: 16,
+            connection_timeout_ms: 5000,
+            statement_timeout_ms: 15000,
+        },
+        local_development: true,
+        auth_key_variable: Some("COLOSSUS_CLOUD_AUTH_KEY".into()),
+        maintenance: Default::default(),
+    };
+    let mut auth_key = [0u8; 32];
+    getrandom::fill(&mut auth_key)?;
+    let environment = root.open_file(Path::new("local.env"))?;
+    environment.file().write_all(format!("export COLOSSUS_CLOUD_DATABASE='postgres://colossus:local-only-database@127.0.0.1:5433/colossus_cloud'\nexport COLOSSUS_CLOUD_AUTH_KEY='{}'\n",hex::encode(auth_key)).as_bytes())?;
+    environment.file().sync_all()?;
+    let file = root.open_file(Path::new("cloud.json"))?;
+    serde_json::to_writer_pretty(file.file(), &config)?;
+    file.file().sync_all()?;
+    root.sync_directory()?;
+    println!(
+        "Local cloud configuration is ready at {}",
+        root.path().join("cloud.json").display()
+    );
+    Ok(())
+}
diff --git a/crates/colossus-cloud-server/examples/init_runtime.rs b/crates/colossus-cloud-server/examples/init_runtime.rs
new file mode 100644
index 000000000..b533e9ecc
--- /dev/null
+++ b/crates/colossus-cloud-server/examples/init_runtime.rs
@@ -0,0 +1,27 @@
+//! Create an isolated, credential-free Echo runtime for local cloud acceptance.
+use colossus_home::ColossusHome;
+use colossus_runtime::RuntimeConfig;
+use std::{io::Write, path::Path};
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let directory = std::env::args_os()
+        .nth(1)
+        .ok_or("usage: init_runtime ABSOLUTE_PRIVATE_DIR")?;
+    let home = ColossusHome::ensure_at(directory)?;
+    let root = home.confined_root();
+    if root.path().join("config.yaml").exists() {
+        return Err("runtime configuration already exists".into());
+    }
+    let workflows = root.prepare_directory(Path::new("workflows"))?;
+    root.prepare_directory(Path::new("api"))?;
+    let mut config = RuntimeConfig::offline_template(root.path().join("state.redb"));
+    config.workflows.repository = workflows.clone();
+    config.workflows.user = workflows;
+    let yaml = serde_saphyr::to_string(&config)?;
+    let file = root.open_file(Path::new("config.yaml"))?;
+    file.file().write_all(yaml.as_bytes())?;
+    file.file().sync_all()?;
+    root.sync_directory()?;
+    println!("Isolated Echo runtime ready at {}", root.path().display());
+    Ok(())
+}
diff --git a/crates/colossus-cloud-server/src/admin.rs b/crates/colossus-cloud-server/src/admin.rs
new file mode 100644
index 000000000..d8aded66f
--- /dev/null
+++ b/crates/colossus-cloud-server/src/admin.rs
@@ -0,0 +1,488 @@
+//! Authenticated product identity/project administration; no runtime credential access.
+use crate::{http::Result, server::State};
+use axum::{
+    Json, Router,
+    extract::{Path, Query, State as Extract},
+    http::{HeaderMap, StatusCode},
+    routing::{get, post},
+};
+use colossus_cloud::{
+    CloudError, CloudPermission, CloudProject, CloudUser, LocalCredential, LoginIdentityMetadata,
+    OidcIdentity, ProjectRole, UserAccount, hash_identity, normalize_username,
+};
+use serde::Deserialize;
+use std::sync::Arc;
+use zeroize::Zeroizing;
+
+pub(crate) fn router() -> Router<Arc<State>> {
+    Router::new()
+        .route("/api/projects", get(projects).post(create_project))
+        .route("/api/projects/{project}", get(project).patch(edit_project))
+        .route(
+            "/api/projects/{project}/members",
+            get(members).post(add_member),
+        )
+        .route(
+            "/api/projects/{project}/members/{user}",
+            axum::routing::patch(edit_member).delete(remove_member),
+        )
+        .route("/api/projects/{project}/member-candidates", get(candidates))
+        .route("/api/admin/projects", get(admin_projects))
+        .route("/api/admin/users", get(users).post(create_user))
+        .route("/api/admin/users/{user}", get(user).patch(edit_user))
+        .route("/api/admin/users/{user}/password", post(password))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Page {
+    after: Option<String>,
+    limit: Option<usize>,
+    query: Option<String>,
+}
+impl Page {
+    fn limit(&self) -> Result<usize> {
+        let n = self.limit.unwrap_or(100);
+        if !(1..=100).contains(&n) {
+            return Err(CloudError::InvalidArgument.into());
+        }
+        if self
+            .after
+            .as_ref()
+            .is_some_and(|a| a.len() > 128 || a.chars().any(char::is_control))
+        {
+            return Err(CloudError::InvalidArgument.into());
+        }
+        if self
+            .query
+            .as_ref()
+            .is_some_and(|q| q.len() > 256 || q.chars().any(char::is_control))
+        {
+            return Err(CloudError::InvalidArgument.into());
+        }
+        Ok(n)
+    }
+}
+async fn users(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let actor = state.auth.admin(&headers, false).await?;
+    let limit = page.limit()?;
+    let users = state
+        .repo
+        .list_users(&actor, page.after.as_deref(), page.query.as_deref(), limit)
+        .await?;
+    let next = (users.len() == limit)
+        .then(|| users.last().map(|u| u.id.clone()))
+        .flatten();
+    Ok(Json(serde_json::json!({"users":users,"next_cursor":next})))
+}
+async fn user(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>> {
+    state.auth.admin(&headers, false).await?;
+    Ok(Json(
+        serde_json::json!({"user":state.repo.account(&id).await?.user}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct NewUser {
+    username: Option<String>,
+    password: Option<String>,
+    oidc_subject: Option<String>,
+    display_name: String,
+    email: Option<String>,
+    #[serde(default)]
+    is_admin: bool,
+}
+async fn create_user(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Json(mut input): Json<NewUser>,
+) -> Result<Json<serde_json::Value>> {
+    let actor = state.auth.admin(&headers, true).await?;
+    let username = input
+        .username
+        .as_deref()
+        .map(normalize_username)
+        .transpose()?;
+    let provider = state.config.oidc.as_ref();
+    if input.oidc_subject.is_some() && provider.is_none() {
+        return Err(CloudError::InvalidArgument.into());
+    }
+    if username.is_some() && (state.config.local_auth.is_none() || input.password.is_none()) {
+        return Err(CloudError::InvalidArgument.into());
+    }
+    if input.password.is_some() && username.is_none() {
+        return Err(CloudError::InvalidArgument.into());
+    }
+    let id = if let (Some(provider), Some(subject)) = (provider, &input.oidc_subject) {
+        hash_identity(&["oidc-user", &provider.issuer, subject])
+    } else {
+        uuid::Uuid::now_v7().simple().to_string()
+    };
+    let now = time::OffsetDateTime::now_utc()
+        .format(&time::format_description::well_known::Rfc3339)
+        .map_err(|_| CloudError::Storage)?;
+    let mut identities = Vec::new();
+    let oidc = if let (Some(provider), Some(subject)) = (provider, input.oidc_subject) {
+        identities.push(LoginIdentityMetadata {
+            kind: "oidc".into(),
+            label: provider.label.clone(),
+            username: None,
+            issuer: Some(provider.issuer.clone()),
+            subject: Some(subject.clone()),
+        });
+        Some(OidcIdentity {
+            user_id: id.clone(),
+            issuer: provider.issuer.clone(),
+            subject,
+        })
+    } else {
+        None
+    };
+    let local = if let Some(username) = username {
+        let hash = state
+            .auth
+            .password_hash(Zeroizing::new(
+                input.password.take().ok_or(CloudError::InvalidArgument)?,
+            ))
+            .await?;
+        identities.push(LoginIdentityMetadata {
+            kind: "local".into(),
+            label: "Local account".into(),
+            username: Some(username.clone()),
+            issuer: None,
+            subject: None,
+        });
+        Some(LocalCredential {
+            user_id: id.clone(),
+            username,
+            password_hash: hash,
+        })
+    } else {
+        None
+    };
+    let account = UserAccount {
+        user: CloudUser {
+            id,
+            display_name: input.display_name,
+            email: input.email,
+            active: true,
+            is_admin: input.is_admin,
+            revision: 1,
+            created_at: now.clone(),
+            updated_at: now,
+            identities,
+        },
+        security_epoch: 1,
+    };
+    let user = state
+        .repo
+        .create_account(&actor.id, account, oidc, local)
+        .await?;
+    Ok(Json(serde_json::json!({"user":user})))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct UserEdit {
+    revision: u64,
+    display_name: Option<String>,
+    #[serde(default, deserialize_with = "nullable_email")]
+    email: Option<Option<String>>,
+    active: Option<bool>,
+    is_admin: Option<bool>,
+}
+fn nullable_email<'de, D: serde::Deserializer<'de>>(
+    d: D,
+) -> std::result::Result<Option<Option<String>>, D::Error> {
+    Option::<String>::deserialize(d).map(Some)
+}
+async fn edit_user(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(input): Json<UserEdit>,
+) -> Result<Json<serde_json::Value>> {
+    let actor = state.auth.admin(&headers, true).await?;
+    let mut user = state.repo.account(&id).await?.user;
+    user.revision = input.revision;
+    if let Some(name) = input.display_name {
+        user.display_name = name;
+    }
+    if let Some(email) = input.email {
+        user.email = email;
+    }
+    if let Some(active) = input.active {
+        user.active = active;
+    }
+    if let Some(admin) = input.is_admin {
+        user.is_admin = admin;
+    }
+    Ok(Json(
+        serde_json::json!({"user":state.repo.update_account(&actor,user).await?}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Password {
+    revision: u64,
+    new_password: String,
+}
+async fn password(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(input): Json<Password>,
+) -> Result<Json<serde_json::Value>> {
+    let actor = state.auth.admin(&headers, true).await?;
+    if state.config.local_auth.is_none() {
+        return Err(CloudError::PermissionDenied.into());
+    }
+    let hash = state
+        .auth
+        .password_hash(Zeroizing::new(input.new_password))
+        .await?;
+    Ok(Json(
+        serde_json::json!({"user":state.repo.reset_local_password(&actor,&id,input.revision,hash).await?}),
+    ))
+}
+async fn projects(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let limit = page.limit()?;
+    let user = state.auth.user(&headers).await?;
+    let projects = if user.is_admin {
+        state
+            .repo
+            .projects_page(&user, page.after.as_deref(), limit)
+            .await?
+    } else {
+        state
+            .auth
+            .projects(&headers)
+            .await?
+            .into_iter()
+            .filter(|p| page.after.as_ref().is_none_or(|after| p.id > *after))
+            .take(limit)
+            .collect()
+    };
+    let next = (projects.len() == limit)
+        .then(|| projects.last().map(|p| p.id.clone()))
+        .flatten();
+    Ok(Json(
+        serde_json::json!({"projects":projects,"next_cursor":next}),
+    ))
+}
+async fn admin_projects(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    state.auth.admin(&headers, false).await?;
+    projects(Extract(state), headers, Query(page)).await
+}
+async fn project(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+) -> Result<Json<serde_json::Value>> {
+    state
+        .auth
+        .caller(&headers, &id, false)
+        .await?
+        .require(CloudPermission::Read)?;
+    Ok(Json(
+        serde_json::json!({"project":state.repo.project(&id).await?}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct NewProject {
+    id: Option<String>,
+    name: String,
+    #[serde(default)]
+    description: String,
+    parent_project_id: Option<String>,
+}
+async fn create_project(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Json(input): Json<NewProject>,
+) -> Result<Json<serde_json::Value>> {
+    let actor = state.auth.admin(&headers, true).await?;
+    let project = CloudProject {
+        id: input
+            .id
+            .unwrap_or_else(|| uuid::Uuid::now_v7().simple().to_string()),
+        name: input.name,
+        description: input.description,
+        parent_project_id: input.parent_project_id,
+        archived: false,
+        revision: 0,
+        created_at: String::new(),
+        updated_at: String::new(),
+    };
+    Ok(Json(
+        serde_json::json!({"project":state.repo.save_project(&actor,project).await?}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ProjectEdit {
+    revision: u64,
+    name: Option<String>,
+    description: Option<String>,
+    #[serde(default, deserialize_with = "nullable_email")]
+    parent_project_id: Option<Option<String>>,
+    archived: Option<bool>,
+}
+async fn edit_project(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(input): Json<ProjectEdit>,
+) -> Result<Json<serde_json::Value>> {
+    let user = state.auth.user(&headers).await?;
+    let caller = state.auth.caller(&headers, &id, true).await?;
+    caller.require(CloudPermission::Administer)?;
+    let mut project = state.repo.project(&id).await?;
+    project.revision = input.revision;
+    if let Some(name) = input.name {
+        project.name = name;
+    }
+    if let Some(description) = input.description {
+        project.description = description;
+    }
+    if let Some(parent) = input.parent_project_id {
+        project.parent_project_id = parent;
+    }
+    if let Some(archived) = input.archived {
+        project.archived = archived;
+    }
+    let project = if user.is_admin {
+        state.repo.save_project(&user, project).await?
+    } else {
+        state.repo.update_project_metadata(&caller, project).await?
+    };
+    Ok(Json(serde_json::json!({"project":project})))
+}
+async fn members(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &id, false).await?;
+    let limit = page.limit()?;
+    let members = state
+        .repo
+        .project_members(&caller, page.after.as_deref(), limit)
+        .await?;
+    let next = (members.len() == limit)
+        .then(|| members.last().map(|m| hash_identity(&[&m.user_id])))
+        .flatten();
+    let ids = members
+        .iter()
+        .map(|m| m.user_id.clone())
+        .collect::<Vec<_>>();
+    let accounts = state
+        .repo
+        .storage()
+        .user_accounts(&ids)
+        .await?
+        .into_iter()
+        .map(|record| {
+            serde_json::from_value::<UserAccount>(record.value)
+                .map(|a| (a.user.id.clone(), a.user))
+                .map_err(|_| CloudError::Storage)
+        })
+        .collect::<colossus_cloud::CloudResult<std::collections::BTreeMap<_, _>>>()?;
+    let members = members
+        .into_iter()
+        .map(|member| {
+            let mut value = serde_json::to_value(&member).map_err(|_| CloudError::Storage)?;
+            if let Some(user) = accounts.get(&member.user_id) {
+                value["display_name"] = serde_json::Value::String(user.display_name.clone());
+                value["active"] = serde_json::Value::Bool(user.active);
+            }
+            Ok(value)
+        })
+        .collect::<colossus_cloud::CloudResult<Vec<_>>>()?;
+    Ok(Json(
+        serde_json::json!({"members":members,"next_cursor":next}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Member {
+    user_id: String,
+    role: ProjectRole,
+    revision: Option<u64>,
+}
+async fn add_member(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Json(input): Json<Member>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &id, true).await?;
+    Ok(Json(
+        serde_json::json!({"member":state.repo.save_membership(&caller,&input.user_id,input.role,input.revision.unwrap_or(0)).await?}),
+    ))
+}
+async fn edit_member(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path((id, user)): Path<(String, String)>,
+    Json(input): Json<Member>,
+) -> Result<Json<serde_json::Value>> {
+    if input.user_id != user {
+        return Err(CloudError::InvalidArgument.into());
+    }
+    let caller = state.auth.caller(&headers, &id, true).await?;
+    Ok(Json(
+        serde_json::json!({"member":state.repo.save_membership(&caller,&user,input.role,input.revision.ok_or(CloudError::InvalidArgument)?).await?}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Revision {
+    revision: u64,
+}
+async fn remove_member(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path((id, user)): Path<(String, String)>,
+    Query(input): Query<Revision>,
+) -> Result<StatusCode> {
+    let caller = state.auth.caller(&headers, &id, true).await?;
+    state
+        .repo
+        .remove_membership(&caller, &user, input.revision)
+        .await?;
+    Ok(StatusCode::NO_CONTENT)
+}
+async fn candidates(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Path(id): Path<String>,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &id, false).await?;
+    let query = page.query.ok_or(CloudError::InvalidArgument)?;
+    let users = state
+        .repo
+        .member_candidates(&caller, &query)
+        .await?
+        .into_iter()
+        .map(|u| serde_json::json!({"id":u.id,"display_name":u.display_name}))
+        .collect::<Vec<_>>();
+    Ok(Json(serde_json::json!({"users":users})))
+}
diff --git a/crates/colossus-cloud-server/src/auth.rs b/crates/colossus-cloud-server/src/auth.rs
new file mode 100644
index 000000000..bbeac6099
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth.rs
@@ -0,0 +1,416 @@
+use crate::config::Config;
+use axum::http::{HeaderMap, HeaderValue};
+use chacha20poly1305::{
+    KeyInit, XChaCha20Poly1305, XNonce,
+    aead::{Aead, Payload},
+};
+use colossus_cloud::storage::{
+    AuthSession, CloudStore, CloudTransaction, EntityKey, EntityKind, EntityMutation,
+};
+use colossus_cloud::{CloudCaller, CloudError, CloudResult};
+use openidconnect::{
+    AccessTokenHash, AuthorizationCode, ClientId, ClientSecret, CsrfToken, EndpointMaybeSet,
+    EndpointNotSet, EndpointSet, IssuerUrl, Nonce, OAuth2TokenResponse, PkceCodeChallenge,
+    PkceCodeVerifier, RedirectUrl, TokenResponse,
+    core::{CoreAuthenticationFlow, CoreClient, CoreProviderMetadata},
+};
+use sha2::{Digest, Sha256};
+use std::{sync::Arc, time::Duration};
+use zeroize::Zeroizing;
+mod accounts;
+mod bootstrap;
+mod local;
+#[cfg(test)]
+mod tests;
+
+type Client = CoreClient<
+    EndpointSet,
+    EndpointNotSet,
+    EndpointNotSet,
+    EndpointNotSet,
+    EndpointMaybeSet,
+    EndpointMaybeSet,
+>;
+#[derive(serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Flow {
+    verifier: String,
+    nonce: String,
+    expires_at: u64,
+}
+pub(crate) struct Authentication {
+    client: Option<Client>,
+    client_secret: Option<ClientSecret>,
+    http: reqwest::Client,
+    config: Config,
+    store: Arc<dyn CloudStore>,
+    flow_key: Option<Zeroizing<[u8; 32]>>,
+    password_permits: Arc<tokio::sync::Semaphore>,
+    dummy_password_hash: String,
+}
+fn hash(value: &str) -> String {
+    hex::encode(Sha256::digest(value.as_bytes()))
+}
+fn cookie(headers: &HeaderMap, name: &str) -> Option<String> {
+    headers
+        .get("cookie")?
+        .to_str()
+        .ok()?
+        .split(';')
+        .find_map(|part| {
+            part.trim()
+                .strip_prefix(&format!("{name}="))
+                .map(str::to_owned)
+        })
+}
+impl Authentication {
+    #[cfg(test)]
+    pub async fn new(config: Config) -> Result<Self, &'static str> {
+        Self::with_store(
+            config,
+            Arc::new(colossus_cloud::storage::MemoryCloudStore::default()),
+        )
+        .await
+    }
+    pub async fn with_store(
+        config: Config,
+        store: Arc<dyn CloudStore>,
+    ) -> Result<Self, &'static str> {
+        let flow_key = config
+            .auth_key_variable
+            .as_ref()
+            .map(|variable| {
+                let encoded = Zeroizing::new(
+                    std::env::var(variable).map_err(|_| "OIDC flow key unavailable")?,
+                );
+                let mut key = Zeroizing::new([0u8; 32]);
+                hex::decode_to_slice(encoded.trim(), key.as_mut())
+                    .map_err(|_| "OIDC flow key invalid")?;
+                Ok::<_, &'static str>(key)
+            })
+            .transpose()?;
+        if !config.local_development && config.oidc.is_some() && flow_key.is_none() {
+            return Err("production requires encrypted OIDC flows");
+        }
+        bootstrap::seed_accounts(&store, &config)
+            .await
+            .map_err(|_| "cloud identity initialization failed")?;
+        let http = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .timeout(Duration::from_secs(15))
+            .build()
+            .map_err(|_| "OIDC HTTP configuration failed")?;
+        let (client, secret) = if let Some(oidc) = &config.oidc {
+            let metadata = CoreProviderMetadata::discover_async(
+                IssuerUrl::new(oidc.issuer.clone()).map_err(|_| "invalid issuer")?,
+                &http,
+            )
+            .await
+            .map_err(|_| "OIDC discovery failed")?;
+            let secret = oidc
+                .client_secret_file
+                .as_ref()
+                .map(|path| {
+                    std::fs::read_to_string(path)
+                        .map(Zeroizing::new)
+                        .map_err(|_| "cannot load OIDC secret")
+                })
+                .transpose()?
+                .map(|secret| ClientSecret::new(secret.trim().to_owned()));
+            let client = CoreClient::from_provider_metadata(
+                metadata,
+                ClientId::new(oidc.client_id.clone()),
+                secret.clone(),
+            )
+            .set_redirect_uri(
+                RedirectUrl::new(format!(
+                    "{}/auth/callback",
+                    config.public_origin.trim_end_matches('/')
+                ))
+                .map_err(|_| "invalid callback")?,
+            );
+            (Some(client), secret)
+        } else {
+            (None, None)
+        };
+        let password_permits = Arc::new(tokio::sync::Semaphore::new(4));
+        let dummy_password_hash = if config.local_auth.is_some() {
+            local::hash_password(
+                password_permits.clone(),
+                Zeroizing::new(Nonce::new_random().secret().to_owned()),
+            )
+            .await
+            .map_err(|_| "local authentication initialization failed")?
+        } else {
+            String::new()
+        };
+        Ok(Self {
+            client,
+            client_secret: secret,
+            http,
+            config,
+            store,
+            flow_key,
+            password_permits,
+            dummy_password_hash,
+        })
+    }
+    pub async fn login(&self) -> CloudResult<(String, HeaderValue)> {
+        let client = self.client.as_ref().ok_or(CloudError::PermissionDenied)?;
+        let bucket = (crate::http::now() / 60).to_string();
+        self.consume_auth_budget(
+            &colossus_cloud::hash_identity(&["oidc-login-global", &bucket]),
+            120,
+        )
+        .await?;
+        let (challenge, verifier) = PkceCodeChallenge::new_random_sha256();
+        let (url, state, nonce) = client
+            .authorize_url(
+                CoreAuthenticationFlow::AuthorizationCode,
+                CsrfToken::new_random,
+                Nonce::new_random,
+            )
+            .set_pkce_challenge(challenge)
+            .url();
+        let id = self.authority_hash(state.secret());
+        let flow = Flow {
+            verifier: verifier.secret().into(),
+            nonce: nonce.secret().into(),
+            expires_at: crate::http::now() + 300,
+        };
+        let value = self.seal_flow(&id, &flow)?;
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![EntityMutation {
+                    key: flow_key(&id),
+                    expected_revision: 0,
+                    value,
+                    actor: "oidc".into(),
+                    operation: "cloud.auth.flow-created.v2".into(),
+                }],
+                ..Default::default()
+            })
+            .await?;
+        let header = self.set_cookie("colossus_flow", state.secret(), 300)?;
+        Ok((url.to_string(), header))
+    }
+    pub async fn callback(
+        &self,
+        headers: &HeaderMap,
+        state: &str,
+        code: String,
+    ) -> CloudResult<HeaderValue> {
+        if state.len() > 256
+            || code.len() > 4096
+            || cookie(headers, "colossus_flow").as_deref().map(hash) != Some(hash(state))
+        {
+            return Err(CloudError::PermissionDenied);
+        }
+        let key = flow_key(&self.authority_hash(state));
+        let record = self
+            .store
+            .read(&key)
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        let flow = self.open_flow(&key.id, &record.value)?;
+        if flow.expires_at <= crate::http::now() {
+            return Err(CloudError::PermissionDenied);
+        }
+        self.store
+            .delete_entity(&key, record.revision)
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        let client = self.client.as_ref().ok_or(CloudError::PermissionDenied)?;
+        let oidc = self
+            .config
+            .oidc
+            .as_ref()
+            .ok_or(CloudError::PermissionDenied)?;
+        let token = client
+            .exchange_code(AuthorizationCode::new(code))
+            .map_err(|_| CloudError::PermissionDenied)?
+            .set_pkce_verifier(PkceCodeVerifier::new(flow.verifier))
+            .request_async(&self.http)
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        let id = token.id_token().ok_or(CloudError::PermissionDenied)?;
+        // Refresh issuer-owned keys for each new session. An IdP key rotation
+        // must neither require a host restart nor keep a retired key trusted.
+        let metadata = CoreProviderMetadata::discover_async(
+            IssuerUrl::new(oidc.issuer.clone()).map_err(|_| CloudError::PermissionDenied)?,
+            &self.http,
+        )
+        .await
+        .map_err(|_| CloudError::PermissionDenied)?;
+        let verification_client = CoreClient::from_provider_metadata(
+            metadata,
+            ClientId::new(oidc.client_id.clone()),
+            self.client_secret.clone(),
+        );
+        let verifier = verification_client.id_token_verifier();
+        let claims = id
+            .claims(&verifier, &Nonce::new(flow.nonce))
+            .map_err(|_| CloudError::PermissionDenied)?;
+        if let Some(expected) = claims.access_token_hash() {
+            let actual = AccessTokenHash::from_token(
+                token.access_token(),
+                id.signing_alg().map_err(|_| CloudError::PermissionDenied)?,
+                id.signing_key(&verifier)
+                    .map_err(|_| CloudError::PermissionDenied)?,
+            )
+            .map_err(|_| CloudError::PermissionDenied)?;
+            if actual != *expected {
+                return Err(CloudError::PermissionDenied);
+            }
+        }
+        let binding_key = colossus_cloud::identity_key(
+            EntityKind::OidcIdentity,
+            &colossus_cloud::hash_identity(&[&oidc.issuer, claims.subject().as_str()]),
+        );
+        let binding: colossus_cloud::OidcIdentity = serde_json::from_value(
+            self.store
+                .read(&binding_key)
+                .await
+                .map_err(|_| CloudError::PermissionDenied)?
+                .value,
+        )
+        .map_err(|_| CloudError::PermissionDenied)?;
+        if binding.issuer != oidc.issuer || binding.subject != claims.subject().as_str() {
+            return Err(CloudError::PermissionDenied);
+        }
+        let account = self
+            .repository()?
+            .account(&binding.user_id)
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        if !account.user.active {
+            return Err(CloudError::PermissionDenied);
+        }
+        let subject = account.user.id;
+        let seconds = (claims.expiration() - chrono_now())
+            .num_seconds()
+            .clamp(0, 8 * 60 * 60) as u64;
+        if seconds == 0 {
+            return Err(CloudError::PermissionDenied);
+        }
+        let session = Nonce::new_random().secret().to_owned();
+        let now = crate::http::now();
+        self.store
+            .put_session(AuthSession {
+                session_hash: self.authority_hash(&session),
+                security_epoch: account.security_epoch,
+                subject,
+                csrf_hash: String::new(),
+                created_at: now,
+                expires_at: now + seconds,
+            })
+            .await?;
+        self.set_cookie("colossus_session", &session, seconds)
+    }
+    fn authority_hash(&self, token: &str) -> String {
+        if let Some(oidc) = &self.config.oidc {
+            hash(&format!("{}\0{}\0{}", oidc.issuer, oidc.client_id, token))
+        } else {
+            self.local_session_hash(token)
+        }
+    }
+    fn local_session_hash(&self, token: &str) -> String {
+        hash(&format!("local\0{}\0{}", self.config.public_origin, token))
+    }
+    pub async fn logout(&self, headers: &HeaderMap) -> CloudResult<HeaderValue> {
+        if headers.get("origin").and_then(|value| value.to_str().ok())
+            != Some(self.config.public_origin.trim_end_matches('/'))
+        {
+            return Err(CloudError::PermissionDenied);
+        }
+        if let Some(token) = cookie(headers, "colossus_session") {
+            self.store
+                .delete_session(&self.authority_hash(&token))
+                .await?;
+            self.store
+                .delete_session(&self.local_session_hash(&token))
+                .await?;
+        }
+        self.set_cookie("colossus_session", "", 0)
+    }
+    fn seal_flow(&self, id: &str, flow: &Flow) -> CloudResult<serde_json::Value> {
+        let plaintext = Zeroizing::new(serde_json::to_vec(flow).map_err(|_| CloudError::Storage)?);
+        let Some(key) = &self.flow_key else {
+            return serde_json::to_value(flow).map_err(|_| CloudError::Storage);
+        };
+        let mut nonce = [0u8; 24];
+        getrandom::fill(&mut nonce).map_err(|_| CloudError::Storage)?;
+        let cipher =
+            XChaCha20Poly1305::new_from_slice(key.as_ref()).map_err(|_| CloudError::Storage)?;
+        let ciphertext = cipher
+            .encrypt(
+                XNonce::from_slice(&nonce),
+                Payload {
+                    msg: &plaintext,
+                    aad: id.as_bytes(),
+                },
+            )
+            .map_err(|_| CloudError::Storage)?;
+        Ok(
+            serde_json::json!({"nonce":hex::encode(nonce),"ciphertext":hex::encode(ciphertext),"expires_at":flow.expires_at}),
+        )
+    }
+    fn open_flow(&self, id: &str, value: &serde_json::Value) -> CloudResult<Flow> {
+        let Some(key) = &self.flow_key else {
+            return serde_json::from_value(value.clone()).map_err(|_| CloudError::PermissionDenied);
+        };
+        let nonce = hex::decode(
+            value
+                .get("nonce")
+                .and_then(serde_json::Value::as_str)
+                .ok_or(CloudError::PermissionDenied)?,
+        )
+        .map_err(|_| CloudError::PermissionDenied)?;
+        let encoded = value
+            .get("ciphertext")
+            .and_then(serde_json::Value::as_str)
+            .filter(|value| value.len() <= 16_384)
+            .ok_or(CloudError::PermissionDenied)?;
+        if nonce.len() != 24 {
+            return Err(CloudError::PermissionDenied);
+        }
+        let ciphertext = hex::decode(encoded).map_err(|_| CloudError::PermissionDenied)?;
+        let cipher =
+            XChaCha20Poly1305::new_from_slice(key.as_ref()).map_err(|_| CloudError::Storage)?;
+        let plaintext = Zeroizing::new(
+            cipher
+                .decrypt(
+                    XNonce::from_slice(&nonce),
+                    Payload {
+                        msg: &ciphertext,
+                        aad: id.as_bytes(),
+                    },
+                )
+                .map_err(|_| CloudError::PermissionDenied)?,
+        );
+        serde_json::from_slice(&plaintext).map_err(|_| CloudError::PermissionDenied)
+    }
+    fn set_cookie(&self, name: &str, value: &str, seconds: u64) -> CloudResult<HeaderValue> {
+        HeaderValue::from_str(&format!(
+            "{name}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={seconds}{}",
+            if self.config.local_development {
+                ""
+            } else {
+                "; Secure"
+            }
+        ))
+        .map_err(|_| CloudError::Storage)
+    }
+}
+fn chrono_now() -> chrono::DateTime<chrono::Utc> {
+    chrono::Utc::now()
+}
+
+fn flow_key(id: &str) -> EntityKey {
+    EntityKey {
+        kind: EntityKind::AuthFlow,
+        project_id: "__auth".into(),
+        parent_id: None,
+        id: id.into(),
+    }
+}
diff --git a/crates/colossus-cloud-server/src/auth/accounts.rs b/crates/colossus-cloud-server/src/auth/accounts.rs
new file mode 100644
index 000000000..49604df1d
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/accounts.rs
@@ -0,0 +1,170 @@
+use super::*;
+use colossus_cloud::{
+    CloudPermission, CloudProject, CloudRepository, CloudUser, ProjectMembership, UserAccount,
+    membership_key,
+};
+use std::collections::BTreeSet;
+
+impl Authentication {
+    pub(super) fn repository(&self) -> CloudResult<CloudRepository> {
+        CloudRepository::new(self.store.clone())
+    }
+    pub(crate) fn csrf(&self, headers: &HeaderMap) -> CloudResult<()> {
+        if headers.get("origin").and_then(|v| v.to_str().ok())
+            != Some(self.config.public_origin.trim_end_matches('/'))
+            || headers.get("x-colossus-csrf").and_then(|v| v.to_str().ok()) != Some("1")
+        {
+            return Err(CloudError::PermissionDenied);
+        }
+        Ok(())
+    }
+    pub(super) async fn session(
+        &self,
+        headers: &HeaderMap,
+    ) -> CloudResult<(AuthSession, UserAccount)> {
+        let token = cookie(headers, "colossus_session")
+            .filter(|t| t.len() <= 256)
+            .ok_or(CloudError::PermissionDenied)?;
+        let now = crate::http::now();
+        let mut session = None;
+        if self.config.oidc.is_some() {
+            session = self
+                .store
+                .read_session(&self.authority_hash(&token), now)
+                .await
+                .ok();
+        }
+        if session.is_none() && self.config.local_auth.is_some() {
+            session = self
+                .store
+                .read_session(&self.local_session_hash(&token), now)
+                .await
+                .ok();
+        }
+        let session = session.ok_or(CloudError::PermissionDenied)?;
+        let account = self
+            .repository()?
+            .account(&session.subject)
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        if !account.user.active || session.security_epoch != account.security_epoch {
+            return Err(CloudError::PermissionDenied);
+        }
+        Ok((session, account))
+    }
+    pub(crate) async fn user(&self, headers: &HeaderMap) -> CloudResult<CloudUser> {
+        Ok(self.session(headers).await?.1.user)
+    }
+    pub(crate) async fn admin(
+        &self,
+        headers: &HeaderMap,
+        mutation: bool,
+    ) -> CloudResult<CloudUser> {
+        if mutation {
+            self.csrf(headers)?;
+        }
+        let user = self.user(headers).await?;
+        if !user.is_admin {
+            return Err(CloudError::PermissionDenied);
+        }
+        Ok(user)
+    }
+    pub async fn caller(
+        &self,
+        headers: &HeaderMap,
+        project: &str,
+        mutation: bool,
+    ) -> CloudResult<CloudCaller> {
+        self.caller_with_expiry(headers, project, mutation)
+            .await
+            .map(|(caller, _)| caller)
+    }
+    pub async fn caller_with_expiry(
+        &self,
+        headers: &HeaderMap,
+        project: &str,
+        mutation: bool,
+    ) -> CloudResult<(CloudCaller, u64)> {
+        if mutation {
+            self.csrf(headers)?;
+        }
+        let (session, account) = self.session(headers).await?;
+        let mut permissions = BTreeSet::new();
+        // Global management/read visibility grants no implicit task execution or approval.
+        if account.user.is_admin {
+            permissions.extend([CloudPermission::Read, CloudPermission::Administer]);
+        }
+        match self
+            .store
+            .read(&membership_key(project, &account.user.id))
+            .await
+        {
+            Ok(record) => {
+                let member: ProjectMembership =
+                    serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?;
+                if member.project_id != project
+                    || member.user_id != account.user.id
+                    || member.subject != account.user.id
+                {
+                    return Err(CloudError::PermissionDenied);
+                }
+                permissions.extend(member.permissions);
+            }
+            Err(CloudError::NotFound) => {}
+            Err(error) => return Err(error),
+        }
+        if permissions.is_empty() {
+            return Err(CloudError::PermissionDenied);
+        }
+        let metadata = self.repository()?.project(project).await?;
+        if metadata.archived {
+            permissions
+                .retain(|p| matches!(p, CloudPermission::Read | CloudPermission::Administer));
+        }
+        Ok((
+            CloudCaller::new(account.user.id, project.into(), permissions)?,
+            session.expires_at,
+        ))
+    }
+    pub async fn memberships(&self, headers: &HeaderMap) -> CloudResult<Vec<ProjectMembership>> {
+        let user = self.user(headers).await?;
+        Ok(self
+            .repository()?
+            .user_memberships(&user.id)
+            .await?
+            .into_iter()
+            .filter(|m| !m.permissions.is_empty())
+            .collect())
+    }
+    pub(crate) async fn projects(&self, headers: &HeaderMap) -> CloudResult<Vec<CloudProject>> {
+        let user = self.user(headers).await?;
+        let repo = self.repository()?;
+        let mut projects = Vec::new();
+        if user.is_admin {
+            let mut after = None;
+            loop {
+                let page = repo.projects_page(&user, after.as_deref(), 100).await?;
+                let count = page.len();
+                after = page.last().map(|p| p.id.clone());
+                projects.extend(page);
+                if count < 100 {
+                    break;
+                }
+                if projects.len() > 1024 {
+                    return Err(CloudError::ResourceExhausted);
+                }
+            }
+        } else {
+            for member in repo.user_memberships(&user.id).await? {
+                if member.permissions.contains(&CloudPermission::Read) {
+                    projects.push(repo.project(&member.project_id).await?);
+                }
+            }
+        }
+        projects.sort_by(|a, b| a.id.cmp(&b.id));
+        Ok(projects)
+    }
+    pub(crate) fn public_configuration(&self) -> serde_json::Value {
+        serde_json::json!({"local_enabled":self.config.local_auth.is_some(),"oidc":self.config.oidc.as_ref().map(|provider|serde_json::json!({"label":provider.label,"login_url":"/auth/login"}))})
+    }
+}
diff --git a/crates/colossus-cloud-server/src/auth/bootstrap.rs b/crates/colossus-cloud-server/src/auth/bootstrap.rs
new file mode 100644
index 000000000..3659c776b
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/bootstrap.rs
@@ -0,0 +1,360 @@
+//! Audited one-time migration and explicit first-administrator provisioning.
+use super::*;
+use colossus_cloud::{
+    CloudPermission, CloudProject, CloudRepository, CloudUser, IDENTITY_NAMESPACE, LocalCredential,
+    LoginIdentityMetadata, OidcIdentity, ProjectMembership, ProjectRole, UserAccount,
+    hash_identity, identity_key, membership_key, normalize_username, project_key,
+};
+fn timestamp() -> CloudResult<String> {
+    time::OffsetDateTime::now_utc()
+        .format(&time::format_description::well_known::Rfc3339)
+        .map_err(|_| CloudError::Storage)
+}
+fn operation(
+    key: EntityKey,
+    revision: u64,
+    value: serde_json::Value,
+    name: &str,
+) -> EntityMutation {
+    EntityMutation {
+        key,
+        expected_revision: revision,
+        value,
+        actor: "operator-bootstrap".into(),
+        operation: name.into(),
+    }
+}
+fn metadata(
+    oidc: Option<&crate::config::OidcConfig>,
+    subject: Option<&str>,
+    username: Option<&str>,
+) -> Vec<LoginIdentityMetadata> {
+    let mut identities = Vec::new();
+    if let Some(username) = username {
+        identities.push(LoginIdentityMetadata {
+            kind: "local".into(),
+            label: "Local account".into(),
+            username: Some(username.into()),
+            issuer: None,
+            subject: None,
+        });
+    }
+    if let (Some(provider), Some(subject)) = (oidc, subject) {
+        identities.push(LoginIdentityMetadata {
+            kind: "oidc".into(),
+            label: provider.label.clone(),
+            username: None,
+            issuer: Some(provider.issuer.clone()),
+            subject: Some(subject.into()),
+        });
+    }
+    identities
+}
+pub(super) async fn seed_accounts(store: &Arc<dyn CloudStore>, config: &Config) -> CloudResult<()> {
+    let repo = CloudRepository::new(store.clone())?;
+    // Explicit bootstrap may be supplied later to upgrade a previously configured-only deployment.
+    bootstrap_administrator(&repo, config).await?;
+    let marker = identity_key(EntityKind::Setting, "identity-bootstrap-v3");
+    match store.read(&marker).await {
+        Ok(_) => return Ok(()),
+        Err(CloudError::NotFound) => {}
+        Err(error) => return Err(error),
+    }
+    for member in &config.memberships {
+        let provider = config.oidc.as_ref().ok_or(CloudError::InvalidArgument)?;
+        let user_id = hash_identity(&["oidc-user", &provider.issuer, &member.subject]);
+        let now = timestamp()?;
+        if matches!(repo.account(&user_id).await, Err(CloudError::NotFound)) {
+            let account = UserAccount {
+                user: CloudUser {
+                    id: user_id.clone(),
+                    display_name: member.subject.clone(),
+                    email: None,
+                    active: true,
+                    is_admin: false,
+                    revision: 1,
+                    created_at: now.clone(),
+                    updated_at: now.clone(),
+                    identities: metadata(Some(provider), Some(&member.subject), None),
+                },
+                security_epoch: 1,
+            };
+            let binding = OidcIdentity {
+                user_id: user_id.clone(),
+                issuer: provider.issuer.clone(),
+                subject: member.subject.clone(),
+            };
+            match repo
+                .create_account("operator-bootstrap", account, Some(binding), None)
+                .await
+            {
+                Ok(_) | Err(CloudError::Conflict) => {}
+                Err(e) => return Err(e),
+            }
+        }
+        if matches!(
+            store.read(&project_key(&member.project_id)).await,
+            Err(CloudError::NotFound)
+        ) {
+            let project = CloudProject {
+                id: member.project_id.clone(),
+                name: member.project_id.clone(),
+                description: String::new(),
+                parent_project_id: None,
+                archived: false,
+                revision: 1,
+                created_at: now.clone(),
+                updated_at: now,
+            };
+            match store
+                .commit(CloudTransaction {
+                    entities: vec![operation(
+                        project_key(&project.id),
+                        0,
+                        serde_json::to_value(project).map_err(|_| CloudError::Storage)?,
+                        "cloud.project.bootstrap.v3",
+                    )],
+                    ..Default::default()
+                })
+                .await
+            {
+                Ok(()) | Err(colossus_ports::StoreError::Conflict { .. }) => {}
+                Err(e) => return Err(e.into()),
+            }
+        }
+        let key = membership_key(&member.project_id, &user_id);
+        if matches!(store.read(&key).await, Err(CloudError::NotFound)) {
+            let role = if member.permissions.contains(&CloudPermission::Administer) {
+                ProjectRole::ProjectAdmin
+            } else if member.permissions.contains(&CloudPermission::Approve) {
+                ProjectRole::Approver
+            } else if member.permissions.contains(&CloudPermission::Execute) {
+                ProjectRole::Operator
+            } else {
+                ProjectRole::Viewer
+            };
+            let value = ProjectMembership {
+                project_id: member.project_id.clone(),
+                user_id: user_id.clone(),
+                subject: user_id,
+                role,
+                permissions: member.permissions.clone(),
+                revision: 1,
+            };
+            match store
+                .commit(CloudTransaction {
+                    entities: vec![operation(
+                        key,
+                        0,
+                        serde_json::to_value(value).map_err(|_| CloudError::Storage)?,
+                        "cloud.membership.bootstrap.v3",
+                    )],
+                    ..Default::default()
+                })
+                .await
+            {
+                Ok(()) | Err(colossus_ports::StoreError::Conflict { .. }) => {}
+                Err(e) => return Err(e.into()),
+            }
+        }
+    }
+    let users = store
+        .list(&colossus_cloud::storage::EntityQuery::new(
+            EntityKind::User,
+            IDENTITY_NAMESPACE.into(),
+        ))
+        .await?;
+    if users.is_empty() {
+        return Err(CloudError::PermissionDenied);
+    }
+    match store
+        .commit(CloudTransaction {
+            entities: vec![operation(
+                marker,
+                0,
+                serde_json::json!({"completed":true,"version":3}),
+                "cloud.identity.bootstrap-completed.v3",
+            )],
+            ..Default::default()
+        })
+        .await
+    {
+        Ok(()) | Err(colossus_ports::StoreError::Conflict { .. }) => Ok(()),
+        Err(e) => Err(e.into()),
+    }
+}
+async fn bootstrap_administrator(repo: &CloudRepository, config: &Config) -> CloudResult<()> {
+    let Some(bootstrap) = &config.bootstrap_admin else {
+        return Ok(());
+    };
+    let marker = identity_key(EntityKind::Setting, "administrator-bootstrap-v3");
+    match repo.storage().read(&marker).await {
+        Ok(_) => return Ok(()),
+        Err(CloudError::NotFound) => {}
+        Err(error) => return Err(error),
+    }
+    let mut administrators =
+        colossus_cloud::storage::EntityQuery::new(EntityKind::User, IDENTITY_NAMESPACE.into());
+    administrators.status = Some("administrator".into());
+    administrators.limit = 1;
+    if !repo.storage().list(&administrators).await?.is_empty() {
+        return Ok(());
+    }
+    let username = bootstrap
+        .username
+        .as_deref()
+        .map(normalize_username)
+        .transpose()?;
+    let provider = config.oidc.as_ref();
+    let binding = bootstrap
+        .oidc_subject
+        .as_ref()
+        .map(|subject| {
+            let provider = provider.ok_or(CloudError::InvalidArgument)?;
+            Ok::<_, CloudError>((provider, subject))
+        })
+        .transpose()?;
+    let id = if let Some((provider, subject)) = binding {
+        hash_identity(&["oidc-user", &provider.issuer, subject])
+    } else if let Some(username) = &username {
+        hash_identity(&["bootstrap-local", username])
+    } else {
+        return Err(CloudError::InvalidArgument);
+    };
+    let now = timestamp()?;
+    let existing = match repo.account(&id).await {
+        Ok(account) => Some(account),
+        Err(CloudError::NotFound) => None,
+        Err(error) => return Err(error),
+    };
+    if let Some(mut account) = existing {
+        let revision = account.user.revision;
+        account.user.is_admin = true;
+        account.user.updated_at = now;
+        let mut bindings = Vec::new();
+        if let Some(username) = &username {
+            let key = identity_key(EntityKind::LocalCredential, &hash_identity(&[username]));
+            match repo.storage().read(&key).await {
+                Ok(record) => {
+                    let credential: LocalCredential =
+                        serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?;
+                    if credential.user_id != id {
+                        return Err(CloudError::Conflict);
+                    }
+                }
+                Err(CloudError::NotFound) => {
+                    let credential =
+                        bootstrap_local_credential(config, bootstrap, &id, username).await?;
+                    bindings.push(operation(
+                        key,
+                        0,
+                        serde_json::to_value(credential).map_err(|_| CloudError::Storage)?,
+                        "cloud.user.bootstrap-local-bound.v3",
+                    ));
+                    account
+                        .user
+                        .identities
+                        .extend(metadata(None, None, Some(username)));
+                }
+                Err(error) => return Err(error),
+            }
+        }
+        bindings.push(operation(
+            identity_key(EntityKind::User, &id),
+            revision,
+            serde_json::to_value(account).map_err(|_| CloudError::Storage)?,
+            "cloud.user.bootstrap-administrator.v3",
+        ));
+        match repo
+            .storage()
+            .commit(CloudTransaction {
+                entities: bindings,
+                ..Default::default()
+            })
+            .await
+        {
+            Ok(()) | Err(colossus_ports::StoreError::Conflict { .. }) => {}
+            Err(error) => return Err(error.into()),
+        };
+    } else {
+        let account = UserAccount {
+            user: CloudUser {
+                id: id.clone(),
+                display_name: bootstrap.display_name.clone(),
+                email: bootstrap.email.clone(),
+                active: true,
+                is_admin: true,
+                revision: 1,
+                created_at: now.clone(),
+                updated_at: now,
+                identities: metadata(
+                    provider,
+                    bootstrap.oidc_subject.as_deref(),
+                    username.as_deref(),
+                ),
+            },
+            security_epoch: 1,
+        };
+        let oidc = binding.map(|(provider, subject)| OidcIdentity {
+            user_id: id.clone(),
+            issuer: provider.issuer.clone(),
+            subject: subject.clone(),
+        });
+        let local = if let Some(username) = username {
+            Some(bootstrap_local_credential(config, bootstrap, &id, &username).await?)
+        } else {
+            None
+        };
+        match repo
+            .create_account("operator-bootstrap", account, oidc, local)
+            .await
+        {
+            Ok(_) | Err(CloudError::Conflict) => {}
+            Err(e) => return Err(e),
+        }
+    }
+    let account = repo.account(&id).await?;
+    if !account.user.is_admin || !account.user.active {
+        return Err(CloudError::PermissionDenied);
+    }
+    match repo
+        .storage()
+        .commit(CloudTransaction {
+            entities: vec![operation(
+                marker,
+                0,
+                serde_json::json!({"completed":true,"user_id":id}),
+                "cloud.administrator.bootstrap-completed.v3",
+            )],
+            ..Default::default()
+        })
+        .await
+    {
+        Ok(()) | Err(colossus_ports::StoreError::Conflict { .. }) => Ok(()),
+        Err(e) => Err(e.into()),
+    }
+}
+
+async fn bootstrap_local_credential(
+    config: &Config,
+    bootstrap: &crate::config::BootstrapAdmin,
+    user: &str,
+    username: &str,
+) -> CloudResult<LocalCredential> {
+    if config.local_auth.is_none() {
+        return Err(CloudError::InvalidArgument);
+    }
+    let variable = bootstrap
+        .password_variable
+        .as_ref()
+        .ok_or(CloudError::InvalidArgument)?;
+    let password =
+        Zeroizing::new(std::env::var(variable).map_err(|_| CloudError::PermissionDenied)?);
+    let password_hash =
+        super::local::hash_password(Arc::new(tokio::sync::Semaphore::new(1)), password).await?;
+    Ok(LocalCredential {
+        user_id: user.into(),
+        username: username.into(),
+        password_hash,
+    })
+}
diff --git a/crates/colossus-cloud-server/src/auth/local.rs b/crates/colossus-cloud-server/src/auth/local.rs
new file mode 100644
index 000000000..371aca5ad
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/local.rs
@@ -0,0 +1,183 @@
+use super::*;
+use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier, password_hash::SaltString};
+use colossus_cloud::{LocalCredential, hash_identity, identity_key, normalize_username};
+
+pub(super) async fn hash_password(
+    permits: Arc<tokio::sync::Semaphore>,
+    password: Zeroizing<String>,
+) -> CloudResult<String> {
+    if password.chars().count() < 15 || password.len() > 1024 {
+        return Err(CloudError::InvalidArgument);
+    }
+    let permit = permits
+        .try_acquire_owned()
+        .map_err(|_| CloudError::ResourceExhausted)?;
+    let mut salt = [0u8; 16];
+    getrandom::fill(&mut salt).map_err(|_| CloudError::Storage)?;
+    tokio::task::spawn_blocking(move || {
+        let _permit = permit;
+        let salt = SaltString::encode_b64(&salt).map_err(|_| CloudError::Storage)?;
+        Argon2::default()
+            .hash_password(password.as_bytes(), &salt)
+            .map(|hash| hash.to_string())
+            .map_err(|_| CloudError::Storage)
+    })
+    .await
+    .map_err(|_| CloudError::Storage)?
+}
+impl Authentication {
+    pub(crate) async fn password_hash(&self, password: Zeroizing<String>) -> CloudResult<String> {
+        hash_password(self.password_permits.clone(), password).await
+    }
+    pub(crate) async fn local_login(
+        &self,
+        headers: &HeaderMap,
+        username: String,
+        password: Zeroizing<String>,
+    ) -> CloudResult<HeaderValue> {
+        self.local_login_at(headers, username, password, crate::http::now())
+            .await
+    }
+    pub(super) async fn local_login_at(
+        &self,
+        headers: &HeaderMap,
+        username: String,
+        password: Zeroizing<String>,
+        budget_at: u64,
+    ) -> CloudResult<HeaderValue> {
+        self.csrf(headers)?;
+        let config = self
+            .config
+            .local_auth
+            .as_ref()
+            .ok_or(CloudError::PermissionDenied)?;
+        if !(1..=1024).contains(&password.len()) {
+            return Err(CloudError::PermissionDenied);
+        }
+        let username = normalize_username(&username).map_err(|_| CloudError::PermissionDenied)?;
+        self.login_budget(&username, budget_at).await?;
+        let record = self
+            .store
+            .read(&identity_key(
+                EntityKind::LocalCredential,
+                &hash_identity(&[&username]),
+            ))
+            .await
+            .ok();
+        let credential = record.and_then(|r| {
+            serde_json::from_value::<LocalCredential>(r.value)
+                .ok()
+                .map(|credential| (r.revision, credential))
+        });
+        let encoded = credential
+            .as_ref()
+            .map(|(_, c)| c.password_hash.clone())
+            .unwrap_or_else(|| self.dummy_password_hash.clone());
+        let permit = self
+            .password_permits
+            .clone()
+            .try_acquire_owned()
+            .map_err(|_| CloudError::ResourceExhausted)?;
+        let verified = tokio::task::spawn_blocking(move || {
+            let _permit = permit;
+            PasswordHash::new(&encoded).is_ok_and(|hash| {
+                Argon2::default()
+                    .verify_password(password.as_bytes(), &hash)
+                    .is_ok()
+            })
+        })
+        .await
+        .map_err(|_| CloudError::PermissionDenied)?;
+        let (revision, credential) = credential
+            .filter(|_| verified)
+            .ok_or(CloudError::PermissionDenied)?;
+        let account = self
+            .repository()?
+            .account(&credential.user_id)
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        if !account.user.active {
+            return Err(CloudError::PermissionDenied);
+        }
+        // Reconcile after account lookup: old password verification must never
+        // acquire the newer account epoch when credential rotation raced with it.
+        let current = self
+            .store
+            .read(&identity_key(
+                EntityKind::LocalCredential,
+                &hash_identity(&[&username]),
+            ))
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        if current.revision != revision {
+            return Err(CloudError::PermissionDenied);
+        }
+        let session = Nonce::new_random().secret().to_owned();
+        let now = crate::http::now();
+        let seconds = config.session_seconds;
+        self.store
+            .put_session(AuthSession {
+                session_hash: self.local_session_hash(&session),
+                subject: account.user.id,
+                csrf_hash: String::new(),
+                created_at: now,
+                expires_at: now + seconds,
+                security_epoch: account.security_epoch,
+            })
+            .await?;
+        self.set_cookie("colossus_session", &session, seconds)
+    }
+    async fn login_budget(&self, username: &str, now: u64) -> CloudResult<()> {
+        let bucket = (now / 60).to_string();
+        // Shared database counters survive replicas; neither remote IP nor proxy headers are trusted.
+        for (name, limit) in [
+            (hash_identity(&["local-login-global", &bucket]), 120u64),
+            (hash_identity(&["local-login", username, &bucket]), 8u64),
+        ] {
+            self.consume_auth_budget_at(&name, limit, now).await?;
+        }
+        Ok(())
+    }
+    pub(super) async fn consume_auth_budget(&self, name: &str, limit: u64) -> CloudResult<()> {
+        self.consume_auth_budget_at(name, limit, crate::http::now())
+            .await
+    }
+    async fn consume_auth_budget_at(&self, name: &str, limit: u64, now: u64) -> CloudResult<()> {
+        let key = flow_key(name);
+        for attempt in 0..8 {
+            let (revision, count) = match self.store.read(&key).await {
+                Ok(r) => (
+                    r.revision,
+                    r.value
+                        .get("attempts")
+                        .and_then(serde_json::Value::as_u64)
+                        .ok_or(CloudError::Storage)?,
+                ),
+                Err(CloudError::NotFound) => (0, 0),
+                Err(e) => return Err(e),
+            };
+            if count >= limit {
+                return Err(CloudError::ResourceExhausted);
+            }
+            match self
+                .store
+                .commit(CloudTransaction {
+                    entities: vec![EntityMutation {
+                        key: key.clone(),
+                        expected_revision: revision,
+                        value: serde_json::json!({"attempts":count+1,"expires_at":now+600}),
+                        actor: "browser-authentication".into(),
+                        operation: "cloud.auth.attempt.v3".into(),
+                    }],
+                    ..Default::default()
+                })
+                .await
+            {
+                Ok(()) => break,
+                Err(colossus_ports::StoreError::Conflict { .. }) if attempt < 7 => continue,
+                Err(e) => return Err(e.into()),
+            }
+        }
+        Ok(())
+    }
+}
diff --git a/crates/colossus-cloud-server/src/auth/tests.rs b/crates/colossus-cloud-server/src/auth/tests.rs
new file mode 100644
index 000000000..f05c449ca
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/tests.rs
@@ -0,0 +1,395 @@
+use super::*;
+use crate::config::{Membership, OidcConfig};
+use axum::{
+    Form, Json, Router,
+    extract::State,
+    routing::{get, post},
+};
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use colossus_cloud::CloudPermission;
+use p256::ecdsa::{Signature, SigningKey, signature::Signer as _};
+use serde_json::{Value, json};
+use std::{collections::BTreeSet, sync::Arc};
+use std::{collections::HashMap, sync::Mutex};
+mod transport;
+
+struct IssuerState {
+    issuer: String,
+    key: SigningKey,
+    nonce: Mutex<String>,
+    challenge: Mutex<String>,
+    invalid: Mutex<&'static str>,
+}
+async fn discovery(State(state): State<Arc<IssuerState>>) -> Json<Value> {
+    Json(
+        json!({"issuer":state.issuer,"authorization_endpoint":format!("{}/authorize",state.issuer),"token_endpoint":format!("{}/token",state.issuer),"jwks_uri":format!("{}/jwks",state.issuer),"response_types_supported":["code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["ES256"],"code_challenge_methods_supported":["S256"]}),
+    )
+}
+async fn jwks(State(state): State<Arc<IssuerState>>) -> Json<Value> {
+    let point = signing_key(&state).verifying_key().to_encoded_point(false);
+    Json(
+        json!({"keys":[{"kty":"EC","crv":"P-256","kid":"test","use":"sig","alg":"ES256","x":URL_SAFE_NO_PAD.encode(point.x().unwrap()),"y":URL_SAFE_NO_PAD.encode(point.y().unwrap())}]}),
+    )
+}
+async fn token(
+    State(state): State<Arc<IssuerState>>,
+    Form(form): Form<HashMap<String, String>>,
+) -> Json<Value> {
+    assert_eq!(
+        URL_SAFE_NO_PAD.encode(Sha256::digest(form["code_verifier"].as_bytes())),
+        *state.challenge.lock().unwrap()
+    );
+    assert_eq!(form["grant_type"], "authorization_code");
+    let invalid = *state.invalid.lock().unwrap();
+    let now = crate::http::now();
+    let mut claims = json!({"iss":state.issuer,"sub":"alice","aud":"colossus","exp":now+300,"iat":now,"nonce":state.nonce.lock().unwrap().clone(),"at_hash":URL_SAFE_NO_PAD.encode(&Sha256::digest(b"access")[..16])});
+    match invalid {
+        "nonce" => claims["nonce"] = json!("wrong"),
+        "audience" => claims["aud"] = json!("other-client"),
+        "issuer" => claims["iss"] = json!("https://other.invalid"),
+        "expiry" => claims["exp"] = json!(now - 60),
+        "subject" => claims["sub"] = json!("not-a-member"),
+        "access-hash" => claims["at_hash"] = json!("incorrect"),
+        _ => {}
+    }
+    let header =
+        URL_SAFE_NO_PAD.encode(serde_json::to_vec(&json!({"alg":"ES256","kid":"test"})).unwrap());
+    let payload = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&claims).unwrap());
+    let message = format!("{header}.{payload}");
+    let signature: Signature = signing_key(&state).sign(message.as_bytes());
+    let signature = if invalid == "signature" {
+        vec![0u8; 64]
+    } else {
+        signature.to_bytes().to_vec()
+    };
+    Json(
+        json!({"access_token":"access","token_type":"Bearer","expires_in":300,"id_token":format!("{message}.{}",URL_SAFE_NO_PAD.encode(signature))}),
+    )
+}
+fn signing_key(state: &IssuerState) -> SigningKey {
+    if *state.invalid.lock().unwrap() == "rotated-key" {
+        SigningKey::from_bytes((&[8u8; 32]).into()).unwrap()
+    } else {
+        state.key.clone()
+    }
+}
+
+#[tokio::test]
+async fn oidc_key_rotation_is_observed_without_host_restart() {
+    let (auth, issuer, server) = fixture().await;
+    *issuer.invalid.lock().unwrap() = "rotated-key";
+    let (headers, state) = flow(&auth, &issuer).await;
+    let cookie = auth
+        .callback(&headers, &state, "code".into())
+        .await
+        .unwrap();
+    assert!(cookie.to_str().unwrap().starts_with("colossus_session="));
+    server.abort();
+}
+async fn fixture() -> (
+    Authentication,
+    Arc<IssuerState>,
+    tokio::task::JoinHandle<()>,
+) {
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let issuer = format!("http://{}", listener.local_addr().unwrap());
+    let state = Arc::new(IssuerState {
+        issuer: issuer.clone(),
+        key: SigningKey::from_bytes((&[7u8; 32]).into()).unwrap(),
+        nonce: Mutex::new(String::new()),
+        challenge: Mutex::new(String::new()),
+        invalid: Mutex::new(""),
+    });
+    let router = Router::new()
+        .route("/.well-known/openid-configuration", get(discovery))
+        .route("/jwks", get(jwks))
+        .route("/token", post(token))
+        .with_state(state.clone());
+    let task = tokio::spawn(async move {
+        axum::serve(listener, router).await.unwrap();
+    });
+    let auth = Authentication::new(Config {
+        http_bind: "127.0.0.1:0".parse().unwrap(),
+        grpc_bind: "127.0.0.1:0".parse().unwrap(),
+        public_origin: "http://127.0.0.1:5180".into(),
+        grpc_endpoint: "https://localhost:8443".into(),
+        ca_certificate: "ca.pem".into(),
+        ca_key: "ca-key.pem".into(),
+        server_certificate: "server.pem".into(),
+        server_key: "server-key.pem".into(),
+        web_root: "dist".into(),
+        local_auth: None,
+        bootstrap_admin: None,
+        classification: None,
+        oidc: Some(OidcConfig {
+            label: "Local identity".into(),
+            issuer,
+            client_id: "colossus".into(),
+            client_secret_file: None,
+        }),
+        memberships: vec![Membership {
+            subject: "alice".into(),
+            project_id: "project-a".into(),
+            permissions: BTreeSet::from([CloudPermission::Read, CloudPermission::Execute]),
+        }],
+        database: colossus_cloud_postgres::CloudDatabaseConfig {
+            connection_variable: "COLOSSUS_CLOUD_TEST_DATABASE".into(),
+            schema: "cloud_auth_fixture".into(),
+            tls: colossus_cloud_postgres::CloudDatabaseTls::Disabled,
+            max_connections: 4,
+            connection_timeout_ms: 5000,
+            statement_timeout_ms: 5000,
+        },
+        local_development: true,
+        auth_key_variable: None,
+        maintenance: Default::default(),
+    })
+    .await
+    .unwrap();
+    (auth, state, task)
+}
+async fn flow(auth: &Authentication, issuer: &IssuerState) -> (HeaderMap, String) {
+    let (url, cookie) = auth.login().await.unwrap();
+    let url = url::Url::parse(&url).unwrap();
+    let query: HashMap<_, _> = url.query_pairs().into_owned().collect();
+    assert_eq!(query["code_challenge_method"], "S256");
+    *issuer.challenge.lock().unwrap() = query["code_challenge"].clone();
+    *issuer.nonce.lock().unwrap() = query["nonce"].clone();
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        "cookie",
+        HeaderValue::from_str(cookie.to_str().unwrap().split(';').next().unwrap()).unwrap(),
+    );
+    (headers, query["state"].clone())
+}
+#[tokio::test]
+async fn oidc_sign_in_binds_pkce_nonce_session_project_and_csrf() {
+    let (auth, issuer, server) = fixture().await;
+    let (flow_headers, state) = flow(&auth, &issuer).await;
+    assert_eq!(
+        auth.callback(&HeaderMap::new(), &state, "code".into())
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let cookie = auth
+        .callback(&flow_headers, &state, "code".into())
+        .await
+        .unwrap();
+    assert!(cookie.to_str().unwrap().contains("HttpOnly; SameSite=Lax"));
+    assert_eq!(
+        auth.callback(&flow_headers, &state, "code".into())
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        "cookie",
+        HeaderValue::from_str(cookie.to_str().unwrap().split(';').next().unwrap()).unwrap(),
+    );
+    assert_eq!(
+        auth.caller(&headers, "other-project", false)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        auth.caller(&headers, "project-a", true).await.unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    headers.insert("origin", HeaderValue::from_static("http://127.0.0.1:5180"));
+    headers.insert("x-colossus-csrf", HeaderValue::from_static("1"));
+    assert_eq!(
+        auth.caller(&headers, "project-a", true)
+            .await
+            .unwrap()
+            .subject(),
+        auth.user(&headers).await.unwrap().id
+    );
+    auth.logout(&headers).await.unwrap();
+    assert_eq!(
+        auth.caller(&headers, "project-a", false).await.unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    server.abort();
+}
+#[tokio::test]
+async fn invalid_oidc_tokens_never_create_sessions() {
+    let (auth, issuer, server) = fixture().await;
+    for invalid in [
+        "nonce",
+        "audience",
+        "issuer",
+        "expiry",
+        "subject",
+        "access-hash",
+        "signature",
+    ] {
+        *issuer.invalid.lock().unwrap() = invalid;
+        let (headers, state) = flow(&auth, &issuer).await;
+        assert_eq!(
+            auth.callback(&headers, &state, "code".into())
+                .await
+                .unwrap_err(),
+            CloudError::PermissionDenied,
+            "{invalid}"
+        );
+    }
+    assert!(
+        auth.store
+            .read_session(&"0".repeat(64), crate::http::now())
+            .await
+            .is_err()
+    );
+    server.abort();
+}
+
+async fn signed_session(auth: &Authentication, issuer: &IssuerState) -> HeaderMap {
+    let (headers, state) = flow(auth, issuer).await;
+    let cookie = auth
+        .callback(&headers, &state, "code".into())
+        .await
+        .unwrap();
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        "cookie",
+        HeaderValue::from_str(cookie.to_str().unwrap().split(';').next().unwrap()).unwrap(),
+    );
+    headers
+}
+#[tokio::test]
+async fn persisted_roles_revoke_and_regrant_without_configuration_overwriting_admin_edits() {
+    let (auth, issuer, server) = fixture().await;
+    let headers = signed_session(&auth, &issuer).await;
+    let user = auth.user(&headers).await.unwrap();
+    assert!(
+        auth.caller(&headers, "project-a", false)
+            .await
+            .unwrap()
+            .require(CloudPermission::Execute)
+            .is_ok()
+    );
+    let manager = CloudCaller::new(
+        "fixture-administrator".into(),
+        "project-a".into(),
+        [CloudPermission::Read, CloudPermission::Administer].into(),
+    )
+    .unwrap();
+    let repo = auth.repository().unwrap();
+    let initial = repo.user_memberships(&user.id).await.unwrap().remove(0);
+    let viewer = repo
+        .save_membership(
+            &manager,
+            &user.id,
+            colossus_cloud::ProjectRole::Viewer,
+            initial.revision,
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        auth.caller(&headers, "project-a", false)
+            .await
+            .unwrap()
+            .require(CloudPermission::Execute),
+        Err(CloudError::PermissionDenied)
+    );
+    let mut changed = auth.config.clone();
+    changed.memberships[0].permissions = [CloudPermission::Read, CloudPermission::Execute].into();
+    let restarted = Authentication::with_store(changed, auth.store.clone())
+        .await
+        .unwrap();
+    assert_eq!(
+        restarted
+            .caller(&headers, "project-a", false)
+            .await
+            .unwrap()
+            .require(CloudPermission::Execute),
+        Err(CloudError::PermissionDenied)
+    );
+    repo.remove_membership(&manager, &user.id, viewer.revision)
+        .await
+        .unwrap();
+    assert!(auth.memberships(&headers).await.unwrap().is_empty());
+    assert_eq!(
+        restarted
+            .caller(&headers, "project-a", false)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    repo.save_membership(&manager, &user.id, colossus_cloud::ProjectRole::Operator, 0)
+        .await
+        .unwrap();
+    assert!(
+        restarted
+            .caller(&headers, "project-a", false)
+            .await
+            .unwrap()
+            .require(CloudPermission::Execute)
+            .is_ok()
+    );
+    assert!(
+        repo.save_membership(
+            &manager,
+            &user.id,
+            colossus_cloud::ProjectRole::ProjectAdmin,
+            viewer.revision
+        )
+        .await
+        .is_err()
+    );
+    server.abort();
+}
+#[tokio::test]
+async fn persistent_sessions_and_oidc_flows_are_bound_to_issuer_and_client() {
+    let (auth, issuer, server) = fixture().await;
+    let headers = signed_session(&auth, &issuer).await;
+    let (flow_headers, state) = flow(&auth, &issuer).await;
+    let mut different_client = auth.config.clone();
+    different_client.oidc.as_mut().unwrap().client_id = "another-client".into();
+    let different_client = Authentication::with_store(different_client, auth.store.clone())
+        .await
+        .unwrap();
+    assert_eq!(
+        different_client
+            .caller(&headers, "project-a", false)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        different_client
+            .callback(&flow_headers, &state, "code".into())
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let (other, _, other_server) = fixture().await;
+    let mut different_issuer = auth.config.clone();
+    different_issuer.oidc.as_mut().unwrap().issuer =
+        other.config.oidc.as_ref().unwrap().issuer.clone();
+    let different_issuer = Authentication::with_store(different_issuer, auth.store.clone())
+        .await
+        .unwrap();
+    assert_eq!(
+        different_issuer
+            .caller(&headers, "project-a", false)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        different_issuer
+            .callback(&flow_headers, &state, "code".into())
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    server.abort();
+    other_server.abort();
+}
+
+mod local;
+
+mod markers;
diff --git a/crates/colossus-cloud-server/src/auth/tests/local.rs b/crates/colossus-cloud-server/src/auth/tests/local.rs
new file mode 100644
index 000000000..427597c1c
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/tests/local.rs
@@ -0,0 +1,473 @@
+use super::*;
+use colossus_cloud::{
+    CloudProject, CloudUser, LocalCredential, LoginIdentityMetadata, ProjectRole, UserAccount,
+};
+
+const PASSWORD: &str = "fixture local password 2026";
+
+#[tokio::test]
+async fn bootstrap_existing_oidc_account_adds_local_binding_once_without_resetting_credentials() {
+    const ISOLATED: &str = "COLOSSUS_BOOTSTRAP_TEST_ISOLATED";
+    const SECRET: &str = "COLOSSUS_BOOTSTRAP_TEST_PASSWORD";
+    if std::env::var_os(ISOLATED).is_none() {
+        // A child owns its secret environment before any threads start; tests never mutate the process environment.
+        let output=tokio::process::Command::new(std::env::current_exe().unwrap()).args(["--exact","auth::tests::local::bootstrap_existing_oidc_account_adds_local_binding_once_without_resetting_credentials","--test-threads=1"]).env(ISOLATED,"1").env(SECRET,PASSWORD).output().await.unwrap();
+        assert!(
+            output.status.success(),
+            "isolated bootstrap regression failed: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        return;
+    }
+    let (prior, _, server) = fixture().await;
+    let original = prior
+        .repository()
+        .unwrap()
+        .user_memberships(&colossus_cloud::hash_identity(&[
+            "oidc-user",
+            &prior.config.oidc.as_ref().unwrap().issuer,
+            "alice",
+        ]))
+        .await
+        .unwrap()
+        .remove(0);
+    let mut config = prior.config.clone();
+    config.local_auth = Some(crate::config::LocalAuthConfig {
+        session_seconds: 3600,
+    });
+    config.bootstrap_admin = Some(crate::config::BootstrapAdmin {
+        display_name: "Existing administrator".into(),
+        email: None,
+        oidc_subject: Some("alice".into()),
+        username: Some("promoted-admin".into()),
+        password_variable: Some(SECRET.into()),
+    });
+    let promoted = Authentication::with_store(config.clone(), prior.store.clone())
+        .await
+        .unwrap();
+    let headers = local_cookie(&promoted, "promoted-admin", PASSWORD).await;
+    let user = promoted.admin(&headers, false).await.unwrap();
+    assert_eq!(user.id, original.user_id);
+    assert!(
+        user.identities
+            .iter()
+            .any(|identity| identity.username.as_deref() == Some("promoted-admin"))
+    );
+    let revision = promoted
+        .repository()
+        .unwrap()
+        .account(&user.id)
+        .await
+        .unwrap()
+        .user
+        .revision;
+    config.bootstrap_admin.as_mut().unwrap().password_variable =
+        Some("MISSING_BOOTSTRAP_SECRET_MUST_NOT_BE_READ".into());
+    let restarted = Authentication::with_store(config, prior.store.clone())
+        .await
+        .unwrap();
+    assert!(restarted.admin(&headers, false).await.is_ok());
+    assert_eq!(
+        restarted
+            .repository()
+            .unwrap()
+            .account(&user.id)
+            .await
+            .unwrap()
+            .user
+            .revision,
+        revision
+    );
+    server.abort();
+}
+async fn fixture_local() -> (Authentication, tokio::task::JoinHandle<()>) {
+    let (oidc, _, server) = fixture().await;
+    let mut config = oidc.config.clone();
+    config.oidc = None;
+    config.memberships.clear();
+    config.local_auth = Some(crate::config::LocalAuthConfig {
+        session_seconds: 3600,
+    });
+    let auth = Authentication::with_store(config, oidc.store.clone())
+        .await
+        .unwrap();
+    for (id, username, admin) in [
+        ("local-admin", "administrator", true),
+        ("local-user", "operator", false),
+    ] {
+        let hash = auth
+            .password_hash(Zeroizing::new(PASSWORD.into()))
+            .await
+            .unwrap();
+        let now = time::OffsetDateTime::now_utc()
+            .format(&time::format_description::well_known::Rfc3339)
+            .unwrap();
+        let account = UserAccount {
+            user: CloudUser {
+                id: id.into(),
+                display_name: username.into(),
+                email: None,
+                active: true,
+                is_admin: admin,
+                revision: 1,
+                created_at: now.clone(),
+                updated_at: now,
+                identities: vec![LoginIdentityMetadata {
+                    kind: "local".into(),
+                    label: "Local account".into(),
+                    username: Some(username.into()),
+                    issuer: None,
+                    subject: None,
+                }],
+            },
+            security_epoch: 1,
+        };
+        auth.repository()
+            .unwrap()
+            .create_account(
+                "fixture-provisioning",
+                account,
+                None,
+                Some(LocalCredential {
+                    user_id: id.into(),
+                    username: username.into(),
+                    password_hash: hash,
+                }),
+            )
+            .await
+            .unwrap();
+    }
+    (auth, server)
+}
+fn csrf() -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert("origin", HeaderValue::from_static("http://127.0.0.1:5180"));
+    headers.insert("x-colossus-csrf", HeaderValue::from_static("1"));
+    headers
+}
+async fn local_cookie(auth: &Authentication, username: &str, password: &str) -> HeaderMap {
+    let mut headers = csrf();
+    let cookie = auth
+        .local_login(&headers, username.into(), Zeroizing::new(password.into()))
+        .await
+        .unwrap();
+    headers.insert(
+        "cookie",
+        HeaderValue::from_str(cookie.to_str().unwrap().split(';').next().unwrap()).unwrap(),
+    );
+    headers
+}
+#[tokio::test]
+async fn local_password_sessions_are_revoked_across_replicas_and_disabled_users_cannot_return() {
+    let (auth, server) = fixture_local().await;
+    assert_eq!(
+        auth.local_login(
+            &HeaderMap::new(),
+            "operator".into(),
+            Zeroizing::new(PASSWORD.into())
+        )
+        .await
+        .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        auth.local_login(
+            &csrf(),
+            "operator".into(),
+            Zeroizing::new("incorrect password".into())
+        )
+        .await
+        .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        auth.local_login(
+            &csrf(),
+            "unknown-user".into(),
+            Zeroizing::new("incorrect password".into())
+        )
+        .await
+        .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let headers = local_cookie(&auth, "OPERATOR", PASSWORD).await;
+    assert_eq!(auth.user(&headers).await.unwrap().id, "local-user");
+    assert!(auth.admin(&headers, false).await.is_err());
+    let replica = Authentication::with_store(auth.config.clone(), auth.store.clone())
+        .await
+        .unwrap();
+    assert!(replica.user(&headers).await.is_ok());
+    let admin_headers = local_cookie(&auth, "administrator", PASSWORD).await;
+    let admin = auth.admin(&admin_headers, true).await.unwrap();
+    let caller = auth
+        .caller(&admin_headers, "project-a", true)
+        .await
+        .unwrap();
+    assert_eq!(
+        caller.require(CloudPermission::Execute),
+        Err(CloudError::PermissionDenied)
+    );
+    assert_eq!(
+        caller.require(CloudPermission::Approve),
+        Err(CloudError::PermissionDenied)
+    );
+    let repo = auth.repository().unwrap();
+    repo.save_membership(&caller, "local-user", ProjectRole::ProjectAdmin, 0)
+        .await
+        .unwrap();
+    assert!(
+        auth.caller(&headers, "project-a", true)
+            .await
+            .unwrap()
+            .require(CloudPermission::Execute)
+            .is_ok()
+    );
+    assert_eq!(
+        auth.caller(&headers, "project-a", true)
+            .await
+            .unwrap()
+            .require(CloudPermission::Approve),
+        Err(CloudError::PermissionDenied)
+    );
+    let child = CloudProject {
+        id: "private-child".into(),
+        name: "Private child".into(),
+        description: String::new(),
+        parent_project_id: Some("project-a".into()),
+        archived: false,
+        revision: 0,
+        created_at: String::new(),
+        updated_at: String::new(),
+    };
+    repo.save_project(&admin, child).await.unwrap();
+    assert_eq!(
+        auth.caller(&headers, "private-child", false)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let hash = auth
+        .password_hash(Zeroizing::new("rotated fixture password 2026".into()))
+        .await
+        .unwrap();
+    let user = repo.account("local-user").await.unwrap().user;
+    let updated = repo
+        .reset_local_password(&admin, "local-user", user.revision, hash)
+        .await
+        .unwrap();
+    assert_eq!(
+        auth.user(&headers).await.unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        replica.user(&headers).await.unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let fresh = local_cookie(&replica, "operator", "rotated fixture password 2026").await;
+    let mut disabled = updated;
+    disabled.active = false;
+    let mut disabled = repo.update_account(&admin, disabled).await.unwrap();
+    assert_eq!(
+        replica.user(&fresh).await.unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        auth.local_login(
+            &csrf(),
+            "operator".into(),
+            Zeroizing::new("rotated fixture password 2026".into())
+        )
+        .await
+        .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    disabled.active = true;
+    repo.update_account(&admin, disabled).await.unwrap();
+    assert_eq!(
+        replica.user(&fresh).await.unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let mut last_admin = admin.clone();
+    last_admin.active = false;
+    assert_eq!(
+        repo.update_account(&admin, last_admin).await.unwrap_err(),
+        CloudError::Conflict
+    );
+    let admin = auth.admin(&admin_headers, false).await.unwrap();
+    let mut changed = admin.clone();
+    changed.is_admin = false;
+    assert_eq!(
+        repo.update_account(&admin, changed).await.unwrap_err(),
+        CloudError::Conflict
+    );
+    server.abort();
+}
+#[tokio::test]
+async fn local_password_inputs_and_shared_attempt_budgets_are_bounded() {
+    let (auth, server) = fixture_local().await;
+    let now = crate::http::now();
+    assert!(
+        auth.password_hash(Zeroizing::new("界".repeat(5)))
+            .await
+            .is_err()
+    );
+    assert!(
+        auth.password_hash(Zeroizing::new("a".repeat(1025)))
+            .await
+            .is_err()
+    );
+    for _ in 0..8 {
+        assert_eq!(
+            auth.local_login_at(
+                &csrf(),
+                "rate-limited".into(),
+                Zeroizing::new("incorrect password".into()),
+                now,
+            )
+            .await
+            .unwrap_err(),
+            CloudError::PermissionDenied
+        );
+    }
+    let replica = Authentication::with_store(auth.config.clone(), auth.store.clone())
+        .await
+        .unwrap();
+    assert_eq!(
+        replica
+            .local_login_at(
+                &csrf(),
+                "rate-limited".into(),
+                Zeroizing::new("incorrect password".into()),
+                now,
+            )
+            .await
+            .unwrap_err(),
+        CloudError::ResourceExhausted
+    );
+    assert_eq!(
+        replica
+            .local_login_at(
+                &csrf(),
+                "rate-limited".into(),
+                Zeroizing::new("incorrect password".into()),
+                now + 60,
+            )
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    server.abort();
+}
+
+#[tokio::test]
+async fn exhausted_global_login_budget_does_not_create_new_username_buckets() {
+    let (auth, server) = fixture_local().await;
+    let now = crate::http::now();
+    let bucket = (now / 60).to_string();
+    let global = flow_key(&colossus_cloud::hash_identity(&[
+        "local-login-global",
+        &bucket,
+    ]));
+    auth.store
+        .commit(CloudTransaction {
+            entities: vec![EntityMutation {
+                key: global,
+                expected_revision: 0,
+                value: json!({"attempts":120,"expires_at":now+600}),
+                actor: "fixture".into(),
+                operation: "fixture.auth-budget".into(),
+            }],
+            ..Default::default()
+        })
+        .await
+        .unwrap();
+    assert_eq!(
+        auth.local_login(
+            &csrf(),
+            "new-username".into(),
+            Zeroizing::new(PASSWORD.into())
+        )
+        .await
+        .unwrap_err(),
+        CloudError::ResourceExhausted
+    );
+    let personal = flow_key(&colossus_cloud::hash_identity(&[
+        "local-login",
+        "new-username",
+        &bucket,
+    ]));
+    assert!(matches!(
+        auth.store.read(&personal).await,
+        Err(CloudError::NotFound)
+    ));
+    server.abort();
+}
+
+#[tokio::test]
+async fn password_rotation_between_credential_read_and_verification_cannot_mint_new_epoch_cookie() {
+    let (auth, server) = fixture_local().await;
+    let key = colossus_cloud::identity_key(
+        EntityKind::LocalCredential,
+        &colossus_cloud::hash_identity(&["operator"]),
+    );
+    let original = auth.store.read(&key).await.unwrap();
+    let mut credential: LocalCredential = serde_json::from_value(original.value).unwrap();
+    credential.password_hash = auth
+        .password_hash(Zeroizing::new("concurrently rotated password".into()))
+        .await
+        .unwrap();
+    let mut account = auth
+        .repository()
+        .unwrap()
+        .account("local-user")
+        .await
+        .unwrap();
+    let version = account.user.revision;
+    account.security_epoch += 1;
+    account.user.revision += 1;
+    let transaction = CloudTransaction {
+        entities: vec![
+            EntityMutation {
+                key: key.clone(),
+                expected_revision: original.revision,
+                value: serde_json::to_value(credential).unwrap(),
+                actor: "local-admin".into(),
+                operation: "fixture.password-rotation".into(),
+            },
+            EntityMutation {
+                key: colossus_cloud::identity_key(EntityKind::User, "local-user"),
+                expected_revision: version,
+                value: serde_json::to_value(account).unwrap(),
+                actor: "local-admin".into(),
+                operation: "fixture.password-rotation".into(),
+            },
+        ],
+        ..Default::default()
+    };
+    let injected: Arc<dyn CloudStore> = Arc::new(super::markers::MarkerFailure::rotating(
+        auth.store.clone(),
+        key,
+        transaction,
+    ));
+    let raced = Authentication::with_store(auth.config.clone(), injected)
+        .await
+        .unwrap();
+    assert_eq!(
+        raced
+            .local_login(&csrf(), "operator".into(), Zeroizing::new(PASSWORD.into()))
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert!(
+        raced
+            .local_login(
+                &csrf(),
+                "operator".into(),
+                Zeroizing::new("concurrently rotated password".into())
+            )
+            .await
+            .is_ok()
+    );
+    server.abort();
+}
diff --git a/crates/colossus-cloud-server/src/auth/tests/markers.rs b/crates/colossus-cloud-server/src/auth/tests/markers.rs
new file mode 100644
index 000000000..27b240485
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/tests/markers.rs
@@ -0,0 +1,166 @@
+//! Fault-injection proof that bootstrap does no work after a marker verification failure.
+use super::*;
+use colossus_cloud::storage::*;
+use std::sync::atomic::{AtomicUsize, Ordering};
+pub(super) struct MarkerFailure {
+    inner: Arc<dyn CloudStore>,
+    key: &'static str,
+    writes: AtomicUsize,
+    rotation: std::sync::Mutex<Option<(EntityKey, CloudTransaction)>>,
+}
+impl MarkerFailure {
+    pub(super) fn rotating(
+        inner: Arc<dyn CloudStore>,
+        key: EntityKey,
+        transaction: CloudTransaction,
+    ) -> Self {
+        Self {
+            inner,
+            key: "",
+            writes: AtomicUsize::new(0),
+            rotation: std::sync::Mutex::new(Some((key, transaction))),
+        }
+    }
+}
+#[async_trait::async_trait]
+impl CloudStore for MarkerFailure {
+    fn subscribe(&self) -> tokio::sync::broadcast::Receiver<String> {
+        self.inner.subscribe()
+    }
+    async fn readiness(&self) -> CloudResult<()> {
+        self.inner.readiness().await
+    }
+    async fn read(&self, key: &EntityKey) -> CloudResult<EntityRecord> {
+        if key.kind == EntityKind::Setting && key.id == self.key {
+            Err(CloudError::Storage)
+        } else {
+            let record = self.inner.read(key).await?;
+            let rotation = {
+                let mut next = self.rotation.lock().unwrap();
+                if next.as_ref().is_some_and(|(trigger, _)| trigger == key) {
+                    next.take()
+                } else {
+                    None
+                }
+            };
+            if let Some((_, transaction)) = rotation {
+                self.inner
+                    .commit(transaction)
+                    .await
+                    .map_err(CloudError::from)?;
+            }
+            Ok(record)
+        }
+    }
+    async fn delete_entity(&self, key: &EntityKey, revision: u64) -> CloudResult<()> {
+        self.inner.delete_entity(key, revision).await
+    }
+    async fn list(&self, q: &EntityQuery) -> CloudResult<Vec<EntityRecord>> {
+        self.inner.list(q).await
+    }
+    async fn list_projects(
+        &self,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<EntityRecord>> {
+        self.inner.list_projects(after, limit).await
+    }
+    async fn user_identities(&self, user: &str) -> CloudResult<Vec<EntityRecord>> {
+        self.inner.user_identities(user).await
+    }
+    async fn user_accounts(&self, users: &[String]) -> CloudResult<Vec<EntityRecord>> {
+        self.inner.user_accounts(users).await
+    }
+    async fn memberships(&self, subject: &str) -> CloudResult<Vec<EntityRecord>> {
+        self.inner.memberships(subject).await
+    }
+    async fn thread_incomplete(&self, project: &str, thread: &str) -> CloudResult<bool> {
+        self.inner.thread_incomplete(project, thread).await
+    }
+    async fn commit(
+        &self,
+        t: CloudTransaction,
+    ) -> std::result::Result<(), colossus_ports::StoreError> {
+        self.writes.fetch_add(1, Ordering::SeqCst);
+        self.inner.commit(t).await
+    }
+    async fn events(
+        &self,
+        p: &str,
+        s: &str,
+        after: u64,
+        limit: usize,
+    ) -> CloudResult<Vec<ReleasedEvent>> {
+        self.inner.events(p, s, after, limit).await
+    }
+    async fn cursor(&self, p: &str, s: &str, c: &str) -> CloudResult<u64> {
+        self.inner.cursor(p, s, c).await
+    }
+    async fn put_session(&self, s: AuthSession) -> CloudResult<()> {
+        self.inner.put_session(s).await
+    }
+    async fn read_session(&self, h: &str, now: u64) -> CloudResult<AuthSession> {
+        self.inner.read_session(h, now).await
+    }
+    async fn delete_session(&self, h: &str) -> CloudResult<()> {
+        self.inner.delete_session(h).await
+    }
+    async fn claim_lease(
+        &self,
+        p: &str,
+        n: &str,
+        o: &str,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease> {
+        self.inner.claim_lease(p, n, o, now, ttl).await
+    }
+    async fn read_lease(&self, p: &str, n: &str, now: u64) -> CloudResult<ConnectionLease> {
+        self.inner.read_lease(p, n, now).await
+    }
+    async fn renew_lease(
+        &self,
+        l: &ConnectionLease,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease> {
+        self.inner.renew_lease(l, now, ttl).await
+    }
+    async fn release_lease(&self, l: &ConnectionLease) -> CloudResult<()> {
+        self.inner.release_lease(l).await
+    }
+    async fn verify_lease(&self, l: &ConnectionLease, now: u64) -> CloudResult<()> {
+        self.inner.verify_lease(l, now).await
+    }
+}
+#[tokio::test]
+async fn bootstrap_propagates_marker_integrity_failure_without_initializing_accounts() {
+    let (auth, _, server) = fixture().await;
+    for marker in ["identity-bootstrap-v3", "administrator-bootstrap-v3"] {
+        let store = Arc::new(MarkerFailure {
+            inner: Arc::new(MemoryCloudStore::default()),
+            key: marker,
+            writes: AtomicUsize::new(0),
+            rotation: std::sync::Mutex::new(None),
+        });
+        let mut config = auth.config.clone();
+        if marker == "administrator-bootstrap-v3" {
+            config.bootstrap_admin = Some(crate::config::BootstrapAdmin {
+                display_name: "Fixture administrator".into(),
+                email: None,
+                oidc_subject: Some("alice".into()),
+                username: None,
+                password_variable: None,
+            });
+        }
+        let port: Arc<dyn CloudStore> = store.clone();
+        assert_eq!(
+            super::super::bootstrap::seed_accounts(&port, &config)
+                .await
+                .unwrap_err(),
+            CloudError::Storage
+        );
+        assert_eq!(store.writes.load(Ordering::SeqCst), 0);
+    }
+    server.abort();
+}
diff --git a/crates/colossus-cloud-server/src/auth/tests/transport.rs b/crates/colossus-cloud-server/src/auth/tests/transport.rs
new file mode 100644
index 000000000..fd9757be9
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/tests/transport.rs
@@ -0,0 +1,673 @@
+//! Real OIDC, HTTP/SSE, encrypted enrollment, mTLS, connector, runtime, prompt,
+//! approval, cancellation, rotation and host-restart acceptance. No model credentials.
+use super::*;
+use colossus_api::{
+    ApiScope, ApplicationKind, ApplicationPrincipal, CallerContext, RequestId, scopes,
+};
+use colossus_api_runtime::{PublicInteractionRouter, RuntimeAgentRunApi};
+use colossus_cloud::CloudTask;
+use colossus_connector::{ConnectorStatus, EnrollmentStore, RuntimeConnector};
+use colossus_contracts::VaultRecord;
+use colossus_credentials::{PlatformCredentialVault, PlatformKeyStore};
+use colossus_home::ColossusHome;
+use colossus_policy::DenyApproval;
+use colossus_ports::{CredentialError, CredentialKey, CredentialVault};
+use colossus_runtime::{Runtime, RuntimeConfig, RuntimeOpenOptions};
+use colossus_sdk::{ContextBoundAgentRunClient, InteractionContent, InteractionStatus, RunStatus};
+use rcgen::{
+    BasicConstraints, CertificateParams, ExtendedKeyUsagePurpose, IsCa, Issuer, KeyPair,
+    KeyUsagePurpose,
+};
+use std::{
+    path::Path,
+    sync::atomic::{AtomicUsize, Ordering},
+};
+use tokio::sync::watch;
+use zeroize::Zeroizing;
+
+mod managed;
+
+#[derive(Default)]
+struct TestKeys(Mutex<HashMap<String, Zeroizing<Vec<u8>>>>);
+impl PlatformKeyStore for TestKeys {
+    fn read(
+        &self,
+        account: &str,
+    ) -> Result<Option<Zeroizing<Vec<u8>>>, colossus_ports::CredentialError> {
+        Ok(self.0.lock().unwrap().get(account).cloned())
+    }
+    fn write(&self, account: &str, bytes: &[u8]) -> Result<(), colossus_ports::CredentialError> {
+        self.0
+            .lock()
+            .unwrap()
+            .insert(account.into(), Zeroizing::new(bytes.to_vec()));
+        Ok(())
+    }
+}
+struct FaultVault {
+    inner: PlatformCredentialVault,
+    fail_write: AtomicUsize,
+}
+impl CredentialVault for FaultVault {
+    fn read(&self, key: &CredentialKey) -> Result<Option<VaultRecord>, CredentialError> {
+        self.inner.read(key)
+    }
+    fn write(&self, key: &CredentialKey, record: &VaultRecord) -> Result<(), CredentialError> {
+        if self
+            .fail_write
+            .fetch_update(Ordering::SeqCst, Ordering::SeqCst, |remaining| {
+                remaining.checked_sub(1)
+            })
+            == Ok(1)
+        {
+            return Err(CredentialError::Io);
+        }
+        self.inner.write(key, record)
+    }
+    fn delete(&self, key: &CredentialKey) -> Result<(), CredentialError> {
+        self.inner.delete(key)
+    }
+}
+fn tls_files(root: &Path, config: &mut Config) {
+    let key = KeyPair::generate().unwrap();
+    let mut params = CertificateParams::default();
+    params.is_ca = IsCa::Ca(BasicConstraints::Unconstrained);
+    params.key_usages = vec![
+        KeyUsagePurpose::KeyCertSign,
+        KeyUsagePurpose::DigitalSignature,
+    ];
+    let ca = params.self_signed(&key).unwrap();
+    let issuer = Issuer::new(params, key);
+    let server_key = KeyPair::generate().unwrap();
+    let mut params = CertificateParams::new(vec!["localhost".into()]).unwrap();
+    params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
+    let server = params.signed_by(&server_key, &issuer).unwrap();
+    for (name, value) in [
+        ("ca.pem", ca.pem()),
+        ("ca-key.pem", issuer.key().serialize_pem()),
+        ("server.pem", server.pem()),
+        ("server-key.pem", server_key.serialize_pem()),
+    ] {
+        std::fs::write(root.join(name), value).unwrap();
+    }
+    config.ca_certificate = root.join("ca.pem");
+    config.ca_key = root.join("ca-key.pem");
+    config.server_certificate = root.join("server.pem");
+    config.server_key = root.join("server-key.pem");
+}
+async fn sign_in(client: &reqwest::Client, origin: &str, issuer: &IssuerState) -> HeaderMap {
+    let login = client
+        .get(format!("{origin}/auth/login"))
+        .send()
+        .await
+        .unwrap();
+    let url = url::Url::parse(login.headers()["location"].to_str().unwrap()).unwrap();
+    let query: HashMap<_, _> = url.query_pairs().into_owned().collect();
+    *issuer.challenge.lock().unwrap() = query["code_challenge"].clone();
+    *issuer.nonce.lock().unwrap() = query["nonce"].clone();
+    let callback = client
+        .get(format!("{origin}/auth/callback"))
+        .query(&[("state", query["state"].as_str()), ("code", "fixture-code")])
+        .header(
+            "cookie",
+            login.headers()["set-cookie"]
+                .to_str()
+                .unwrap()
+                .split(';')
+                .next()
+                .unwrap(),
+        )
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(callback.status(), 303);
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        "cookie",
+        HeaderValue::from_str(
+            callback.headers()["set-cookie"]
+                .to_str()
+                .unwrap()
+                .split(';')
+                .next()
+                .unwrap(),
+        )
+        .unwrap(),
+    );
+    headers.insert("origin", HeaderValue::from_str(origin).unwrap());
+    headers.insert("x-colossus-csrf", HeaderValue::from_static("1"));
+    headers
+}
+async fn post(
+    client: &reqwest::Client,
+    origin: &str,
+    headers: &HeaderMap,
+    path: &str,
+    value: Value,
+) -> Value {
+    let response = client
+        .post(format!("{origin}{path}"))
+        .headers(headers.clone())
+        .json(&value)
+        .send()
+        .await
+        .unwrap();
+    assert!(response.status().is_success(), "{}", response.status());
+    response.json().await.unwrap()
+}
+async fn wait_task(
+    client: &reqwest::Client,
+    origin: &str,
+    headers: &HeaderMap,
+    id: &str,
+    predicate: impl Fn(&CloudTask) -> bool,
+) -> CloudTask {
+    let mut last = None;
+    let result = tokio::time::timeout(Duration::from_secs(25), async {
+        loop {
+            let response: Value = client
+                .get(format!("{origin}/api/projects/project-a/tasks/{id}"))
+                .headers(headers.clone())
+                .send()
+                .await
+                .unwrap()
+                .error_for_status()
+                .unwrap()
+                .json()
+                .await
+                .unwrap();
+            let task: CloudTask = serde_json::from_value(response["task"].clone()).unwrap();
+            last = Some(task.clone());
+            if predicate(&task) {
+                return task;
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    })
+    .await;
+    result.unwrap_or_else(|_| panic!("cloud task deadline: {last:?}"))
+}
+async fn provider(
+    axum::extract::State(turn): axum::extract::State<Arc<AtomicUsize>>,
+) -> impl axum::response::IntoResponse {
+    let turn = turn.fetch_add(1, Ordering::SeqCst);
+    let choice = match turn {
+        1 => {
+            json!({"delta":{"tool_calls":[{"index":0,"id":"write","type":"function","function":{"name":"filesystem_write","arguments":json!({"path":"approved.txt","content":"cloud-approved","mode":"create"}).to_string()}}]},"finish_reason":"tool_calls"})
+        }
+        2 => json!({"delta":{"content":"Cloud approval completed."},"finish_reason":"stop"}),
+        _ => {
+            json!({"delta":{"tool_calls":[{"index":0,"id":format!("ask-{turn}"),"type":"function","function":{"name":"user_ask","arguments":json!({"question":"Continue the isolated acceptance task?","choices":["Continue"],"allow_free_form":true}).to_string()}}]},"finish_reason":"tool_calls"})
+        }
+    };
+    let event = json!({"id":"cloud-fixture","choices":[{"index":0,"delta":choice["delta"],"finish_reason":choice["finish_reason"]}]});
+    (
+        [("content-type", "text/event-stream")],
+        format!("data: {event}\n\ndata: [DONE]\n\n"),
+    )
+}
+
+#[tokio::test]
+async fn oidc_to_runtime_prompt_approval_cancel_rotate_and_recover() {
+    acceptance(false).await;
+}
+
+#[tokio::test]
+#[ignore = "operator-owned: local PostgreSQL plus COLOSSUS_CLOUD_TEST_DATABASE"]
+async fn postgres_oidc_to_runtime_and_recover() {
+    acceptance(true).await;
+}
+
+async fn acceptance(postgres: bool) {
+    let (auth, issuer, oidc) = fixture().await;
+    let directory = tempfile::tempdir().unwrap();
+    let root = directory.path().canonicalize().unwrap();
+    let home = ColossusHome::ensure_at(root.join("native")).unwrap();
+    let browser = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let grpc = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let mut config = auth.config.clone();
+    config.http_bind = browser.local_addr().unwrap();
+    config.grpc_bind = grpc.local_addr().unwrap();
+    config.public_origin = format!("http://{}", config.http_bind);
+    config.grpc_endpoint = format!("https://localhost:{}", config.grpc_bind.port());
+    config.database.schema = format!("cloud_e2e_{}", uuid::Uuid::now_v7().simple());
+    config.database.tls = colossus_cloud_postgres::CloudDatabaseTls::Disabled;
+    config.auth_key_variable = None;
+    let cloud_store: Arc<dyn colossus_cloud::storage::CloudStore> = if postgres {
+        Arc::new(
+            colossus_cloud_postgres::CloudPostgresStore::open(
+                config.database.clone(),
+                &colossus_network::AdditionalRootCertificates::default(),
+            )
+            .await
+            .unwrap(),
+        )
+    } else {
+        Arc::new(colossus_cloud::storage::MemoryCloudStore::default())
+    };
+    config.memberships[0].permissions = BTreeSet::from([
+        CloudPermission::Read,
+        CloudPermission::Execute,
+        CloudPermission::Control,
+        CloudPermission::Approve,
+        CloudPermission::Administer,
+    ]);
+    tls_files(&root, &mut config);
+    drop(auth);
+    let origin = config.public_origin.clone();
+    let server = crate::server::CloudServer::with_store(config.clone(), cloud_store.clone())
+        .await
+        .unwrap();
+    let (stop, shutdown) = watch::channel(false);
+    let host = tokio::spawn(server.serve_listeners(browser, grpc, shutdown));
+    let client = reqwest::Client::builder()
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .unwrap();
+    let failed_sign_in = client
+        .get(format!("{origin}/auth/callback"))
+        .query(&[("state", "untrusted-state"), ("code", "untrusted-code")])
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(failed_sign_in.status(), 403);
+    assert!(
+        failed_sign_in.headers()["content-type"]
+            .to_str()
+            .unwrap()
+            .starts_with("text/html")
+    );
+    assert!(!failed_sign_in.headers().contains_key("set-cookie"));
+    let failure_page = failed_sign_in.text().await.unwrap();
+    assert!(failure_page.contains("Return to Colossus"));
+    assert!(!failure_page.contains("untrusted-state"));
+    assert!(!failure_page.contains("untrusted-code"));
+    let cancelled_sign_in = client
+        .get(format!("{origin}/auth/callback"))
+        .query(&[
+            ("error", "access_denied"),
+            ("error_description", "untrusted-description"),
+        ])
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(cancelled_sign_in.status(), 403);
+    assert!(!cancelled_sign_in.headers().contains_key("set-cookie"));
+    let cancelled_page = cancelled_sign_in.text().await.unwrap();
+    assert!(cancelled_page.contains("Return to Colossus"));
+    assert!(!cancelled_page.contains("untrusted-description"));
+    let headers = sign_in(&client, &origin, &issuer).await;
+    assert_eq!(
+        client
+            .get(format!("{origin}/api/projects/foreign/tasks"))
+            .headers(headers.clone())
+            .send()
+            .await
+            .unwrap()
+            .status(),
+        403
+    );
+    let mut no_csrf = headers.clone();
+    no_csrf.remove("x-colossus-csrf");
+    assert_eq!(
+        client
+            .post(format!("{origin}/api/projects/project-a/invitations"))
+            .headers(no_csrf)
+            .json(&json!({"label":"test","roles":["primary"]}))
+            .send()
+            .await
+            .unwrap()
+            .status(),
+        403
+    );
+    let invite = post(
+        &client,
+        &origin,
+        &headers,
+        "/api/projects/project-a/invitations",
+        json!({"label":"Acceptance runtime","roles":["primary"]}),
+    )
+    .await;
+    let vault = Arc::new(FaultVault {
+        inner: PlatformCredentialVault::with_key_store(
+            home.confined_root().clone(),
+            "cloud-acceptance",
+            Arc::new(TestKeys::default()),
+        )
+        .unwrap(),
+        fail_write: AtomicUsize::new(0),
+    });
+    let enrollment = EnrollmentStore::new(vault.clone(), "node-a").unwrap();
+    let connection = enrollment
+        .enroll(
+            invite["enrollment_url"].as_str().unwrap().into(),
+            Zeroizing::new(invite["token"].as_str().unwrap().into()),
+            "runtime-a".into(),
+            vec![],
+            true,
+        )
+        .await
+        .unwrap();
+    let (_, key) = enrollment.load().unwrap().unwrap();
+
+    let model_listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let model_origin = format!("http://{}", model_listener.local_addr().unwrap());
+    let turns = Arc::new(AtomicUsize::new(0));
+    let model_router = Router::new()
+        .route("/v1/chat/completions", axum::routing::post(provider))
+        .with_state(turns.clone());
+    let model =
+        tokio::spawn(async move { axum::serve(model_listener, model_router).await.unwrap() });
+    let workspace = root.join("workspace");
+    std::fs::create_dir(&workspace).unwrap();
+    let mut runtime_config = RuntimeConfig::offline_template(workspace.join("runtime.redb"));
+    runtime_config.workflows.repository = workspace.join("workflows");
+    runtime_config.workflows.user = workspace.join("workflows");
+    std::fs::create_dir(&runtime_config.workflows.repository).unwrap();
+    runtime_config.access=serde_json::from_value(json!({"profile":"pinned","tools":{"include":["user.ask","filesystem.write"]},"actions":{"allow":["provider.openai.chat"],"requireApproval":["filesystem.write"]}})).unwrap();
+    runtime_config.providers=serde_json::from_value(json!({"profiles":{"fixture":{"kind":"open_ai_compatible","baseUrl":format!("{model_origin}/v1"),"timeoutMs":5000}}})).unwrap();
+    runtime_config.models=serde_json::from_value(json!({"profiles":{"fixture":{"providerProfile":"fixture","model":"fixture","contextWindowTokens":32768,"maxOutputTokens":4096,"capabilities":{"toolCalls":true,"streaming":true}}},"roles":{"primary":"fixture"}})).unwrap();
+    runtime_config.sandbox.network_destinations = vec![model_origin];
+    runtime_config.sandbox.filesystem =
+        serde_json::from_value(json!([{"root":workspace,"mode":"write"}])).unwrap();
+    let interactions = Arc::new(PublicInteractionRouter::new(Arc::new(DenyApproval), None));
+    let runtime = Arc::new(
+        Runtime::open_with_options(
+            &runtime_config,
+            interactions.clone(),
+            Some(interactions.clone()),
+            RuntimeOpenOptions::for_workspace(&workspace).unwrap(),
+        )
+        .unwrap(),
+    );
+    let api = Arc::new(RuntimeAgentRunApi::new(
+        runtime.clone(),
+        interactions,
+        "primary",
+        "Perform the acceptance task.",
+    ));
+    let principal = ApplicationPrincipal::authenticated(
+        "app:cloud-acceptance",
+        "credential-acceptance",
+        ApplicationKind::Enrolled,
+        [
+            scopes::RUNS_EXECUTE,
+            scopes::RUNS_READ,
+            scopes::RUNS_CONTROL,
+            scopes::PROMPTS_RESPOND,
+            scopes::APPROVALS_RESPOND,
+        ]
+        .into_iter()
+        .map(|scope| ApiScope::new(scope).unwrap()),
+        ["primary".into()],
+        ["user.ask".into(), "filesystem.write".into()],
+    )
+    .unwrap();
+    let runs = Arc::new(ContextBoundAgentRunClient::new(
+        api,
+        CallerContext::authenticated(principal, RequestId::new("cloud-request").unwrap()),
+    ));
+    let (disconnect, close) = watch::channel(false);
+    let (status, mut online) = watch::channel(ConnectorStatus::Connecting);
+    let connector = RuntimeConnector::new(connection.clone(), key, runs.clone())
+        .unwrap()
+        .with_enrollment_store(enrollment.clone());
+    let connected = tokio::spawn(connector.run(close, status));
+    tokio::time::timeout(Duration::from_secs(5), async {
+        while *online.borrow() != ConnectorStatus::Connected {
+            online.changed().await.unwrap();
+        }
+    })
+    .await
+    .unwrap();
+    let create = |id: &str| json!({"node_id":connection.node_id,"request":{"plugin_skill_ids":[],"input":[{"text":"Acceptance task"}],"session_id":null,"end_user_id":null,"role":"primary","mode":"execute","research_depth":null,"research_sources":[],"plan_action":null,"branch":null,"max_turns":8,"idempotency_key":id}});
+    let allocated = post(
+        &client,
+        &origin,
+        &headers,
+        "/api/projects/project-a/tasks",
+        create("once"),
+    )
+    .await;
+    let id = allocated["task"]["task_id"].as_str().unwrap();
+    assert_eq!(
+        post(
+            &client,
+            &origin,
+            &headers,
+            "/api/projects/project-a/tasks",
+            create("once")
+        )
+        .await["task"]["task_id"],
+        id
+    );
+    for approval in [false, true] {
+        let task = wait_task(&client, &origin, &headers, id, |task| {
+            task.snapshot.as_ref().is_some_and(|snapshot| {
+                snapshot.pending_interactions.iter().any(|item| {
+                    item.status == InteractionStatus::Pending
+                        && matches!(item.content, InteractionContent::Approval(_)) == approval
+                })
+            })
+        })
+        .await;
+        let interaction = task
+            .snapshot
+            .unwrap()
+            .pending_interactions
+            .into_iter()
+            .find(|item| {
+                item.status == InteractionStatus::Pending
+                    && matches!(item.content, InteractionContent::Approval(_)) == approval
+            })
+            .unwrap();
+        assert!(!workspace.join("approved.txt").exists());
+        let answer = match &interaction.content {
+            InteractionContent::UserPrompt(prompt) => {
+                assert!(!approval);
+                json!({"prompt":{"choice":{"choice_id":prompt.choices[0].choice_id,"label":prompt.choices[0].label}}})
+            }
+            InteractionContent::Approval(content) => {
+                assert!(approval);
+                json!({"approval":{"approved":true,"request_hash":content.request_hash}})
+            }
+        };
+        post(&client,&origin,&headers,&format!("/api/projects/project-a/tasks/{id}/respond"),json!({"mutation_id":format!("answer-{approval}"),"request":{"run_id":interaction.run_id,"interaction_id":interaction.interaction_id,"etag":interaction.etag,"response":answer,"idempotency_key":format!("answer-{approval}")}})).await;
+    }
+    let completed = wait_task(&client, &origin, &headers, id, |task| {
+        task.snapshot.as_ref().is_some_and(|snapshot| {
+            snapshot.run.status == RunStatus::Completed
+                && task.last_sequence == snapshot.run.last_sequence
+        })
+    })
+    .await;
+    assert_eq!(
+        std::fs::read_to_string(workspace.join("approved.txt")).unwrap(),
+        "cloud-approved"
+    );
+    let mut events = client
+        .get(format!(
+            "{origin}/api/projects/project-a/tasks/{id}/events?after=0"
+        ))
+        .headers(headers.clone())
+        .send()
+        .await
+        .unwrap();
+    let chunk = tokio::time::timeout(Duration::from_secs(3), events.chunk())
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert!(String::from_utf8_lossy(&chunk).contains("id: 1"));
+    drop(events);
+    let cancelled = post(
+        &client,
+        &origin,
+        &headers,
+        "/api/projects/project-a/tasks",
+        create("cancel-once"),
+    )
+    .await;
+    let cancel_id = cancelled["task"]["task_id"].as_str().unwrap();
+    wait_task(&client, &origin, &headers, cancel_id, |task| {
+        task.snapshot
+            .as_ref()
+            .is_some_and(|snapshot| !snapshot.pending_interactions.is_empty())
+    })
+    .await;
+    post(
+        &client,
+        &origin,
+        &headers,
+        &format!("/api/projects/project-a/tasks/{cancel_id}/cancel"),
+        json!({"mutation_id":"cancel-once"}),
+    )
+    .await;
+    wait_task(&client, &origin, &headers, cancel_id, |task| {
+        task.snapshot
+            .as_ref()
+            .is_some_and(|snapshot| snapshot.run.status == RunStatus::Cancelled)
+    })
+    .await;
+    disconnect.send_replace(true);
+    connected.await.unwrap().unwrap();
+    // The host commits rotation, but saving the returned leaf fails. Restart
+    // with the old leaf and persisted pending CSR; automatic renewal must replay.
+    vault.fail_write.store(2, Ordering::SeqCst);
+    assert!(enrollment.renew(true).await.is_err());
+    let (rotated, key) = enrollment.load().unwrap().unwrap();
+    assert_eq!(rotated.certificate_pem, connection.certificate_pem);
+    stop.send_replace(true);
+    tokio::time::timeout(Duration::from_secs(5), host)
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    let server = crate::server::CloudServer::with_store(config.clone(), cloud_store.clone())
+        .await
+        .unwrap();
+    let (stop, close) = watch::channel(false);
+    let browser = tokio::net::TcpListener::bind(config.http_bind)
+        .await
+        .unwrap();
+    let grpc = tokio::net::TcpListener::bind(config.grpc_bind)
+        .await
+        .unwrap();
+    let host = tokio::spawn(server.serve_listeners(browser, grpc, close));
+    let headers = sign_in(&client, &origin, &issuer).await;
+    let recovered = wait_task(&client, &origin, &headers, id, |task| {
+        task.last_sequence == completed.last_sequence
+    })
+    .await;
+    assert_eq!(recovered.run_id, completed.run_id);
+    let (disconnect, close) = watch::channel(false);
+    let (status, mut online) = watch::channel(ConnectorStatus::Connecting);
+    let connected = tokio::spawn(
+        RuntimeConnector::new(rotated.clone(), key, runs)
+            .unwrap()
+            .with_enrollment_store(enrollment.clone())
+            .run(close, status),
+    );
+    tokio::time::timeout(Duration::from_secs(5), async {
+        while *online.borrow() != ConnectorStatus::Connected {
+            online.changed().await.unwrap();
+        }
+    })
+    .await
+    .unwrap();
+    assert_ne!(
+        enrollment.load().unwrap().unwrap().0.certificate_pem,
+        connection.certificate_pem
+    );
+    // Keep this connector alive through a host restart. An authenticated peer
+    // that never completes HTTP/2 must not defeat the channel startup deadline.
+    stop.send_replace(true);
+    tokio::time::timeout(Duration::from_secs(5), host)
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    let listener = tokio::net::TcpListener::bind(config.grpc_bind)
+        .await
+        .unwrap();
+    let stalled_config = config.clone();
+    let (accepted, peer_accepted) = tokio::sync::oneshot::channel();
+    let stalled = tokio::spawn(async move {
+        use futures::StreamExt as _;
+        let ca = std::fs::read_to_string(&stalled_config.ca_certificate).unwrap();
+        let mut incoming = Box::pin(crate::tls::incoming(listener, &stalled_config, &ca).unwrap());
+        let peer = incoming.next().await.unwrap().unwrap();
+        accepted.send(()).unwrap();
+        std::future::pending::<()>().await;
+        drop(peer);
+    });
+    tokio::time::timeout(Duration::from_secs(10), peer_accepted)
+        .await
+        .unwrap()
+        .unwrap();
+    drop(online.borrow_and_update());
+    tokio::time::timeout(Duration::from_secs(12), online.changed())
+        .await
+        .expect("authenticated HTTP/2 stall must leave channel startup")
+        .unwrap();
+    assert_eq!(*online.borrow(), ConnectorStatus::Reconnecting);
+    stalled.abort();
+    assert!(stalled.await.unwrap_err().is_cancelled());
+    let server = crate::server::CloudServer::with_store(config.clone(), cloud_store.clone())
+        .await
+        .unwrap();
+    let (stop, close) = watch::channel(false);
+    let browser = tokio::net::TcpListener::bind(config.http_bind)
+        .await
+        .unwrap();
+    let grpc = tokio::net::TcpListener::bind(config.grpc_bind)
+        .await
+        .unwrap();
+    let host = tokio::spawn(server.serve_listeners(browser, grpc, close));
+    tokio::time::timeout(Duration::from_secs(10), async {
+        while *online.borrow() != ConnectorStatus::Connected {
+            online.changed().await.unwrap();
+        }
+    })
+    .await
+    .expect("same connector recovers after channel startup timeout");
+    let headers = sign_in(&client, &origin, &issuer).await;
+    let retained = wait_task(&client, &origin, &headers, id, |_| true).await;
+    assert_eq!(retained.run_id, completed.run_id);
+    assert_eq!(retained.last_sequence, completed.last_sequence);
+    let fleet: Value = client
+        .get(format!("{origin}/api/projects/project-a/nodes"))
+        .headers(headers.clone())
+        .send()
+        .await
+        .unwrap()
+        .json()
+        .await
+        .unwrap();
+    let node = &fleet["nodes"][0]["node"];
+    post(
+        &client,
+        &origin,
+        &headers,
+        &format!("/api/projects/project-a/nodes/{}/revoke", rotated.node_id),
+        json!({"revision":node["revision"]}),
+    )
+    .await;
+    assert!(
+        tokio::time::timeout(Duration::from_secs(5), connected)
+            .await
+            .unwrap()
+            .unwrap()
+            .is_err()
+    );
+    assert_eq!(*online.borrow(), ConnectorStatus::Revoked);
+    // A native acknowledgement lost after host revocation remains replayable.
+    enrollment.revoke().await.unwrap();
+    enrollment.revoke().await.unwrap();
+    assert!(enrollment.load().unwrap().unwrap().0.revoked);
+    drop(disconnect);
+    stop.send_replace(true);
+    host.await.unwrap().unwrap();
+    model.abort();
+    oidc.abort();
+}
diff --git a/crates/colossus-cloud-server/src/auth/tests/transport/managed.rs b/crates/colossus-cloud-server/src/auth/tests/transport/managed.rs
new file mode 100644
index 000000000..dd564c871
--- /dev/null
+++ b/crates/colossus-cloud-server/src/auth/tests/transport/managed.rs
@@ -0,0 +1,283 @@
+//! Browser-to-native-sidecar acceptance and application-exit connection semantics.
+use super::*;
+use colossus_sdk::{
+    ApiMajor, AppPrivateInstanceDir, Colossus, GetRunRequest, InstanceId, ManagedAccessProfile,
+    ManagedRuntimeConfig, NativeSidecarLifecycle, Sha256Digest, SidecarApplicationGrant,
+    SidecarApprovalBrokerGrant, SidecarBootstrapConfig, SidecarOptions, VerifiedExecutable,
+};
+use std::{fs::File, io::Read as _};
+
+struct NativeKeys(uuid::Uuid);
+impl Drop for NativeKeys {
+    fn drop(&mut self) {
+        for account in [
+            format!("journal-key:journal-{}", self.0),
+            format!("signing-key:checkpoint-{}", self.0),
+            format!("journal-anchor:journal-{}", self.0),
+        ] {
+            delete_native_test_key(&account);
+        }
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn delete_native_test_key(account: &str) {
+    // The keyring delete implementation first reads the secret, which can open
+    // an access prompt for keys created by the sidecar. Delete only this test's
+    // UUID-scoped metadata, matching native_lifecycle's macOS cleanup.
+    let _ = std::process::Command::new("/usr/bin/security")
+        .env_clear()
+        .args([
+            "delete-generic-password",
+            "-s",
+            "com.obscuritylabs.colossus.managed-runtime",
+            "-a",
+            account,
+        ])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status();
+}
+
+#[cfg(not(target_os = "macos"))]
+fn delete_native_test_key(account: &str) {
+    if let Ok(entry) = keyring::Entry::new("com.obscuritylabs.colossus.managed-runtime", account) {
+        let _ = entry.delete_credential();
+    }
+}
+
+fn digest(path: &Path) -> [u8; 32] {
+    let mut file = File::open(path).unwrap();
+    let mut hash = Sha256::new();
+    let mut buffer = [0; 65_536];
+    loop {
+        let count = file.read(&mut buffer).unwrap();
+        if count == 0 {
+            break;
+        }
+        hash.update(&buffer[..count]);
+    }
+    hash.finalize().into()
+}
+
+#[tokio::test]
+#[ignore = "native credential store, loopback and COLOSSUS_ACCEPTANCE_SIDECAR required"]
+async fn managed_sidecar_cloud_run_isolated_and_application_exit_disconnects() {
+    let sidecar = std::fs::canonicalize(
+        std::env::var_os("COLOSSUS_ACCEPTANCE_SIDECAR").expect("prepared verified native sidecar"),
+    )
+    .unwrap();
+    let (auth, issuer, oidc) = fixture().await;
+    #[cfg(windows)]
+    let directory = tempfile::tempdir_in(std::env::var_os("USERPROFILE").unwrap()).unwrap();
+    #[cfg(not(windows))]
+    let directory = tempfile::tempdir().unwrap();
+    let root = directory.path().canonicalize().unwrap();
+    let home = ColossusHome::ensure_at(root.join("native")).unwrap();
+    let workspace = root.join("workspace");
+    std::fs::create_dir(&workspace).unwrap();
+    let instance_home =
+        ColossusHome::ensure_at(root.join("managed-local").join("a".repeat(64))).unwrap();
+    let instance = uuid::Uuid::now_v7();
+    let _keys = NativeKeys(instance);
+    let grant = |application, scopes: &[&str]| {
+        SidecarApplicationGrant::new(
+            application,
+            scopes.iter().map(|scope| ApiScope::new(*scope).unwrap()),
+            ["primary".into()],
+            Vec::<String>::new(),
+        )
+        .unwrap()
+    };
+    let bootstrap = SidecarBootstrapConfig::new(
+        &workspace,
+        ManagedRuntimeConfig::echo(ManagedAccessProfile::Minimal),
+        grant(
+            "app:desktop-cloud-acceptance",
+            &[
+                scopes::RUNS_EXECUTE,
+                scopes::RUNS_READ,
+                scopes::RUNS_CONTROL,
+                scopes::PROMPTS_RESPOND,
+            ],
+        ),
+    )
+    .unwrap()
+    .with_colossus_home(home.root())
+    .unwrap()
+    .with_approval_broker_grant(
+        SidecarApprovalBrokerGrant::new("app:desktop-cloud-acceptance", ["primary".into()])
+            .unwrap(),
+    )
+    .unwrap()
+    .with_connector_grant(grant(
+        "app:independent-cloud-acceptance",
+        &[
+            scopes::RUNS_EXECUTE,
+            scopes::RUNS_READ,
+            scopes::RUNS_CONTROL,
+            scopes::PROMPTS_RESPOND,
+            scopes::APPROVALS_RESPOND,
+        ],
+    ))
+    .unwrap();
+    let lifecycle = NativeSidecarLifecycle::new(bootstrap);
+    let desktop = Colossus::start_sidecar(
+        &lifecycle,
+        SidecarOptions::new(
+            InstanceId::from_uuid(instance),
+            AppPrivateInstanceDir::new(instance_home.root()).unwrap(),
+            VerifiedExecutable::new(&sidecar, Sha256Digest::from_bytes(digest(&sidecar))).unwrap(),
+            ApiMajor::new(1).unwrap(),
+        )
+        .unwrap(),
+    )
+    .await
+    .unwrap();
+    let runs = desktop
+        .connector_runs()
+        .expect("separate native cloud grant");
+    let browser = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let grpc = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let mut config = auth.config.clone();
+    config.http_bind = browser.local_addr().unwrap();
+    config.grpc_bind = grpc.local_addr().unwrap();
+    config.public_origin = format!("http://{}", config.http_bind);
+    config.grpc_endpoint = format!("https://localhost:{}", config.grpc_bind.port());
+    config.memberships[0]
+        .permissions
+        .insert(CloudPermission::Administer);
+    tls_files(&root, &mut config);
+    drop(auth);
+    let origin = config.public_origin.clone();
+    let server = crate::server::CloudServer::with_store(
+        config,
+        Arc::new(colossus_cloud::storage::MemoryCloudStore::default()),
+    )
+    .await
+    .unwrap();
+    let (stop, shutdown) = watch::channel(false);
+    let host = tokio::spawn(server.serve_listeners(browser, grpc, shutdown));
+    let browser_client = reqwest::Client::builder()
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .unwrap();
+    let headers = sign_in(&browser_client, &origin, &issuer).await;
+    let invitation = post(
+        &browser_client,
+        &origin,
+        &headers,
+        "/api/projects/project-a/invitations",
+        json!({"label":"Managed Local", "roles":["primary"]}),
+    )
+    .await;
+    let vault = Arc::new(
+        PlatformCredentialVault::with_key_store(
+            home.confined_root().clone(),
+            "managed-cloud-acceptance",
+            Arc::new(TestKeys::default()),
+        )
+        .unwrap(),
+    );
+    let enrollment = EnrollmentStore::new(vault, "managed-local").unwrap();
+    let config = enrollment
+        .enroll(
+            invitation["enrollment_url"].as_str().unwrap().into(),
+            Zeroizing::new(invitation["token"].as_str().unwrap().into()),
+            desktop.instance_id().unwrap().to_string(),
+            vec![],
+            true,
+        )
+        .await
+        .unwrap();
+    let (_, key) = enrollment.load().unwrap().unwrap();
+    let (_disconnect, close) = watch::channel(false);
+    let (status, mut online) = watch::channel(ConnectorStatus::Connecting);
+    let connector = tokio::spawn(
+        RuntimeConnector::new(config.clone(), key, runs)
+            .unwrap()
+            .with_enrollment_store(enrollment.clone())
+            .run(close, status),
+    );
+    tokio::time::timeout(Duration::from_secs(10), async {
+        while *online.borrow() != ConnectorStatus::Connected {
+            online.changed().await.unwrap();
+        }
+    })
+    .await
+    .unwrap();
+    let allocated = post(&browser_client, &origin, &headers, "/api/projects/project-a/tasks",
+        json!({"node_id":config.node_id,"request":{"plugin_skill_ids":[],"input":[{"text":"Native Desktop cloud acceptance"}],"session_id":null,"end_user_id":null,"role":"primary","mode":"execute","research_depth":null,"research_sources":[],"plan_action":null,"branch":null,"max_turns":1,"idempotency_key":"native-desktop-cloud-task"}})).await;
+    let task_id = allocated["task"]["task_id"].as_str().unwrap();
+    let completed = wait_task(&browser_client, &origin, &headers, task_id, |task| {
+        task.snapshot.as_ref().is_some_and(|snapshot| {
+            snapshot.run.status == RunStatus::Completed
+                && task.last_sequence == snapshot.run.last_sequence
+        })
+    })
+    .await;
+    let run_id = completed.run_id.unwrap();
+    assert!(
+        completed.last_sequence > 0 && completed.released_bytes > 0,
+        "released native output reaches the browser"
+    );
+    let mut events = browser_client
+        .get(format!(
+            "{origin}/api/projects/project-a/tasks/{task_id}/events?after=0"
+        ))
+        .headers(headers.clone())
+        .send()
+        .await
+        .unwrap();
+    let chunk = tokio::time::timeout(Duration::from_secs(3), events.chunk())
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert!(String::from_utf8_lossy(&chunk).contains("id: 1"));
+    drop(events);
+    assert!(
+        desktop
+            .get_run(GetRunRequest {
+                run_id: run_id.clone()
+            })
+            .await
+            .is_err(),
+        "Desktop primary cannot inherit cloud application runs"
+    );
+    // Closing the application-owned SDK lifetime must take its cloud connection
+    // offline, even while the connector task and enrollment remain alive.
+    desktop.close().await.unwrap();
+    tokio::time::timeout(Duration::from_secs(10), connector)
+        .await
+        .unwrap()
+        .unwrap()
+        .unwrap();
+    assert_eq!(*online.borrow(), ConnectorStatus::Disconnected);
+    tokio::time::timeout(Duration::from_secs(5), async {
+        loop {
+            let fleet: Value = browser_client
+                .get(format!("{origin}/api/projects/project-a/nodes"))
+                .headers(headers.clone())
+                .send()
+                .await
+                .unwrap()
+                .json()
+                .await
+                .unwrap();
+            if fleet["nodes"][0]["presence"].is_null() {
+                break;
+            }
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+    })
+    .await
+    .expect("application exit removes cloud readiness");
+    let retained = wait_task(&browser_client, &origin, &headers, task_id, |_| true).await;
+    assert_eq!(retained.run_id.as_deref(), Some(run_id.as_str()));
+    enrollment.revoke().await.unwrap();
+    enrollment.forget().unwrap();
+    stop.send_replace(true);
+    host.await.unwrap().unwrap();
+    oidc.abort();
+}
diff --git a/crates/colossus-cloud-server/src/bin/colossus-control-plane.rs b/crates/colossus-cloud-server/src/bin/colossus-control-plane.rs
new file mode 100644
index 000000000..a185aa277
--- /dev/null
+++ b/crates/colossus-cloud-server/src/bin/colossus-control-plane.rs
@@ -0,0 +1,5 @@
+//! Colossus Control Plane server entry point.
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    colossus_cloud_server::cli::run().await
+}
diff --git a/crates/colossus-cloud-server/src/certificates.rs b/crates/colossus-cloud-server/src/certificates.rs
new file mode 100644
index 000000000..946d21136
--- /dev/null
+++ b/crates/colossus-cloud-server/src/certificates.rs
@@ -0,0 +1,42 @@
+use crate::config::Config;
+use rcgen::{
+    CertificateParams, CertificateSigningRequestParams, ExtendedKeyUsagePurpose, Issuer, KeyPair,
+};
+use sha2::{Digest, Sha256};
+use time::{Duration, OffsetDateTime};
+use zeroize::Zeroizing;
+
+pub(crate) struct CertificateAuthority {
+    issuer: Issuer<'static, KeyPair>,
+    pub pem: String,
+}
+impl CertificateAuthority {
+    pub fn load(config: &Config) -> Result<Self, &'static str> {
+        let pem = std::fs::read_to_string(&config.ca_certificate)
+            .map_err(|_| "cannot load connector CA")?;
+        let key = Zeroizing::new(
+            std::fs::read_to_string(&config.ca_key).map_err(|_| "cannot load connector CA key")?,
+        );
+        let issuer =
+            Issuer::from_ca_cert_pem(&pem, KeyPair::from_pem(&key).map_err(|_| "invalid CA key")?)
+                .map_err(|_| "invalid CA certificate")?;
+        Ok(Self { issuer, pem })
+    }
+    pub fn sign(&self, csr: &str) -> Result<(String, String), &'static str> {
+        if csr.len() > 16384 {
+            return Err("invalid certificate request");
+        }
+        let mut request = CertificateSigningRequestParams::from_pem(csr)
+            .map_err(|_| "invalid certificate request")?;
+        // The host supplies all extensions; an untrusted CSR cannot obtain CA authority.
+        let now = OffsetDateTime::now_utc();
+        request.params = CertificateParams::default();
+        request.params.not_before = now - Duration::minutes(5);
+        request.params.not_after = now + Duration::days(30);
+        request.params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ClientAuth];
+        let cert = request
+            .signed_by(&self.issuer)
+            .map_err(|_| "cannot issue client certificate")?;
+        Ok((cert.pem(), hex::encode(Sha256::digest(cert.der()))))
+    }
+}
diff --git a/crates/colossus-cloud-server/src/cli.rs b/crates/colossus-cloud-server/src/cli.rs
new file mode 100644
index 000000000..2d50a3c2a
--- /dev/null
+++ b/crates/colossus-cloud-server/src/cli.rs
@@ -0,0 +1,68 @@
+//! Kubernetes control-plane entry point. Configuration contains secret references only.
+use crate::{config::Config, migration, server::ControlPlaneServer};
+/// Run the canonical entry point; the former server binary remains a compatibility alias.
+pub async fn run() -> Result<(), Box<dyn std::error::Error>> {
+    let mut arguments = std::env::args_os().skip(1);
+    let path = arguments.next().ok_or(
+        "usage: colossus-control-plane CONFIG.json | migrate-journal LEGACY_CONFIG.json CONFIG.json",
+    )?;
+    if path == "--help" || path == "-h" {
+        println!(
+            "Colossus Control Plane\nUsage: colossus-control-plane CONFIG.json\n       colossus-control-plane migrate-journal LEGACY_CONFIG.json CONFIG.json"
+        );
+        return Ok(());
+    }
+    if path == "--version" || path == "-V" {
+        println!("Colossus Control Plane {}", env!("CARGO_PKG_VERSION"));
+        return Ok(());
+    }
+    if path == "migrate-journal" {
+        let legacy = arguments
+            .next()
+            .ok_or("migration requires legacy and target configuration paths")?;
+        let target = arguments
+            .next()
+            .ok_or("migration requires target configuration path")?;
+        if arguments.next().is_some() {
+            return Err("unexpected migration arguments".into());
+        }
+        let config: Config = serde_json::from_slice(&std::fs::read(target)?)?;
+        let report = migration::migrate_journal(std::path::Path::new(&legacy), &config).await?;
+        println!(
+            "Imported {} entities and {} released events from verified sequence {} across {} projects.",
+            report.entities,
+            report.released_events,
+            report.source_sequence,
+            report.projects.len()
+        );
+        return Ok(());
+    }
+    if arguments.next().is_some() {
+        return Err("unexpected control-plane server arguments".into());
+    }
+    let config: Config = serde_json::from_slice(&std::fs::read(path)?)?;
+    let server = ControlPlaneServer::open(config).await?;
+    let (sender, receiver) = tokio::sync::watch::channel(false);
+    tokio::spawn(async move {
+        shutdown_signal().await;
+        let _ = sender.send(true);
+    });
+    server.serve(receiver).await?;
+    Ok(())
+}
+
+async fn shutdown_signal() {
+    #[cfg(unix)]
+    {
+        if let Ok(mut signal) =
+            tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
+        {
+            tokio::select! {
+                _ = tokio::signal::ctrl_c() => {},
+                _ = signal.recv() => {},
+            }
+            return;
+        }
+    }
+    let _ = tokio::signal::ctrl_c().await;
+}
diff --git a/crates/colossus-cloud-server/src/config.rs b/crates/colossus-cloud-server/src/config.rs
new file mode 100644
index 000000000..ce3c65418
--- /dev/null
+++ b/crates/colossus-cloud-server/src/config.rs
@@ -0,0 +1,259 @@
+use colossus_cloud::CloudPermission;
+use colossus_cloud_postgres::{CloudDatabaseConfig, CloudDatabaseTls};
+use serde::{Deserialize, Serialize};
+use std::{collections::BTreeSet, net::SocketAddr, path::PathBuf};
+
+/// Secret-reference-only control-plane host configuration.
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct Config {
+    /// HTTP listener; production terminates HTTPS at its trusted ingress.
+    pub http_bind: SocketAddr,
+    /// End-to-end TLS gRPC listener.
+    pub grpc_bind: SocketAddr,
+    /// Exact browser origin, also used for CSRF and OIDC callbacks.
+    pub public_origin: String,
+    /// Public outbound connector endpoint, always HTTPS.
+    pub grpc_endpoint: String,
+    /// PEM connector certificate authority.
+    pub ca_certificate: PathBuf,
+    /// PEM authority private key mounted from a Kubernetes Secret.
+    pub ca_key: PathBuf,
+    /// PEM server leaf, including its public chain.
+    pub server_certificate: PathBuf,
+    /// PEM server private key.
+    pub server_key: PathBuf,
+    /// OIDC discovery and relying-party configuration.
+    pub oidc: Option<OidcConfig>,
+    /// Local password authentication, disabled unless explicitly configured.
+    #[serde(default)]
+    pub local_auth: Option<LocalAuthConfig>,
+    /// One-time first-administrator provisioning; no default credential exists.
+    #[serde(default)]
+    pub bootstrap_admin: Option<BootstrapAdmin>,
+    /// Optional initial deployment marking; retained administrator edits take precedence.
+    #[serde(default)]
+    pub classification: Option<colossus_cloud::settings::ClassificationBanner>,
+    /// One-time legacy issuer-bound membership seeds; persisted roles are authoritative.
+    #[serde(default)]
+    pub memberships: Vec<Membership>,
+    /// Built web frontend directory served at the authenticated application origin.
+    pub web_root: PathBuf,
+    /// Dedicated cloud relational database and bounded asynchronous pool.
+    pub database: CloudDatabaseConfig,
+    /// Independent 32-byte OIDC-flow envelope key reference, required in production.
+    pub auth_key_variable: Option<String>,
+    /// Bounded operational cleanup; conversation history and audit are retained.
+    #[serde(default)]
+    pub maintenance: colossus_cloud::storage::CloudMaintenancePolicy,
+    /// Allow HTTP origins and plaintext state only on loopback for local acceptance.
+    #[serde(default)]
+    pub local_development: bool,
+}
+/// OIDC authorization-code/PKCE sign-in configuration.
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct OidcConfig {
+    /// Human-readable sign-in provider name, never HTML.
+    #[serde(default = "default_oidc_label")]
+    pub label: String,
+    /// Exact trusted issuer; discovered metadata must match it.
+    pub issuer: String,
+    /// Registered relying-party client identity.
+    pub client_id: String,
+    /// Optional mounted confidential-client secret.
+    pub client_secret_file: Option<PathBuf>,
+}
+fn default_oidc_label() -> String {
+    "OpenID Connect".into()
+}
+/// Explicit local-authentication deployment switch.
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LocalAuthConfig {
+    /// Default session duration, constrained to five minutes through eight hours.
+    #[serde(default = "default_session_seconds")]
+    pub session_seconds: u64,
+}
+fn default_session_seconds() -> u64 {
+    8 * 60 * 60
+}
+/// Administrator bootstrap, used only while no persisted global administrator exists.
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct BootstrapAdmin {
+    /// Initial administrator display name.
+    pub display_name: String,
+    /// Optional display-only contact address.
+    pub email: Option<String>,
+    /// Explicit issuer-bound subject under the configured provider.
+    pub oidc_subject: Option<String>,
+    /// Optional canonical local-login username.
+    pub username: Option<String>,
+    /// Reference to a one-time password secret; password values never enter config.
+    pub password_variable: Option<String>,
+}
+/// One explicitly configured authenticated project membership.
+#[derive(Clone, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct Membership {
+    /// OIDC subject under the single configured issuer.
+    pub subject: String,
+    /// Project namespace.
+    pub project_id: String,
+    /// Independent cloud permissions.
+    pub permissions: BTreeSet<CloudPermission>,
+}
+impl Config {
+    /// Validate origins and namespaces before network or credential access.
+    pub fn validate(&self) -> Result<(), &'static str> {
+        let origin = url::Url::parse(&self.public_origin).map_err(|_| "invalid public origin")?;
+        let endpoint = url::Url::parse(&self.grpc_endpoint).map_err(|_| "invalid gRPC endpoint")?;
+        let issuer = self
+            .oidc
+            .as_ref()
+            .map(|oidc| url::Url::parse(&oidc.issuer).map_err(|_| "invalid OIDC issuer"))
+            .transpose()?;
+        let loopback =
+            |url: &url::Url| matches!(url.host_str(), Some("localhost" | "127.0.0.1" | "[::1]"));
+        if endpoint.scheme() != "https"
+            || endpoint.path() != "/"
+            || !endpoint.username().is_empty()
+            || endpoint.password().is_some()
+            || endpoint.query().is_some()
+            || endpoint.fragment().is_some()
+            || issuer.as_ref().is_some_and(|issuer| {
+                !issuer.username().is_empty()
+                    || issuer.password().is_some()
+                    || issuer.query().is_some()
+                    || issuer.fragment().is_some()
+            })
+            || !matches!(origin.scheme(), "http" | "https")
+            || issuer
+                .as_ref()
+                .is_some_and(|issuer| !matches!(issuer.scheme(), "http" | "https"))
+            || origin.path() != "/"
+            || origin.query().is_some()
+            || origin.fragment().is_some()
+            || !origin.username().is_empty()
+            || origin.password().is_some()
+        {
+            return Err("invalid cloud origin");
+        }
+        if self.local_development {
+            if !self.http_bind.ip().is_loopback()
+                || !self.grpc_bind.ip().is_loopback()
+                || !loopback(&origin)
+                || issuer.as_ref().is_some_and(|issuer| !loopback(issuer))
+                || !loopback(&endpoint)
+            {
+                return Err("local development requires loopback endpoints");
+            }
+        } else if origin.scheme() != "https"
+            || issuer
+                .as_ref()
+                .is_some_and(|issuer| issuer.scheme() != "https")
+        {
+            return Err("production requires HTTPS authentication endpoints");
+        }
+        if !self.local_development && matches!(&self.database.tls, CloudDatabaseTls::Disabled) {
+            return Err("production PostgreSQL requires verified TLS");
+        }
+        if self.oidc.is_none() && self.local_auth.is_none() {
+            return Err("configure an OIDC provider or explicit local authentication");
+        }
+        if let Some(marking) = &self.classification {
+            marking
+                .validate()
+                .map_err(|_| "invalid deployment marking")?;
+        }
+        if self.oidc.as_ref().is_some_and(|oidc| {
+            oidc.client_id.is_empty()
+                || oidc.client_id.len() > 256
+                || oidc.label.trim().is_empty()
+                || oidc.label.len() > 128
+                || oidc.label.chars().any(char::is_control)
+        }) {
+            return Err("invalid OIDC provider");
+        }
+        if self
+            .local_auth
+            .as_ref()
+            .is_some_and(|local| !(300..=8 * 60 * 60).contains(&local.session_seconds))
+        {
+            return Err("invalid local session duration");
+        }
+        if let Some(bootstrap) = &self.bootstrap_admin {
+            if bootstrap.display_name.trim().is_empty()
+                || bootstrap.display_name.len() > 256
+                || bootstrap.display_name.chars().any(char::is_control)
+                || bootstrap
+                    .email
+                    .as_ref()
+                    .is_some_and(|s| s.len() > 320 || s.chars().any(char::is_control))
+            {
+                return Err("invalid administrator metadata");
+            }
+            if bootstrap
+                .oidc_subject
+                .as_ref()
+                .is_some_and(|s| s.is_empty() || s.len() > 256 || s.chars().any(char::is_control))
+                || bootstrap.oidc_subject.is_some() && self.oidc.is_none()
+            {
+                return Err("invalid administrator provider identity");
+            }
+            if let Some(username) = &bootstrap.username {
+                colossus_cloud::normalize_username(username)
+                    .map_err(|_| "invalid administrator username")?;
+                if self.local_auth.is_none()
+                    || bootstrap.password_variable.as_ref().is_none_or(|s| {
+                        s.is_empty()
+                            || s.len() > 128
+                            || !s.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_')
+                    })
+                {
+                    return Err("administrator local login requires a secret reference");
+                }
+            } else if bootstrap.password_variable.is_some() {
+                return Err("administrator password requires a username");
+            }
+            if bootstrap.username.is_none() && bootstrap.oidc_subject.is_none() {
+                return Err("administrator requires a login identity");
+            }
+        }
+        if self.memberships.len() > 1024 || (!self.memberships.is_empty() && self.oidc.is_none()) {
+            return Err("invalid project memberships");
+        }
+        for member in &self.memberships {
+            if member.project_id.starts_with("__") {
+                return Err("reserved project namespace");
+            }
+            colossus_cloud::CloudCaller::new(
+                member.subject.clone(),
+                member.project_id.clone(),
+                member.permissions.clone(),
+            )
+            .map_err(|_| "invalid membership")?;
+        }
+        let unique: BTreeSet<_> = self
+            .memberships
+            .iter()
+            .map(|membership| (&membership.subject, &membership.project_id))
+            .collect();
+        if unique.len() != self.memberships.len() {
+            return Err("duplicate project membership");
+        }
+        if !(1..=1024).contains(&self.maintenance.batch_limit)
+            || !(60..=30 * 86400).contains(&self.maintenance.delivered_outbox_retention_seconds)
+        {
+            return Err("invalid cloud maintenance policy");
+        }
+        self.database
+            .validate()
+            .map_err(|_| "invalid cloud database configuration")?;
+        if !self.local_development && self.oidc.is_some() && self.auth_key_variable.is_none() {
+            return Err("production requires an OIDC-flow encryption key reference");
+        }
+        Ok(())
+    }
+}
diff --git a/crates/colossus-cloud-server/src/connection.rs b/crates/colossus-cloud-server/src/connection.rs
new file mode 100644
index 000000000..1785b0f83
--- /dev/null
+++ b/crates/colossus-cloud-server/src/connection.rs
@@ -0,0 +1,497 @@
+use crate::server::{NodePresence, State, db};
+use colossus_cloud::{CloudError, CloudNode};
+use colossus_cloud_protocol::{
+    Command, MAX_PAYLOAD_BYTES, MAX_QUEUED_FRAMES, PROTOCOL_MAJOR, decode, decode_update, encode,
+    v1alpha1::{
+        self as wire, control_frame,
+        runtime_connection_server::{RuntimeConnection, RuntimeConnectionServer},
+        runtime_frame,
+    },
+};
+use sha2::{Digest, Sha256};
+use std::{
+    collections::HashSet,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+use tokio::sync::mpsc;
+use tokio_stream::wrappers::ReceiverStream;
+use tonic::{
+    Request, Response, Status, Streaming,
+    transport::server::{TcpConnectInfo, TlsConnectInfo},
+};
+
+pub(crate) fn service(state: Arc<State>) -> RuntimeConnectionServer<Connection> {
+    RuntimeConnectionServer::new(Connection(state))
+        .max_decoding_message_size(MAX_PAYLOAD_BYTES + 16384)
+        .max_encoding_message_size(MAX_PAYLOAD_BYTES + 16384)
+}
+pub(crate) struct Connection(Arc<State>);
+#[tonic::async_trait]
+impl RuntimeConnection for Connection {
+    type ConnectStream = ReceiverStream<Result<wire::ControlFrame, Status>>;
+    async fn revoke_enrollment(
+        &self,
+        request: Request<wire::EnrollmentIdentity>,
+    ) -> Result<Response<wire::EnrollmentRevoked>, Status> {
+        let fingerprint = peer_fingerprint(&request)?;
+        let input = request.into_inner();
+        db(self.0.repo.clone(), move |repo| async move {
+            repo.revoke_own_node(
+                &input.project_id,
+                &input.node_id,
+                &fingerprint,
+                &input.instance_id,
+            )
+            .await
+        })
+        .await
+        .map_err(status)?;
+        Ok(Response::new(wire::EnrollmentRevoked {}))
+    }
+    async fn renew_certificate(
+        &self,
+        request: Request<wire::CertificateRenewal>,
+    ) -> Result<Response<wire::RenewedCertificate>, Status> {
+        let fingerprint = peer_fingerprint(&request)?;
+        let input = request.into_inner();
+        let (pem, fingerprint_new) = self
+            .0
+            .ca
+            .sign(&input.csr_pem)
+            .map_err(|_| Status::invalid_argument("invalid certificate request"))?;
+        let certificate = colossus_cloud::CertificateRedemption {
+            fingerprint: fingerprint_new,
+            csr_sha256: hex::encode(Sha256::digest(input.csr_pem.as_bytes())),
+            certificate_pem: pem,
+        };
+        let certificate_pem = db(self.0.repo.clone(), move |repo| async move {
+            repo.renew_certificate(
+                colossus_cloud::RenewalIdentity {
+                    project_id: &input.project_id,
+                    node_id: &input.node_id,
+                    instance_id: &input.instance_id,
+                    previous_fingerprint: &fingerprint,
+                    renewal_id: &input.renewal_id,
+                },
+                certificate,
+                crate::http::now(),
+            )
+            .await
+        })
+        .await
+        .map_err(status)?;
+        Ok(Response::new(wire::RenewedCertificate { certificate_pem }))
+    }
+    async fn connect(
+        &self,
+        request: Request<Streaming<wire::RuntimeFrame>>,
+    ) -> Result<Response<Self::ConnectStream>, Status> {
+        let fingerprint = peer_fingerprint(&request)?;
+        let mut inbound = request.into_inner();
+        let first = tokio::time::timeout(Duration::from_secs(10), inbound.message())
+            .await
+            .map_err(|_| Status::deadline_exceeded("hello timeout"))??
+            .ok_or_else(|| Status::invalid_argument("hello required"))?;
+        let Some(runtime_frame::Body::Hello(hello)) = first.body else {
+            return Err(Status::invalid_argument("hello required"));
+        };
+        if hello.protocol_major != PROTOCOL_MAJOR
+            || hello.capabilities.len() > 64
+            || hello
+                .capabilities
+                .iter()
+                .any(|cap| cap.is_empty() || cap.len() > 128 || cap.chars().any(char::is_control))
+        {
+            return Err(Status::failed_precondition(
+                "incompatible protocol or capabilities",
+            ));
+        }
+        let node = db(self.0.repo.clone(), {
+            let hello = hello.clone();
+            move |repo| async move {
+                repo.authenticate_node(
+                    &hello.project_id,
+                    &hello.node_id,
+                    &fingerprint,
+                    &hello.instance_id,
+                )
+                .await
+            }
+        })
+        .await
+        .map_err(status)?;
+        let inventory = if hello.inventory_json.is_empty() {
+            None
+        } else {
+            let inventory: colossus_cloud_protocol::RuntimeInventory =
+                decode(&hello.inventory_json)
+                    .map_err(|_| Status::invalid_argument("invalid runtime inventory"))?;
+            inventory
+                .validate()
+                .map_err(|_| Status::invalid_argument("invalid runtime inventory"))?;
+            Some(inventory)
+        };
+        let discovery_enabled = inventory.is_some();
+        let connection_id = format!("{}-{}", self.0.replica_id, uuid::Uuid::now_v7().simple());
+        let key = format!("{}:{}", node.project_id, node.node_id);
+        let lease = self
+            .0
+            .repo
+            .storage()
+            .claim_lease(
+                &node.project_id,
+                &node.node_id,
+                &connection_id,
+                crate::http::now(),
+                30,
+            )
+            .await
+            .map_err(status)?;
+        let prepared = async {
+            let node = if let Some(inventory) = inventory {
+                tokio::time::timeout(
+                    Duration::from_secs(5),
+                    self.0.repo.with_lease(lease.clone()).register_inventory(
+                        &node,
+                        inventory,
+                        crate::http::now(),
+                    ),
+                )
+                .await
+                .map_err(|_| Status::deadline_exceeded("inventory initialization timeout"))?
+                .map_err(status)?
+            } else {
+                node
+            };
+            {
+                let mut presence = self
+                    .0
+                    .presence
+                    .lock()
+                    .map_err(|_| Status::unavailable("presence unavailable"))?;
+                // The committed claim already fenced any expired previous owner.
+                if presence.len() >= 1024 && !presence.contains_key(&key) {
+                    return Err(Status::resource_exhausted("node connection limit"));
+                }
+                presence.insert(
+                    key.clone(),
+                    NodePresence {
+                        connection_id: connection_id.clone(),
+                        ready: false,
+                        capabilities: hello.capabilities,
+                        heartbeat: Some(Instant::now()),
+                    },
+                );
+            }
+            let (sender, receiver) = mpsc::channel(MAX_QUEUED_FRAMES);
+            sender
+                .send(Ok(wire::ControlFrame {
+                    body: Some(control_frame::Body::Welcome(wire::ConnectionWelcome {
+                        protocol_major: PROTOCOL_MAJOR,
+                        connection_id: connection_id.clone(),
+                    })),
+                }))
+                .await
+                .map_err(|_| Status::cancelled("connection closed"))?;
+            Ok::<_, Status>((node, sender, receiver))
+        }
+        .await;
+        let (node, sender, receiver) = match prepared {
+            Ok(prepared) => prepared,
+            Err(error) => {
+                let _ = self.0.repo.storage().release_lease(&lease).await;
+                if let Ok(mut presence) = self.0.presence.lock()
+                    && presence
+                        .get(&key)
+                        .is_some_and(|entry| entry.connection_id == connection_id)
+                {
+                    presence.remove(&key);
+                }
+                return Err(error);
+            }
+        };
+        let state = self.0.clone();
+        tokio::spawn(async move {
+            let result = serve_connection(
+                state.clone(),
+                ConnectionScope {
+                    node,
+                    key: key.clone(),
+                    generation: connection_id.clone(),
+                    lease: lease.clone(),
+                    discovery_enabled,
+                },
+                inbound,
+                &sender,
+            )
+            .await;
+            let _ = state.repo.storage().release_lease(&lease).await;
+            if let Ok(mut presence) = state.presence.lock()
+                && presence
+                    .get(&key)
+                    .is_some_and(|current| current.connection_id == connection_id)
+            {
+                presence.remove(&key);
+            }
+            if let Err(error) = result {
+                eprintln!("Runtime connection ended: {}", error.code());
+                let _ = sender.send(Err(error)).await;
+            }
+        });
+        Ok(Response::new(ReceiverStream::new(receiver)))
+    }
+}
+fn peer_fingerprint<T>(request: &Request<T>) -> Result<String, Status> {
+    let peer = request
+        .extensions()
+        .get::<TlsConnectInfo<TcpConnectInfo>>()
+        .and_then(TlsConnectInfo::peer_certs)
+        .and_then(|certificates| certificates.first().cloned())
+        .ok_or_else(|| Status::unauthenticated("client certificate required"))?;
+    Ok(hex::encode(Sha256::digest(peer.as_ref())))
+}
+struct ConnectionScope {
+    node: CloudNode,
+    key: String,
+    generation: String,
+    lease: colossus_cloud::storage::ConnectionLease,
+    discovery_enabled: bool,
+}
+async fn serve_connection(
+    state: Arc<State>,
+    scope: ConnectionScope,
+    mut inbound: Streaming<wire::RuntimeFrame>,
+    sender: &mpsc::Sender<Result<wire::ControlFrame, Status>>,
+) -> Result<(), Status> {
+    let ConnectionScope {
+        node,
+        key,
+        generation,
+        mut lease,
+        discovery_enabled,
+    } = scope;
+    let mut interval = tokio::time::interval(Duration::from_millis(500));
+    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+    let mut last_heartbeat = Instant::now();
+    let mut sent = HashSet::new();
+    let mut watched = HashSet::new();
+    let mut command_cursor: Option<String> = None;
+    let mut task_cursor: Option<String> = None;
+    let mut shutdown = state.shutdown.subscribe();
+    let mut hints = state.repo.storage().subscribe();
+    let mut discovery: Option<(String, String)> = None;
+    let mut last_discovery = Instant::now() - Duration::from_secs(30);
+    let mut visible_sessions = std::collections::BTreeMap::<String, bool>::new();
+    let mut last_presence = Instant::now();
+    let mut last_dispatch = Instant::now() - Duration::from_secs(1);
+    loop {
+        if *shutdown.borrow() {
+            return Ok(());
+        }
+        let repo = state.repo.with_lease(lease.clone());
+        tokio::select! {
+            _=shutdown.changed()=>return Ok(()),
+            frame=inbound.message()=>{
+                let frame=frame?.ok_or_else(||Status::cancelled("runtime disconnected"))?;
+                state.repo.storage().verify_lease(&lease,crate::http::now()).await.map_err(status)?;
+                match frame.body {
+                    Some(runtime_frame::Body::Heartbeat(heartbeat))=>{
+                        repo.authenticate_node(&node.project_id,&node.node_id,&node.certificate_sha256,&node.instance_id).await.map_err(status)?;
+                        lease=state.repo.storage().renew_lease(&lease,crate::http::now(),30).await.map_err(status)?;
+                        if !heartbeat.inventory_json.is_empty() {
+                            let inventory:colossus_cloud_protocol::RuntimeInventory=decode(&heartbeat.inventory_json).map_err(|_|Status::invalid_argument("invalid runtime inventory"))?;
+                            repo.register_inventory(&node,inventory,crate::http::now()).await.map_err(status)?;
+                            repo.heartbeat_node(&node,heartbeat.ready,crate::http::now()).await.map_err(status)?;
+                            last_presence=Instant::now();
+                        }
+                        last_heartbeat=Instant::now();
+                        {let mut presence=state.presence.lock().map_err(|_|Status::unavailable("presence unavailable"))?;
+                        let current=presence.get_mut(&key).filter(|current|current.connection_id==generation).ok_or_else(||Status::aborted("connection superseded"))?;
+                        current.ready=heartbeat.ready;current.heartbeat=Some(last_heartbeat);}
+                        if last_presence.elapsed()>Duration::from_secs(10){repo.heartbeat_node(&node,heartbeat.ready,crate::http::now()).await.map_err(status)?;last_presence=Instant::now();}
+                    },
+                    Some(runtime_frame::Body::Receipt(receipt))=>{
+                        let reply=decode(&receipt.reply_json).map_err(|_|Status::invalid_argument("invalid receipt"))?;
+                        repo.record_receipt(&node,&receipt.command_id,&receipt.task_id,reply).await.map_err(status)?;
+                    },
+                    Some(runtime_frame::Body::Snapshot(snapshot))=>{
+                        let snapshot_value=decode(&snapshot.snapshot_json).map_err(|_|Status::invalid_argument("invalid snapshot"))?;
+                        repo.record_snapshot(&node,&snapshot.task_id,snapshot_value).await.map_err(status)?;
+                    },
+                    Some(runtime_frame::Body::Event(event))=>{
+                        let update=decode_update(&event.update_json,&event.run_id,event.sequence).map_err(|_|Status::invalid_argument("invalid released event"))?;
+                        let sequence=repo.record_update(&node,&event.task_id,update).await.map_err(status)?;
+                        send(sender,control_frame::Body::Acknowledgement(wire::EventAcknowledgement{task_id:event.task_id,sequence})).await?;
+                    },
+                    Some(runtime_frame::Body::Discovery(page))=>{
+                        let Some((sync_id,page_token))=&discovery else{return Err(Status::invalid_argument("discovery was not requested"));};
+                        if page.sync_id!=*sync_id || page.page_token!=*page_token{return Err(Status::invalid_argument("discovery cursor does not match"));}
+                        let runs:Vec<colossus_cloud_protocol::ReleasedRunInventory>=decode(&page.runs_json).map_err(|_|Status::invalid_argument("invalid discovery page"))?;
+                        for entry in &runs {
+                            visible_sessions.entry(entry.run.session_id.clone()).and_modify(|allowed|*allowed|=entry.continuable).or_insert(entry.continuable);
+                            if visible_sessions.len()>16_384 {return Err(Status::resource_exhausted("workspace discovery session bound"));}
+                        }
+                        repo.discover_runs(&node,runs,&page.sync_id).await.map_err(status)?;
+                        // ACK is emitted only after all idempotent source mappings commit.
+                        send(sender,control_frame::Body::DiscoveryAcknowledgement(wire::DiscoveryAcknowledgement{sync_id:page.sync_id.clone(),page_token:page.page_token})).await?;
+                        if page.next_page_token.is_empty(){repo.finish_discovery(&node,&visible_sessions).await.map_err(status)?;discovery=None;last_discovery=Instant::now();visible_sessions.clear();}else{
+                            discovery=Some((page.sync_id.clone(),page.next_page_token.clone()));
+                            send(sender,control_frame::Body::Discover(wire::DiscoverRuns{sync_id:page.sync_id,page_token:page.next_page_token,page_size:colossus_cloud_protocol::MAX_DISCOVERY_PAGE_SIZE,include_archived:true})).await?;
+                        }
+                    },
+                    Some(runtime_frame::Body::OutputLimit(limit))=>{
+                        repo.record_output_limit(&node,&limit.task_id,&limit.run_id,limit.after_sequence).await.map_err(status)?;
+                        return Err(Status::resource_exhausted("released output retention limit"));
+                    },
+                    _=>return Err(Status::invalid_argument("unexpected runtime frame")),
+                }
+            },
+            _=interval.tick()=>{},
+            _=hints.recv()=>{},
+        }
+        if last_dispatch.elapsed() < Duration::from_millis(500) {
+            continue;
+        }
+        last_dispatch = Instant::now();
+        if last_heartbeat.elapsed() > Duration::from_secs(30) {
+            return Err(Status::deadline_exceeded("heartbeat expired"));
+        }
+        state
+            .repo
+            .storage()
+            .verify_lease(&lease, crate::http::now())
+            .await
+            .map_err(status)?;
+        if discovery_enabled
+            && discovery.is_none()
+            && last_discovery.elapsed() >= Duration::from_secs(15)
+        {
+            let sync_id = uuid::Uuid::now_v7().simple().to_string();
+            discovery = Some((sync_id.clone(), String::new()));
+            send(
+                sender,
+                control_frame::Body::Discover(wire::DiscoverRuns {
+                    sync_id,
+                    page_token: String::new(),
+                    page_size: colossus_cloud_protocol::MAX_DISCOVERY_PAGE_SIZE,
+                    include_archived: true,
+                }),
+            )
+            .await?;
+        }
+        let commands = repo
+            .commands(&node, command_cursor.as_deref(), 100)
+            .await
+            .map_err(status)?;
+        command_cursor = if commands.len() == 100 {
+            commands.last().map(|command| command.command_id.clone())
+        } else {
+            None
+        };
+        for command in commands {
+            if command.reply.is_none()
+                && !sent.contains(&command.command_id)
+                && repo
+                    .command_dispatchable(&node, &command)
+                    .await
+                    .map_err(status)?
+            {
+                if sent.len() >= 4096 {
+                    return Err(Status::resource_exhausted("connection command limit"));
+                }
+                let bytes = encode(&command.command)
+                    .map_err(|_| Status::invalid_argument("invalid command"))?;
+                state
+                    .repo
+                    .storage()
+                    .verify_lease(&lease, crate::http::now())
+                    .await
+                    .map_err(status)?;
+                send(
+                    sender,
+                    control_frame::Body::Command(wire::CloudCommand {
+                        command_id: command.command_id.clone(),
+                        task_id: command.task_id,
+                        command_json: bytes,
+                        after_sequence: 0,
+                    }),
+                )
+                .await?;
+                sent.insert(command.command_id);
+            }
+        }
+        let tasks = repo
+            .node_tasks(&node, task_cursor.as_deref(), 100)
+            .await
+            .map_err(status)?;
+        task_cursor = if tasks.len() == 100 {
+            tasks.last().map(|task| task.task_id.clone())
+        } else {
+            None
+        };
+        for task in tasks {
+            let Some(run_id) = task.run_id else {
+                continue;
+            };
+            let complete = task.snapshot.as_ref().is_some_and(|snapshot| {
+                snapshot.run.terminal.is_some()
+                    && (task.output_limited || task.last_sequence >= snapshot.run.last_sequence)
+            });
+            if complete {
+                watched.remove(&task.task_id);
+                continue;
+            }
+            if !watched.contains(&task.task_id)
+                && watched.len() < colossus_cloud_protocol::MAX_ACTIVE_TASKS.min(8)
+            {
+                let bytes = encode(&Command::Watch {
+                    run_id,
+                    snapshot_only: task.output_limited,
+                })
+                .map_err(|_| Status::invalid_argument("invalid watch"))?;
+                state
+                    .repo
+                    .storage()
+                    .verify_lease(&lease, crate::http::now())
+                    .await
+                    .map_err(status)?;
+                send(
+                    sender,
+                    control_frame::Body::Command(wire::CloudCommand {
+                        command_id: format!("watch-{}", task.task_id),
+                        task_id: task.task_id.clone(),
+                        command_json: bytes,
+                        after_sequence: task.last_sequence,
+                    }),
+                )
+                .await?;
+                watched.insert(task.task_id);
+            }
+        }
+    }
+}
+async fn send(
+    sender: &mpsc::Sender<Result<wire::ControlFrame, Status>>,
+    body: control_frame::Body,
+) -> Result<(), Status> {
+    tokio::time::timeout(
+        Duration::from_secs(10),
+        sender.send(Ok(wire::ControlFrame { body: Some(body) })),
+    )
+    .await
+    .map_err(|_| Status::resource_exhausted("connection backpressure deadline"))?
+    .map_err(|_| Status::cancelled("connection closed"))
+}
+fn status(error: CloudError) -> Status {
+    match error {
+        CloudError::PermissionDenied => {
+            Status::permission_denied("enrollment revoked or authority absent")
+        }
+        CloudError::InvalidArgument => Status::invalid_argument("invalid cloud frame"),
+        CloudError::NotFound => Status::not_found("allocation not found"),
+        CloudError::Conflict => Status::aborted("durable reconciliation conflict"),
+        CloudError::ResourceExhausted => Status::resource_exhausted("cloud resource bound"),
+        CloudError::Storage => Status::unavailable("cloud storage unavailable"),
+    }
+}
diff --git a/crates/colossus-cloud-server/src/http.rs b/crates/colossus-cloud-server/src/http.rs
new file mode 100644
index 000000000..353ef368f
--- /dev/null
+++ b/crates/colossus-cloud-server/src/http.rs
@@ -0,0 +1,819 @@
+use crate::server::{State, db};
+use axum::{
+    Json, Router,
+    extract::{DefaultBodyLimit, Path, Query, State as Extract},
+    http::{HeaderMap, StatusCode, header},
+    response::{
+        Html, IntoResponse, Redirect, Response,
+        sse::{Event, KeepAlive, Sse},
+    },
+    routing::{get, post},
+};
+use colossus_cloud::{CertificateRedemption, CloudError, Enrollment};
+use colossus_sdk::{CreateRunRequest, RespondInteractionRequest};
+use serde::Deserialize;
+use sha2::{Digest, Sha256};
+use std::{collections::BTreeSet, convert::Infallible, sync::Arc, time::Duration};
+
+mod spa;
+
+pub(crate) fn router(state: Arc<State>) -> Router {
+    Router::new().route("/health/live",get(||async{"ok"})).route("/health/ready",get(ready))
+        .route("/auth/login",get(login)).route("/auth/local",post(local_login)).route("/auth/callback",get(callback)).route("/auth/logout",post(logout))
+        .route("/api/auth/config",get(auth_configuration))
+        .route("/api/me",get(me)).route("/api/enroll",post(enroll))
+        .route("/api/projects/{project}/nodes",get(nodes)).route("/api/projects/{project}/invitations",post(invite))
+        .route("/api/projects/{project}/nodes/{node}",get(node_detail))
+        .route("/api/projects/{project}/nodes/{node}/revoke",post(revoke))
+        .route("/api/projects/{project}/hosts",get(hosts))
+        .route("/api/projects/{project}/workspaces",get(workspaces))
+        .route("/api/projects/{project}/threads",get(threads).post(create_thread))
+        .route("/api/projects/{project}/threads/{thread}",get(thread_detail).patch(edit_thread))
+        .route("/api/projects/{project}/threads/{thread}/messages",post(send_message))
+        .route("/api/projects/{project}/threads/{thread}/events",get(thread_events))
+        .route("/api/projects/{project}/tasks",get(tasks).post(create))
+        .route("/api/projects/{project}/tasks/{task}",get(task))
+        .route("/api/projects/{project}/tasks/{task}/commands/{command}",get(command))
+        .route("/api/projects/{project}/tasks/{task}/events",get(events))
+        .route("/api/projects/{project}/tasks/{task}/cancel",post(cancel))
+        .route("/api/projects/{project}/tasks/{task}/respond",post(respond))
+        .merge(crate::admin::router()).merge(crate::observability::router()).merge(crate::settings::router())
+        .fallback_service(spa::service(&state.config.web_root))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::if_not_present(header::HeaderName::from_static("x-content-type-options"), header::HeaderValue::from_static("nosniff")))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::if_not_present(header::HeaderName::from_static("referrer-policy"),header::HeaderValue::from_static("no-referrer")))
+        .layer(tower_http::set_header::SetResponseHeaderLayer::if_not_present(header::HeaderName::from_static("content-security-policy"),header::HeaderValue::from_static("default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'")))
+        .layer(DefaultBodyLimit::max(colossus_cloud_protocol::MAX_PAYLOAD_BYTES))
+        .layer(axum::middleware::from_fn_with_state(state.clone(), admission)).with_state(state)
+}
+async fn admission(
+    Extract(state): Extract<Arc<State>>,
+    request: axum::extract::Request,
+    next: axum::middleware::Next,
+) -> Response {
+    let Ok(_permit) = state.http_permits.clone().try_acquire_owned() else {
+        return Error(CloudError::ResourceExhausted).into_response();
+    };
+    let mut response = match tokio::time::timeout(Duration::from_secs(30), next.run(request)).await
+    {
+        Ok(response) => response,
+        Err(_) => Error(CloudError::Storage).into_response(),
+    };
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        header::HeaderValue::from_static("no-store"),
+    );
+    response
+}
+async fn ready(Extract(state): Extract<Arc<State>>) -> Result<&'static str> {
+    db(state.repo.clone(), |repo| async move {
+        repo.check_readiness().await
+    })
+    .await?;
+    Ok("ok")
+}
+pub(crate) struct Error(pub(crate) CloudError);
+impl From<CloudError> for Error {
+    fn from(error: CloudError) -> Self {
+        Self(error)
+    }
+}
+impl IntoResponse for Error {
+    fn into_response(self) -> Response {
+        let status = match self.0 {
+            CloudError::PermissionDenied => StatusCode::FORBIDDEN,
+            CloudError::NotFound => StatusCode::NOT_FOUND,
+            CloudError::Conflict => StatusCode::CONFLICT,
+            CloudError::ResourceExhausted => StatusCode::TOO_MANY_REQUESTS,
+            CloudError::InvalidArgument => StatusCode::BAD_REQUEST,
+            CloudError::Storage => StatusCode::SERVICE_UNAVAILABLE,
+        };
+        (
+            status,
+            [(header::CACHE_CONTROL, "no-store")],
+            Json(serde_json::json!({"error":self.0})),
+        )
+            .into_response()
+    }
+}
+pub(crate) type Result<T> = std::result::Result<T, Error>;
+async fn auth_configuration(
+    Extract(state): Extract<Arc<State>>,
+) -> Result<Json<serde_json::Value>> {
+    let mut value = state.auth.public_configuration();
+    value["classification"] =
+        serde_json::to_value(state.repo.display_settings().await?.classification)
+            .map_err(|_| CloudError::Storage)?;
+    Ok(Json(value))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct LocalLogin {
+    username: String,
+    password: String,
+}
+async fn local_login(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Json(input): Json<LocalLogin>,
+) -> Result<Response> {
+    let cookie = state
+        .auth
+        .local_login(
+            &headers,
+            input.username,
+            zeroize::Zeroizing::new(input.password),
+        )
+        .await?;
+    Ok(([(header::SET_COOKIE, cookie)], StatusCode::NO_CONTENT).into_response())
+}
+async fn login(Extract(state): Extract<Arc<State>>) -> Result<Response> {
+    let (url, cookie) = state.auth.login().await?;
+    let mut response = Redirect::temporary(&url).into_response();
+    response.headers_mut().insert(header::SET_COOKIE, cookie);
+    Ok(response)
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Callback {
+    state: String,
+    code: String,
+    #[serde(default)]
+    session_state: Option<String>,
+    #[serde(default)]
+    iss: Option<String>,
+}
+async fn callback(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    query: std::result::Result<Query<Callback>, axum::extract::rejection::QueryRejection>,
+) -> Response {
+    let Ok(Query(query)) = query else {
+        return sign_in_failed();
+    };
+    if query.iss.as_ref().is_some_and(|issuer| {
+        state
+            .config
+            .oidc
+            .as_ref()
+            .is_none_or(|provider| issuer != &provider.issuer)
+    }) {
+        return sign_in_failed();
+    }
+    let _ = query.session_state;
+    let cookie = match state
+        .auth
+        .callback(&headers, &query.state, query.code)
+        .await
+    {
+        Ok(cookie) => cookie,
+        Err(_) => return sign_in_failed(),
+    };
+    let mut response = Redirect::to("/").into_response();
+    response.headers_mut().insert(header::SET_COOKIE, cookie);
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        header::HeaderValue::from_static("no-store"),
+    );
+    response
+}
+fn sign_in_failed() -> Response {
+    (
+        StatusCode::FORBIDDEN,
+        Html(include_str!("sign-in-failed.html")),
+    )
+        .into_response()
+}
+async fn logout(Extract(state): Extract<Arc<State>>, headers: HeaderMap) -> Result<Response> {
+    let cookie = state.auth.logout(&headers).await?;
+    Ok(([(header::SET_COOKIE, cookie)], StatusCode::NO_CONTENT).into_response())
+}
+async fn me(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+) -> Result<Json<serde_json::Value>> {
+    Ok(Json(
+        serde_json::json!({"user":state.auth.user(&headers).await?,"memberships":state.auth.memberships(&headers).await?,"projects":state.auth.projects(&headers).await?}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Page {
+    after: Option<String>,
+    limit: Option<usize>,
+}
+async fn nodes(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let nodes = db(state.repo.clone(), move |repo| async move {
+        repo.list_nodes(&caller, page.after.as_deref(), page.limit.unwrap_or(100))
+            .await
+    })
+    .await?;
+    let local_presence = state
+        .presence
+        .lock()
+        .map_err(|_| CloudError::Storage)?
+        .clone();
+    let next_cursor = (nodes.len() == page.limit.unwrap_or(100).min(100))
+        .then(|| nodes.last().map(|node| node.node_id.clone()))
+        .flatten();
+    let mut fleet = Vec::with_capacity(nodes.len());
+    for node in nodes {
+        let online = local_presence
+            .get(&format!("{}:{}", node.project_id, node.node_id))
+            .filter(|online| {
+                online
+                    .heartbeat
+                    .is_some_and(|time| time.elapsed() < Duration::from_secs(30))
+            })
+            .cloned();
+        let presence = if node.revoked {
+            None
+        } else if online.is_some() {
+            online
+        } else {
+            match state
+                .repo
+                .storage()
+                .read_lease(&node.project_id, &node.node_id, now())
+                .await
+            {
+                Ok(lease) => Some(crate::server::NodePresence {
+                    connection_id: lease.owner_id,
+                    ready: node.runtime_ready,
+                    capabilities: Vec::new(),
+                    heartbeat: None,
+                }),
+                Err(CloudError::NotFound) => None,
+                Err(error) => return Err(error.into()),
+            }
+        };
+        fleet.push(serde_json::json!({"node":node,"presence":presence}));
+    }
+    Ok(Json(
+        serde_json::json!({"nodes":fleet,"next_cursor":next_cursor}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Invite {
+    label: String,
+    roles: BTreeSet<String>,
+}
+async fn invite(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Json(input): Json<Invite>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let mut bytes = [0u8; 32];
+    getrandom::fill(&mut bytes).map_err(|_| CloudError::Storage)?;
+    let token = hex::encode(bytes);
+    let token_hash = hex::encode(Sha256::digest(token.as_bytes()));
+    let node_id = uuid::Uuid::now_v7().simple().to_string();
+    let invitation = Enrollment {
+        token_hash,
+        project_id: project,
+        node_id: node_id.clone(),
+        label: input.label,
+        roles: input.roles,
+        expires_at: now() + 600,
+        redeemed_certificate: None,
+        redeemed_csr: None,
+        certificate_pem: None,
+    };
+    db(state.repo.clone(), move |repo| async move {
+        repo.invite(&caller, invitation, now()).await
+    })
+    .await?;
+    Ok(Json(
+        serde_json::json!({"token":token,"node_id":node_id,"expires_in":600,"enrollment_url":format!("{}/api/enroll",state.config.public_origin.trim_end_matches('/'))}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Redeem {
+    token: String,
+    instance_id: String,
+    csr_pem: String,
+}
+async fn enroll(
+    Extract(state): Extract<Arc<State>>,
+    Json(input): Json<Redeem>,
+) -> Result<Json<serde_json::Value>> {
+    if input.token.len() != 64 || !input.token.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err(CloudError::PermissionDenied.into());
+    }
+    let (certificate, fingerprint) = state
+        .ca
+        .sign(&input.csr_pem)
+        .map_err(|_| CloudError::InvalidArgument)?;
+    let token_hash = hex::encode(Sha256::digest(input.token.as_bytes()));
+    let csr_sha256 = hex::encode(Sha256::digest(input.csr_pem.as_bytes()));
+    let (node, certificate) = db(state.repo.clone(), move |repo| async move {
+        repo.redeem(
+            &token_hash,
+            &input.instance_id,
+            CertificateRedemption {
+                fingerprint,
+                csr_sha256,
+                certificate_pem: certificate,
+            },
+            now(),
+        )
+        .await
+    })
+    .await?;
+    Ok(Json(
+        serde_json::json!({"node":node,"certificate_pem":certificate,"ca_pem":state.ca.pem,"grpc_endpoint":state.config.grpc_endpoint}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Revision {
+    revision: u64,
+}
+async fn revoke(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, node)): Path<(String, String)>,
+    headers: HeaderMap,
+    Json(input): Json<Revision>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let node = db(state.repo.clone(), move |repo| async move {
+        repo.revoke_node(&caller, &node, input.revision).await
+    })
+    .await?;
+    Ok(Json(serde_json::json!({"node":node})))
+}
+async fn tasks(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let tasks = db(state.repo.clone(), move |repo| async move {
+        repo.list_tasks(&caller, page.after.as_deref(), page.limit.unwrap_or(100))
+            .await
+    })
+    .await?;
+    Ok(Json(serde_json::json!({"tasks":tasks})))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Create {
+    node_id: String,
+    request: CreateRunRequest,
+}
+async fn create(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Json(input): Json<Create>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let task = db(state.repo.clone(), move |repo| async move {
+        repo.create_task(&caller, &input.node_id, input.request)
+            .await
+    })
+    .await?;
+    Ok(Json(serde_json::json!({"task":task})))
+}
+async fn task(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, task)): Path<(String, String)>,
+    headers: HeaderMap,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let task = db(state.repo.clone(), move |repo| async move {
+        repo.get_task(&caller, &task).await
+    })
+    .await?;
+    Ok(Json(serde_json::json!({"task":task})))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Mutation {
+    mutation_id: String,
+}
+async fn command(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, task, command)): Path<(String, String, String)>,
+    headers: HeaderMap,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let command = db(state.repo.clone(), move |repo| async move {
+        repo.get_command(&caller, &task, &command).await
+    })
+    .await?;
+    Ok(Json(serde_json::json!({"command":command})))
+}
+async fn cancel(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, task)): Path<(String, String)>,
+    headers: HeaderMap,
+    Json(input): Json<Mutation>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let command = db(state.repo.clone(), move |repo| async move {
+        repo.cancel_task(&caller, &task, &input.mutation_id).await
+    })
+    .await?;
+    Ok(Json(serde_json::json!({"command":command})))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Respond {
+    mutation_id: String,
+    request: RespondInteractionRequest,
+}
+async fn respond(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, task)): Path<(String, String)>,
+    headers: HeaderMap,
+    Json(input): Json<Respond>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let command = db(state.repo.clone(), move |repo| async move {
+        repo.respond_task(&caller, &task, &input.mutation_id, input.request)
+            .await
+    })
+    .await?;
+    Ok(Json(serde_json::json!({"command":command})))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Cursor {
+    #[serde(default)]
+    after: u64,
+}
+async fn events(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, task)): Path<(String, String)>,
+    headers: HeaderMap,
+    Query(cursor): Query<Cursor>,
+) -> Result<Sse<impl futures::Stream<Item = std::result::Result<Event, Infallible>>>> {
+    stream_events(state, headers, project, task, cursor.after, false).await
+}
+async fn thread_events(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, thread)): Path<(String, String)>,
+    headers: HeaderMap,
+    Query(cursor): Query<Cursor>,
+) -> Result<Sse<impl futures::Stream<Item = std::result::Result<Event, Infallible>>>> {
+    stream_events(state, headers, project, thread, cursor.after, true).await
+}
+async fn stream_events(
+    state: Arc<State>,
+    headers: HeaderMap,
+    project: String,
+    scope: String,
+    after: u64,
+    thread: bool,
+) -> Result<Sse<impl futures::Stream<Item = std::result::Result<Event, Infallible>>>> {
+    let permit = state
+        .sse_permits
+        .clone()
+        .try_acquire_owned()
+        .map_err(|_| CloudError::ResourceExhausted)?;
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let after = headers
+        .get("last-event-id")
+        .map(|value| {
+            value
+                .to_str()
+                .ok()
+                .and_then(|value| value.parse::<u64>().ok())
+                .ok_or(CloudError::InvalidArgument)
+        })
+        .transpose()?
+        .unwrap_or(after);
+    let hints = state.repo.storage().subscribe();
+    let first = if thread {
+        state
+            .repo
+            .thread_updates(&caller, &scope, after, 100)
+            .await?
+    } else {
+        state
+            .repo
+            .updates(&caller, &scope, after, 100)
+            .await?
+            .into_iter()
+            .map(|update| {
+                Ok(colossus_cloud::storage::ReleasedEvent {
+                    project_id: project.clone(),
+                    scope_id: scope.clone(),
+                    sequence: update.sequence,
+                    value: serde_json::to_value(update).map_err(|_| CloudError::Storage)?,
+                })
+            })
+            .collect::<colossus_cloud::CloudResult<Vec<_>>>()?
+    };
+    let stream = futures::stream::unfold(
+        (
+            state, headers, project, scope, after, first, permit, hints, thread, 0u64, false,
+        ),
+        |(
+            state,
+            headers,
+            project,
+            scope,
+            mut after,
+            mut pending,
+            permit,
+            mut hints,
+            thread,
+            mut revision,
+            mut hint_pending,
+        )| async move {
+            loop {
+                if *state.shutdown.borrow() {
+                    return None;
+                }
+                let caller = state.auth.caller(&headers, &project, false).await.ok()?;
+                if let Some(update) = pending.first().cloned() {
+                    pending.remove(0);
+                    after = update.sequence;
+                    let event = Event::default()
+                        .id(after.to_string())
+                        .event("run_update")
+                        .json_data(update.value)
+                        .ok()?;
+                    return Some((
+                        Ok(event),
+                        (
+                            state,
+                            headers,
+                            project,
+                            scope,
+                            after,
+                            pending,
+                            permit,
+                            hints,
+                            thread,
+                            revision,
+                            hint_pending,
+                        ),
+                    ));
+                }
+                if thread && !hint_pending {
+                    let detail = state.repo.get_thread(&caller, &scope).await.ok()?;
+                    if detail.thread.revision != revision {
+                        revision = detail.thread.revision;
+                        hint_pending = true;
+                        let event = Event::default()
+                            .event("thread_changed")
+                            .json_data(&detail.thread)
+                            .ok()?;
+                        return Some((
+                            Ok(event),
+                            (
+                                state,
+                                headers,
+                                project,
+                                scope,
+                                after,
+                                pending,
+                                permit,
+                                hints,
+                                thread,
+                                revision,
+                                hint_pending,
+                            ),
+                        ));
+                    }
+                }
+                let mut shutdown = state.shutdown.subscribe();
+                tokio::select! { _=hints.recv()=>{},_=tokio::time::sleep(Duration::from_secs(5))=>{},_=shutdown.changed()=>return None }
+                hint_pending = false;
+                pending = if thread {
+                    state
+                        .repo
+                        .thread_updates(&caller, &scope, after, 100)
+                        .await
+                        .ok()?
+                } else {
+                    state
+                        .repo
+                        .updates(&caller, &scope, after, 100)
+                        .await
+                        .ok()?
+                        .into_iter()
+                        .filter_map(|update| {
+                            serde_json::to_value(&update).ok().map(|value| {
+                                colossus_cloud::storage::ReleasedEvent {
+                                    project_id: project.clone(),
+                                    scope_id: scope.clone(),
+                                    sequence: update.sequence,
+                                    value,
+                                }
+                            })
+                        })
+                        .collect()
+                };
+            }
+        },
+    );
+    Ok(Sse::new(stream).keep_alive(KeepAlive::new().interval(Duration::from_secs(10))))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ThreadPage {
+    node_id: Option<String>,
+    query: Option<String>,
+    archived: Option<bool>,
+    after: Option<String>,
+    limit: Option<usize>,
+}
+async fn hosts(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let hosts = state
+        .repo
+        .list_hosts(&caller, page.after.as_deref(), page.limit.unwrap_or(100))
+        .await?;
+    let next_cursor = (hosts.len() == page.limit.unwrap_or(100).min(100))
+        .then(|| hosts.last().map(|host| host.host_id.clone()))
+        .flatten();
+    Ok(Json(
+        serde_json::json!({"hosts":hosts,"next_cursor":next_cursor}),
+    ))
+}
+async fn workspaces(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Query(page): Query<Page>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let workspaces = state
+        .repo
+        .list_workspaces(&caller, page.after.as_deref(), page.limit.unwrap_or(100))
+        .await?;
+    Ok(Json(serde_json::json!({"workspaces":workspaces})))
+}
+async fn threads(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Query(page): Query<ThreadPage>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let (threads, next_cursor) = state
+        .repo
+        .query_threads(
+            &caller,
+            page.node_id,
+            page.query,
+            page.archived,
+            page.after,
+            page.limit.unwrap_or(100),
+        )
+        .await?;
+    Ok(Json(
+        serde_json::json!({"threads":threads,"next_cursor":next_cursor}),
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct NewThread {
+    node_id: String,
+    title: Option<String>,
+    request: CreateRunRequest,
+}
+async fn create_thread(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Json(input): Json<NewThread>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let (thread, task) = state
+        .repo
+        .create_thread(&caller, &input.node_id, input.title, input.request)
+        .await?;
+    Ok(Json(serde_json::json!({"thread":thread,"task":task})))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct HistoryPage {
+    task_after: Option<String>,
+    message_after: Option<String>,
+}
+async fn thread_detail(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, id)): Path<(String, String)>,
+    headers: HeaderMap,
+    Query(page): Query<HistoryPage>,
+) -> Result<Json<colossus_cloud::CloudThreadDetail>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    Ok(Json(
+        state
+            .repo
+            .thread_detail(
+                &caller,
+                &id,
+                page.task_after.as_deref(),
+                page.message_after.as_deref(),
+            )
+            .await?,
+    ))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ThreadMessage {
+    expected_revision: u64,
+    request: CreateRunRequest,
+}
+async fn send_message(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, id)): Path<(String, String)>,
+    headers: HeaderMap,
+    Json(input): Json<ThreadMessage>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let (thread, task) = state
+        .repo
+        .send_message(&caller, &id, input.expected_revision, input.request)
+        .await?;
+    Ok(Json(serde_json::json!({"thread":thread,"task":task})))
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ThreadEdit {
+    revision: u64,
+    title: Option<String>,
+    archived: Option<bool>,
+}
+async fn edit_thread(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, id)): Path<(String, String)>,
+    headers: HeaderMap,
+    Json(input): Json<ThreadEdit>,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    let thread = state
+        .repo
+        .update_thread(&caller, &id, input.revision, input.title, input.archived)
+        .await?;
+    Ok(Json(serde_json::json!({"thread":thread})))
+}
+pub(crate) fn now() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|duration| duration.as_secs())
+        .unwrap_or(0)
+}
+
+async fn node_detail(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, id)): Path<(String, String)>,
+    headers: HeaderMap,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let node = state.repo.get_node(&caller, &id).await?;
+    let local = state
+        .presence
+        .lock()
+        .map_err(|_| CloudError::Storage)?
+        .get(&format!("{}:{}", node.project_id, node.node_id))
+        .filter(|presence| {
+            presence
+                .heartbeat
+                .is_some_and(|time| time.elapsed() < Duration::from_secs(30))
+        })
+        .cloned();
+    let presence = if node.revoked {
+        None
+    } else if local.is_some() {
+        local
+    } else {
+        match state
+            .repo
+            .storage()
+            .read_lease(&node.project_id, &node.node_id, now())
+            .await
+        {
+            Ok(lease) => Some(crate::server::NodePresence {
+                connection_id: lease.owner_id,
+                ready: node.runtime_ready,
+                capabilities: Vec::new(),
+                heartbeat: None,
+            }),
+            Err(CloudError::NotFound) => None,
+            Err(error) => return Err(error.into()),
+        }
+    };
+    Ok(Json(serde_json::json!({"node":node,"presence":presence})))
+}
diff --git a/crates/colossus-cloud-server/src/http/spa.rs b/crates/colossus-cloud-server/src/http/spa.rs
new file mode 100644
index 000000000..d0e7d5a8b
--- /dev/null
+++ b/crates/colossus-cloud-server/src/http/spa.rs
@@ -0,0 +1,124 @@
+//! Public frontend shell routes; resource authorization stays in the API handlers.
+
+use axum::{
+    Router,
+    body::Body,
+    extract::Request,
+    http::{Method, StatusCode},
+    response::IntoResponse,
+};
+use std::path::Path;
+use tower_http::services::{ServeDir, ServeFile};
+
+pub(super) fn service(web_root: &Path) -> Router {
+    let assets = ServeDir::new(web_root);
+    let shell = ServeFile::new(web_root.join("index.html"));
+    Router::new().fallback(move |request: Request| {
+        let mut assets = assets.clone();
+        let mut shell = shell.clone();
+        async move {
+            // Preserve the static service's existing method rejection and Allow header.
+            if request.method() != Method::GET && request.method() != Method::HEAD {
+                return match assets.try_call(request).await {
+                    Ok(response) => response.map(Body::new),
+                    Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+                };
+            }
+            let Some(parts) = path_parts(request.uri().path()) else {
+                return StatusCode::NOT_FOUND.into_response();
+            };
+            if frontend_path(&parts) {
+                return match shell.try_call(request).await {
+                    Ok(response) => response.map(Body::new),
+                    Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+                };
+            }
+            if parts.first().is_some_and(|part| {
+                matches!(
+                    part.as_str(),
+                    "api" | "auth" | "health" | "projects" | "fleet" | "admin" | "settings"
+                )
+            }) {
+                return StatusCode::NOT_FOUND.into_response();
+            }
+            match assets.try_call(request).await {
+                Ok(response) => response.map(Body::new),
+                Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            }
+        }
+    })
+}
+
+fn path_parts(path: &str) -> Option<Vec<String>> {
+    if path.len() > 2048 || !path.starts_with('/') {
+        return None;
+    }
+    let path = path.strip_suffix('/').unwrap_or(path);
+    if path.is_empty() {
+        return Some(Vec::new());
+    }
+    path.strip_prefix('/')?
+        .split('/')
+        .map(|part| {
+            let decoded = decode_part(part)?;
+            (!decoded.is_empty()
+                && decoded != "."
+                && decoded != ".."
+                && !decoded
+                    .chars()
+                    .any(|c| c == '/' || c == '\\' || c.is_control()))
+            .then_some(decoded)
+        })
+        .collect()
+}
+
+fn decode_part(part: &str) -> Option<String> {
+    let bytes = part.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' {
+            let high = (*bytes.get(index + 1)? as char).to_digit(16)?;
+            let low = (*bytes.get(index + 2)? as char).to_digit(16)?;
+            decoded.push((high * 16 + low) as u8);
+            index += 3;
+        } else {
+            decoded.push(bytes[index]);
+            index += 1;
+        }
+    }
+    String::from_utf8(decoded).ok()
+}
+
+fn identifier(value: &str) -> bool {
+    !value.is_empty()
+        && value.encode_utf16().count() <= 256
+        && !value.chars().any(|c| c.is_whitespace() || c == '\u{feff}')
+}
+
+fn frontend_path(parts: &[String]) -> bool {
+    let parts: Vec<&str> = parts.iter().map(String::as_str).collect();
+    match parts.as_slice() {
+        [] | ["fleet" | "projects" | "admin" | "settings"] => true,
+        ["admin", "users" | "projects" | "settings"] => true,
+        [
+            "projects",
+            project,
+            "overview" | "tasks" | "analytics" | "access" | "settings",
+        ] => identifier(project),
+        [
+            "projects",
+            project,
+            "agents",
+            node,
+            "overview" | "threads" | "analytics" | "policy",
+        ] => identifier(project) && identifier(node),
+        ["projects", project, "threads" | "tasks", resource] => {
+            identifier(project) && identifier(resource)
+        }
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/colossus-cloud-server/src/http/spa/tests.rs b/crates/colossus-cloud-server/src/http/spa/tests.rs
new file mode 100644
index 000000000..721d02348
--- /dev/null
+++ b/crates/colossus-cloud-server/src/http/spa/tests.rs
@@ -0,0 +1,179 @@
+use super::*;
+use axum::{body::to_bytes, http::HeaderMap};
+use tower::ServiceExt as _;
+
+const SHELL: &str = "<!doctype html><html><body>Control Plane shell fixture</body></html>";
+const ASSET: &[u8] = b"const fixture = true;";
+
+fn fixture() -> (tempfile::TempDir, Router) {
+    let directory = tempfile::tempdir().expect("SPA fixture directory");
+    std::fs::write(directory.path().join("index.html"), SHELL).expect("SPA fixture shell");
+    std::fs::create_dir(directory.path().join("assets")).expect("SPA fixture assets");
+    std::fs::write(directory.path().join("assets/app.js"), ASSET).expect("SPA fixture asset");
+    for namespace in ["api", "auth", "health"] {
+        std::fs::create_dir(directory.path().join(namespace)).expect("reserved fixture directory");
+        std::fs::write(
+            directory.path().join(namespace).join("missing"),
+            b"reserved file",
+        )
+        .expect("reserved fixture file");
+    }
+    let router = service(directory.path());
+    (directory, router)
+}
+
+async fn response(router: &Router, method: Method, path: &str) -> (StatusCode, HeaderMap, Vec<u8>) {
+    let response = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(method)
+                .uri(path)
+                .body(Body::empty())
+                .expect("fixture request"),
+        )
+        .await
+        .expect("fixture response");
+    let status = response.status();
+    let headers = response.headers().clone();
+    let body = to_bytes(response.into_body(), 4096)
+        .await
+        .expect("bounded fixture body")
+        .to_vec();
+    (status, headers, body)
+}
+
+#[tokio::test]
+async fn spa_get_recognized_pages_returns_exact_shell() {
+    let (_directory, router) = fixture();
+    for path in [
+        "/",
+        "/fleet",
+        "/projects",
+        "/admin",
+        "/admin/users",
+        "/admin/projects",
+        "/admin/settings",
+        "/settings",
+        "/projects/project-a/overview",
+        "/projects/project-a/tasks",
+        "/projects/project-a/analytics",
+        "/projects/project-a/access",
+        "/projects/project-a/settings",
+        "/projects/project-a/agents/node-a/overview",
+        "/projects/project-a/agents/node-a/threads",
+        "/projects/project-a/agents/node-a/analytics",
+        "/projects/project-a/agents/node-a/policy",
+        "/projects/project-a/threads/thread-a",
+        "/projects/project-a/tasks/task-a",
+        "/projects/project%3Aa/agents/node%3Ab/threads?compose=1",
+        "/fleet?project=project%3Aa",
+    ] {
+        let (status, headers, body) = response(&router, Method::GET, path).await;
+        assert_eq!(status, StatusCode::OK, "{path}");
+        assert_eq!(body, SHELL.as_bytes(), "{path}");
+        assert!(
+            headers["content-type"]
+                .to_str()
+                .unwrap()
+                .starts_with("text/html")
+        );
+    }
+    let (status, _, body) = response(&router, Method::GET, "/projects/project-a/overview/").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, SHELL.as_bytes());
+}
+
+#[tokio::test]
+async fn spa_head_preserves_shell_headers_without_body() {
+    let (_directory, router) = fixture();
+    for path in ["/", "/projects/project-a/threads/thread-a"] {
+        let (get_status, get_headers, get_body) = response(&router, Method::GET, path).await;
+        let (head_status, head_headers, head_body) = response(&router, Method::HEAD, path).await;
+        assert_eq!(get_status, StatusCode::OK);
+        assert_eq!(head_status, StatusCode::OK);
+        assert!(head_body.is_empty());
+        assert_eq!(head_headers["content-type"], get_headers["content-type"]);
+        assert_eq!(
+            head_headers["content-length"],
+            get_headers["content-length"]
+        );
+        assert_eq!(get_body, SHELL.as_bytes());
+    }
+}
+
+#[tokio::test]
+async fn spa_assets_reserved_namespaces_and_unknown_paths_stay_distinct() {
+    let (_directory, router) = fixture();
+    let (status, _, body) = response(&router, Method::GET, "/assets/app.js").await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, ASSET);
+    for path in [
+        "/missing-page",
+        "/assets/missing.js",
+        "/api/missing",
+        "/auth/missing",
+        "/health/missing",
+        "/%61pi/missing",
+        "/projects/project-a/missing-view",
+        "/projects/project-a/agents/node-a/missing-view",
+        "/admin/missing-view",
+    ] {
+        for method in [Method::GET, Method::HEAD] {
+            let (status, _, body) = response(&router, method, path).await;
+            assert_eq!(status, StatusCode::NOT_FOUND, "{path}");
+            assert_ne!(body, SHELL.as_bytes(), "{path}");
+            assert_ne!(body, b"reserved file", "{path}");
+        }
+    }
+}
+
+#[tokio::test]
+async fn spa_malformed_identifiers_and_traversal_cannot_select_shell_or_asset() {
+    let (_directory, router) = fixture();
+    let oversized = format!("/projects/{}/overview", "a".repeat(257));
+    let oversized_path = format!("/assets/{}", "a".repeat(2048));
+    for path in [
+        "/projects/../overview",
+        "/projects/%2e%2e/overview",
+        "/projects/project%2fa/overview",
+        "/projects/project%5ca/overview",
+        "/projects/bad%20id/overview",
+        "/projects/bad%00id/overview",
+        "/projects/%ff/overview",
+        "/projects/%zz/overview",
+        "/projects/project-a/overview//",
+        "/assets/../index.html",
+        "/assets/%2e%2e/index.html",
+        "/assets/%2findex.html",
+        "/assets/%5cindex.html",
+        oversized.as_str(),
+        oversized_path.as_str(),
+    ] {
+        let (status, _, body) = response(&router, Method::GET, path).await;
+        assert_eq!(status, StatusCode::NOT_FOUND, "{path}");
+        assert_ne!(body, SHELL.as_bytes(), "{path}");
+    }
+    let at_limit = format!("/projects/{}/overview", "a".repeat(256));
+    assert_eq!(
+        response(&router, Method::GET, &at_limit).await.0,
+        StatusCode::OK
+    );
+}
+
+#[tokio::test]
+async fn spa_non_get_preserves_static_method_rejection() {
+    let (_directory, router) = fixture();
+    for method in [Method::POST, Method::PUT, Method::DELETE, Method::OPTIONS] {
+        for path in [
+            "/fleet",
+            "/projects/project-a/threads/thread-a",
+            "/assets/app.js",
+        ] {
+            let (status, headers, body) = response(&router, method.clone(), path).await;
+            assert_eq!(status, StatusCode::METHOD_NOT_ALLOWED, "{method} {path}");
+            assert_eq!(headers["allow"], "GET,HEAD");
+            assert_ne!(body, SHELL.as_bytes());
+        }
+    }
+}
diff --git a/crates/colossus-cloud-server/src/lib.rs b/crates/colossus-cloud-server/src/lib.rs
new file mode 100644
index 000000000..fc945c2aa
--- /dev/null
+++ b/crates/colossus-cloud-server/src/lib.rs
@@ -0,0 +1,17 @@
+//! Authenticated browser and outbound runtime transports for the cloud application.
+mod admin;
+mod auth;
+mod certificates;
+/// Canonical server command and its compatibility entry point.
+pub mod cli;
+/// Secret-reference-only Kubernetes and local host configuration.
+pub mod config;
+mod connection;
+mod http;
+/// Explicit offline import from the former protected cloud journal.
+pub mod migration;
+mod observability;
+/// Composed HTTP/OIDC and mutual-TLS server lifecycle.
+pub mod server;
+mod settings;
+mod tls;
diff --git a/crates/colossus-cloud-server/src/main.rs b/crates/colossus-cloud-server/src/main.rs
new file mode 100644
index 000000000..7f3078afc
--- /dev/null
+++ b/crates/colossus-cloud-server/src/main.rs
@@ -0,0 +1,5 @@
+//! Compatibility entry point for existing server deployments.
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    colossus_cloud_server::cli::run().await
+}
diff --git a/crates/colossus-cloud-server/src/migration.rs b/crates/colossus-cloud-server/src/migration.rs
new file mode 100644
index 000000000..aef2b4076
--- /dev/null
+++ b/crates/colossus-cloud-server/src/migration.rs
@@ -0,0 +1,574 @@
+//! Explicit offline migration. Verified canonical source events remain unchanged.
+use crate::config::Config;
+use colossus_cloud::{CloudError, CloudRepository, storage::*};
+use colossus_cloud_postgres::CloudPostgresStore;
+use colossus_home::ConfinedRoot;
+use colossus_journal_postgres::{PostgresEventJournal, PostgresJournalConfig};
+use colossus_journal_redb::{
+    DisabledCheckpointSigner, Ed25519CheckpointSigner, EnvironmentKeyProvider,
+    PlaintextKeyProvider, RedbEventJournal,
+};
+use colossus_ports::{CheckpointSigner, EventJournal, KeyProvider};
+use serde::Deserialize;
+use serde_json::{Value, json};
+use std::{
+    collections::BTreeSet,
+    io::Read,
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+
+#[cfg(test)]
+mod tests;
+
+const PAGE: usize = 16;
+const PREFIXES: [&str; 9] = [
+    "cloud.node:",
+    "cloud.task:",
+    "cloud.node-task:",
+    "cloud.run:",
+    "cloud.command:",
+    "cloud.invitation:",
+    "cloud.renewal:",
+    "cloud.admission:",
+    "cloud.output:",
+];
+
+/// Credential-free outcome of one verified, resumable offline import.
+#[derive(Clone, Debug)]
+pub struct MigrationReport {
+    /// Verified source journal head retained by the import marker.
+    pub source_sequence: u64,
+    /// Original domain events imported while preserving aggregate revisions.
+    pub entities: u64,
+    /// Released run updates retained with their original exclusive cursors.
+    pub released_events: u64,
+    /// Projects imported, with unchanged namespaces.
+    pub projects: Vec<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+enum LegacyStorage {
+    Redb {
+        path: PathBuf,
+        key_variable: Option<String>,
+    },
+    Postgres {
+        config: PostgresJournalConfig,
+        key_variable: String,
+        anchor_path: PathBuf,
+    },
+}
+struct LegacyConfig {
+    storage: LegacyStorage,
+    signing: Option<String>,
+    local: bool,
+}
+
+fn legacy_config(bytes: &[u8]) -> Result<LegacyConfig, &'static str> {
+    let value: Value =
+        serde_json::from_slice(bytes).map_err(|_| "legacy cloud configuration is invalid")?;
+    let object = value
+        .as_object()
+        .ok_or("legacy cloud configuration is invalid")?;
+    const FIELDS: [&str; 16] = [
+        "http_bind",
+        "grpc_bind",
+        "public_origin",
+        "grpc_endpoint",
+        "ca_certificate",
+        "ca_key",
+        "server_certificate",
+        "server_key",
+        "oidc",
+        "memberships",
+        "web_root",
+        "storage",
+        "signing_key_variable",
+        "local_development",
+        "schema_version",
+        "auth_key_variable",
+    ];
+    if object.keys().any(|key| !FIELDS.contains(&key.as_str())) {
+        return Err("legacy cloud configuration has unsupported fields");
+    }
+    let storage: LegacyStorage = serde_json::from_value(
+        object
+            .get("storage")
+            .cloned()
+            .ok_or("legacy storage configuration is missing")?,
+    )
+    .map_err(|_| "legacy storage configuration is invalid")?;
+    let signing: Option<String> = serde_json::from_value(
+        object
+            .get("signing_key_variable")
+            .cloned()
+            .unwrap_or(Value::Null),
+    )
+    .map_err(|_| "legacy signing reference is invalid")?;
+    let local = object
+        .get("local_development")
+        .and_then(Value::as_bool)
+        .unwrap_or(false);
+    let encryption = match &storage {
+        LegacyStorage::Redb { key_variable, .. } => key_variable.as_ref(),
+        LegacyStorage::Postgres { key_variable, .. } => Some(key_variable),
+    };
+    if !local && (encryption.is_none() || signing.is_none()) {
+        return Err("legacy production state requires its encryption and signing references");
+    }
+    if signing.as_ref().is_some_and(|key| Some(key) == encryption) {
+        return Err("legacy encryption and signing references must be independent");
+    }
+    Ok(LegacyConfig {
+        storage,
+        signing,
+        local,
+    })
+}
+
+fn source(config: LegacyConfig) -> Result<Arc<dyn EventJournal>, &'static str> {
+    let signer: Arc<dyn CheckpointSigner> = match config.signing {
+        Some(variable) => {
+            let value = zeroize::Zeroizing::new(
+                std::env::var(variable).map_err(|_| "legacy signing key is unavailable")?,
+            );
+            let mut secret = zeroize::Zeroizing::new([0u8; 32]);
+            hex::decode_to_slice(value.trim(), secret.as_mut())
+                .map_err(|_| "legacy signing key is invalid")?;
+            Arc::new(Ed25519CheckpointSigner::new("cloud-signing-v1", *secret))
+        }
+        None => Arc::new(DisabledCheckpointSigner),
+    };
+    let journal: Arc<dyn EventJournal> = match config.storage {
+        LegacyStorage::Redb { path, key_variable } => {
+            if !std::fs::symlink_metadata(&path)
+                .is_ok_and(|metadata| metadata.is_file() && !metadata.file_type().is_symlink())
+            {
+                return Err("legacy journal must be an existing protected regular file");
+            }
+            let root = ConfinedRoot::bind(path.parent().ok_or("legacy journal path is invalid")?)
+                .map_err(|_| "legacy journal parent is unavailable")?;
+            let retained = root
+                .open_existing_file_read_write(
+                    path.file_name()
+                        .ok_or("legacy journal path is invalid")?
+                        .as_ref(),
+                )
+                .map_err(|_| "legacy journal file is unavailable")?;
+            retained
+                .revalidate(&root)
+                .map_err(|_| "legacy journal identity changed")?;
+            let keys: Arc<dyn KeyProvider> = match key_variable {
+                Some(variable) => Arc::new(EnvironmentKeyProvider::new(
+                    variable,
+                    "cloud-v1",
+                    path.with_extension("anchor"),
+                )),
+                None if config.local => Arc::new(PlaintextKeyProvider),
+                None => return Err("legacy plaintext journal requires local development"),
+            };
+            Arc::new(
+                RedbEventJournal::open_file_with_startup_verification(
+                    retained
+                        .file()
+                        .try_clone()
+                        .map_err(|_| "legacy journal file is unavailable")?,
+                    keys,
+                    signer,
+                    colossus_contracts::StartupVerificationMode::Full,
+                )
+                .map_err(|_| "legacy journal is unavailable; stop its writer before migrating")?,
+            )
+        }
+        LegacyStorage::Postgres {
+            config,
+            key_variable,
+            anchor_path,
+        } => Arc::new(
+            PostgresEventJournal::open(
+                config,
+                Arc::new(EnvironmentKeyProvider::new(
+                    key_variable,
+                    "cloud-v1",
+                    anchor_path,
+                )),
+                signer,
+            )
+            .map_err(|_| "legacy journal is unavailable; stop its writer before migrating")?,
+        ),
+    };
+    if journal.is_recovery_mode() {
+        return Err("legacy journal is in read-only recovery mode");
+    }
+    journal
+        .verify()
+        .map_err(|_| "legacy journal verification failed")?;
+    Ok(journal)
+}
+
+fn marker() -> EntityKey {
+    EntityKey {
+        kind: EntityKind::AuthFlow,
+        project_id: "__migration".into(),
+        parent_id: None,
+        id: "journal-import".into(),
+    }
+}
+fn identity(stream: &str, value: &Value) -> Result<EntityKey, &'static str> {
+    let (kind, tail) = stream
+        .split_once(':')
+        .ok_or("legacy entity identity is invalid")?;
+    let kind = match kind {
+        "cloud.node" => EntityKind::Node,
+        "cloud.task" => EntityKind::Task,
+        "cloud.node-task" => EntityKind::NodeTask,
+        "cloud.run" => EntityKind::Run,
+        "cloud.command" => EntityKind::Command,
+        "cloud.invitation" => EntityKind::Invitation,
+        "cloud.renewal" => EntityKind::Renewal,
+        "cloud.admission" => EntityKind::Admission,
+        _ => return Err("legacy journal contains unsupported state"),
+    };
+    let (project, rest) = if kind == EntityKind::Invitation {
+        (
+            value
+                .get("project_id")
+                .and_then(Value::as_str)
+                .ok_or("legacy invitation project is invalid")?,
+            tail,
+        )
+    } else {
+        tail.split_once(':')
+            .ok_or("legacy project identity is invalid")?
+    };
+    let (parent, id) = if matches!(
+        kind,
+        EntityKind::NodeTask | EntityKind::Run | EntityKind::Command
+    ) {
+        let (parent, id) = rest
+            .split_once(':')
+            .ok_or("legacy parent identity is invalid")?;
+        (Some(parent.to_owned()), id)
+    } else {
+        (None, rest)
+    };
+    let valid = |id: &str| {
+        !id.is_empty()
+            && id.len() <= 128
+            && id
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_'))
+    };
+    if !valid(project) || !valid(id) || parent.as_ref().is_some_and(|id| !valid(id)) {
+        return Err("legacy entity identity is invalid");
+    }
+    Ok(EntityKey {
+        kind,
+        project_id: project.into(),
+        parent_id: parent,
+        id: id.into(),
+    })
+}
+
+async fn page(
+    journal: Arc<dyn EventJournal>,
+    stream: String,
+    after: u64,
+) -> Result<Vec<(colossus_contracts::EventEnvelope, Value)>, &'static str> {
+    tokio::task::spawn_blocking(move || {
+        journal
+            .read_stream_from(&stream, after, PAGE)
+            .map_err(|_| "legacy journal read failed")?
+            .into_iter()
+            .map(|event| {
+                let value = journal
+                    .decrypt_payload(&event)
+                    .map_err(|_| "legacy journal payload verification failed")?;
+                Ok((event, value))
+            })
+            .collect()
+    })
+    .await
+    .map_err(|_| "legacy journal reader failed")?
+}
+
+async fn streams(
+    journal: Arc<dyn EventJournal>,
+    prefix: &str,
+    after: Option<String>,
+) -> Result<Vec<String>, &'static str> {
+    let prefix = prefix.to_owned();
+    tokio::task::spawn_blocking(move || {
+        journal
+            .list_stream_ids(&prefix, after.as_deref(), 64)
+            .map_err(|_| "legacy journal discovery failed")
+    })
+    .await
+    .map_err(|_| "legacy journal reader failed")?
+}
+
+async fn projects(
+    journal: Arc<dyn EventJournal>,
+    head: (u64, String),
+) -> Result<BTreeSet<String>, &'static str> {
+    let mut projects = BTreeSet::new();
+    let mut after = 1;
+    loop {
+        let source = journal.clone();
+        let events = tokio::task::spawn_blocking(move || {
+            source
+                .read_global(after, PAGE)
+                .map_err(|_| "legacy journal read failed")
+        })
+        .await
+        .map_err(|_| "legacy journal reader failed")??;
+        if events.is_empty() {
+            break;
+        }
+        for event in events {
+            if event.global_sequence != after
+                || event.event_version != 1
+                || !event.event_type.starts_with("cloud.")
+                || !PREFIXES
+                    .iter()
+                    .any(|prefix| event.stream_id.starts_with(prefix))
+            {
+                return Err("legacy journal contains unsupported or inconsistent state");
+            }
+            let value = journal
+                .decrypt_payload(&event)
+                .map_err(|_| "legacy journal payload verification failed")?;
+            let project = if let Some(output) = event.stream_id.strip_prefix("cloud.output:") {
+                output
+                    .split_once(':')
+                    .ok_or("legacy output identity is invalid")?
+                    .0
+                    .to_owned()
+            } else {
+                identity(&event.stream_id, &value)?.project_id
+            };
+            projects.insert(project);
+            if projects.len() > 4096 {
+                return Err("legacy project count exceeds migration bound");
+            }
+            after = after
+                .checked_add(1)
+                .ok_or("legacy sequence exceeds migration bound")?;
+        }
+    }
+    if after.saturating_sub(1) != head.0
+        || journal
+            .head()
+            .map_err(|_| "legacy journal head is unavailable")?
+            != head
+    {
+        return Err("legacy journal changed during migration");
+    }
+    Ok(projects)
+}
+
+async fn replay(
+    journal: Arc<dyn EventJournal>,
+    store: Arc<dyn CloudStore>,
+    head: (u64, String),
+) -> Result<MigrationReport, &'static str> {
+    let project_ids = projects(journal.clone(), head.clone()).await?;
+    for project in &project_ids {
+        let key = EntityKey {
+            kind: EntityKind::Project,
+            project_id: project.clone(),
+            parent_id: None,
+            id: project.clone(),
+        };
+        if matches!(store.read(&key).await, Err(CloudError::NotFound)) {
+            store
+                .commit(CloudTransaction {
+                    entities: vec![EntityMutation {
+                        key,
+                        expected_revision: 0,
+                        value: json!({"project_id":project,"label":project,"revision":1}),
+                        actor: "journal-import".into(),
+                        operation: "cloud.project.imported.v2".into(),
+                    }],
+                    ..Default::default()
+                })
+                .await
+                .map_err(|_| "migration project initialization failed")?;
+        }
+    }
+    let mut report = MigrationReport {
+        source_sequence: head.0,
+        entities: 0,
+        released_events: 0,
+        projects: project_ids.into_iter().collect(),
+    };
+    for prefix in PREFIXES {
+        let mut after = None;
+        loop {
+            let listed = streams(journal.clone(), prefix, after.clone()).await?;
+            if listed.is_empty() {
+                break;
+            }
+            for stream in &listed {
+                let mut version = 0;
+                loop {
+                    let events = page(journal.clone(), stream.clone(), version).await?;
+                    if events.is_empty() {
+                        break;
+                    }
+                    for (event, value) in events {
+                        if event.stream_version != version + 1 {
+                            return Err("legacy entity revision is inconsistent");
+                        }
+                        if let Some(output) = stream.strip_prefix("cloud.output:") {
+                            let (project, scope) = output
+                                .split_once(':')
+                                .ok_or("legacy output identity is invalid")?;
+                            let update: colossus_sdk::RunUpdate =
+                                serde_json::from_value(value.clone())
+                                    .map_err(|_| "legacy released event is invalid")?;
+                            if update.sequence != event.stream_version {
+                                return Err("legacy released event cursor is inconsistent");
+                            }
+                            store
+                                .commit(CloudTransaction {
+                                    events: vec![ReleasedEvent {
+                                        project_id: project.into(),
+                                        scope_id: scope.into(),
+                                        sequence: event.stream_version,
+                                        value,
+                                    }],
+                                    ..Default::default()
+                                })
+                                .await
+                                .map_err(|_| "legacy released event import failed")?;
+                            report.released_events += 1;
+                        } else {
+                            let key = identity(stream, &value)?;
+                            let current = store.read(&key).await;
+                            let needed = match current {
+                                Ok(record) if record.revision > event.stream_version => false,
+                                Ok(record)
+                                    if record.revision == event.stream_version
+                                        && record.value == value =>
+                                {
+                                    false
+                                }
+                                Ok(record) if record.revision == version => true,
+                                Err(CloudError::NotFound) if version == 0 => true,
+                                _ => {
+                                    return Err(
+                                        "legacy entity target revision conflicts with source",
+                                    );
+                                }
+                            };
+                            if needed {
+                                store
+                                    .commit(CloudTransaction {
+                                        entities: vec![EntityMutation {
+                                            key,
+                                            expected_revision: version,
+                                            value,
+                                            actor: event.actor.id,
+                                            operation: event.event_type,
+                                        }],
+                                        ..Default::default()
+                                    })
+                                    .await
+                                    .map_err(|_| "legacy entity import failed")?;
+                            }
+                            report.entities += 1;
+                        }
+                        version = event.stream_version;
+                    }
+                }
+            }
+            after = listed.last().cloned();
+        }
+    }
+    if journal
+        .head()
+        .map_err(|_| "legacy journal head is unavailable")?
+        != head
+    {
+        return Err("legacy journal changed during migration");
+    }
+    Ok(report)
+}
+
+/// Import a verified, offline legacy cloud journal into an empty or matching resumable database.
+/// Stop both source and destination controllers first. Failed imports retain a running
+/// marker that prevents normal server startup; retry uses the same verified source head.
+pub async fn migrate_journal(
+    legacy_config_path: &Path,
+    config: &Config,
+) -> Result<MigrationReport, &'static str> {
+    config.validate()?;
+    let mut bytes = Vec::new();
+    std::fs::File::open(legacy_config_path)
+        .map_err(|_| "legacy cloud configuration is unavailable")?
+        .take(65537)
+        .read_to_end(&mut bytes)
+        .map_err(|_| "legacy cloud configuration is unavailable")?;
+    if bytes.len() > 65536 {
+        return Err("legacy cloud configuration exceeds its bound");
+    }
+    let legacy = legacy_config(&bytes)?;
+    if matches!(&legacy.storage, LegacyStorage::Postgres{config:source,..} if source.schema == config.database.schema)
+    {
+        return Err("legacy and destination PostgreSQL schemas must be distinct");
+    }
+    let journal = tokio::task::spawn_blocking(move || source(legacy))
+        .await
+        .map_err(|_| "legacy journal initialization failed")??;
+    let head = journal
+        .head()
+        .map_err(|_| "legacy journal head is unavailable")?;
+    projects(journal.clone(), head.clone()).await?;
+    let database = CloudPostgresStore::open(
+        config.database.clone(),
+        &colossus_network::AdditionalRootCertificates::default(),
+    )
+    .await
+    .map_err(|_| "migration database is unavailable")?;
+    let prior = database
+        .begin_journal_import(&head.1, head.0)
+        .await
+        .map_err(|_| "migration target must be empty or match this exact source head")?;
+    if prior.value.get("status").and_then(Value::as_str) == Some("complete") {
+        return Ok(MigrationReport {
+            source_sequence: head.0,
+            entities: prior
+                .value
+                .get("entities")
+                .and_then(Value::as_u64)
+                .unwrap_or_default(),
+            released_events: prior
+                .value
+                .get("released_events")
+                .and_then(Value::as_u64)
+                .unwrap_or_default(),
+            projects: serde_json::from_value(
+                prior.value.get("projects").cloned().unwrap_or(json!([])),
+            )
+            .map_err(|_| "migration completion marker is invalid")?,
+        });
+    }
+    let store: Arc<dyn CloudStore> = Arc::new(database);
+    let report = replay(journal, store.clone(), head.clone()).await?;
+    let repo =
+        CloudRepository::new(store.clone()).map_err(|_| "migration repository is unavailable")?;
+    for project in &report.projects {
+        repo.bootstrap_migrated_project(project)
+            .await
+            .map_err(|_| "legacy conversation projection import failed")?;
+    }
+    let current = store
+        .read(&marker())
+        .await
+        .map_err(|_| "migration marker is unavailable")?;
+    store.commit(CloudTransaction{entities:vec![EntityMutation{key:marker(),expected_revision:current.revision,value:json!({"source_head_hash":head.1,"source_sequence":head.0,"status":"complete","entities":report.entities,"released_events":report.released_events,"projects":report.projects}),actor:"journal-import".into(),operation:"cloud.journal-import.completed.v2".into()}],..Default::default()}).await.map_err(|_|"migration completion could not be committed")?;
+    Ok(report)
+}
diff --git a/crates/colossus-cloud-server/src/migration/tests.rs b/crates/colossus-cloud-server/src/migration/tests.rs
new file mode 100644
index 000000000..7a60f51bc
--- /dev/null
+++ b/crates/colossus-cloud-server/src/migration/tests.rs
@@ -0,0 +1,100 @@
+use super::*;
+use colossus_contracts::{Actor, ActorType, EventClassification, ExecutionContext, NewEvent};
+
+#[tokio::test]
+async fn legacy_import_preserves_stream_versions_ids_receipts_and_output_cursors() {
+    let journal = Arc::new(
+        RedbEventJournal::open_in_memory(
+            Arc::new(PlaintextKeyProvider),
+            Arc::new(DisabledCheckpointSigner),
+        )
+        .expect("source"),
+    );
+    let append = |stream: &str, version: u64, value: Value| {
+        journal
+            .append(NewEvent {
+                stream_id: stream.into(),
+                expected_stream_version: version,
+                event_type: "cloud.fixture.v1".into(),
+                event_version: 1,
+                classification: EventClassification::Domain,
+                actor: Actor {
+                    actor_type: ActorType::Application,
+                    id: "source-owner".into(),
+                },
+                context: ExecutionContext::default(),
+                payload: value,
+            })
+            .expect("source event")
+    };
+    append(
+        "cloud.node:project:node",
+        0,
+        json!({"node_id":"node","project_id":"project","revision":1}),
+    );
+    append(
+        "cloud.node:project:node",
+        1,
+        json!({"node_id":"node","project_id":"project","revision":2}),
+    );
+    append(
+        "cloud.task:project:task",
+        0,
+        json!({"task_id":"task","project_id":"project","node_id":"node","run_id":"run","last_sequence":1,"revision":1}),
+    );
+    append(
+        "cloud.command:project:node:command",
+        0,
+        json!({"command_id":"command","task_id":"task","node_id":"node","revision":1,"reply":{"kind":"fixture-receipt"}}),
+    );
+    append("cloud.run:project:node:run", 0, json!("task"));
+    append("cloud.node-task:project:node:task", 0, json!("task"));
+    let update = colossus_sdk::RunUpdate {
+        run_id: "run".into(),
+        sequence: 1,
+        created_at: "2026-10-05T00:00:00Z".into(),
+        update: colossus_sdk::RunUpdateKind::OutputDelta("Released history".into()),
+    };
+    append(
+        "cloud.output:project:task",
+        0,
+        serde_json::to_value(update).expect("released update"),
+    );
+    let head = journal.head().expect("head");
+    let store: Arc<dyn CloudStore> = Arc::new(MemoryCloudStore::default());
+    let report = replay(journal.clone(), store.clone(), head.clone())
+        .await
+        .expect("import");
+    assert_eq!(report.entities, 6);
+    assert_eq!(report.released_events, 1);
+    let node = store
+        .read(&identity("cloud.node:project:node", &json!({})).expect("key"))
+        .await
+        .expect("node");
+    assert_eq!(node.revision, 2);
+    assert_eq!(node.value["node_id"], "node");
+    let command = store
+        .read(&identity("cloud.command:project:node:command", &json!({})).expect("key"))
+        .await
+        .expect("receipt");
+    assert_eq!(command.value["reply"]["kind"], "fixture-receipt");
+    assert_eq!(
+        store
+            .events("project", "task", 0, 16)
+            .await
+            .expect("events")[0]
+            .sequence,
+        1
+    );
+    replay(journal, store.clone(), head)
+        .await
+        .expect("exact source resumes without duplicates");
+    assert_eq!(
+        store
+            .events("project", "task", 0, 16)
+            .await
+            .expect("events")
+            .len(),
+        1
+    );
+}
diff --git a/crates/colossus-cloud-server/src/observability.rs b/crates/colossus-cloud-server/src/observability.rs
new file mode 100644
index 000000000..a4ef8261d
--- /dev/null
+++ b/crates/colossus-cloud-server/src/observability.rs
@@ -0,0 +1,207 @@
+//! Scoped operational dashboards and runtime-reported policy inspection.
+use crate::{
+    http::{Result, now},
+    server::State,
+};
+use axum::{
+    Json, Router,
+    extract::{Path, Query, State as Extract},
+    http::HeaderMap,
+    routing::get,
+};
+use colossus_cloud::{
+    CloudError,
+    observability::{DailyActivity, OperationalCounts},
+};
+use futures::{StreamExt, TryStreamExt};
+use serde::Deserialize;
+use std::{collections::BTreeMap, sync::Arc};
+
+pub(crate) fn router() -> Router<Arc<State>> {
+    Router::new()
+        .route("/api/dashboard", get(dashboard))
+        .route("/api/overview", get(dashboard))
+        .route("/api/projects/{project}/analytics", get(project_analytics))
+        .route(
+            "/api/projects/{project}/nodes/{node}/analytics",
+            get(node_analytics),
+        )
+        .route(
+            "/api/projects/{project}/nodes/{node}/policy",
+            get(node_policy),
+        )
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Window {
+    #[serde(default = "default_days")]
+    days: u16,
+}
+fn default_days() -> u16 {
+    7
+}
+fn timestamp() -> String {
+    time::OffsetDateTime::now_utc()
+        .format(&time::format_description::well_known::Rfc3339)
+        .unwrap_or_default()
+}
+async fn project_analytics(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Query(window): Query<Window>,
+) -> Result<Json<serde_json::Value>> {
+    analytics(state, headers, project, None, window.days).await
+}
+async fn node_analytics(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, node)): Path<(String, String)>,
+    headers: HeaderMap,
+    Query(window): Query<Window>,
+) -> Result<Json<serde_json::Value>> {
+    analytics(state, headers, project, Some(node), window.days).await
+}
+async fn analytics(
+    state: Arc<State>,
+    headers: HeaderMap,
+    project: String,
+    node: Option<String>,
+    days: u16,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let stats = state
+        .repo
+        .statistics(&caller, node.as_deref(), now(), days)
+        .await?;
+    Ok(Json(
+        serde_json::json!({"generated_at":timestamp(),"window_days":days,"counts":stats.counts,"activity":stats.activity,"usage":stats.usage,"telemetry":{"complete":stats.complete,"description":"Run outcomes and retained provider usage; failures are not evidence of a policy violation."}}),
+    ))
+}
+async fn dashboard(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Query(window): Query<Window>,
+) -> Result<Json<serde_json::Value>> {
+    let days = window.days;
+    if !(1..=90).contains(&days) {
+        return Err(CloudError::InvalidArgument.into());
+    }
+    let observed_at = now();
+    let projects = state.auth.projects(&headers).await?;
+    let mut counts = OperationalCounts::default();
+    let mut recent = Vec::new();
+    let mut activity = BTreeMap::<String, DailyActivity>::new();
+    let mut complete = true;
+    // A bounded four-project fan-out leaves database capacity for agent ingestion.
+    // Visibility is still resolved independently before every project's reads.
+    let snapshots = futures::stream::iter(projects)
+        .map(|project| {
+            let state = &state;
+            let headers = &headers;
+            async move {
+                let caller = match state.auth.caller(headers, &project.id, false).await {
+                    Ok(caller) => caller,
+                    Err(CloudError::PermissionDenied) => return Ok(None),
+                    Err(error) => return Err(error),
+                };
+                let stats = state
+                    .repo
+                    .statistics(&caller, None, observed_at, days)
+                    .await?;
+                let threads = state
+                    .repo
+                    .list_threads(&caller, None, None, Some(false), None, 5)
+                    .await?;
+                Ok::<_, CloudError>(Some((project.name, stats, threads)))
+            }
+        })
+        .buffer_unordered(4)
+        .try_collect::<Vec<_>>()
+        .await?;
+    for (project_name, stats, threads) in snapshots.into_iter().flatten() {
+        counts.projects += 1;
+        counts.hosts += stats.counts.hosts;
+        counts.agents += stats.counts.agents;
+        counts.online_agents += stats.counts.online_agents;
+        counts.threads += stats.counts.threads;
+        counts.runs += stats.counts.runs;
+        counts.completed += stats.counts.completed;
+        counts.failed += stats.counts.failed;
+        counts.cancelled += stats.counts.cancelled;
+        counts.interrupted += stats.counts.interrupted;
+        counts.outcome_unknown += stats.counts.outcome_unknown;
+        counts.active += stats.counts.active;
+        counts.queued += stats.counts.queued;
+        complete &= stats.complete;
+        for day in stats.activity {
+            let total = activity
+                .entry(day.date.clone())
+                .or_insert_with(|| DailyActivity {
+                    date: day.date.clone(),
+                    ..Default::default()
+                });
+            total.runs += day.runs;
+            total.completed += day.completed;
+            total.failed += day.failed;
+            for (aggregate, value) in [
+                (&mut total.input_tokens, day.input_tokens),
+                (&mut total.output_tokens, day.output_tokens),
+            ] {
+                if let Some(value) = value {
+                    *aggregate = Some(
+                        aggregate
+                            .unwrap_or(0)
+                            .checked_add(value)
+                            .ok_or(CloudError::Storage)?,
+                    );
+                }
+            }
+        }
+        for thread in threads {
+            recent.push(serde_json::json!({"project_name":project_name,"thread":thread}));
+        }
+    }
+    recent.sort_by(|a, b| {
+        b.pointer("/thread/updated_at")
+            .and_then(serde_json::Value::as_str)
+            .cmp(
+                &a.pointer("/thread/updated_at")
+                    .and_then(serde_json::Value::as_str),
+            )
+    });
+    recent.truncate(10);
+    Ok(Json(
+        serde_json::json!({"generated_at":timestamp(),"window_days":days,"counts":{"projects":counts.projects,"hosts":counts.hosts,"agents":counts.agents,"online_agents":counts.online_agents,"threads":counts.threads,"active_runs":counts.active,"queued_tasks":counts.queued,"failed_runs":counts.failed,"outcome_unknown_runs":counts.outcome_unknown},"recent_threads":recent,"activity":activity.into_values().collect::<Vec<_>>(),"telemetry":{"complete":complete,"description":"Visible projects only. Run outcomes are not policy-violation counts; imported history may omit usage."}}),
+    ))
+}
+async fn node_policy(
+    Extract(state): Extract<Arc<State>>,
+    Path((project, node)): Path<(String, String)>,
+    headers: HeaderMap,
+) -> Result<Json<serde_json::Value>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    let node = state.repo.get_node(&caller, &node).await?;
+    let current = now();
+    let connected = if node.revoked || !node.runtime_ready {
+        false
+    } else {
+        match state
+            .repo
+            .storage()
+            .read_lease(&project, &node.node_id, current)
+            .await
+        {
+            Ok(_) => true,
+            Err(CloudError::NotFound) => false,
+            Err(error) => return Err(error.into()),
+        }
+    };
+    let observed = node.policy_observed_at;
+    let stale = !connected || observed.is_none_or(|time| current.saturating_sub(time) > 60);
+    let baseline = state.repo.project_policy(&caller).await?;
+    let posture = node.policy.as_ref();
+    let evaluation = baseline.evaluate(posture, stale);
+    Ok(Json(
+        serde_json::json!({"node_id":node.node_id,"observed_at":observed,"last_seen_at":observed,"connected":connected,"posture":posture,"provenance":"runtime_reported","stale":stale,"status":if posture.is_some(){"reported"}else{"unknown"},"description":"Authenticated runtime-reported configuration. Monitoring drift is not independent attestation or proof that a prohibited effect occurred.","expectation":baseline,"evaluation":evaluation}),
+    ))
+}
diff --git a/crates/colossus-cloud-server/src/server.rs b/crates/colossus-cloud-server/src/server.rs
new file mode 100644
index 000000000..d55c7cc33
--- /dev/null
+++ b/crates/colossus-cloud-server/src/server.rs
@@ -0,0 +1,220 @@
+use crate::{auth::Authentication, certificates::CertificateAuthority, config::Config};
+use colossus_cloud::storage::CloudStore;
+use colossus_cloud::{CloudRepository, CloudResult};
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex},
+    time::Instant,
+};
+
+/// Sanitized online state; connectivity never changes a durable task's placement.
+#[derive(Clone, serde::Serialize)]
+pub struct NodePresence {
+    /// Current stream generation.
+    pub connection_id: String,
+    /// Runtime advertised readiness.
+    pub ready: bool,
+    /// Bounded released capability names.
+    pub capabilities: Vec<String>,
+    #[serde(skip)]
+    pub(crate) heartbeat: Option<Instant>,
+}
+pub(crate) struct State {
+    pub config: Config,
+    pub repo: CloudRepository,
+    pub auth: Authentication,
+    pub ca: CertificateAuthority,
+    pub presence: Mutex<HashMap<String, NodePresence>>,
+    pub http_permits: Arc<tokio::sync::Semaphore>,
+    pub sse_permits: Arc<tokio::sync::Semaphore>,
+    pub shutdown: tokio::sync::watch::Sender<bool>,
+    pub replica_id: String,
+}
+/// Fully composed HTTP/OIDC and mutual-TLS runtime host.
+pub struct ControlPlaneServer {
+    pub(crate) state: Arc<State>,
+}
+/// Source-compatible name retained for existing integrations.
+pub type CloudServer = ControlPlaneServer;
+impl ControlPlaneServer {
+    /// Compose after database migrations, verified TLS policy and OIDC discovery.
+    pub async fn open(config: Config) -> Result<Self, &'static str> {
+        config.validate()?;
+        let store = colossus_cloud_postgres::CloudPostgresStore::open(
+            config.database.clone(),
+            &colossus_network::AdditionalRootCertificates::default(),
+        )
+        .await
+        .map_err(|_| "cloud database unavailable")?;
+        Self::with_store(config, Arc::new(store)).await
+    }
+    /// Compose with cloud-owned persistence; deterministic acceptance can inject a test adapter.
+    pub async fn with_store(
+        config: Config,
+        store: Arc<dyn CloudStore>,
+    ) -> Result<Self, &'static str> {
+        config.validate()?;
+        store
+            .readiness()
+            .await
+            .map_err(|_| "cloud database unavailable")?;
+        let marker = colossus_cloud::storage::EntityKey {
+            kind: colossus_cloud::storage::EntityKind::AuthFlow,
+            project_id: "__migration".into(),
+            parent_id: None,
+            id: "journal-import".into(),
+        };
+        match store.read(&marker).await {
+            Ok(record)
+                if record
+                    .value
+                    .get("status")
+                    .and_then(serde_json::Value::as_str)
+                    != Some("complete") =>
+            {
+                return Err("cloud journal migration is incomplete");
+            }
+            Ok(_) | Err(colossus_cloud::CloudError::NotFound) => {}
+            Err(_) => return Err("cloud database unavailable"),
+        }
+        let repo =
+            CloudRepository::new(store.clone()).map_err(|_| "cloud repository unavailable")?;
+        if let Some(classification) = &config.classification {
+            classification
+                .validate()
+                .map_err(|_| "classification banner invalid")?;
+            let key = colossus_cloud::storage::EntityKey {
+                kind: colossus_cloud::storage::EntityKind::Setting,
+                project_id: "__identity".into(),
+                parent_id: None,
+                id: "display".into(),
+            };
+            match store.read(&key).await {
+                Err(colossus_cloud::CloudError::NotFound) => {
+                    let settings = colossus_cloud::settings::ControlPlaneSettings {
+                        revision: 0,
+                        classification: classification.clone(),
+                    };
+                    match repo
+                        .replace_display_settings("operator-configuration", settings)
+                        .await
+                    {
+                        Ok(_) | Err(colossus_cloud::CloudError::Conflict) => {}
+                        Err(_) => return Err("classification banner storage unavailable"),
+                    }
+                }
+                Ok(_) => {}
+                Err(_) => return Err("classification banner storage unavailable"),
+            }
+        }
+        let ca = CertificateAuthority::load(&config)?;
+        let auth = Authentication::with_store(config.clone(), store).await?;
+        Ok(Self {
+            state: Arc::new(State {
+                config,
+                repo,
+                auth,
+                ca,
+                presence: Mutex::new(HashMap::new()),
+                http_permits: Arc::new(tokio::sync::Semaphore::new(256)),
+                sse_permits: Arc::new(tokio::sync::Semaphore::new(1024)),
+                shutdown: tokio::sync::watch::channel(false).0,
+                replica_id: uuid::Uuid::now_v7().simple().to_string(),
+            }),
+        })
+    }
+    /// Run browser HTTP and end-to-end mutual-TLS gRPC until shutdown. Ingress must
+    /// preserve HTTP/2 and TLS passthrough on the connector endpoint.
+    pub async fn serve(
+        self,
+        shutdown: tokio::sync::watch::Receiver<bool>,
+    ) -> Result<(), &'static str> {
+        let config = &self.state.config;
+        let grpc_listener = tokio::net::TcpListener::bind(config.grpc_bind)
+            .await
+            .map_err(|_| "gRPC listener unavailable")?;
+        let listener = tokio::net::TcpListener::bind(config.http_bind)
+            .await
+            .map_err(|_| "HTTP listener unavailable")?;
+        self.serve_listeners(listener, grpc_listener, shutdown)
+            .await
+    }
+    pub(crate) async fn serve_listeners(
+        self,
+        listener: tokio::net::TcpListener,
+        grpc_listener: tokio::net::TcpListener,
+        shutdown: tokio::sync::watch::Receiver<bool>,
+    ) -> Result<(), &'static str> {
+        let config = &self.state.config;
+        let incoming = crate::tls::incoming(grpc_listener, config, &self.state.ca.pem)?;
+        let grpc = tonic::transport::Server::builder()
+            .concurrency_limit_per_connection(2)
+            .timeout(std::time::Duration::from_secs(3600))
+            .add_service(crate::connection::service(self.state.clone()));
+        let http = axum::serve(listener, crate::http::router(self.state.clone()))
+            .with_graceful_shutdown(wait_shutdown(shutdown.clone()));
+        let shutdown_for_streams = shutdown.clone();
+        let grpc = grpc.serve_with_incoming_shutdown(incoming, wait_shutdown(shutdown));
+        let drain = async {
+            tokio::try_join!(
+                async { http.await.map_err(|_| "HTTP server stopped") },
+                async { grpc.await.map_err(|_| "gRPC server stopped") }
+            )?;
+            Ok::<(), &'static str>(())
+        };
+        tokio::pin!(drain);
+        let state = self.state.clone();
+        let forward = async move {
+            wait_shutdown(shutdown_for_streams).await;
+            state.shutdown.send_replace(true);
+        };
+        tokio::pin!(forward);
+        let maintenance_state = self.state.clone();
+        let upkeep = async move {
+            let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
+            interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+            loop {
+                interval.tick().await;
+                if maintenance_state
+                    .repo
+                    .storage()
+                    .maintain(crate::http::now(), &maintenance_state.config.maintenance)
+                    .await
+                    .is_err()
+                {
+                    eprintln!(
+                        "Cloud operational maintenance unavailable; retained state remains authoritative."
+                    );
+                }
+            }
+        };
+        tokio::pin!(upkeep);
+        tokio::select! {
+            result = &mut drain => result?,
+            _ = &mut upkeep => return Err("cloud maintenance stopped"),
+            _ = &mut forward => {
+                tokio::time::timeout(std::time::Duration::from_secs(30), &mut drain)
+                    .await.map_err(|_| "cloud shutdown drain deadline exceeded")??;
+            }
+        }
+        Ok(())
+    }
+}
+async fn wait_shutdown(mut receiver: tokio::sync::watch::Receiver<bool>) {
+    loop {
+        if *receiver.borrow() {
+            return;
+        }
+        if receiver.changed().await.is_err() {
+            return;
+        }
+    }
+}
+pub(crate) async fn db<T: Send, F: std::future::Future<Output = CloudResult<T>> + Send>(
+    repo: CloudRepository,
+    action: impl FnOnce(CloudRepository) -> F + Send,
+) -> CloudResult<T> {
+    // Database pooling bounds concurrency. No blocking PostgreSQL connection is
+    // opened on each service operation and no blocking task owns the transaction.
+    action(repo).await
+}
diff --git a/crates/colossus-cloud-server/src/settings.rs b/crates/colossus-cloud-server/src/settings.rs
new file mode 100644
index 000000000..a65b5ff0f
--- /dev/null
+++ b/crates/colossus-cloud-server/src/settings.rs
@@ -0,0 +1,73 @@
+//! Display settings and monitoring baselines through authenticated administration.
+use crate::{
+    http::{Error, Result},
+    server::State,
+};
+use axum::{
+    Json, Router,
+    extract::{Path, State as Extract},
+    http::HeaderMap,
+    routing::get,
+};
+use colossus_cloud::settings::{ControlPlaneSettings, ProjectPolicyExpectation};
+use std::sync::Arc;
+
+pub(crate) fn router() -> Router<Arc<State>> {
+    Router::new()
+        .route("/api/settings", get(public_settings))
+        .route(
+            "/api/admin/settings",
+            get(admin_settings).patch(update_settings),
+        )
+        .route(
+            "/api/projects/{project}/policy",
+            get(project_policy).patch(update_policy),
+        )
+}
+async fn public_settings(
+    Extract(state): Extract<Arc<State>>,
+) -> Result<Json<ControlPlaneSettings>> {
+    Ok(Json(state.repo.display_settings().await?))
+}
+async fn admin_settings(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+) -> Result<Json<serde_json::Value>> {
+    state.auth.admin(&headers, false).await?;
+    let settings = state.repo.display_settings().await?;
+    Ok(Json(
+        serde_json::json!({"revision":settings.revision,"classification":settings.classification,"auth":{"local_enabled":state.config.local_auth.is_some(),"oidc_label":state.config.oidc.as_ref().map(|oidc| &oidc.label)}}),
+    ))
+}
+async fn update_settings(
+    Extract(state): Extract<Arc<State>>,
+    headers: HeaderMap,
+    Json(settings): Json<ControlPlaneSettings>,
+) -> Result<Json<ControlPlaneSettings>> {
+    let user = state.auth.admin(&headers, true).await?;
+    Ok(Json(
+        state
+            .repo
+            .replace_display_settings(&user.id, settings)
+            .await?,
+    ))
+}
+async fn project_policy(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+) -> Result<Json<ProjectPolicyExpectation>> {
+    let caller = state.auth.caller(&headers, &project, false).await?;
+    Ok(Json(state.repo.project_policy(&caller).await?))
+}
+async fn update_policy(
+    Extract(state): Extract<Arc<State>>,
+    Path(project): Path<String>,
+    headers: HeaderMap,
+    Json(policy): Json<ProjectPolicyExpectation>,
+) -> std::result::Result<Json<ProjectPolicyExpectation>, Error> {
+    let caller = state.auth.caller(&headers, &project, true).await?;
+    Ok(Json(
+        state.repo.replace_project_policy(&caller, policy).await?,
+    ))
+}
diff --git a/crates/colossus-cloud-server/src/sign-in-failed.html b/crates/colossus-cloud-server/src/sign-in-failed.html
new file mode 100644
index 000000000..1e334a740
--- /dev/null
+++ b/crates/colossus-cloud-server/src/sign-in-failed.html
@@ -0,0 +1,78 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Sign-in interrupted · Colossus Cloud</title>
+    <style>
+      :root {
+        color-scheme: dark light;
+        font-family: system-ui, sans-serif;
+        background: #111318;
+        color: #eef0f5;
+      }
+      body {
+        margin: 0;
+        min-height: 100svh;
+        display: grid;
+        place-items: center;
+      }
+      main {
+        width: min(440px, calc(100% - 48px));
+        padding: 48px 0;
+      }
+      .brand {
+        color: #99a6bc;
+        font-size: 14px;
+        letter-spacing: 0.04em;
+      }
+      h1 {
+        font-size: clamp(28px, 6vw, 36px);
+        line-height: 1.2;
+        margin: 28px 0 16px;
+      }
+      p {
+        color: #abb4c4;
+        line-height: 1.6;
+        margin: 0 0 28px;
+      }
+      a {
+        display: inline-block;
+        background: #2365c6;
+        color: #fff;
+        font-weight: 600;
+        text-decoration: none;
+        padding: 12px 18px;
+        border-radius: 8px;
+      }
+      a:hover {
+        background: #1c55a5;
+      }
+      a:focus-visible {
+        outline: 3px solid #a8cdff;
+        outline-offset: 4px;
+      }
+      @media (prefers-color-scheme: light) {
+        :root {
+          background: #f5f7fa;
+          color: #18202f;
+        }
+        .brand,
+        p {
+          color: #536177;
+        }
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <div class="brand">COLOSSUS CLOUD</div>
+      <h1>Let’s try signing in again.</h1>
+      <p>
+        Your sign-in could not be completed. The request may have expired.
+        Return to Colossus and start a fresh sign-in.
+      </p>
+      <a href="/">Return to Colossus</a>
+    </main>
+  </body>
+</html>
diff --git a/crates/colossus-cloud-server/src/tls.rs b/crates/colossus-cloud-server/src/tls.rs
new file mode 100644
index 000000000..73a0783e4
--- /dev/null
+++ b/crates/colossus-cloud-server/src/tls.rs
@@ -0,0 +1,64 @@
+use crate::config::Config;
+use futures::{Stream, StreamExt};
+use rustls::{
+    RootCertStore, ServerConfig,
+    pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject},
+    server::WebPkiClientVerifier,
+};
+use std::{sync::Arc, time::Duration};
+use tokio::{
+    net::{TcpListener, TcpStream},
+    time::timeout,
+};
+use tokio_rustls::{TlsAcceptor, server::TlsStream};
+use tokio_stream::wrappers::TcpListenerStream;
+use zeroize::Zeroizing;
+
+pub(crate) fn incoming(
+    listener: TcpListener,
+    config: &Config,
+    ca_pem: &str,
+) -> Result<impl Stream<Item = Result<TlsStream<TcpStream>, std::io::Error>>, &'static str> {
+    let certificate =
+        std::fs::read(&config.server_certificate).map_err(|_| "cannot load server certificate")?;
+    let key =
+        Zeroizing::new(std::fs::read(&config.server_key).map_err(|_| "cannot load server key")?);
+    let chain = CertificateDer::pem_slice_iter(&certificate)
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|_| "invalid server certificate")?;
+    let key = PrivateKeyDer::from_pem_slice(&key).map_err(|_| "invalid server key")?;
+    let mut roots = RootCertStore::empty();
+    for certificate in CertificateDer::pem_slice_iter(ca_pem.as_bytes()) {
+        roots
+            .add(certificate.map_err(|_| "invalid client CA")?)
+            .map_err(|_| "invalid client CA")?;
+    }
+    let provider = Arc::new(rustls::crypto::ring::default_provider());
+    let verifier = WebPkiClientVerifier::builder_with_provider(Arc::new(roots), provider.clone())
+        .build()
+        .map_err(|_| "invalid client CA")?;
+    let mut tls = ServerConfig::builder_with_provider(provider)
+        .with_protocol_versions(&[&rustls::version::TLS13])
+        .map_err(|_| "TLS 1.3 unavailable")?
+        .with_client_cert_verifier(verifier)
+        .with_single_cert(chain, key)
+        .map_err(|_| "invalid TLS identity")?;
+    tls.alpn_protocols = vec![b"h2".to_vec()];
+    let acceptor = TlsAcceptor::from(Arc::new(tls));
+    Ok(TcpListenerStream::new(listener)
+        .map(move |socket| {
+            let acceptor = acceptor.clone();
+            async move {
+                match socket {
+                    Ok(socket) => timeout(Duration::from_secs(5), acceptor.accept(socket))
+                        .await
+                        .ok()
+                        .and_then(Result::ok)
+                        .map(Ok),
+                    Err(error) => Some(Err(error)),
+                }
+            }
+        })
+        .buffer_unordered(64)
+        .filter_map(|result| async move { result }))
+}
diff --git a/crates/colossus-cloud/Cargo.toml b/crates/colossus-cloud/Cargo.toml
new file mode 100644
index 000000000..2d3027fc1
--- /dev/null
+++ b/crates/colossus-cloud/Cargo.toml
@@ -0,0 +1,28 @@
+[package]
+name = "colossus-cloud"
+publish = false
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+async-trait.workspace = true
+tokio.workspace = true
+time.workspace = true
+colossus-cloud-protocol.workspace = true
+colossus-contracts.workspace = true
+colossus-ports.workspace = true
+colossus-sdk = { workspace = true, features = ["serialization"] }
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+hex.workspace = true
+thiserror.workspace = true
+uuid.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+
+[lints]
+workspace = true
diff --git a/crates/colossus-cloud/src/accounts.rs b/crates/colossus-cloud/src/accounts.rs
new file mode 100644
index 000000000..2d3269505
--- /dev/null
+++ b/crates/colossus-cloud/src/accounts.rs
@@ -0,0 +1,229 @@
+use crate::storage::{EntityKey, EntityKind};
+use crate::{CloudError, CloudPermission, CloudResult, validate_identifier};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
+
+/// Fixed global authority namespace, separate from project resource authority.
+pub const IDENTITY_NAMESPACE: &str = "__identity";
+
+/// Human account metadata. Credentials are retained separately and never released here.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct CloudUser {
+    /// Immutable domain identity within its namespace.
+    pub id: String,
+    /// Bounded human-readable account name.
+    pub display_name: String,
+    /// Optional display-only contact; never an account-linking proof.
+    pub email: Option<String>,
+    /// Whether new logins and retained sessions may authenticate.
+    pub active: bool,
+    /// Global product management and all-project read visibility; execution remains explicit.
+    pub is_admin: bool,
+    /// Current compare-and-swap revision.
+    pub revision: u64,
+    /// UTC RFC3339 creation time.
+    pub created_at: String,
+    /// UTC RFC3339 last-edit time.
+    pub updated_at: String,
+    #[serde(default)]
+    /// Credential-free login binding metadata.
+    pub identities: Vec<LoginIdentityMetadata>,
+}
+
+/// Safe login binding metadata for account administration.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LoginIdentityMetadata {
+    /// Login kind, local or oidc.
+    pub kind: String,
+    /// Human-readable configured login provider name.
+    pub label: String,
+    /// Canonical local username, when applicable.
+    pub username: Option<String>,
+    /// Exact trusted OIDC issuer, when applicable.
+    pub issuer: Option<String>,
+    /// Verified issuer-bound subject, when applicable.
+    pub subject: Option<String>,
+}
+
+/// Retained account plus a revocation generation; changing credentials retires old sessions.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct UserAccount {
+    /// Credential-free account metadata.
+    pub user: CloudUser,
+    /// Monotonic generation invalidating previously authenticated sessions.
+    pub security_epoch: u64,
+}
+
+/// An explicit project role. Hierarchy display never implies inherited membership.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ProjectRole {
+    /// Read released project data.
+    Viewer,
+    /// Read, submit tasks and control ordinary task interactions.
+    Operator,
+    /// Read/control and answer exact native effect approvals.
+    Approver,
+    /// Configure and operate the project; approval requires a separate explicit grant.
+    ProjectAdmin,
+}
+impl ProjectRole {
+    /// Exact permission bundle for a newly assigned built-in role.
+    pub fn permissions(self) -> BTreeSet<CloudPermission> {
+        use CloudPermission::*;
+        match self {
+            Self::Viewer => [Read].into(),
+            Self::Operator => [Read, Execute, Control].into(),
+            Self::Approver => [Read, Control, Approve].into(),
+            Self::ProjectAdmin => [Read, Execute, Control, Administer].into(),
+        }
+    }
+}
+
+/// Named project namespace with independently authorized children.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct CloudProject {
+    /// Immutable domain identity within its namespace.
+    pub id: String,
+    /// Bounded project display name.
+    pub name: String,
+    #[serde(default)]
+    /// Bounded plain-text project description.
+    pub description: String,
+    /// Display parent; access is independent and never inherited.
+    pub parent_project_id: Option<String>,
+    /// Retain history while removing cloud execution/control/approval access.
+    pub archived: bool,
+    /// Current compare-and-swap revision.
+    pub revision: u64,
+    /// UTC RFC3339 creation time.
+    pub created_at: String,
+    /// UTC RFC3339 last-edit time.
+    pub updated_at: String,
+}
+
+/// Persisted project membership with its explicit permission ceiling.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct ProjectMembership {
+    /// Exact project authority namespace.
+    pub project_id: String,
+    /// Stable persisted account identity.
+    pub user_id: String,
+    /// Compatibility correlation field: always equal to the stable user identity.
+    pub subject: String,
+    /// Server-derived explicit project role.
+    pub role: ProjectRole,
+    /// Persisted cloud ceiling; intersects the native runtime grant.
+    pub permissions: BTreeSet<CloudPermission>,
+    /// Current compare-and-swap revision.
+    pub revision: u64,
+}
+
+/// Verified provider binding. Emails are never used to link accounts.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct OidcIdentity {
+    /// Stable persisted account identity.
+    pub user_id: String,
+    /// Exact trusted OIDC issuer, when applicable.
+    pub issuer: String,
+    /// Verified issuer-bound subject, when applicable.
+    pub subject: String,
+}
+
+/// Native-host-only salted PHC credential. Never expose it in browser responses.
+#[derive(Clone, Serialize, Deserialize)]
+pub struct LocalCredential {
+    /// Stable persisted account identity.
+    pub user_id: String,
+    /// Canonical local username, when applicable.
+    pub username: String,
+    /// Salted Argon2id PHC value, retained exclusively by host storage.
+    pub password_hash: String,
+}
+
+/// Construct a key in the fixed identity authority namespace.
+pub fn identity_key(kind: EntityKind, id: &str) -> EntityKey {
+    EntityKey {
+        kind,
+        project_id: IDENTITY_NAMESPACE.into(),
+        parent_id: None,
+        id: id.into(),
+    }
+}
+/// Construct the canonical project key.
+pub fn project_key(id: &str) -> EntityKey {
+    EntityKey {
+        kind: EntityKind::Project,
+        project_id: id.into(),
+        parent_id: None,
+        id: id.into(),
+    }
+}
+/// Construct one stable account membership key within a project.
+pub fn membership_key(project: &str, user: &str) -> EntityKey {
+    EntityKey {
+        kind: EntityKind::Membership,
+        project_id: project.into(),
+        parent_id: None,
+        id: hash_identity(&[user]),
+    }
+}
+/// Compute a SHA-256 domain identity from length-prefixed components.
+pub fn hash_identity(parts: &[&str]) -> String {
+    let mut hash = Sha256::new();
+    for part in parts {
+        hash.update((part.len() as u64).to_be_bytes());
+        hash.update(part.as_bytes());
+    }
+    hex::encode(hash.finalize())
+}
+/// Validate and ASCII-fold a bounded canonical local username.
+pub fn normalize_username(value: &str) -> CloudResult<String> {
+    if !(3..=128).contains(&value.len())
+        || !value
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'_' | b'-' | b'.' | b'@'))
+    {
+        return Err(CloudError::InvalidArgument);
+    }
+    Ok(value.to_ascii_lowercase())
+}
+/// Validate public account metadata before persistence.
+pub fn validate_user(user: &CloudUser) -> CloudResult<()> {
+    validate_identifier(&user.id)?;
+    if user.display_name.trim().is_empty()
+        || user.display_name.len() > 256
+        || user.display_name.chars().any(char::is_control)
+        || user
+            .email
+            .as_ref()
+            .is_some_and(|s| s.len() > 320 || s.chars().any(char::is_control))
+    {
+        return Err(CloudError::InvalidArgument);
+    }
+    Ok(())
+}
+/// Validate project metadata and reserved hierarchy identifiers.
+pub fn validate_project(project: &CloudProject) -> CloudResult<()> {
+    validate_identifier(&project.id)?;
+    if project.id.starts_with("__")
+        || project.name.trim().is_empty()
+        || project.name.len() > 256
+        || project.name.chars().any(char::is_control)
+        || project.description.len() > 4096
+        || project
+            .description
+            .chars()
+            .any(|c| c.is_control() && !matches!(c, '\n' | '\t'))
+    {
+        return Err(CloudError::InvalidArgument);
+    }
+    if let Some(parent) = &project.parent_project_id {
+        validate_identifier(parent)?;
+        if parent == &project.id {
+            return Err(CloudError::InvalidArgument);
+        }
+    }
+    Ok(())
+}
diff --git a/crates/colossus-cloud/src/enrollment.rs b/crates/colossus-cloud/src/enrollment.rs
new file mode 100644
index 000000000..fac746f92
--- /dev/null
+++ b/crates/colossus-cloud/src/enrollment.rs
@@ -0,0 +1,50 @@
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+
+/// Single-use enrollment invitation, bound to administrator-reviewed placement.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Enrollment {
+    /// Hash of the high-entropy invitation, never its redeemable plaintext.
+    pub token_hash: String,
+    /// Fixed owning project.
+    pub project_id: String,
+    /// Fixed node identity.
+    pub node_id: String,
+    /// Administrator-reviewed display label.
+    pub label: String,
+    /// Additional role ceiling, independent of the local grant.
+    pub roles: BTreeSet<String>,
+    /// Unix second expiry enforced at redemption.
+    pub expires_at: u64,
+    /// Exact enrolled certificate hash after redemption.
+    pub redeemed_certificate: Option<String>,
+    /// CSR hash bound to the consumed invitation for exact retry reconciliation.
+    pub redeemed_csr: Option<String>,
+    /// Public issued certificate retained to reconcile a lost enrollment response.
+    pub certificate_pem: Option<String>,
+}
+
+/// Host-validated issuance, carrying no private signing or connector key.
+pub struct CertificateRedemption {
+    /// Exact issued leaf hash.
+    pub fingerprint: String,
+    /// Exact verified CSR hash.
+    pub csr_sha256: String,
+    /// Issued public leaf PEM.
+    pub certificate_pem: String,
+}
+
+/// Exact identity authenticated by the existing mTLS leaf during certificate renewal.
+pub struct RenewalIdentity<'a> {
+    /// Owning project.
+    pub project_id: &'a str,
+    /// Fixed enrolled node.
+    pub node_id: &'a str,
+    /// Independently bound local runtime.
+    pub instance_id: &'a str,
+    /// SHA-256 of the presented client leaf.
+    pub previous_fingerprint: &'a str,
+    /// Durable native-generated renewal identity.
+    pub renewal_id: &'a str,
+}
diff --git a/crates/colossus-cloud/src/error.rs b/crates/colossus-cloud/src/error.rs
new file mode 100644
index 000000000..71fba8e81
--- /dev/null
+++ b/crates/colossus-cloud/src/error.rs
@@ -0,0 +1,35 @@
+/// Bounded categorical cloud service failure, without credential or payload diagnostics.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, serde::Serialize, thiserror::Error)]
+#[serde(rename_all = "snake_case")]
+pub enum CloudError {
+    /// Required project permission or enrolled node authority is absent.
+    #[error("cloud authority is absent or revoked")]
+    PermissionDenied,
+    /// A strict field or identity binding was invalid.
+    #[error("cloud request is invalid")]
+    InvalidArgument,
+    /// Resource is absent within the authenticated project.
+    #[error("cloud resource was not found")]
+    NotFound,
+    /// A mutation identity, revision, or event cursor conflicts with durable state.
+    #[error("cloud state conflicts with this request")]
+    Conflict,
+    /// A configured resource budget was exhausted.
+    #[error("cloud resource bound was exceeded")]
+    ResourceExhausted,
+    /// Canonical storage or integrity verification is unavailable.
+    #[error("cloud storage is unavailable")]
+    Storage,
+}
+
+/// Result returned by project-scoped cloud services.
+pub type CloudResult<T> = Result<T, CloudError>;
+
+impl From<colossus_ports::StoreError> for CloudError {
+    fn from(error: colossus_ports::StoreError) -> Self {
+        match error {
+            colossus_ports::StoreError::Conflict { .. } => Self::Conflict,
+            _ => Self::Storage,
+        }
+    }
+}
diff --git a/crates/colossus-cloud/src/identity.rs b/crates/colossus-cloud/src/identity.rs
new file mode 100644
index 000000000..43bec9920
--- /dev/null
+++ b/crates/colossus-cloud/src/identity.rs
@@ -0,0 +1,67 @@
+use crate::{CloudError, CloudResult, validate_identifier};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+
+/// Cloud permission independent of the runtime's local role/tool/scope ceiling.
+#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CloudPermission {
+    /// Read the project's registered runtimes and released tasks.
+    Read,
+    /// Submit agent tasks beneath the selected node's grant.
+    Execute,
+    /// Cooperatively cancel project tasks and answer ordinary prompts.
+    Control,
+    /// Answer exact runtime-bound effect approvals.
+    Approve,
+    /// Enroll and revoke project nodes.
+    Administer,
+}
+
+/// Project authority constructed only after the host authenticates an identity.
+///
+/// Browser request bodies never supply this context. Verified identity and persisted
+/// project membership are resolved by host authentication, never by request fields.
+#[derive(Clone, Debug)]
+pub struct CloudCaller {
+    pub(crate) subject: String,
+    pub(crate) project_id: String,
+    permissions: BTreeSet<CloudPermission>,
+}
+
+impl CloudCaller {
+    /// Bind one verified subject to an explicit project membership and permission set.
+    pub fn new(
+        subject: String,
+        project_id: String,
+        permissions: BTreeSet<CloudPermission>,
+    ) -> CloudResult<Self> {
+        validate_identifier(&project_id)?;
+        if subject.is_empty() || subject.len() > 256 || subject.chars().any(char::is_control) {
+            return Err(CloudError::InvalidArgument);
+        }
+        Ok(Self {
+            subject,
+            project_id,
+            permissions,
+        })
+    }
+
+    /// Authenticated subject, suitable for bounded audit correlation.
+    pub fn subject(&self) -> &str {
+        &self.subject
+    }
+
+    /// Exact project selected from authenticated membership.
+    pub fn project_id(&self) -> &str {
+        &self.project_id
+    }
+
+    /// Enforce one exact cloud permission. Administer is not implicit execution.
+    pub fn require(&self, permission: CloudPermission) -> CloudResult<()> {
+        self.permissions
+            .contains(&permission)
+            .then_some(())
+            .ok_or(CloudError::PermissionDenied)
+    }
+}
diff --git a/crates/colossus-cloud/src/lib.rs b/crates/colossus-cloud/src/lib.rs
new file mode 100644
index 000000000..0cdd79f01
--- /dev/null
+++ b/crates/colossus-cloud/src/lib.rs
@@ -0,0 +1,30 @@
+//! Project-scoped cloud placement and released-data services over cloud-owned relational storage.
+//!
+//! This crate never constructs a runtime, executes tools, or grants local authority.
+//! Transports authenticate callers and nodes before entering these services.
+
+mod accounts;
+mod enrollment;
+mod error;
+mod identity;
+/// Read-only controller operational projections.
+pub mod observability;
+mod repository;
+/// Audited public display settings and read-only policy expectations.
+pub mod settings;
+/// Cloud-owned persistence and coordination contracts.
+pub mod storage;
+mod types;
+mod validation;
+
+pub use accounts::*;
+pub use enrollment::{CertificateRedemption, Enrollment, RenewalIdentity};
+
+pub use error::{CloudError, CloudResult};
+pub use identity::{CloudCaller, CloudPermission};
+pub use repository::CloudRepository;
+pub use types::*;
+pub use validation::validate_identifier;
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/colossus-cloud/src/observability.rs b/crates/colossus-cloud/src/observability.rs
new file mode 100644
index 000000000..d2fda0fe0
--- /dev/null
+++ b/crates/colossus-cloud/src/observability.rs
@@ -0,0 +1,385 @@
+//! Read-only operational statistics. These projections never grant execution authority.
+
+use crate::storage::{CloudStore, EntityKind, EntityOrder, EntityQuery, EntityRecord};
+use crate::{CloudCaller, CloudError, CloudPermission, CloudRepository, CloudResult};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+/// Controller-retained counts; run outcomes remain distinct from policy violations.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct OperationalCounts {
+    /// Visible project namespaces; populated by the global dashboard.
+    pub projects: u64,
+    /// Retained host groupings in the selected scope.
+    pub hosts: u64,
+    /// Enrolled, non-revoked runtime registrations.
+    pub agents: u64,
+    /// Ready runtimes with a live fenced connection lease.
+    pub online_agents: u64,
+    /// Retained conversations, including archived history.
+    pub threads: u64,
+    /// Controller-known runs created inside the selected UTC window.
+    pub runs: u64,
+    /// Runs with a known completed outcome.
+    pub completed: u64,
+    /// Runs with a known failed outcome, not a policy-violation count.
+    pub failed: u64,
+    /// Runs with a known cancellation outcome.
+    pub cancelled: u64,
+    /// Runs interrupted before completion.
+    pub interrupted: u64,
+    /// Runs whose external effect outcome remains uncertain.
+    pub outcome_unknown: u64,
+    /// Current running, waiting or cancelling runs, independent of the window.
+    pub active: u64,
+    /// Current accepted runs awaiting execution.
+    pub queued: u64,
+}
+
+/// One UTC day of retained run activity, including days without runs.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct DailyActivity {
+    /// UTC calendar date in YYYY-MM-DD format.
+    pub date: String,
+    /// Controller-known runs created inside the selected UTC window.
+    pub runs: u64,
+    /// Runs with a known completed outcome.
+    pub completed: u64,
+    /// Runs with a known failed outcome, not a policy-violation count.
+    pub failed: u64,
+    /// Sum of retained provider input-token reports; absent means unknown.
+    pub input_tokens: Option<u64>,
+    /// Sum of retained provider output-token reports; absent means unknown.
+    pub output_tokens: Option<u64>,
+}
+
+/// Provider-reported token accounting; missing reports and prices remain unknown.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct OperationalUsage {
+    /// Sum of retained provider input-token reports; absent means unknown.
+    pub input_tokens: Option<u64>,
+    /// Sum of retained provider output-token reports; absent means unknown.
+    pub output_tokens: Option<u64>,
+    /// Absent until explicit provider pricing is configured.
+    pub estimated_cost: Option<f64>,
+    /// Human-readable accounting provenance and coverage limits.
+    pub coverage: String,
+}
+impl Default for OperationalUsage {
+    fn default() -> Self {
+        Self {
+            input_tokens: None,
+            output_tokens: None,
+            estimated_cost: None,
+            coverage: "Only retained provider usage reports are counted; imported or bounded history may omit usage. Pricing is not configured.".into(),
+        }
+    }
+}
+
+/// Database projection from one scoped, read-only query.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct OperationalStatistics {
+    /// Scoped metadata counts.
+    pub counts: OperationalCounts,
+    /// Ordered UTC daily buckets.
+    pub activity: Vec<DailyActivity>,
+    /// Retained provider-reported usage only.
+    pub usage: OperationalUsage,
+    /// False when a bounded fallback query reached its collection limit.
+    pub complete: bool,
+}
+
+impl CloudRepository {
+    /// Read project or agent statistics beneath authenticated project visibility.
+    pub async fn statistics(
+        &self,
+        caller: &CloudCaller,
+        node: Option<&str>,
+        now: u64,
+        days: u16,
+    ) -> CloudResult<OperationalStatistics> {
+        caller.require(CloudPermission::Read)?;
+        if let Some(node) = node {
+            crate::validate_identifier(node)?;
+            self.get_node(caller, node).await?;
+        }
+        if !(1..=90).contains(&days) {
+            return Err(CloudError::InvalidArgument);
+        }
+        self.store
+            .statistics(caller.project_id(), node, now, days)
+            .await
+    }
+}
+
+/// Bounded deterministic adapter fallback; PostgreSQL uses aggregate SQL instead.
+pub(crate) async fn collect<S: CloudStore + ?Sized>(
+    store: &S,
+    project: &str,
+    node: Option<&str>,
+    now: u64,
+    days: u16,
+) -> CloudResult<OperationalStatistics> {
+    if !(1..=90).contains(&days) {
+        return Err(CloudError::InvalidArgument);
+    }
+    let today = i64::try_from(now / 86_400).map_err(|_| CloudError::InvalidArgument)?;
+    let first = today - i64::from(days) + 1;
+    let mut activity = BTreeMap::new();
+    for day in first..=today {
+        let timestamp = time::OffsetDateTime::from_unix_timestamp(day * 86_400)
+            .map_err(|_| CloudError::InvalidArgument)?;
+        let date = timestamp.date().to_string();
+        activity.insert(
+            date.clone(),
+            DailyActivity {
+                date,
+                ..Default::default()
+            },
+        );
+    }
+    let mut result = OperationalStatistics {
+        complete: true,
+        ..Default::default()
+    };
+    let (nodes, complete) = records(store, project, EntityKind::Node, node).await?;
+    result.complete &= complete;
+    for record in &nodes {
+        if !record
+            .value
+            .get("revoked")
+            .and_then(serde_json::Value::as_bool)
+            .unwrap_or(false)
+        {
+            result.counts.agents += 1;
+            if record
+                .value
+                .get("runtime_ready")
+                .and_then(serde_json::Value::as_bool)
+                == Some(true)
+                && store.read_lease(project, &record.key.id, now).await.is_ok()
+            {
+                result.counts.online_agents += 1;
+            }
+        }
+    }
+    if node.is_some() {
+        result.counts.hosts = nodes
+            .iter()
+            .filter_map(|r| r.value.get("host_id").and_then(serde_json::Value::as_str))
+            .collect::<std::collections::BTreeSet<_>>()
+            .len() as u64;
+    } else {
+        let (hosts, complete) = records(store, project, EntityKind::Host, None).await?;
+        result.counts.hosts = hosts.len() as u64;
+        result.complete &= complete;
+    }
+    let (threads, complete) = records(store, project, EntityKind::Thread, node).await?;
+    result.counts.threads = threads.len() as u64;
+    result.complete &= complete;
+    let (tasks, complete) = records(store, project, EntityKind::Task, node).await?;
+    result.complete &= complete;
+    for record in tasks {
+        let value = &record.value;
+        let status = if value
+            .pointer("/dispatch_error/code")
+            .and_then(serde_json::Value::as_str)
+            == Some("outcome_unknown")
+        {
+            "outcome_unknown"
+        } else if value
+            .get("dispatch_error")
+            .is_some_and(|value| !value.is_null())
+        {
+            "failed"
+        } else {
+            value
+                .pointer("/snapshot/run/status")
+                .and_then(serde_json::Value::as_str)
+                .unwrap_or("queued")
+        };
+        match status {
+            "running" | "waiting" | "cancelling" => result.counts.active += 1,
+            "queued" => result.counts.queued += 1,
+            _ => {}
+        }
+        let Some(created) = value.get("created_at").and_then(serde_json::Value::as_str) else {
+            continue;
+        };
+        let Ok(created) =
+            time::OffsetDateTime::parse(created, &time::format_description::well_known::Rfc3339)
+        else {
+            continue;
+        };
+        if created.unix_timestamp() > now as i64 {
+            continue;
+        }
+        let Some(day) = activity.get_mut(&created.date().to_string()) else {
+            continue;
+        };
+        result.counts.runs += 1;
+        day.runs += 1;
+        match status {
+            "completed" => {
+                result.counts.completed += 1;
+                day.completed += 1;
+            }
+            "failed" => {
+                result.counts.failed += 1;
+                day.failed += 1;
+            }
+            "cancelled" => result.counts.cancelled += 1,
+            "interrupted" => result.counts.interrupted += 1,
+            "outcome_unknown" => result.counts.outcome_unknown += 1,
+            _ => {}
+        }
+        let mut after = 0;
+        loop {
+            let events = store.events(project, &record.key.id, after, 100).await?;
+            for event in &events {
+                if let Some(usage) = event.value.pointer("/update/usage") {
+                    for (name, daily, total) in [
+                        (
+                            "input_tokens",
+                            &mut day.input_tokens,
+                            &mut result.usage.input_tokens,
+                        ),
+                        (
+                            "output_tokens",
+                            &mut day.output_tokens,
+                            &mut result.usage.output_tokens,
+                        ),
+                    ] {
+                        if let Some(tokens) = usage.get(name).and_then(serde_json::Value::as_u64) {
+                            *daily = Some(
+                                daily
+                                    .unwrap_or(0)
+                                    .checked_add(tokens)
+                                    .ok_or(CloudError::Storage)?,
+                            );
+                            *total = Some(
+                                total
+                                    .unwrap_or(0)
+                                    .checked_add(tokens)
+                                    .ok_or(CloudError::Storage)?,
+                            );
+                        }
+                    }
+                }
+            }
+            if events.len() < 100 {
+                break;
+            }
+            after = events.last().ok_or(CloudError::Storage)?.sequence;
+            if after >= 10_000 {
+                result.complete = false;
+                break;
+            }
+        }
+    }
+    result.activity = activity.into_values().collect();
+    Ok(result)
+}
+
+async fn records<S: CloudStore + ?Sized>(
+    store: &S,
+    project: &str,
+    kind: EntityKind,
+    node: Option<&str>,
+) -> CloudResult<(Vec<EntityRecord>, bool)> {
+    let mut all = Vec::new();
+    let mut after = None;
+    loop {
+        let page = store
+            .list(&EntityQuery {
+                kind,
+                project_id: project.into(),
+                node_id: node.map(str::to_owned),
+                after,
+                limit: 100,
+                order: EntityOrder::IdAsc,
+                ..Default::default()
+            })
+            .await?;
+        let done = page.len() < 100;
+        after = page.last().map(|r| r.key.id.clone());
+        all.extend(page);
+        if done {
+            return Ok((all, true));
+        }
+        if all.len() >= 10_000 {
+            return Ok((all, false));
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::storage::{
+        CloudTransaction, EntityKey, EntityMutation, MemoryCloudStore, ReleasedEvent,
+    };
+    #[tokio::test]
+    async fn scoped_counts_distinguish_unknown_usage_and_ignore_thread_feed_duplicates() {
+        let store = std::sync::Arc::new(MemoryCloudStore::default());
+        let entity = |project: &str, id: &str, value: serde_json::Value| EntityMutation {
+            key: EntityKey {
+                kind: EntityKind::Task,
+                project_id: project.into(),
+                parent_id: None,
+                id: id.into(),
+            },
+            expected_revision: 0,
+            value,
+            actor: "fixture".into(),
+            operation: "fixture.task.created".into(),
+        };
+        let usage = serde_json::json!({"update":{"usage":{"input_tokens":17,"output_tokens":0}}});
+        store.commit(CloudTransaction { entities:vec![
+            entity("project-a","task-a",serde_json::json!({"created_at":"2026-10-06T12:00:00Z","node_id":"node-a","snapshot":{"run":{"status":"completed"}}})),
+            entity("project-a","task-b",serde_json::json!({"created_at":"2026-10-06T12:00:00Z","node_id":"node-b","snapshot":{"run":{"status":"outcome_unknown"}}})),
+            entity("project-b","task-other",serde_json::json!({"created_at":"2026-10-06T12:00:00Z","node_id":"node-a","snapshot":{"run":{"status":"failed"}}})),
+        ], events:vec![
+            ReleasedEvent{project_id:"project-a".into(),scope_id:"task-a".into(),sequence:1,value:usage.clone()},
+            ReleasedEvent{project_id:"project-a".into(),scope_id:"thread-copy".into(),sequence:1,value:usage},
+        ], ..Default::default() }).await.unwrap();
+        let repo = CloudRepository::new(store.clone()).unwrap();
+        let caller = CloudCaller::new(
+            "reader".into(),
+            "project-a".into(),
+            [CloudPermission::Read].into(),
+        )
+        .unwrap();
+        let now = time::OffsetDateTime::parse(
+            "2026-10-06T13:00:00Z",
+            &time::format_description::well_known::Rfc3339,
+        )
+        .unwrap()
+        .unix_timestamp() as u64;
+        let stats = repo.statistics(&caller, None, now, 7).await.unwrap();
+        assert_eq!(stats.counts.runs, 2);
+        assert_eq!(stats.counts.completed, 1);
+        assert_eq!(stats.counts.failed, 0);
+        assert_eq!(stats.counts.outcome_unknown, 1);
+        assert_eq!(stats.usage.input_tokens, Some(17));
+        assert_eq!(stats.usage.output_tokens, Some(0));
+        assert_eq!(stats.activity.len(), 7);
+        assert!(stats.activity[0].input_tokens.is_none());
+        let node_stats = store
+            .statistics("project-a", Some("node-b"), now, 7)
+            .await
+            .unwrap();
+        assert_eq!(node_stats.counts.runs, 1);
+        assert!(node_stats.usage.input_tokens.is_none());
+        let denied =
+            CloudCaller::new("reader".into(), "project-a".into(), Default::default()).unwrap();
+        assert_eq!(
+            repo.statistics(&denied, None, now, 7).await.unwrap_err(),
+            CloudError::PermissionDenied
+        );
+        assert_eq!(
+            repo.statistics(&caller, None, now, 91).await.unwrap_err(),
+            CloudError::InvalidArgument
+        );
+    }
+}
diff --git a/crates/colossus-cloud/src/repository.rs b/crates/colossus-cloud/src/repository.rs
new file mode 100644
index 000000000..05be91737
--- /dev/null
+++ b/crates/colossus-cloud/src/repository.rs
@@ -0,0 +1,208 @@
+use crate::storage::{
+    CloudStore, CloudTransaction, ConnectionLease, CursorMutation, EntityKey, EntityKind,
+    EntityMutation, EntityOrder, EntityQuery, ReleasedEvent,
+};
+use crate::{
+    CloudCaller, CloudError, CloudNode, CloudPermission, CloudResult, CloudTask, PendingCommand,
+};
+use colossus_cloud_protocol::{CloudReply, Command};
+use serde::{Serialize, de::DeserializeOwned};
+use std::sync::Arc;
+
+mod accounts;
+mod delivery;
+mod enrollment;
+mod history;
+mod inventory;
+mod nodes;
+mod projects;
+mod renewal;
+mod tasks;
+mod threads;
+
+/// Project-scoped application services backed by cloud-owned relational storage.
+#[derive(Clone)]
+pub struct CloudRepository {
+    pub(super) store: Arc<dyn CloudStore>,
+    lease: Option<ConnectionLease>,
+    ingest: Arc<tokio::sync::Semaphore>,
+}
+pub(super) enum Write {
+    Entity(EntityMutation),
+    Event(ReleasedEvent),
+    Cursor(CursorMutation),
+}
+impl CloudRepository {
+    /// Bind independent cloud persistence. Runtime journals never enter this boundary.
+    pub fn new(store: Arc<dyn CloudStore>) -> CloudResult<Self> {
+        Ok(Self {
+            store,
+            lease: None,
+            ingest: Arc::new(tokio::sync::Semaphore::new(12)),
+        })
+    }
+    /// Bind every mutation to the exact active connection generation.
+    pub fn with_lease(&self, lease: ConnectionLease) -> Self {
+        Self {
+            store: self.store.clone(),
+            lease: Some(lease),
+            ingest: self.ingest.clone(),
+        }
+    }
+    /// Probe cloud database readiness without releasing project payloads.
+    pub async fn check_readiness(&self) -> CloudResult<()> {
+        self.store.readiness().await
+    }
+    /// Retain the cloud persistence authority for host composition and coordination.
+    pub fn storage(&self) -> Arc<dyn CloudStore> {
+        self.store.clone()
+    }
+    async fn read<T: DeserializeOwned>(&self, identity: &str) -> CloudResult<(T, u64)> {
+        let record = self.store.read(&key(identity)?).await?;
+        Ok((
+            serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?,
+            record.revision,
+        ))
+    }
+    async fn list<T: DeserializeOwned>(
+        &self,
+        prefix: &str,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<T>> {
+        let query = query(prefix, after, limit.min(100))?;
+        self.store
+            .list(&query)
+            .await?
+            .into_iter()
+            .map(|record| serde_json::from_value(record.value).map_err(|_| CloudError::Storage))
+            .collect()
+    }
+    fn event<T: Serialize>(
+        &self,
+        subject: &str,
+        identity: String,
+        version: u64,
+        operation: &str,
+        value: &T,
+    ) -> CloudResult<Write> {
+        let value = serde_json::to_value(value).map_err(|_| CloudError::InvalidArgument)?;
+        if let Some(scope) = identity.strip_prefix("cloud.output:") {
+            let (project_id, scope_id) =
+                scope.split_once(':').ok_or(CloudError::InvalidArgument)?;
+            return Ok(Write::Event(ReleasedEvent {
+                project_id: project_id.into(),
+                scope_id: scope_id.into(),
+                sequence: version + 1,
+                value,
+            }));
+        }
+        let mut key = key(&identity)?;
+        if key.kind == EntityKind::Invitation {
+            key.project_id = value
+                .get("project_id")
+                .and_then(serde_json::Value::as_str)
+                .ok_or(CloudError::InvalidArgument)?
+                .into();
+        }
+        Ok(Write::Entity(EntityMutation {
+            key,
+            expected_revision: version,
+            value,
+            actor: subject.into(),
+            operation: operation.into(),
+        }))
+    }
+    async fn append<T: Serialize>(
+        &self,
+        subject: &str,
+        identity: String,
+        version: u64,
+        operation: &str,
+        value: &T,
+    ) -> CloudResult<()> {
+        self.commit(vec![
+            self.event(subject, identity, version, operation, value)?,
+        ])
+        .await?;
+        Ok(())
+    }
+    async fn commit(&self, writes: Vec<Write>) -> Result<(), colossus_ports::StoreError> {
+        let mut transaction = CloudTransaction {
+            lease: self.lease.clone(),
+            ..Default::default()
+        };
+        for write in writes {
+            match write {
+                Write::Entity(entity) => transaction.entities.push(entity),
+                Write::Event(event) => transaction.events.push(event),
+                Write::Cursor(cursor) => transaction.cursors.push(cursor),
+            }
+        }
+        self.store.commit(transaction).await
+    }
+}
+// Transitional application identity syntax preserves existing receipts during migration;
+// storage receives explicit table kind, project, parent and entity identities.
+pub(super) fn key(identity: &str) -> CloudResult<EntityKey> {
+    let (kind, tail) = identity
+        .split_once(':')
+        .ok_or(CloudError::InvalidArgument)?;
+    let kind = match kind {
+        "cloud.node" => EntityKind::Node,
+        "cloud.host" => EntityKind::Host,
+        "cloud.workspace" => EntityKind::Workspace,
+        "cloud.thread" => EntityKind::Thread,
+        "cloud.task" => EntityKind::Task,
+        "cloud.command" => EntityKind::Command,
+        "cloud.run" => EntityKind::Run,
+        "cloud.session" => EntityKind::SessionMapping,
+        "cloud.invitation" => EntityKind::Invitation,
+        "cloud.renewal" => EntityKind::Renewal,
+        "cloud.admission" => EntityKind::Admission,
+        "cloud.node-task" => EntityKind::NodeTask,
+        "cloud.message" => EntityKind::ThreadMessage,
+        _ => return Err(CloudError::InvalidArgument),
+    };
+    if kind == EntityKind::Invitation {
+        return Ok(EntityKey {
+            kind,
+            project_id: String::new(),
+            parent_id: None,
+            id: tail.into(),
+        });
+    }
+    let (project_id, rest) = tail.split_once(':').ok_or(CloudError::InvalidArgument)?;
+    let (parent_id, id) = match kind {
+        EntityKind::Command
+        | EntityKind::Run
+        | EntityKind::SessionMapping
+        | EntityKind::NodeTask
+        | EntityKind::ThreadMessage => {
+            let (parent, id) = rest.split_once(':').ok_or(CloudError::InvalidArgument)?;
+            (Some(parent.into()), id)
+        }
+        _ => (None, rest),
+    };
+    Ok(EntityKey {
+        kind,
+        project_id: project_id.into(),
+        parent_id,
+        id: id.into(),
+    })
+}
+fn query(prefix: &str, after: Option<&str>, limit: usize) -> CloudResult<EntityQuery> {
+    let key = key(&format!("{prefix}__page"))?;
+    Ok(EntityQuery {
+        kind: key.kind,
+        project_id: key.project_id,
+        parent_id: key.parent_id,
+        after: after.map(str::to_owned),
+        limit,
+        node_id: None,
+        query: None,
+        status: None,
+        archived: None,
+        order: EntityOrder::IdAsc,
+    })
+}
diff --git a/crates/colossus-cloud/src/repository/accounts.rs b/crates/colossus-cloud/src/repository/accounts.rs
new file mode 100644
index 000000000..b93b960af
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/accounts.rs
@@ -0,0 +1,378 @@
+use super::*;
+use crate::{
+    CloudUser, IDENTITY_NAMESPACE, LocalCredential, OidcIdentity, ProjectMembership, ProjectRole,
+    UserAccount, hash_identity, identity_key, membership_key, validate_user,
+};
+use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+
+pub(super) fn timestamp() -> CloudResult<String> {
+    OffsetDateTime::now_utc()
+        .format(&Rfc3339)
+        .map_err(|_| CloudError::Storage)
+}
+pub(super) fn mutation<T: Serialize>(
+    actor: &str,
+    key: EntityKey,
+    revision: u64,
+    operation: &str,
+    value: &T,
+) -> CloudResult<EntityMutation> {
+    Ok(EntityMutation {
+        key,
+        expected_revision: revision,
+        value: serde_json::to_value(value).map_err(|_| CloudError::InvalidArgument)?,
+        actor: actor.into(),
+        operation: operation.into(),
+    })
+}
+pub(super) fn administrator(user: &CloudUser) -> CloudResult<()> {
+    if user.active && user.is_admin {
+        Ok(())
+    } else {
+        Err(CloudError::PermissionDenied)
+    }
+}
+
+impl CloudRepository {
+    /// Host-only identity lookup after authentication; never releases credentials.
+    pub async fn account(&self, id: &str) -> CloudResult<UserAccount> {
+        crate::validate_identifier(id)?;
+        let record = self.store.read(&identity_key(EntityKind::User, id)).await?;
+        let mut account: UserAccount =
+            serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?;
+        if account.user.id != id {
+            return Err(CloudError::Storage);
+        }
+        account.user.revision = record.revision;
+        Ok(account)
+    }
+    /// Atomically provision an explicit account and its selected login bindings.
+    pub async fn create_account(
+        &self,
+        actor: &str,
+        mut account: UserAccount,
+        oidc: Option<OidcIdentity>,
+        local: Option<LocalCredential>,
+    ) -> CloudResult<CloudUser> {
+        validate_user(&account.user)?;
+        if oidc.is_none() && local.is_none() {
+            return Err(CloudError::InvalidArgument);
+        }
+        account.user.revision = 1;
+        let mut entities = vec![mutation(
+            actor,
+            identity_key(EntityKind::User, &account.user.id),
+            0,
+            "cloud.user.created.v3",
+            &account,
+        )?];
+        if let Some(binding) = oidc {
+            if binding.user_id != account.user.id
+                || binding.subject.is_empty()
+                || binding.subject.len() > 256
+                || binding.subject.chars().any(char::is_control)
+            {
+                return Err(CloudError::InvalidArgument);
+            }
+            entities.push(mutation(
+                actor,
+                identity_key(
+                    EntityKind::OidcIdentity,
+                    &hash_identity(&[&binding.issuer, &binding.subject]),
+                ),
+                0,
+                "cloud.user.oidc-bound.v3",
+                &binding,
+            )?);
+        }
+        if let Some(credential) = local {
+            if credential.user_id != account.user.id
+                || credential.username != crate::normalize_username(&credential.username)?
+                || credential.password_hash.len() > 1024
+            {
+                return Err(CloudError::InvalidArgument);
+            }
+            entities.push(mutation(
+                actor,
+                identity_key(
+                    EntityKind::LocalCredential,
+                    &hash_identity(&[&credential.username]),
+                ),
+                0,
+                "cloud.user.password-created.v3",
+                &credential,
+            )?);
+        }
+        self.store
+            .commit(CloudTransaction {
+                entities,
+                ..Default::default()
+            })
+            .await?;
+        Ok(account.user)
+    }
+    /// Update retained account metadata and retire sessions after disable/reenable.
+    pub async fn update_account(
+        &self,
+        actor: &CloudUser,
+        mut user: CloudUser,
+    ) -> CloudResult<CloudUser> {
+        administrator(actor)?;
+        validate_user(&user)?;
+        let current = self.account(&user.id).await?;
+        if current.user.revision != user.revision {
+            return Err(CloudError::Conflict);
+        }
+        user.created_at = current.user.created_at;
+        user.identities = current.user.identities;
+        user.updated_at = timestamp()?;
+        let epoch = current.security_epoch + u64::from(user.active != current.user.active);
+        let revision = user.revision;
+        user.revision += 1;
+        let account = UserAccount {
+            user: user.clone(),
+            security_epoch: epoch,
+        };
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![mutation(
+                    &actor.id,
+                    identity_key(EntityKind::User, &user.id),
+                    revision,
+                    "cloud.user.updated.v3",
+                    &account,
+                )?],
+                ..Default::default()
+            })
+            .await?;
+        Ok(user)
+    }
+    /// Credential rotation and session retirement commit together.
+    pub async fn reset_local_password(
+        &self,
+        actor: &CloudUser,
+        user_id: &str,
+        expected: u64,
+        password_hash: String,
+    ) -> CloudResult<CloudUser> {
+        administrator(actor)?;
+        let mut account = self.account(user_id).await?;
+        if account.user.revision != expected {
+            return Err(CloudError::Conflict);
+        }
+        // Login binding lookup is indexed by user_id through the dedicated port query.
+        let records = self.store.user_identities(user_id).await?;
+        let record = records
+            .into_iter()
+            .find(|r| r.key.kind == EntityKind::LocalCredential)
+            .ok_or(CloudError::NotFound)?;
+        let mut credential: LocalCredential =
+            serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?;
+        credential.password_hash = password_hash;
+        account.security_epoch += 1;
+        account.user.revision += 1;
+        account.user.updated_at = timestamp()?;
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![
+                    mutation(
+                        &actor.id,
+                        record.key,
+                        record.revision,
+                        "cloud.user.password-reset.v3",
+                        &credential,
+                    )?,
+                    mutation(
+                        &actor.id,
+                        identity_key(EntityKind::User, user_id),
+                        expected,
+                        "cloud.user.sessions-retired.v3",
+                        &account,
+                    )?,
+                ],
+                ..Default::default()
+            })
+            .await?;
+        Ok(account.user)
+    }
+    /// Bounded account listing for a verified global administrator.
+    pub async fn list_users(
+        &self,
+        actor: &CloudUser,
+        after: Option<&str>,
+        query: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudUser>> {
+        administrator(actor)?;
+        let mut options = EntityQuery::new(EntityKind::User, IDENTITY_NAMESPACE.into());
+        options.after = after.map(str::to_owned);
+        options.query = query.map(str::to_owned);
+        options.limit = limit.min(100);
+        self.store
+            .list(&options)
+            .await?
+            .into_iter()
+            .map(|r| {
+                let mut account: UserAccount =
+                    serde_json::from_value(r.value).map_err(|_| CloudError::Storage)?;
+                account.user.revision = r.revision;
+                Ok(account.user)
+            })
+            .collect()
+    }
+    /// Explicit account membership lookup, independent of visual project ancestry.
+    pub async fn user_memberships(&self, user: &str) -> CloudResult<Vec<ProjectMembership>> {
+        self.store
+            .memberships(user)
+            .await?
+            .into_iter()
+            .map(|r| {
+                let mut member: ProjectMembership =
+                    serde_json::from_value(r.value).map_err(|_| CloudError::Storage)?;
+                member.revision = r.revision;
+                Ok(member)
+            })
+            .collect()
+    }
+    /// Assign a single explicit role. Caller authority is resolved by host authentication.
+    pub async fn save_membership(
+        &self,
+        caller: &CloudCaller,
+        user: &str,
+        role: ProjectRole,
+        expected: u64,
+    ) -> CloudResult<ProjectMembership> {
+        caller.require(CloudPermission::Administer)?;
+        let _ = self.account(user).await?;
+        let expected = if expected == 0 {
+            match self
+                .store
+                .read(&membership_key(caller.project_id(), user))
+                .await
+            {
+                Ok(r)
+                    if r.value
+                        .get("permissions")
+                        .and_then(serde_json::Value::as_array)
+                        .is_some_and(Vec::is_empty) =>
+                {
+                    r.revision
+                }
+                Ok(_) => return Err(CloudError::Conflict),
+                Err(CloudError::NotFound) => 0,
+                Err(e) => return Err(e),
+            }
+        } else {
+            expected
+        };
+        let member = ProjectMembership {
+            project_id: caller.project_id().into(),
+            user_id: user.into(),
+            subject: user.into(),
+            role,
+            permissions: role.permissions(),
+            revision: expected + 1,
+        };
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![mutation(
+                    caller.subject(),
+                    membership_key(caller.project_id(), user),
+                    expected,
+                    "cloud.membership.role-assigned.v3",
+                    &member,
+                )?],
+                ..Default::default()
+            })
+            .await?;
+        Ok(member)
+    }
+    /// Remove explicit project access without deleting user or retained project history.
+    pub async fn remove_membership(
+        &self,
+        caller: &CloudCaller,
+        user: &str,
+        expected: u64,
+    ) -> CloudResult<()> {
+        caller.require(CloudPermission::Administer)?;
+        let key = membership_key(caller.project_id(), user);
+        let record = self.store.read(&key).await?;
+        if record.revision != expected {
+            return Err(CloudError::Conflict);
+        }
+        let mut member: ProjectMembership =
+            serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?;
+        member.permissions.clear();
+        member.revision += 1;
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![mutation(
+                    caller.subject(),
+                    key,
+                    expected,
+                    "cloud.membership.removed.v3",
+                    &member,
+                )?],
+                ..Default::default()
+            })
+            .await?;
+        Ok(())
+    }
+    /// Bounded membership administration for the exact project.
+    pub async fn project_members(
+        &self,
+        caller: &CloudCaller,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<ProjectMembership>> {
+        caller.require(CloudPermission::Administer)?;
+        let mut query = EntityQuery::new(EntityKind::Membership, caller.project_id().into());
+        query.after = after.map(str::to_owned);
+        query.limit = limit.min(100);
+        query.status = Some("active".into());
+        self.store
+            .list(&query)
+            .await?
+            .into_iter()
+            .filter(|r| {
+                r.value.get("user_id").is_some()
+                    && r.value
+                        .get("permissions")
+                        .and_then(serde_json::Value::as_array)
+                        .is_some_and(|p| !p.is_empty())
+            })
+            .map(|r| {
+                let mut member: ProjectMembership =
+                    serde_json::from_value(r.value).map_err(|_| CloudError::Storage)?;
+                member.revision = r.revision;
+                Ok(member)
+            })
+            .collect()
+    }
+    /// Minimal directory search to add an existing account, constrained to project administration.
+    pub async fn member_candidates(
+        &self,
+        caller: &CloudCaller,
+        text: &str,
+    ) -> CloudResult<Vec<CloudUser>> {
+        caller.require(CloudPermission::Administer)?;
+        if !(2..=128).contains(&text.len()) || text.chars().any(char::is_control) {
+            return Err(CloudError::InvalidArgument);
+        }
+        let mut query = EntityQuery::new(EntityKind::User, IDENTITY_NAMESPACE.into());
+        query.query = Some(text.into());
+        query.limit = 20;
+        query.status = Some("active".into());
+        self.store
+            .list(&query)
+            .await?
+            .into_iter()
+            .map(|r| {
+                serde_json::from_value::<UserAccount>(r.value)
+                    .map(|a| a.user)
+                    .map_err(|_| CloudError::Storage)
+            })
+            .filter(|r| !matches!(r,Ok(user) if !user.active))
+            .collect()
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/delivery.rs b/crates/colossus-cloud/src/repository/delivery.rs
new file mode 100644
index 000000000..e88479093
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/delivery.rs
@@ -0,0 +1,544 @@
+use super::*;
+use colossus_cloud_protocol::encode;
+use colossus_sdk::{GetRunResponse, RunUpdate};
+
+const MAX_EVENTS: u64 = 1_000_000;
+const MAX_RELEASED_BYTES: usize = 256 * 1024 * 1024;
+
+fn event_stream(project: &str, task: &str) -> String {
+    format!("cloud.output:{project}:{task}")
+}
+
+impl CloudRepository {
+    /// Read one task-bound receipt within the caller's authorized project.
+    pub async fn get_command(
+        &self,
+        caller: &CloudCaller,
+        task_id: &str,
+        command_id: &str,
+    ) -> CloudResult<PendingCommand> {
+        caller.require(CloudPermission::Read)?;
+        crate::validate_identifier(command_id)?;
+        let task = self.task(caller.project_id(), task_id).await?;
+        let (command, _) = self
+            .read::<PendingCommand>(&tasks::command_stream(
+                caller.project_id(),
+                &task.node_id,
+                command_id,
+            ))
+            .await?;
+        if command.task_id != task_id || command.node_id != task.node_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        Ok(command)
+    }
+
+    /// Read a bounded command page, including receipts, for an authenticated live node.
+    /// Hosts advance through all pages so acknowledged commands cannot bury pending work.
+    pub async fn commands(
+        &self,
+        node: &CloudNode,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<PendingCommand>> {
+        self.live_node(node).await?;
+        if let Some(after) = after {
+            crate::validate_identifier(after)?;
+        }
+        self.store
+            .list(&EntityQuery {
+                kind: EntityKind::Command,
+                project_id: node.project_id.clone(),
+                parent_id: Some(node.node_id.clone()),
+                after: after.map(str::to_owned),
+                limit: limit.min(100),
+                node_id: None,
+                query: None,
+                status: Some("pending".into()),
+                archived: None,
+                order: EntityOrder::IdAsc,
+            })
+            .await?
+            .into_iter()
+            .map(|record| serde_json::from_value(record.value).map_err(|_| CloudError::Storage))
+            .collect()
+    }
+
+    /// Reconcile an exact reply and immutable run allocation atomically. A lost ACK
+    /// repeats the same command identity; it never allocates a second task or run.
+    pub async fn record_receipt(
+        &self,
+        node: &CloudNode,
+        command_id: &str,
+        task_id: &str,
+        reply: CloudReply,
+    ) -> CloudResult<()> {
+        self.live_node(node).await?;
+        crate::validate_identifier(command_id)?;
+        let stream = tasks::command_stream(&node.project_id, &node.node_id, command_id);
+        let (mut command, revision) = self.read::<PendingCommand>(&stream).await?;
+        if command.task_id != task_id || command.node_id != node.node_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        if let Some(existing) = &command.reply {
+            // A replayed read may observe a newer projection watermark. Keep the
+            // first durably retained read receipt; mutations still require exact replies.
+            if matches!(command.command, Command::History { .. })
+                && matches!(
+                    reply,
+                    CloudReply::History { .. } | CloudReply::Failed { .. }
+                )
+            {
+                return Ok(());
+            }
+            return if existing == &reply {
+                Ok(())
+            } else {
+                Err(CloudError::Conflict)
+            };
+        }
+        let mut task = self.task(&node.project_id, task_id).await?;
+        if task.node_id != node.node_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        let mut events = Vec::new();
+        match (&command.command, &reply) {
+            (Command::Create { .. }, CloudReply::Run { run }) => {
+                crate::validate_identifier(&run.run.run_id)?;
+                if run.run.role != task.request.role
+                    || run.run.mode != task.request.mode
+                    || run
+                        .pending_interactions
+                        .iter()
+                        .any(|interaction| interaction.run_id != run.run.run_id)
+                {
+                    return Err(CloudError::InvalidArgument);
+                }
+                let allocation_stream = format!(
+                    "cloud.run:{}:{}:{}",
+                    node.project_id, node.node_id, run.run.run_id
+                );
+                match self.read::<String>(&allocation_stream).await {
+                    Ok((allocated, _)) if allocated == task_id => {}
+                    Ok(_) => return Err(CloudError::Conflict),
+                    Err(CloudError::NotFound) => events.push(self.event(
+                        &node.node_id,
+                        allocation_stream,
+                        0,
+                        "cloud.run.allocated.v1",
+                        &task_id,
+                    )?),
+                    Err(error) => return Err(error),
+                }
+                if task.run_id.as_ref().is_some_and(|id| id != &run.run.run_id) {
+                    return Err(CloudError::Conflict);
+                }
+                if let Some(thread_id) = &task.thread_id {
+                    let mut thread = self.thread(&node.project_id, thread_id).await?;
+                    if thread
+                        .session_id
+                        .as_deref()
+                        .is_some_and(|session| session != run.run.session_id)
+                    {
+                        return Err(CloudError::Conflict);
+                    }
+                    let session_key = format!(
+                        "cloud.session:{}:{}:{}",
+                        node.project_id, node.node_id, run.run.session_id
+                    );
+                    match self.read::<String>(&session_key).await {
+                        Ok((mapped, _)) if mapped == *thread_id => {}
+                        Ok(_) => return Err(CloudError::Conflict),
+                        Err(CloudError::NotFound) => events.push(self.event(
+                            &node.node_id,
+                            session_key,
+                            0,
+                            "cloud.session.mapped.v2",
+                            thread_id,
+                        )?),
+                        Err(error) => return Err(error),
+                    }
+                    let revision = thread.revision;
+                    thread.revision += 1;
+                    thread.session_id = Some(run.run.session_id.clone());
+                    thread.updated_at = super::threads::timestamp()?;
+                    events.push(self.event(
+                        &node.node_id,
+                        super::threads::thread_stream(&node.project_id, thread_id),
+                        revision,
+                        "cloud.thread.session-bound.v2",
+                        &thread,
+                    )?);
+                }
+                task.run_id = Some(run.run.run_id.clone());
+                task.snapshot = Some((**run).clone());
+                let version = task.revision;
+                task.revision += 1;
+                events.push(self.event(
+                    &node.node_id,
+                    tasks::stream(&node.project_id, task_id),
+                    version,
+                    "cloud.task.accepted.v1",
+                    &task,
+                )?);
+            }
+            (Command::Create { .. }, CloudReply::Failed { error }) => {
+                let version = task.revision;
+                task.revision += 1;
+                task.dispatch_error = Some(error.clone());
+                events.push(self.event(
+                    &node.node_id,
+                    tasks::stream(&node.project_id, task_id),
+                    version,
+                    "cloud.task.dispatch-failed.v1",
+                    &task,
+                )?);
+            }
+            (Command::Cancel { run_id, .. }, CloudReply::Cancelled { response })
+                if response.run.run_id == *run_id => {}
+            (Command::Respond { request }, CloudReply::Responded { response })
+                if response.interaction.run_id == request.run_id
+                    && response.interaction.interaction_id == request.interaction_id => {}
+            (Command::History { source_run_id, .. }, CloudReply::History { response })
+                if task.run_id.as_deref() == Some(source_run_id) =>
+            {
+                events.extend(self.history_writes(node, &task, response).await?);
+                let revision = task.revision;
+                task.revision += 1;
+                task.history_bounded |= response
+                    .activities
+                    .iter()
+                    .filter_map(|activity| activity.input.as_ref().or(activity.result.as_ref()))
+                    .any(|content| {
+                        content.format == "text"
+                            && content.value.len() >= 65_533
+                            && content.value.ends_with('…')
+                    });
+                task.history_complete = response
+                    .page
+                    .as_ref()
+                    .is_none_or(|page| page.next_page_token.is_empty())
+                    && response.caught_up;
+                events.push(self.event(
+                    &node.node_id,
+                    tasks::stream(&node.project_id, task_id),
+                    revision,
+                    "cloud.task.history-synchronized.v2",
+                    &task,
+                )?);
+            }
+            (_, CloudReply::Failed { .. }) => {}
+            _ => return Err(CloudError::InvalidArgument),
+        }
+        let next_history = match (&command.command, &reply) {
+            (Command::History { .. }, CloudReply::History { response }) => response
+                .page
+                .as_ref()
+                .map(|page| page.next_page_token.clone())
+                .filter(|token| !token.is_empty()),
+            _ => None,
+        };
+        if let Some(page) = &next_history
+            && let Some(write) = self
+                .next_history_write(node, &task, command_id, page.clone())
+                .await?
+        {
+            events.push(write);
+        }
+        command.reply = Some(reply);
+        command.revision = revision + 1;
+        events.push(self.event(
+            &node.node_id,
+            stream,
+            revision,
+            "cloud.command.reconciled.v1",
+            &command,
+        )?);
+        self.commit(events).await?;
+        self.refresh_thread_progress(&task).await?;
+        Ok(())
+    }
+
+    /// Replace a released snapshot only when it belongs to the fixed run and does
+    /// not regress its runtime cursor. Output replay has its own contiguous cursor.
+    pub async fn record_snapshot(
+        &self,
+        node: &CloudNode,
+        task_id: &str,
+        snapshot: GetRunResponse,
+    ) -> CloudResult<()> {
+        self.live_node(node).await?;
+        let mut task = self.task(&node.project_id, task_id).await?;
+        if task.node_id != node.node_id || task.run_id.as_deref() != Some(&snapshot.run.run_id) {
+            return Err(CloudError::PermissionDenied);
+        }
+        if snapshot
+            .pending_interactions
+            .iter()
+            .any(|interaction| interaction.run_id != snapshot.run.run_id)
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        if task
+            .snapshot
+            .as_ref()
+            .is_some_and(|current| current.run.last_sequence > snapshot.run.last_sequence)
+        {
+            return Err(CloudError::Conflict);
+        }
+        if task.snapshot.as_ref() == Some(&snapshot) {
+            return self.refresh_thread_progress(&task).await;
+        }
+        let revision = task.revision;
+        task.revision += 1;
+        task.snapshot = Some(snapshot);
+        self.append(
+            &node.node_id,
+            tasks::stream(&node.project_id, task_id),
+            revision,
+            "cloud.task.snapshot.v1",
+            &task,
+        )
+        .await?;
+        self.refresh_thread_progress(&task).await
+    }
+
+    /// Commit one caller-released event before acknowledging it. Reject gaps and
+    /// changed duplicates; both the event and resume cursor survive host restart.
+    pub async fn record_update(
+        &self,
+        node: &CloudNode,
+        task_id: &str,
+        update: RunUpdate,
+    ) -> CloudResult<u64> {
+        // Queue complete ingestion operations above the pool, leaving capacity
+        // for human history reads and connection/authentication maintenance.
+        let _permit = self
+            .ingest
+            .acquire()
+            .await
+            .map_err(|_| CloudError::Storage)?;
+        self.live_node(node).await?;
+        let mut task = self.task(&node.project_id, task_id).await?;
+        if task.node_id != node.node_id || task.run_id.as_deref() != Some(&update.run_id) {
+            return Err(CloudError::PermissionDenied);
+        }
+        let stream = event_stream(&node.project_id, task_id);
+        if update.sequence == 0 {
+            return Err(CloudError::InvalidArgument);
+        }
+        if update.sequence <= task.last_sequence {
+            let events = self
+                .store
+                .events(&node.project_id, task_id, update.sequence - 1, 1)
+                .await?;
+            let event = events.first().ok_or(CloudError::Storage)?;
+            let existing: RunUpdate =
+                serde_json::from_value(event.value.clone()).map_err(|_| CloudError::Storage)?;
+            return if existing == update {
+                Ok(task.last_sequence)
+            } else {
+                Err(CloudError::Conflict)
+            };
+        }
+        if update.sequence != task.last_sequence + 1 {
+            return Err(CloudError::Conflict);
+        }
+        let encoded = encode(&update);
+        let bytes = encoded.as_ref().map_or(usize::MAX, Vec::len);
+        if encoded.is_err()
+            || update.sequence > MAX_EVENTS
+            || task.released_bytes.saturating_add(bytes) > MAX_RELEASED_BYTES
+        {
+            if !task.output_limited {
+                let revision = task.revision;
+                task.revision += 1;
+                task.output_limited = true;
+                self.append(
+                    &node.node_id,
+                    tasks::stream(&node.project_id, task_id),
+                    revision,
+                    "cloud.task.output-limited.v1",
+                    &task,
+                )
+                .await?;
+            }
+            return Err(CloudError::ResourceExhausted);
+        }
+        let revision = task.revision;
+        task.revision += 1;
+        task.last_sequence = update.sequence;
+        task.released_bytes += bytes;
+        let mut writes = vec![
+            self.event(
+                &node.node_id,
+                stream,
+                update.sequence - 1,
+                "cloud.output.released.v1",
+                &update,
+            )?,
+            self.event(
+                &node.node_id,
+                tasks::stream(&node.project_id, task_id),
+                revision,
+                "cloud.task.cursor.v1",
+                &task,
+            )?,
+        ];
+        if let Some(message) = self.released_message(node, &task, &update).await? {
+            writes.push(message);
+        }
+        if let Some(thread_id) = &task.thread_id {
+            let after = self
+                .store
+                .cursor(&node.project_id, "cloud-thread", thread_id)
+                .await?;
+            let mut value =
+                serde_json::to_value(&update).map_err(|_| CloudError::InvalidArgument)?;
+            value
+                .as_object_mut()
+                .ok_or(CloudError::InvalidArgument)?
+                .insert("task_id".into(), serde_json::Value::String(task_id.into()));
+            writes.push(Write::Event(ReleasedEvent {
+                project_id: node.project_id.clone(),
+                scope_id: format!("thread-{thread_id}"),
+                sequence: after + 1,
+                value,
+            }));
+            writes.push(Write::Cursor(CursorMutation {
+                project_id: node.project_id.clone(),
+                source_id: "cloud-thread".into(),
+                scope_id: thread_id.clone(),
+                expected_sequence: after,
+                sequence: after + 1,
+            }));
+        }
+        self.commit(writes).await?;
+        if !matches!(
+            update.update,
+            colossus_sdk::RunUpdateKind::OutputDelta(_)
+                | colossus_sdk::RunUpdateKind::ReasoningSummary(_)
+                | colossus_sdk::RunUpdateKind::Usage(_)
+                | colossus_sdk::RunUpdateKind::ToolActivity(_)
+        ) {
+            self.refresh_thread_progress(&task).await?;
+        }
+        Ok(task.last_sequence)
+    }
+
+    /// Stop cloud event retention without advancing an unreceived cursor. Only
+    /// the enrolled owner of this exact run may report the local frame bound.
+    pub async fn record_output_limit(
+        &self,
+        node: &CloudNode,
+        task_id: &str,
+        run_id: &str,
+        after_sequence: u64,
+    ) -> CloudResult<()> {
+        self.live_node(node).await?;
+        let mut task = self.task(&node.project_id, task_id).await?;
+        if task.node_id != node.node_id || task.run_id.as_deref() != Some(run_id) {
+            return Err(CloudError::PermissionDenied);
+        }
+        if task.last_sequence != after_sequence {
+            return Err(CloudError::Conflict);
+        }
+        if !task.output_limited {
+            let revision = task.revision;
+            task.revision += 1;
+            task.output_limited = true;
+            self.append(
+                &node.node_id,
+                tasks::stream(&node.project_id, task_id),
+                revision,
+                "cloud.task.output-limited.v1",
+                &task,
+            )
+            .await?;
+        }
+        Ok(())
+    }
+
+    /// Read a bounded, exclusive-cursor page of released output inside one project.
+    pub async fn updates(
+        &self,
+        caller: &CloudCaller,
+        task_id: &str,
+        after: u64,
+        limit: usize,
+    ) -> CloudResult<Vec<RunUpdate>> {
+        caller.require(CloudPermission::Read)?;
+        let task = self.task(caller.project_id(), task_id).await?;
+        if after > task.last_sequence {
+            return Err(CloudError::Conflict);
+        }
+        self.store
+            .events(caller.project_id(), task_id, after, limit.min(100))
+            .await?
+            .into_iter()
+            .map(|event| serde_json::from_value(event.value).map_err(|_| CloudError::Storage))
+            .collect()
+    }
+
+    /// Read the exact allocation for an authenticated node; never accept a cloud
+    /// caller's project selection or a node's arbitrary local run identifier.
+    pub async fn node_task(&self, node: &CloudNode, task_id: &str) -> CloudResult<CloudTask> {
+        self.live_node(node).await?;
+        let task = self.task(&node.project_id, task_id).await?;
+        if task.node_id != node.node_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        Ok(task)
+    }
+}
+
+impl CloudRepository {
+    /// Page fixed-node allocations through their own durable placement index.
+    pub async fn node_tasks(
+        &self,
+        node: &CloudNode,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudTask>> {
+        self.live_node(node).await?;
+        if let Some(after) = after {
+            crate::validate_identifier(after)?;
+        }
+        self.store
+            .list(&EntityQuery {
+                kind: EntityKind::Task,
+                project_id: node.project_id.clone(),
+                parent_id: None,
+                after: after.map(str::to_owned),
+                limit: limit.min(100),
+                node_id: Some(node.node_id.clone()),
+                query: None,
+                status: None,
+                archived: None,
+                order: EntityOrder::IdAsc,
+            })
+            .await?
+            .into_iter()
+            .map(|record| serde_json::from_value(record.value).map_err(|_| CloudError::Storage))
+            .collect()
+    }
+}
+
+impl CloudRepository {
+    /// A later human turn stays queued until its predecessor has settled.
+    pub async fn command_dispatchable(
+        &self,
+        node: &CloudNode,
+        command: &PendingCommand,
+    ) -> CloudResult<bool> {
+        self.live_node(node).await?;
+        if command.node_id != node.node_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        if !matches!(command.command, Command::Create { .. }) {
+            return Ok(true);
+        }
+        self.dispatchable(&self.task(&node.project_id, &command.task_id).await?)
+            .await
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/enrollment.rs b/crates/colossus-cloud/src/repository/enrollment.rs
new file mode 100644
index 000000000..b1e1a25b5
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/enrollment.rs
@@ -0,0 +1,122 @@
+use super::*;
+use crate::{
+    CertificateRedemption, Enrollment, validate_identifier, validation::bounded_fingerprint,
+};
+
+impl CloudRepository {
+    /// Allocate an expiring invitation beneath explicit administration authority.
+    pub async fn invite(
+        &self,
+        caller: &CloudCaller,
+        invitation: Enrollment,
+        now: u64,
+    ) -> CloudResult<()> {
+        caller.require(CloudPermission::Administer)?;
+        bounded_fingerprint(&invitation.token_hash)?;
+        validate_identifier(&invitation.node_id)?;
+        if invitation.project_id != caller.project_id()
+            || invitation.redeemed_certificate.is_some()
+            || invitation.redeemed_csr.is_some()
+            || invitation.certificate_pem.is_some()
+            || invitation.expires_at <= now
+            || invitation.expires_at > now.saturating_add(600)
+            || invitation.label.is_empty()
+            || invitation.label.len() > 128
+            || invitation.label.chars().any(char::is_control)
+            || invitation.roles.is_empty()
+            || invitation.roles.len() > 32
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        for role in &invitation.roles {
+            validate_identifier(role)?;
+        }
+        self.append(
+            caller.subject(),
+            format!("cloud.invitation:{}", invitation.token_hash),
+            0,
+            "cloud.invitation.created.v1",
+            &invitation,
+        )
+        .await
+    }
+
+    /// Atomically consume an invitation and enroll its fixed placement. A repeated
+    /// redeem with the same certificate/instance reconciles a lost HTTP response.
+    pub async fn redeem(
+        &self,
+        token_hash: &str,
+        instance_id: &str,
+        certificate: CertificateRedemption,
+        now: u64,
+    ) -> CloudResult<(CloudNode, String)> {
+        bounded_fingerprint(token_hash)?;
+        bounded_fingerprint(&certificate.fingerprint)?;
+        bounded_fingerprint(&certificate.csr_sha256)?;
+        if certificate.certificate_pem.len() > 16384 {
+            return Err(CloudError::InvalidArgument);
+        }
+        validate_identifier(instance_id)?;
+        let invitation_stream = format!("cloud.invitation:{token_hash}");
+        let (mut invitation, revision) = self
+            .read::<Enrollment>(&invitation_stream)
+            .await
+            .map_err(|_| CloudError::PermissionDenied)?;
+        if let Some(existing) = &invitation.redeemed_certificate {
+            if invitation.redeemed_csr.as_deref() != Some(&certificate.csr_sha256) {
+                return Err(CloudError::PermissionDenied);
+            }
+            return self
+                .authenticate_node(
+                    &invitation.project_id,
+                    &invitation.node_id,
+                    existing,
+                    instance_id,
+                )
+                .await
+                .and_then(|node| {
+                    Ok((node, invitation.certificate_pem.ok_or(CloudError::Storage)?))
+                });
+        }
+        if invitation.expires_at <= now {
+            return Err(CloudError::PermissionDenied);
+        }
+        let node = CloudNode {
+            node_id: invitation.node_id.clone(),
+            project_id: invitation.project_id.clone(),
+            instance_id: instance_id.into(),
+            label: invitation.label.clone(),
+            certificate_sha256: certificate.fingerprint.clone(),
+            roles: invitation.roles.clone(),
+            revoked: false,
+            host_id: None,
+            workspace_id: None,
+            workspace_label: None,
+            runtime_ready: false,
+            policy: None,
+            policy_observed_at: None,
+            revision: 1,
+        };
+        invitation.redeemed_certificate = Some(certificate.fingerprint);
+        invitation.redeemed_csr = Some(certificate.csr_sha256);
+        invitation.certificate_pem = Some(certificate.certificate_pem.clone());
+        self.commit(vec![
+            self.event(
+                "enrollment",
+                invitation_stream,
+                revision,
+                "cloud.invitation.redeemed.v1",
+                &invitation,
+            )?,
+            self.event(
+                "enrollment",
+                format!("cloud.node:{}:{}", node.project_id, node.node_id),
+                0,
+                "cloud.node.enrolled.v1",
+                &node,
+            )?,
+        ])
+        .await?;
+        Ok((node, certificate.certificate_pem))
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/history.rs b/crates/colossus-cloud/src/repository/history.rs
new file mode 100644
index 000000000..07f4904a7
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/history.rs
@@ -0,0 +1,208 @@
+use super::*;
+use crate::{CloudMessage, validation::fingerprint};
+use colossus_sdk::{ListSessionActivityResponse, SessionActivityKind, SessionActivityLane};
+
+impl CloudRepository {
+    pub(super) async fn queue_history(
+        &self,
+        node: &CloudNode,
+        task: &CloudTask,
+        generation: &str,
+        page_token: Option<String>,
+    ) -> CloudResult<PendingCommand> {
+        self.live_node(node).await?;
+        if generation.len() > 128 || page_token.as_ref().is_some_and(|token| token.len() > 4096) {
+            return Err(CloudError::InvalidArgument);
+        }
+        let source_run_id = task.run_id.clone().ok_or(CloudError::Conflict)?;
+        let id = fingerprint(
+            &serde_json::to_vec(&("history", &task.task_id, generation, &page_token))
+                .map_err(|_| CloudError::InvalidArgument)?,
+        )[..32]
+            .to_owned();
+        let command = PendingCommand {
+            command_id: id.clone(),
+            task_id: task.task_id.clone(),
+            node_id: node.node_id.clone(),
+            command: Command::History {
+                source_run_id,
+                page_token,
+                page_size: colossus_cloud_protocol::MAX_DISCOVERY_PAGE_SIZE,
+            },
+            reply: None,
+            revision: 1,
+        };
+        let key = tasks::command_stream(&node.project_id, &node.node_id, &id);
+        match self
+            .append(
+                "cloud-history",
+                key.clone(),
+                0,
+                "cloud.history.requested.v2",
+                &command,
+            )
+            .await
+        {
+            Ok(()) => Ok(command),
+            Err(CloudError::Conflict) => {
+                let (existing, _) = self.read::<PendingCommand>(&key).await?;
+                if existing.command != command.command {
+                    return Err(CloudError::Conflict);
+                }
+                Ok(existing)
+            }
+            Err(error) => Err(error),
+        }
+    }
+    pub(super) async fn history_writes(
+        &self,
+        node: &CloudNode,
+        task: &CloudTask,
+        response: &ListSessionActivityResponse,
+    ) -> CloudResult<Vec<Write>> {
+        if response.activities.len() > colossus_cloud_protocol::MAX_DISCOVERY_PAGE_SIZE as usize {
+            return Err(CloudError::ResourceExhausted);
+        }
+        let id = task.thread_id.as_ref().ok_or(CloudError::Conflict)?;
+        let thread = self.thread(&node.project_id, id).await?;
+        let mut writes = Vec::new();
+        for activity in &response.activities {
+            if activity.lane != SessionActivityLane::Agent {
+                return Err(CloudError::InvalidArgument);
+            }
+            let (role, content) = match activity.kind {
+                SessionActivityKind::User => ("user", activity.input.as_ref()),
+                SessionActivityKind::Assistant => ("assistant", activity.result.as_ref()),
+                _ => return Err(CloudError::InvalidArgument),
+            };
+            let Some(content) = content.filter(|content| content.format == "text") else {
+                continue;
+            };
+            if content.value.is_empty() {
+                continue;
+            }
+            let mut owner = task.task_id.clone();
+            if let Some(run) = &activity.run_id {
+                match self
+                    .read::<String>(&format!(
+                        "cloud.run:{}:{}:{run}",
+                        node.project_id, node.node_id
+                    ))
+                    .await
+                {
+                    Ok((mapped, _)) => {
+                        let mapped_task = self.task(&node.project_id, &mapped).await?;
+                        if mapped_task.thread_id.as_deref() != Some(id) {
+                            return Err(CloudError::PermissionDenied);
+                        }
+                        owner = mapped;
+                    }
+                    Err(CloudError::NotFound) => {}
+                    Err(error) => return Err(error),
+                }
+            }
+            let message_id = format!(
+                "h{}",
+                &fingerprint(
+                    format!(
+                        "{}:{}:{}",
+                        node.node_id,
+                        thread.session_id.as_deref().unwrap_or_default(),
+                        activity.activity_id
+                    )
+                    .as_bytes()
+                )[..32]
+            );
+            let key = format!("cloud.message:{}:{id}:{message_id}", node.project_id);
+            let previous = match self.read::<CloudMessage>(&key).await {
+                Ok(value) => Some(value),
+                Err(CloudError::NotFound) => None,
+                Err(error) => return Err(error),
+            };
+            let revision = previous.as_ref().map_or(0, |(_, revision)| *revision);
+            let created_at = if role == "assistant" {
+                activity
+                    .completed_at
+                    .as_ref()
+                    .unwrap_or(&activity.started_at)
+                    .clone()
+            } else {
+                activity.started_at.clone()
+            };
+            let mut message = CloudMessage {
+                message_id,
+                thread_id: id.clone(),
+                project_id: node.project_id.clone(),
+                role: role.into(),
+                text: content.value.clone(),
+                created_at,
+                task_id: owner,
+                revision: revision + 1,
+            };
+            if let Some((existing, _)) = previous {
+                message.revision = existing.revision;
+                if message == existing {
+                    continue;
+                }
+                message.revision = revision + 1;
+            }
+            writes.push(self.event(
+                &node.node_id,
+                key,
+                revision,
+                "cloud.message.history-released.v2",
+                &message,
+            )?);
+        }
+        Ok(writes)
+    }
+}
+
+impl CloudRepository {
+    pub(super) async fn next_history_write(
+        &self,
+        node: &CloudNode,
+        task: &CloudTask,
+        generation: &str,
+        page_token: String,
+    ) -> CloudResult<Option<Write>> {
+        if page_token.len() > 4096 {
+            return Err(CloudError::InvalidArgument);
+        }
+        let id = fingerprint(
+            &serde_json::to_vec(&(
+                "history",
+                &task.task_id,
+                generation,
+                &Some(page_token.clone()),
+            ))
+            .map_err(|_| CloudError::InvalidArgument)?,
+        )[..32]
+            .to_owned();
+        let command = PendingCommand {
+            command_id: id.clone(),
+            task_id: task.task_id.clone(),
+            node_id: node.node_id.clone(),
+            command: Command::History {
+                source_run_id: task.run_id.clone().ok_or(CloudError::Conflict)?,
+                page_token: Some(page_token),
+                page_size: colossus_cloud_protocol::MAX_DISCOVERY_PAGE_SIZE,
+            },
+            reply: None,
+            revision: 1,
+        };
+        let key = tasks::command_stream(&node.project_id, &node.node_id, &id);
+        match self.read::<PendingCommand>(&key).await {
+            Ok((existing, _)) if existing.command == command.command => Ok(None),
+            Ok(_) => Err(CloudError::Conflict),
+            Err(CloudError::NotFound) => Ok(Some(self.event(
+                &node.node_id,
+                key,
+                0,
+                "cloud.history.page-requested.v2",
+                &command,
+            )?)),
+            Err(error) => Err(error),
+        }
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/inventory.rs b/crates/colossus-cloud/src/repository/inventory.rs
new file mode 100644
index 000000000..057544710
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/inventory.rs
@@ -0,0 +1,497 @@
+use super::*;
+use crate::{CloudHost, CloudThread, CloudWorkspace, validation::fingerprint};
+use colossus_cloud_protocol::{ReleasedRunInventory, RuntimeInventory};
+use colossus_sdk::{CreateRunRequest, GetRunResponse, IdempotencyKey, InputContentPart};
+
+impl CloudRepository {
+    /// Publish sanitized grouping without widening any runtime grant.
+    pub async fn register_inventory(
+        &self,
+        node: &CloudNode,
+        inventory: RuntimeInventory,
+        now: u64,
+    ) -> CloudResult<CloudNode> {
+        inventory
+            .validate()
+            .map_err(|_| CloudError::InvalidArgument)?;
+        for _ in 0..8 {
+            self.live_node(node).await?;
+            let mut fresh = self.node(&node.project_id, &node.node_id).await?;
+            if fresh
+                .host_id
+                .as_ref()
+                .is_some_and(|host| host != &inventory.host_id)
+                || fresh
+                    .workspace_id
+                    .as_ref()
+                    .is_some_and(|workspace| workspace != &inventory.workspace_id)
+            {
+                return Err(CloudError::Conflict);
+            }
+            let host_key = format!("cloud.host:{}:{}", node.project_id, inventory.host_id);
+            let (host_version, previous_host) = match self.read::<CloudHost>(&host_key).await {
+                Ok((host, revision)) => (revision, Some(host)),
+                Err(CloudError::NotFound) => (0, None),
+                Err(error) => return Err(error),
+            };
+            let workspace_key = format!(
+                "cloud.workspace:{}:{}",
+                node.project_id, inventory.workspace_id
+            );
+            let (workspace_version, previous_workspace) = match self
+                .read::<CloudWorkspace>(&workspace_key)
+                .await
+            {
+                Ok((workspace, revision)) => {
+                    if workspace.node_id != node.node_id || workspace.host_id != inventory.host_id {
+                        return Err(CloudError::Conflict);
+                    }
+                    (revision, Some(workspace))
+                }
+                Err(CloudError::NotFound) => (0, None),
+                Err(error) => return Err(error),
+            };
+            let mut host = CloudHost {
+                host_id: inventory.host_id.clone(),
+                project_id: node.project_id.clone(),
+                label: inventory.host_label.clone(),
+                platform: inventory.platform.clone(),
+                deployment_kind: serde_json::to_value(inventory.deployment_kind)
+                    .ok()
+                    .and_then(|value| value.as_str().map(str::to_owned))
+                    .unwrap_or_else(|| "cli".into()),
+                // Existing presence belongs to heartbeat_node, not repeated
+                // static inventory samples accompanying policy observations.
+                last_seen_at: previous_host.as_ref().map_or(now, |host| host.last_seen_at),
+                revision: host_version,
+            };
+            let mut workspace = CloudWorkspace {
+                workspace_id: inventory.workspace_id.clone(),
+                project_id: node.project_id.clone(),
+                host_id: inventory.host_id.clone(),
+                node_id: node.node_id.clone(),
+                label: inventory.workspace_label.clone(),
+                sharing: serde_json::to_value(inventory.sharing)
+                    .ok()
+                    .and_then(|value| value.as_str().map(str::to_owned))
+                    .ok_or(CloudError::InvalidArgument)?,
+                revision: workspace_version,
+            };
+            let previous_node = fresh.clone();
+            let node_version = fresh.revision;
+            fresh.host_id = Some(inventory.host_id.clone());
+            fresh.workspace_id = Some(inventory.workspace_id.clone());
+            fresh.workspace_label = Some(inventory.workspace_label.clone());
+            fresh.runtime_ready = true;
+            if let Some(policy) = inventory.policy.clone() {
+                fresh.policy = Some(policy);
+                fresh.policy_observed_at = Some(now);
+            }
+            let mut writes = Vec::new();
+            if previous_host.as_ref() != Some(&host) {
+                host.revision += 1;
+                writes.push(self.event(
+                    &node.node_id,
+                    host_key,
+                    host_version,
+                    "cloud.host.observed.v2",
+                    &host,
+                )?);
+            }
+            if previous_workspace.as_ref() != Some(&workspace) {
+                workspace.revision += 1;
+                writes.push(self.event(
+                    &node.node_id,
+                    workspace_key,
+                    workspace_version,
+                    "cloud.workspace.observed.v2",
+                    &workspace,
+                )?);
+            }
+            if fresh != previous_node {
+                fresh.revision += 1;
+                writes.push(self.event(
+                    &node.node_id,
+                    format!("cloud.node:{}:{}", node.project_id, node.node_id),
+                    node_version,
+                    "cloud.node.inventory.v2",
+                    &fresh,
+                )?);
+            }
+            // A no-op still checks the bound connection generation atomically;
+            // it emits no entity audit/outbox entries or changed notifications.
+            match self.commit(writes).await {
+                Ok(()) => return Ok(fresh),
+                Err(colossus_ports::StoreError::Conflict { .. }) => continue,
+                Err(error) => return Err(error.into()),
+            }
+        }
+        Err(CloudError::Conflict)
+    }
+    /// List host groups within the authenticated project.
+    pub async fn list_hosts(
+        &self,
+        caller: &CloudCaller,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudHost>> {
+        caller.require(CloudPermission::Read)?;
+        self.list(
+            &format!("cloud.host:{}:", caller.project_id()),
+            after,
+            limit,
+        )
+        .await
+    }
+    /// List advertised workspace identities without releasing local paths.
+    pub async fn list_workspaces(
+        &self,
+        caller: &CloudCaller,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudWorkspace>> {
+        caller.require(CloudPermission::Read)?;
+        self.list(
+            &format!("cloud.workspace:{}:", caller.project_id()),
+            after,
+            limit,
+        )
+        .await
+    }
+    /// Upsert an authenticated bounded discovery page, preserving source placement.
+    pub async fn discover_runs(
+        &self,
+        node: &CloudNode,
+        runs: Vec<ReleasedRunInventory>,
+        sync_id: &str,
+    ) -> CloudResult<()> {
+        self.live_node(node).await?;
+        if runs.len() > colossus_cloud_protocol::MAX_DISCOVERY_PAGE_SIZE as usize {
+            return Err(CloudError::ResourceExhausted);
+        }
+        let current_node = self.node(&node.project_id, &node.node_id).await?;
+        for discovered in runs {
+            let run = discovered.run;
+            crate::validate_identifier(&run.run_id)?;
+            crate::validate_identifier(&run.session_id)?;
+            let session_key = format!(
+                "cloud.session:{}:{}:{}",
+                node.project_id, node.node_id, run.session_id
+            );
+            let (thread_id, session_version) = match self.read::<String>(&session_key).await {
+                Ok((id, version)) => (id, version),
+                Err(CloudError::NotFound) => (
+                    format!(
+                        "t{}",
+                        &fingerprint(
+                            format!("{}:{}:{}", node.project_id, node.node_id, run.session_id)
+                                .as_bytes()
+                        )[..32]
+                    ),
+                    0,
+                ),
+                Err(error) => return Err(error),
+            };
+            let thread_key = super::threads::thread_stream(&node.project_id, &thread_id);
+            let (mut thread, thread_version) = match self.thread(&node.project_id, &thread_id).await
+            {
+                Ok(thread) => {
+                    let version = thread.revision;
+                    (thread, version)
+                }
+                Err(CloudError::NotFound) => (
+                    CloudThread {
+                        thread_id: thread_id.clone(),
+                        project_id: node.project_id.clone(),
+                        node_id: node.node_id.clone(),
+                        host_id: current_node.host_id.clone(),
+                        workspace_id: current_node.workspace_id.clone(),
+                        title: run.title.chars().take(256).collect(),
+                        created_at: run.created_at.clone(),
+                        updated_at: run.updated_at.clone(),
+                        revision: 0,
+                        archived: run.archived,
+                        session_id: Some(run.session_id.clone()),
+                        sync_status: if run.last_sequence > 0 {
+                            "incomplete"
+                        } else {
+                            "current"
+                        }
+                        .into(),
+                        source: "runtime".into(),
+                        can_continue: discovered.continuable,
+                        active_task_id: None,
+                        queued_task_ids: vec![],
+                    },
+                    0,
+                ),
+                Err(error) => return Err(error),
+            };
+            let before_thread = thread.clone();
+            if thread.node_id != node.node_id
+                || thread
+                    .session_id
+                    .as_deref()
+                    .is_some_and(|id| id != run.session_id)
+            {
+                return Err(CloudError::PermissionDenied);
+            }
+            let run_key = format!(
+                "cloud.run:{}:{}:{}",
+                node.project_id, node.node_id, run.run_id
+            );
+            let (task_id, run_version) = match self.read::<String>(&run_key).await {
+                Ok(value) => value,
+                Err(CloudError::NotFound) => (
+                    fingerprint(
+                        format!("{}:{}:{}", node.project_id, node.node_id, run.run_id).as_bytes(),
+                    )[..32]
+                        .into(),
+                    0,
+                ),
+                Err(error) => return Err(error),
+            };
+            let task_key = tasks::stream(&node.project_id, &task_id);
+            let mut writes = Vec::new();
+            let task = match self.task(&node.project_id, &task_id).await {
+                Ok(mut task) => {
+                    if task.node_id != node.node_id || task.run_id.as_deref() != Some(&run.run_id) {
+                        return Err(CloudError::PermissionDenied);
+                    }
+                    let revision = task.revision;
+                    let before = task.clone();
+                    task.thread_id = Some(thread_id.clone());
+                    task.source_read_only = !discovered.controllable;
+                    if task
+                        .snapshot
+                        .as_ref()
+                        .is_none_or(|snapshot| snapshot.run.last_sequence < run.last_sequence)
+                    {
+                        if task.subject == "runtime" {
+                            task.history_complete = false;
+                        }
+                        task.snapshot = Some(GetRunResponse {
+                            run: run.clone(),
+                            pending_interactions: task
+                                .snapshot
+                                .as_ref()
+                                .map_or_else(Vec::new, |snapshot| {
+                                    snapshot.pending_interactions.clone()
+                                }),
+                        });
+                    }
+                    if task != before {
+                        task.revision += 1;
+                        task.updated_at = super::threads::timestamp()?;
+                        writes.push(self.event(
+                            &node.node_id,
+                            task_key,
+                            revision,
+                            "cloud.task.discovered.v2",
+                            &task,
+                        )?);
+                    }
+                    task
+                }
+                Err(CloudError::NotFound) => {
+                    let task = CloudTask {
+                        task_id: task_id.clone(),
+                        project_id: node.project_id.clone(),
+                        node_id: node.node_id.clone(),
+                        subject: "runtime".into(),
+                        created_at: run.created_at.clone(),
+                        updated_at: run.updated_at.clone(),
+                        request: CreateRunRequest {
+                            plugin_skill_ids: vec![],
+                            input: vec![InputContentPart::Text(run.title.clone())],
+                            session_id: Some(run.session_id.clone()),
+                            end_user_id: None,
+                            role: run.role.clone(),
+                            mode: run.mode,
+                            research_depth: None,
+                            research_sources: vec![],
+                            plan_action: None,
+                            branch: None,
+                            max_turns: 0,
+                            idempotency_key: IdempotencyKey::new(format!("discovered-{task_id}"))
+                                .map_err(|_| CloudError::InvalidArgument)?,
+                        },
+                        thread_id: Some(thread_id.clone()),
+                        source_read_only: !discovered.controllable,
+                        history_complete: false,
+                        history_bounded: false,
+                        run_id: Some(run.run_id.clone()),
+                        snapshot: Some(GetRunResponse {
+                            run: run.clone(),
+                            pending_interactions: vec![],
+                        }),
+                        dispatch_error: None,
+                        last_sequence: 0,
+                        released_bytes: 0,
+                        output_limited: false,
+                        revision: 1,
+                    };
+                    writes.push(self.event(
+                        &node.node_id,
+                        task_key,
+                        0,
+                        "cloud.task.discovered.v2",
+                        &task,
+                    )?);
+                    writes.push(self.event(
+                        &node.node_id,
+                        format!(
+                            "cloud.node-task:{}:{}:{task_id}",
+                            node.project_id, node.node_id
+                        ),
+                        0,
+                        "cloud.node-task.discovered.v2",
+                        &task_id,
+                    )?);
+                    task
+                }
+                Err(error) => return Err(error),
+            };
+            if run_version == 0 {
+                writes.push(self.event(
+                    &node.node_id,
+                    run_key,
+                    0,
+                    "cloud.run.discovered.v2",
+                    &task_id,
+                )?);
+            }
+            if session_version == 0 {
+                writes.push(self.event(
+                    &node.node_id,
+                    session_key,
+                    0,
+                    "cloud.session.mapped.v2",
+                    &thread_id,
+                )?);
+            }
+            thread.session_id = Some(run.session_id.clone());
+            thread.can_continue = discovered.continuable;
+            thread.updated_at = thread.updated_at.max(run.updated_at);
+            if task.last_sequence < run.last_sequence {
+                thread.sync_status = "incomplete".into();
+            }
+            if thread_version == 0 || thread != before_thread {
+                thread.revision = thread_version + 1;
+                writes.push(self.event(
+                    &node.node_id,
+                    thread_key,
+                    thread_version,
+                    "cloud.thread.discovered.v2",
+                    &thread,
+                )?);
+            }
+            if !writes.is_empty() {
+                self.commit(writes).await?;
+            }
+            if task.subject == "runtime" && !task.history_complete {
+                self.queue_history(node, &task, sync_id, None).await?;
+            }
+        }
+        Ok(())
+    }
+}
+
+impl CloudRepository {
+    /// Persist readiness independently of connection presence and refresh host contact.
+    pub async fn heartbeat_node(&self, node: &CloudNode, ready: bool, now: u64) -> CloudResult<()> {
+        self.live_node(node).await?;
+        let mut current = self.node(&node.project_id, &node.node_id).await?;
+        let mut writes = Vec::new();
+        if current.runtime_ready != ready {
+            let revision = current.revision;
+            current.revision += 1;
+            current.runtime_ready = ready;
+            writes.push(self.event(
+                &node.node_id,
+                format!("cloud.node:{}:{}", node.project_id, node.node_id),
+                revision,
+                "cloud.node.readiness.v2",
+                &current,
+            )?);
+        }
+        if let Some(host_id) = &current.host_id {
+            let key = format!("cloud.host:{}:{host_id}", node.project_id);
+            let (mut host, revision) = self.read::<CloudHost>(&key).await?;
+            if now > host.last_seen_at {
+                host.last_seen_at = now;
+                host.revision = revision + 1;
+                writes.push(self.event(
+                    &node.node_id,
+                    key,
+                    revision,
+                    "cloud.host.heartbeat.v2",
+                    &host,
+                )?);
+            }
+        }
+        if writes.is_empty() {
+            return Ok(());
+        }
+        self.commit(writes).await?;
+        Ok(())
+    }
+}
+
+impl CloudRepository {
+    /// A completed authorized discovery cycle withdraws continuation from omitted sources.
+    /// Already released cloud history stays retained for project readers.
+    pub async fn finish_discovery(
+        &self,
+        node: &CloudNode,
+        visible_sessions: &std::collections::BTreeMap<String, bool>,
+    ) -> CloudResult<()> {
+        self.live_node(node).await?;
+        let mut after = None;
+        loop {
+            let records = self
+                .store
+                .list(&EntityQuery {
+                    kind: EntityKind::Thread,
+                    project_id: node.project_id.clone(),
+                    parent_id: None,
+                    after: after.clone(),
+                    limit: 100,
+                    node_id: Some(node.node_id.clone()),
+                    query: None,
+                    status: None,
+                    archived: None,
+                    order: EntityOrder::IdAsc,
+                })
+                .await?;
+            if records.is_empty() {
+                break;
+            }
+            after = records.last().map(|record| record.key.id.clone());
+            for record in records {
+                let mut thread: CloudThread =
+                    serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?;
+                // New cloud sessions without a receipt are not discovery omissions.
+                let Some(session) = &thread.session_id else {
+                    continue;
+                };
+                let can_continue = visible_sessions.get(session).copied().unwrap_or(false);
+                if thread.can_continue != can_continue {
+                    let revision = thread.revision;
+                    thread.revision += 1;
+                    thread.can_continue = can_continue;
+                    thread.updated_at = super::threads::timestamp()?;
+                    self.append(
+                        &node.node_id,
+                        super::threads::thread_stream(&node.project_id, &thread.thread_id),
+                        revision,
+                        "cloud.thread.visibility-reconciled.v2",
+                        &thread,
+                    )
+                    .await?;
+                }
+            }
+        }
+        Ok(())
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/nodes.rs b/crates/colossus-cloud/src/repository/nodes.rs
new file mode 100644
index 000000000..e99869308
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/nodes.rs
@@ -0,0 +1,161 @@
+use super::*;
+use crate::{validate_identifier, validation::bounded_fingerprint};
+
+fn stream(project: &str, node: &str) -> String {
+    format!("cloud.node:{project}:{node}")
+}
+
+impl CloudRepository {
+    /// Enroll one node under explicit project administration, with no implicit runtime grant.
+    pub async fn register_node(
+        &self,
+        caller: &CloudCaller,
+        mut node: CloudNode,
+    ) -> CloudResult<CloudNode> {
+        caller.require(CloudPermission::Administer)?;
+        validate_identifier(&node.node_id)?;
+        validate_identifier(&node.instance_id)?;
+        bounded_fingerprint(&node.certificate_sha256)?;
+        if node.project_id != caller.project_id()
+            || node.revoked
+            || node.revision != 0
+            || node.policy.is_some()
+            || node.policy_observed_at.is_some()
+            || node.label.is_empty()
+            || node.label.len() > 128
+            || node.label.chars().any(char::is_control)
+            || node.roles.is_empty()
+            || node.roles.len() > 32
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        for role in &node.roles {
+            validate_identifier(role)?;
+        }
+        node.certificate_sha256.make_ascii_lowercase();
+        node.revision = 1;
+        self.append(
+            caller.subject(),
+            stream(caller.project_id(), &node.node_id),
+            0,
+            "cloud.node.enrolled.v1",
+            &node,
+        )
+        .await?;
+        Ok(node)
+    }
+
+    /// Read one exact project-owned node.
+    pub async fn get_node(&self, caller: &CloudCaller, node_id: &str) -> CloudResult<CloudNode> {
+        caller.require(CloudPermission::Read)?;
+        self.node(caller.project_id(), node_id).await
+    }
+
+    /// List one bounded lexical node page, exclusively after a validated node identity.
+    pub async fn list_nodes(
+        &self,
+        caller: &CloudCaller,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudNode>> {
+        caller.require(CloudPermission::Read)?;
+        if let Some(after) = after {
+            validate_identifier(after)?;
+        }
+        let prefix = format!("cloud.node:{}:", caller.project_id());
+        self.list(&prefix, after, limit).await
+    }
+
+    /// Durably revoke an exact revision. Existing authenticated streams must recheck this state.
+    pub async fn revoke_node(
+        &self,
+        caller: &CloudCaller,
+        node_id: &str,
+        revision: u64,
+    ) -> CloudResult<CloudNode> {
+        caller.require(CloudPermission::Administer)?;
+        let mut node = self.node(caller.project_id(), node_id).await?;
+        if node.revoked {
+            return Ok(node);
+        }
+        if node.revision != revision {
+            return Err(CloudError::Conflict);
+        }
+        node.revoked = true;
+        node.revision += 1;
+        self.append(
+            caller.subject(),
+            stream(caller.project_id(), node_id),
+            revision,
+            "cloud.node.revoked.v1",
+            &node,
+        )
+        .await?;
+        Ok(node)
+    }
+
+    /// Verify a TLS-authenticated client leaf against durable project enrollment and local instance.
+    pub async fn authenticate_node(
+        &self,
+        project: &str,
+        node_id: &str,
+        fingerprint: &str,
+        instance_id: &str,
+    ) -> CloudResult<CloudNode> {
+        let node = self.node(project, node_id).await?;
+        if node.revoked || node.certificate_sha256 != fingerprint || node.instance_id != instance_id
+        {
+            return Err(CloudError::PermissionDenied);
+        }
+        Ok(node)
+    }
+
+    /// A TLS-authenticated enrollment can revoke only its exact fixed node.
+    /// Repeated calls remain idempotent after an acknowledgement is lost.
+    pub async fn revoke_own_node(
+        &self,
+        project: &str,
+        node_id: &str,
+        fingerprint: &str,
+        instance_id: &str,
+    ) -> CloudResult<()> {
+        let mut node = self.node(project, node_id).await?;
+        if node.certificate_sha256 != fingerprint || node.instance_id != instance_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        if node.revoked {
+            return Ok(());
+        }
+        let revision = node.revision;
+        node.revoked = true;
+        node.revision += 1;
+        self.append(
+            node_id,
+            stream(project, node_id),
+            revision,
+            "cloud.node.revoked.v1",
+            &node,
+        )
+        .await
+    }
+
+    pub(super) async fn node(&self, project: &str, node_id: &str) -> CloudResult<CloudNode> {
+        validate_identifier(project)?;
+        validate_identifier(node_id)?;
+        let (node, revision) = self.read::<CloudNode>(&stream(project, node_id)).await?;
+        if node.project_id != project || node.node_id != node_id || node.revision != revision {
+            return Err(CloudError::Storage);
+        }
+        Ok(node)
+    }
+
+    pub(super) async fn live_node(&self, node: &CloudNode) -> CloudResult<CloudNode> {
+        self.authenticate_node(
+            &node.project_id,
+            &node.node_id,
+            &node.certificate_sha256,
+            &node.instance_id,
+        )
+        .await
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/projects.rs b/crates/colossus-cloud/src/repository/projects.rs
new file mode 100644
index 000000000..9c0c76d0e
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/projects.rs
@@ -0,0 +1,172 @@
+//! Project names and structural hierarchy, independent of membership inheritance.
+use super::accounts::{administrator, mutation, timestamp};
+use super::*;
+use crate::{CloudProject, CloudUser, project_key, validate_project};
+fn decode_project(record: crate::storage::EntityRecord) -> CloudResult<CloudProject> {
+    if let Ok(mut project) = serde_json::from_value::<CloudProject>(record.value.clone()) {
+        if project.id != record.key.id {
+            return Err(CloudError::Storage);
+        }
+        project.revision = record.revision;
+        return Ok(project);
+    }
+    let legacy = record.value.as_object().ok_or(CloudError::Storage)?;
+    let label = legacy
+        .get("label")
+        .and_then(serde_json::Value::as_str)
+        .ok_or(CloudError::Storage)?;
+    if legacy
+        .keys()
+        .any(|key| !matches!(key.as_str(), "project_id" | "label" | "revision"))
+        || legacy.get("project_id").and_then(serde_json::Value::as_str)
+            != Some(record.key.id.as_str())
+        || record.key.project_id != record.key.id
+        || record.key.parent_id.is_some()
+        || label.trim().is_empty()
+        || label.len() > 256
+        || label.chars().any(char::is_control)
+        || legacy
+            .get("revision")
+            .is_some_and(|value| value.as_u64().is_none_or(|revision| revision == 0))
+    {
+        return Err(CloudError::Storage);
+    }
+    Ok(CloudProject {
+        id: record.key.id.clone(),
+        name: label.into(),
+        description: String::new(),
+        parent_project_id: None,
+        archived: false,
+        revision: record.revision,
+        created_at: String::new(),
+        updated_at: String::new(),
+    })
+}
+
+impl CloudRepository {
+    /// Read the named project; handles legacy project bootstrap metadata during cutover.
+    pub async fn project(&self, id: &str) -> CloudResult<CloudProject> {
+        crate::validate_identifier(id)?;
+        let record = self.store.read(&project_key(id)).await?;
+        decode_project(record)
+    }
+    /// Read all project namespaces in bounded pages for a verified administrator.
+    pub async fn projects_page(
+        &self,
+        actor: &CloudUser,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudProject>> {
+        administrator(actor)?;
+        let records = self.store.list_projects(after, limit.min(100)).await?;
+        records.into_iter().map(decode_project).collect()
+    }
+    /// Create or edit structural hierarchy; adapter serializes structural edits and rejects cycles.
+    pub async fn save_project(
+        &self,
+        actor: &CloudUser,
+        mut project: CloudProject,
+    ) -> CloudResult<CloudProject> {
+        administrator(actor)?;
+        validate_project(&project)?;
+        if let Some(parent) = &project.parent_project_id {
+            let _ = self.project(parent).await?;
+        }
+        let expected = project.revision;
+        if expected > 0 {
+            let prior = self.project(&project.id).await?;
+            if prior.revision != expected {
+                return Err(CloudError::Conflict);
+            }
+            project.created_at = prior.created_at;
+        } else {
+            project.created_at = timestamp()?;
+        }
+        project.updated_at = timestamp()?;
+        project.revision += 1;
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![mutation(
+                    &actor.id,
+                    project_key(&project.id),
+                    expected,
+                    "cloud.project.saved.v3",
+                    &project,
+                )?],
+                ..Default::default()
+            })
+            .await?;
+        Ok(project)
+    }
+    /// Project administrators may edit metadata within their own namespace; hierarchy moves require a global administrator.
+    pub async fn update_project_metadata(
+        &self,
+        caller: &CloudCaller,
+        mut project: CloudProject,
+    ) -> CloudResult<CloudProject> {
+        caller.require(CloudPermission::Administer)?;
+        if project.id != caller.project_id() {
+            return Err(CloudError::PermissionDenied);
+        }
+        let current = self.project(&project.id).await?;
+        if project.revision != current.revision {
+            return Err(CloudError::Conflict);
+        }
+        if project.parent_project_id != current.parent_project_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        validate_project(&project)?;
+        let expected = project.revision;
+        project.revision += 1;
+        project.created_at = current.created_at;
+        project.updated_at = timestamp()?;
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![mutation(
+                    caller.subject(),
+                    project_key(&project.id),
+                    expected,
+                    "cloud.project.metadata-updated.v3",
+                    &project,
+                )?],
+                ..Default::default()
+            })
+            .await?;
+        Ok(project)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn record(value: serde_json::Value) -> crate::storage::EntityRecord {
+        crate::storage::EntityRecord {
+            key: project_key("project-a"),
+            revision: 4,
+            value,
+            page_cursor: None,
+        }
+    }
+    #[test]
+    fn legacy_metadata_is_stable_and_bad_modern_state_never_becomes_legacy() {
+        let first = decode_project(record(
+            serde_json::json!({"project_id":"project-a","label":"Legacy","revision":4}),
+        ))
+        .unwrap();
+        let second = decode_project(record(
+            serde_json::json!({"project_id":"project-a","label":"Legacy","revision":4}),
+        ))
+        .unwrap();
+        assert_eq!(first.created_at, second.created_at);
+        assert!(first.created_at.is_empty());
+        assert!(first.updated_at.is_empty());
+        assert_eq!(decode_project(record(serde_json::json!({"id":"project-a","name":"Modern","archived":"invalid","label":"Legacy","project_id":"project-a"}))).unwrap_err(),CloudError::Storage);
+        assert_eq!(
+            decode_project(record(
+                serde_json::json!({"project_id":"other-project","label":"Legacy"})
+            ))
+            .unwrap_err(),
+            CloudError::Storage
+        );
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/renewal.rs b/crates/colossus-cloud/src/repository/renewal.rs
new file mode 100644
index 000000000..12f496a2e
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/renewal.rs
@@ -0,0 +1,95 @@
+use super::*;
+use crate::{CertificateRedemption, validate_identifier, validation::bounded_fingerprint};
+use serde::Deserialize;
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Renewal {
+    id: String,
+    previous_fingerprint: String,
+    csr_sha256: String,
+    certificate_pem: String,
+    certificate_sha256: String,
+    issued_at: u64,
+}
+
+impl CloudRepository {
+    /// Rotate a fixed node's leaf beneath its existing mTLS authority. The key stays
+    /// native. Exact retries reconcile a lost reply, including after host restart.
+    pub async fn renew_certificate(
+        &self,
+        identity: crate::RenewalIdentity<'_>,
+        certificate: CertificateRedemption,
+        now: u64,
+    ) -> CloudResult<String> {
+        let project = identity.project_id;
+        let node_id = identity.node_id;
+        let instance_id = identity.instance_id;
+        let previous_fingerprint = identity.previous_fingerprint;
+        let renewal_id = identity.renewal_id;
+        validate_identifier(renewal_id)?;
+        bounded_fingerprint(previous_fingerprint)?;
+        bounded_fingerprint(&certificate.fingerprint)?;
+        bounded_fingerprint(&certificate.csr_sha256)?;
+        if certificate.certificate_pem.len() > 16384 {
+            return Err(CloudError::InvalidArgument);
+        }
+        let mut node = self.node(project, node_id).await?;
+        if node.revoked || node.instance_id != instance_id {
+            return Err(CloudError::PermissionDenied);
+        }
+        let renewal_stream = format!("cloud.renewal:{project}:{node_id}");
+        let prior = match self.read::<Renewal>(&renewal_stream).await {
+            Ok(value) => Some(value),
+            Err(CloudError::NotFound) => None,
+            Err(error) => return Err(error),
+        };
+        if let Some((prior, _)) = &prior {
+            if prior.id == renewal_id {
+                return if prior.previous_fingerprint == previous_fingerprint
+                    && prior.csr_sha256 == certificate.csr_sha256
+                    && node.certificate_sha256 == prior.certificate_sha256
+                {
+                    Ok(prior.certificate_pem.clone())
+                } else {
+                    Err(CloudError::Conflict)
+                };
+            }
+            if now < prior.issued_at.saturating_add(60) {
+                return Err(CloudError::ResourceExhausted);
+            }
+        }
+        if node.certificate_sha256 != previous_fingerprint {
+            return Err(CloudError::PermissionDenied);
+        }
+        let renewal = Renewal {
+            id: renewal_id.into(),
+            previous_fingerprint: previous_fingerprint.into(),
+            csr_sha256: certificate.csr_sha256,
+            certificate_pem: certificate.certificate_pem.clone(),
+            certificate_sha256: certificate.fingerprint.clone(),
+            issued_at: now,
+        };
+        let revision = node.revision;
+        node.revision += 1;
+        node.certificate_sha256 = certificate.fingerprint;
+        self.commit(vec![
+            self.event(
+                node_id,
+                format!("cloud.node:{project}:{node_id}"),
+                revision,
+                "cloud.node.certificate-renewed.v1",
+                &node,
+            )?,
+            self.event(
+                node_id,
+                renewal_stream,
+                prior.as_ref().map_or(0, |(_, version)| *version),
+                "cloud.renewal.issued.v1",
+                &renewal,
+            )?,
+        ])
+        .await?;
+        Ok(certificate.certificate_pem)
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/tasks.rs b/crates/colossus-cloud/src/repository/tasks.rs
new file mode 100644
index 000000000..cbb341aee
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/tasks.rs
@@ -0,0 +1,361 @@
+use super::*;
+use crate::{validate_identifier, validation::fingerprint};
+use colossus_sdk::{
+    CreateRunRequest, IdempotencyKey, InputContentPart, InteractionAnswer,
+    RespondInteractionRequest,
+};
+use serde::Deserialize;
+use std::collections::BTreeSet;
+
+#[derive(Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Admission {
+    active: BTreeSet<String>,
+}
+
+pub(super) fn stream(project: &str, task: &str) -> String {
+    format!("cloud.task:{project}:{task}")
+}
+pub(super) fn command_stream(project: &str, node: &str, command: &str) -> String {
+    format!("cloud.command:{project}:{node}:{command}")
+}
+
+impl CloudRepository {
+    /// Atomically allocate a fixed-node task and its dispatch command. Identical retries reuse both.
+    pub(super) async fn allocate_task(
+        &self,
+        caller: &CloudCaller,
+        node_id: &str,
+        mut request: CreateRunRequest,
+        conversation: Option<(crate::CloudThread, u64)>,
+    ) -> CloudResult<CloudTask> {
+        caller.require(CloudPermission::Execute)?;
+        let node = self.node(caller.project_id(), node_id).await?;
+        if node.revoked || !node.roles.contains(&request.role) {
+            return Err(CloudError::PermissionDenied);
+        }
+        // Cross-run context and artifacts require separate cloud ownership mapping.
+        // Refuse them until that mapping exists; never forward a guessed runtime ID.
+        if request.session_id.as_ref().is_some_and(|session| {
+            conversation
+                .as_ref()
+                .and_then(|(thread, _)| thread.session_id.as_ref())
+                != Some(session)
+        }) || request.plan_action.is_some()
+            || request.branch.is_some()
+            || !request.plugin_skill_ids.is_empty()
+            || request.input.is_empty()
+            || request.input.len() > 128
+            || request.max_turns > 100
+            || request
+                .input
+                .iter()
+                .any(|part| !matches!(part, InputContentPart::Text(_)))
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        let input_bytes: usize = request
+            .input
+            .iter()
+            .map(|part| match part {
+                InputContentPart::Text(text) => text.len(),
+                _ => 0,
+            })
+            .sum();
+        if input_bytes == 0 || input_bytes > 1024 * 1024 {
+            return Err(CloudError::ResourceExhausted);
+        }
+        let key = fingerprint(
+            &serde_json::to_vec(&(
+                caller.project_id(),
+                caller.subject(),
+                request.idempotency_key.as_str(),
+            ))
+            .map_err(|_| CloudError::InvalidArgument)?,
+        );
+        let task_id = key[..32].to_owned();
+        request.idempotency_key =
+            IdempotencyKey::new(format!("cloud-{}-{task_id}", caller.project_id()))
+                .map_err(|_| CloudError::InvalidArgument)?;
+        request.end_user_id = Some(caller.subject().into());
+        let task = CloudTask {
+            task_id: task_id.clone(),
+            project_id: caller.project_id().into(),
+            node_id: node_id.into(),
+            subject: caller.subject().into(),
+            created_at: super::threads::timestamp()?,
+            updated_at: super::threads::timestamp()?,
+            request: request.clone(),
+            thread_id: conversation
+                .as_ref()
+                .map(|(thread, _)| thread.thread_id.clone()),
+            source_read_only: false,
+            history_complete: true,
+            history_bounded: false,
+            run_id: None,
+            snapshot: None,
+            dispatch_error: None,
+            last_sequence: 0,
+            released_bytes: 0,
+            output_limited: false,
+            revision: 1,
+        };
+        let command = PendingCommand {
+            command_id: task_id.clone(),
+            task_id: task_id.clone(),
+            node_id: node_id.into(),
+            command: Command::Create {
+                request: Box::new(request),
+            },
+            reply: None,
+            revision: 1,
+        };
+        let admission_stream = format!("cloud.admission:{}:{node_id}", caller.project_id());
+        for _ in 0..8 {
+            match self.task(caller.project_id(), &task_id).await {
+                Ok(existing) => {
+                    return if existing.request == task.request
+                        && existing.node_id == task.node_id
+                        && existing.subject == task.subject
+                        && existing.thread_id == task.thread_id
+                    {
+                        Ok(existing)
+                    } else {
+                        Err(CloudError::Conflict)
+                    };
+                }
+                Err(CloudError::NotFound) => {}
+                Err(error) => return Err(error),
+            }
+            let (mut admission, revision) = match self.read::<Admission>(&admission_stream).await {
+                Ok(value) => value,
+                Err(CloudError::NotFound) => (Admission::default(), 0),
+                Err(error) => return Err(error),
+            };
+            let mut active = BTreeSet::new();
+            for id in &admission.active {
+                let existing = self.task(caller.project_id(), id).await?;
+                let settled = existing.snapshot.as_ref().is_some_and(|snapshot| {
+                    snapshot.run.terminal.is_some()
+                        && snapshot.run.status != colossus_sdk::RunStatus::OutcomeUnknown
+                }) || existing
+                    .dispatch_error
+                    .as_ref()
+                    .is_some_and(|error| error.code != colossus_sdk::ApiErrorCode::OutcomeUnknown);
+                if !settled {
+                    active.insert(id.clone());
+                }
+            }
+            if active.len() >= colossus_cloud_protocol::MAX_ACTIVE_TASKS {
+                return Err(CloudError::ResourceExhausted);
+            }
+            active.insert(task_id.clone());
+            admission.active = active;
+            let mut events = vec![
+                self.event(
+                    caller.subject(),
+                    admission_stream.clone(),
+                    revision,
+                    "cloud.admission.allocated.v1",
+                    &admission,
+                )?,
+                self.event(
+                    caller.subject(),
+                    format!(
+                        "cloud.node-task:{}:{node_id}:{task_id}",
+                        caller.project_id()
+                    ),
+                    0,
+                    "cloud.node-task.allocated.v1",
+                    &task_id,
+                )?,
+                self.event(
+                    caller.subject(),
+                    stream(caller.project_id(), &task_id),
+                    0,
+                    "cloud.task.allocated.v1",
+                    &task,
+                )?,
+                self.event(
+                    caller.subject(),
+                    command_stream(caller.project_id(), node_id, &task_id),
+                    0,
+                    "cloud.command.created.v1",
+                    &command,
+                )?,
+            ];
+            if let Some((mut thread, expected_revision)) = conversation.clone() {
+                if thread.revision != expected_revision {
+                    return Err(CloudError::Conflict);
+                }
+                if thread.queued_task_ids.len() >= 64 {
+                    return Err(CloudError::ResourceExhausted);
+                }
+                thread.queued_task_ids.push(task_id.clone());
+                if thread.active_task_id.is_none() {
+                    thread.active_task_id = Some(task_id.clone());
+                }
+                thread.revision = expected_revision + 1;
+                thread.updated_at = super::threads::timestamp()?;
+                events.push(self.queued_message(caller, &thread, &task)?);
+                events.push(self.event(
+                    caller.subject(),
+                    super::threads::thread_stream(caller.project_id(), &thread.thread_id),
+                    expected_revision,
+                    "cloud.thread.turn-queued.v2",
+                    &thread,
+                )?);
+            }
+            match self.commit(events).await {
+                Ok(_) => return Ok(task),
+                Err(colossus_ports::StoreError::Conflict { .. }) => {
+                    continue;
+                }
+                Err(error) => return Err(error.into()),
+            }
+        }
+        Err(CloudError::Conflict)
+    }
+
+    /// Read the task's released state only inside the authenticated project.
+    pub async fn get_task(&self, caller: &CloudCaller, task_id: &str) -> CloudResult<CloudTask> {
+        caller.require(CloudPermission::Read)?;
+        self.task(caller.project_id(), task_id).await
+    }
+
+    /// Read a bounded page of task identities using the journal's indexed project namespace.
+    pub async fn list_tasks(
+        &self,
+        caller: &CloudCaller,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudTask>> {
+        caller.require(CloudPermission::Read)?;
+        if let Some(after) = after {
+            validate_identifier(after)?;
+        }
+        let prefix = format!("cloud.task:{}:", caller.project_id());
+        self.list(&prefix, after, limit).await
+    }
+
+    /// Queue cooperative cancellation beneath explicit control permission.
+    pub async fn cancel_task(
+        &self,
+        caller: &CloudCaller,
+        task_id: &str,
+        mutation_id: &str,
+    ) -> CloudResult<PendingCommand> {
+        caller.require(CloudPermission::Control)?;
+        let task = self.task(caller.project_id(), task_id).await?;
+        if task.source_read_only {
+            return Err(CloudError::PermissionDenied);
+        }
+        let run_id = task.run_id.clone().ok_or(CloudError::Conflict)?;
+        self.queue_mutation(
+            caller,
+            &task,
+            mutation_id,
+            Command::Cancel {
+                run_id,
+                idempotency_key: IdempotencyKey::new(format!(
+                    "cloud-cancel-{task_id}-{mutation_id}"
+                ))
+                .map_err(|_| CloudError::InvalidArgument)?,
+            },
+        )
+        .await
+    }
+
+    /// Queue an exact prompt/approval answer. Approval authority is independent of cancellation.
+    pub async fn respond_task(
+        &self,
+        caller: &CloudCaller,
+        task_id: &str,
+        mutation_id: &str,
+        mut request: RespondInteractionRequest,
+    ) -> CloudResult<PendingCommand> {
+        caller.require(
+            if matches!(request.response, InteractionAnswer::Approval { .. }) {
+                CloudPermission::Approve
+            } else {
+                CloudPermission::Control
+            },
+        )?;
+        let task = self.task(caller.project_id(), task_id).await?;
+        if task.source_read_only {
+            return Err(CloudError::PermissionDenied);
+        }
+        if task.run_id.as_deref() != Some(&request.run_id) {
+            return Err(CloudError::PermissionDenied);
+        }
+        request.idempotency_key =
+            IdempotencyKey::new(format!("cloud-respond-{task_id}-{mutation_id}"))
+                .map_err(|_| CloudError::InvalidArgument)?;
+        self.queue_mutation(
+            caller,
+            &task,
+            mutation_id,
+            Command::Respond {
+                request: Box::new(request),
+            },
+        )
+        .await
+    }
+
+    async fn queue_mutation(
+        &self,
+        caller: &CloudCaller,
+        task: &CloudTask,
+        mutation_id: &str,
+        command: Command,
+    ) -> CloudResult<PendingCommand> {
+        validate_identifier(mutation_id)?;
+        if self.node(caller.project_id(), &task.node_id).await?.revoked {
+            return Err(CloudError::PermissionDenied);
+        }
+        let command_id = fingerprint(
+            &serde_json::to_vec(&(task.task_id.as_str(), caller.subject(), mutation_id))
+                .map_err(|_| CloudError::InvalidArgument)?,
+        )[..32]
+            .to_owned();
+        let pending = PendingCommand {
+            command_id: command_id.clone(),
+            task_id: task.task_id.clone(),
+            node_id: task.node_id.clone(),
+            command,
+            reply: None,
+            revision: 1,
+        };
+        let stream = command_stream(caller.project_id(), &task.node_id, &command_id);
+        match self
+            .append(
+                caller.subject(),
+                stream.clone(),
+                0,
+                "cloud.command.created.v1",
+                &pending,
+            )
+            .await
+        {
+            Ok(()) => Ok(pending),
+            Err(CloudError::Conflict) => {
+                let (existing, _) = self.read::<PendingCommand>(&stream).await?;
+                if existing.command != pending.command || existing.task_id != pending.task_id {
+                    return Err(CloudError::Conflict);
+                }
+                Ok(existing)
+            }
+            Err(error) => Err(error),
+        }
+    }
+
+    pub(super) async fn task(&self, project: &str, task_id: &str) -> CloudResult<CloudTask> {
+        validate_identifier(project)?;
+        validate_identifier(task_id)?;
+        let (task, revision) = self.read::<CloudTask>(&stream(project, task_id)).await?;
+        if task.project_id != project || task.task_id != task_id || task.revision != revision {
+            return Err(CloudError::Storage);
+        }
+        Ok(task)
+    }
+}
diff --git a/crates/colossus-cloud/src/repository/threads.rs b/crates/colossus-cloud/src/repository/threads.rs
new file mode 100644
index 000000000..1986a2c7b
--- /dev/null
+++ b/crates/colossus-cloud/src/repository/threads.rs
@@ -0,0 +1,814 @@
+use super::*;
+use crate::{
+    CloudMessage, CloudThread, CloudThreadDetail, validate_identifier, validation::fingerprint,
+};
+use colossus_sdk::{
+    CreateRunRequest, InputContentPart, MessageContentPart, MessageRole, RunUpdateKind,
+};
+
+pub(super) fn timestamp() -> CloudResult<String> {
+    time::OffsetDateTime::now_utc()
+        .format(&time::format_description::well_known::Rfc3339)
+        .map_err(|_| CloudError::Storage)
+}
+pub(super) fn thread_stream(project: &str, id: &str) -> String {
+    format!("cloud.thread:{project}:{id}")
+}
+pub(super) fn submission_id(
+    caller: &CloudCaller,
+    request: &CreateRunRequest,
+) -> CloudResult<String> {
+    Ok(fingerprint(
+        &serde_json::to_vec(&(
+            caller.project_id(),
+            caller.subject(),
+            request.idempotency_key.as_str(),
+        ))
+        .map_err(|_| CloudError::InvalidArgument)?,
+    )[..32]
+        .to_owned())
+}
+fn valid_title(title: &str) -> CloudResult<()> {
+    if title.trim().is_empty() || title.len() > 256 || title.chars().any(char::is_control) {
+        return Err(CloudError::InvalidArgument);
+    }
+    Ok(())
+}
+impl CloudRepository {
+    /// Atomically create a fixed-runtime conversation and its first queued turn.
+    pub async fn create_thread(
+        &self,
+        caller: &CloudCaller,
+        node_id: &str,
+        title: Option<String>,
+        request: CreateRunRequest,
+    ) -> CloudResult<(CloudThread, CloudTask)> {
+        caller.require(CloudPermission::Execute)?;
+        if request.session_id.is_some() {
+            return Err(CloudError::InvalidArgument);
+        }
+        let id = format!("t{}", submission_id(caller, &request)?);
+        let node = self.node(caller.project_id(), node_id).await?;
+        let title = title.unwrap_or_else(|| {
+            request
+                .input
+                .iter()
+                .find_map(|part| match part {
+                    InputContentPart::Text(text) => Some(
+                        text.split_whitespace()
+                            .collect::<Vec<_>>()
+                            .join(" ")
+                            .chars()
+                            .take(100)
+                            .collect(),
+                    ),
+                    _ => None,
+                })
+                .unwrap_or_else(|| "New thread".into())
+        });
+        valid_title(&title)?;
+        let now = timestamp()?;
+        let thread = match self.thread(caller.project_id(), &id).await {
+            Ok(existing) => existing,
+            Err(CloudError::NotFound) => CloudThread {
+                thread_id: id.clone(),
+                project_id: caller.project_id().into(),
+                node_id: node_id.into(),
+                host_id: node.host_id,
+                workspace_id: node.workspace_id,
+                title,
+                created_at: now.clone(),
+                updated_at: now,
+                revision: 0,
+                archived: false,
+                session_id: None,
+                sync_status: "current".into(),
+                source: "cloud".into(),
+                can_continue: true,
+                active_task_id: None,
+                queued_task_ids: vec![],
+            },
+            Err(error) => return Err(error),
+        };
+        let task = self
+            .allocate_task(caller, node_id, request, Some((thread, 0)))
+            .await?;
+        Ok((self.thread(caller.project_id(), &id).await?, task))
+    }
+    /// Retain the task entry point as an operational view of a conversation turn.
+    pub async fn create_task(
+        &self,
+        caller: &CloudCaller,
+        node_id: &str,
+        request: CreateRunRequest,
+    ) -> CloudResult<CloudTask> {
+        self.create_thread(caller, node_id, None, request)
+            .await
+            .map(|(_, task)| task)
+    }
+    /// Append one ordered human turn. The service alone resolves runtime session IDs.
+    pub async fn send_message(
+        &self,
+        caller: &CloudCaller,
+        id: &str,
+        expected_revision: u64,
+        mut request: CreateRunRequest,
+    ) -> CloudResult<(CloudThread, CloudTask)> {
+        caller.require(CloudPermission::Execute)?;
+        if request.session_id.is_some() {
+            return Err(CloudError::InvalidArgument);
+        }
+        let thread = self.thread(caller.project_id(), id).await?;
+        if !thread.can_continue || thread.archived {
+            return Err(CloudError::PermissionDenied);
+        }
+        let submission = submission_id(caller, &request)?;
+        if let Ok(existing) = self.task(caller.project_id(), &submission).await {
+            if existing.thread_id.as_deref() != Some(id) || existing.node_id != thread.node_id {
+                return Err(CloudError::Conflict);
+            }
+            request.session_id = existing.request.session_id.clone();
+            let task = self
+                .allocate_task(
+                    caller,
+                    &thread.node_id.clone(),
+                    request,
+                    Some((thread, expected_revision)),
+                )
+                .await?;
+            return Ok((self.thread(caller.project_id(), id).await?, task));
+        }
+        if thread.revision != expected_revision {
+            return Err(CloudError::Conflict);
+        }
+        request.session_id = thread.session_id.clone();
+        // A queued first turn has not established the runtime session yet. Continue
+        // only after its durable receipt; never allocate an unrelated session.
+        if request.session_id.is_none() {
+            return Err(CloudError::Conflict);
+        }
+        let task = self
+            .allocate_task(
+                caller,
+                &thread.node_id.clone(),
+                request,
+                Some((thread, expected_revision)),
+            )
+            .await?;
+        Ok((self.thread(caller.project_id(), id).await?, task))
+    }
+    /// Read a conversation within an authenticated project.
+    pub async fn get_thread(
+        &self,
+        caller: &CloudCaller,
+        id: &str,
+    ) -> CloudResult<CloudThreadDetail> {
+        self.thread_detail(caller, id, None, None).await
+    }
+    /// Bounded retained history remains readable while its runtime is disconnected.
+    pub async fn thread_detail(
+        &self,
+        caller: &CloudCaller,
+        id: &str,
+        task_after: Option<&str>,
+        message_after: Option<&str>,
+    ) -> CloudResult<CloudThreadDetail> {
+        caller.require(CloudPermission::Read)?;
+        let thread = self.thread(caller.project_id(), id).await?;
+        let records = self
+            .store
+            .list(&EntityQuery {
+                kind: EntityKind::Task,
+                project_id: caller.project_id().into(),
+                parent_id: Some(id.into()),
+                after: task_after.map(str::to_owned),
+                limit: 100,
+                node_id: None,
+                query: None,
+                status: None,
+                archived: None,
+                order: EntityOrder::CreatedDesc,
+            })
+            .await?;
+        let next_task_cursor = (records.len() == 100)
+            .then(|| records.last().and_then(|record| record.page_cursor.clone()))
+            .flatten();
+        let tasks: Vec<CloudTask> = records
+            .into_iter()
+            .map(|record| serde_json::from_value(record.value).map_err(|_| CloudError::Storage))
+            .collect::<CloudResult<_>>()?;
+        let records = self
+            .store
+            .list(&EntityQuery {
+                kind: EntityKind::ThreadMessage,
+                project_id: caller.project_id().into(),
+                parent_id: Some(id.into()),
+                after: message_after.map(str::to_owned),
+                limit: 100,
+                node_id: None,
+                query: None,
+                status: None,
+                archived: None,
+                order: EntityOrder::CreatedDesc,
+            })
+            .await?;
+        let next_message_cursor = (records.len() == 100)
+            .then(|| records.last().and_then(|record| record.page_cursor.clone()))
+            .flatten();
+        let mut messages: Vec<CloudMessage> = records
+            .into_iter()
+            .map(|record| serde_json::from_value(record.value).map_err(|_| CloudError::Storage))
+            .collect::<CloudResult<_>>()?;
+        messages.reverse();
+        for task in &tasks {
+            if task.subject != "runtime"
+                && !task.source_read_only
+                && !messages
+                    .iter()
+                    .any(|message| message.task_id == task.task_id && message.role == "user")
+            {
+                let text = task
+                    .request
+                    .input
+                    .iter()
+                    .filter_map(|part| {
+                        if let InputContentPart::Text(text) = part {
+                            Some(text.as_str())
+                        } else {
+                            None
+                        }
+                    })
+                    .collect::<Vec<_>>()
+                    .join("\n");
+                if !text.is_empty() {
+                    messages.push(CloudMessage {
+                        message_id: format!("{}-user", task.task_id),
+                        thread_id: id.into(),
+                        project_id: caller.project_id().into(),
+                        role: "user".into(),
+                        text,
+                        created_at: if task.created_at.is_empty() {
+                            task.snapshot.as_ref().map_or_else(
+                                || thread.created_at.clone(),
+                                |snapshot| snapshot.run.created_at.clone(),
+                            )
+                        } else {
+                            task.created_at.clone()
+                        },
+                        task_id: task.task_id.clone(),
+                        revision: 0,
+                    });
+                }
+            }
+        }
+        let canonical = messages.clone();
+        messages.retain(|message| {
+            !message.message_id.ends_with("-final")
+                || !canonical.iter().any(|other| {
+                    other.message_id != message.message_id
+                        && other.task_id == message.task_id
+                        && other.role == "assistant"
+                        && other.text == message.text
+                })
+        });
+        messages.sort_by(|a, b| {
+            a.created_at
+                .cmp(&b.created_at)
+                .then_with(|| a.message_id.cmp(&b.message_id))
+        });
+
+        Ok(CloudThreadDetail {
+            thread,
+            tasks,
+            messages,
+            next_task_cursor,
+            next_message_cursor,
+        })
+    }
+    /// Query conversation titles and runtime placement in storage, before pagination.
+    pub async fn list_threads(
+        &self,
+        caller: &CloudCaller,
+        node: Option<String>,
+        query: Option<String>,
+        archived: Option<bool>,
+        after: Option<String>,
+        limit: usize,
+    ) -> CloudResult<Vec<CloudThread>> {
+        self.query_threads(caller, node, query, archived, after, limit)
+            .await
+            .map(|(threads, _)| threads)
+    }
+    /// Query a stable page with a cursor capturing its immutable ordering position.
+    pub async fn query_threads(
+        &self,
+        caller: &CloudCaller,
+        node: Option<String>,
+        query: Option<String>,
+        archived: Option<bool>,
+        after: Option<String>,
+        limit: usize,
+    ) -> CloudResult<(Vec<CloudThread>, Option<String>)> {
+        caller.require(CloudPermission::Read)?;
+        if let Some(node) = &node {
+            validate_identifier(node)?;
+        }
+        if query.as_ref().is_some_and(|value| value.len() > 256) {
+            return Err(CloudError::InvalidArgument);
+        }
+        let records = self
+            .store
+            .list(&EntityQuery {
+                kind: EntityKind::Thread,
+                project_id: caller.project_id().into(),
+                parent_id: None,
+                after,
+                limit: limit.min(100),
+                node_id: node,
+                query,
+                status: None,
+                archived,
+                order: EntityOrder::UpdatedDesc,
+            })
+            .await?;
+        let cursor = (records.len() == limit.min(100))
+            .then(|| records.last().and_then(|record| record.page_cursor.clone()))
+            .flatten();
+        let threads = records
+            .into_iter()
+            .map(|record| serde_json::from_value(record.value).map_err(|_| CloudError::Storage))
+            .collect::<CloudResult<_>>()?;
+        Ok((threads, cursor))
+    }
+    /// Change bounded thread metadata using the exact visible revision.
+    pub async fn update_thread(
+        &self,
+        caller: &CloudCaller,
+        id: &str,
+        revision: u64,
+        title: Option<String>,
+        archived: Option<bool>,
+    ) -> CloudResult<CloudThread> {
+        caller.require(CloudPermission::Control)?;
+        let mut thread = self.thread(caller.project_id(), id).await?;
+        if thread.revision != revision {
+            return Err(CloudError::Conflict);
+        }
+        if let Some(title) = title {
+            valid_title(&title)?;
+            thread.title = title.trim().into();
+        }
+        if let Some(archived) = archived {
+            thread.archived = archived;
+        }
+        thread.revision += 1;
+        thread.updated_at = timestamp()?;
+        self.append(
+            caller.subject(),
+            thread_stream(caller.project_id(), id),
+            revision,
+            "cloud.thread.edited.v2",
+            &thread,
+        )
+        .await?;
+        Ok(thread)
+    }
+    pub(super) async fn thread(&self, project: &str, id: &str) -> CloudResult<CloudThread> {
+        validate_identifier(project)?;
+        validate_identifier(id)?;
+        let (thread, revision) = self
+            .read::<CloudThread>(&thread_stream(project, id))
+            .await?;
+        if thread.project_id != project || thread.thread_id != id || thread.revision != revision {
+            return Err(CloudError::Storage);
+        }
+        Ok(thread)
+    }
+    pub(super) fn queued_message(
+        &self,
+        caller: &CloudCaller,
+        thread: &CloudThread,
+        task: &CloudTask,
+    ) -> CloudResult<Write> {
+        let text = task
+            .request
+            .input
+            .iter()
+            .filter_map(|part| {
+                if let InputContentPart::Text(text) = part {
+                    Some(text.as_str())
+                } else {
+                    None
+                }
+            })
+            .collect::<Vec<_>>()
+            .join("\n");
+        let message = CloudMessage {
+            message_id: format!("{}-user", task.task_id),
+            thread_id: thread.thread_id.clone(),
+            project_id: caller.project_id().into(),
+            role: "user".into(),
+            text,
+            created_at: thread.updated_at.clone(),
+            task_id: task.task_id.clone(),
+            revision: 1,
+        };
+        self.event(
+            caller.subject(),
+            format!(
+                "cloud.message:{}:{}:{}",
+                caller.project_id(),
+                thread.thread_id,
+                message.message_id
+            ),
+            0,
+            "cloud.message.queued.v2",
+            &message,
+        )
+    }
+    pub(super) async fn released_message(
+        &self,
+        node: &CloudNode,
+        task: &CloudTask,
+        update: &colossus_sdk::RunUpdate,
+    ) -> CloudResult<Option<Write>> {
+        let Some(thread_id) = &task.thread_id else {
+            return Ok(None);
+        };
+        if !matches!(
+            update.update,
+            RunUpdateKind::Message(_) | RunUpdateKind::Result(_)
+        ) {
+            return Ok(None);
+        }
+        let thread = self.thread(&node.project_id, thread_id).await?;
+        let (id, role, text, created_at) = match &update.update {
+            RunUpdateKind::Message(message) => {
+                if message.run_id != update.run_id {
+                    return Err(CloudError::InvalidArgument);
+                }
+                if thread
+                    .session_id
+                    .as_deref()
+                    .is_some_and(|id| id != message.session_id)
+                {
+                    return Err(CloudError::PermissionDenied);
+                }
+                let role = match message.role {
+                    MessageRole::User => "user",
+                    MessageRole::Assistant => "assistant",
+                    _ => return Ok(None),
+                };
+                if role == "user" && !task.source_read_only && task.subject != "runtime" {
+                    return Ok(None);
+                }
+                let text = message
+                    .content
+                    .iter()
+                    .filter_map(|part| {
+                        if let MessageContentPart::Text(text) = part {
+                            Some(text.as_str())
+                        } else {
+                            None
+                        }
+                    })
+                    .collect::<Vec<_>>()
+                    .join("\n");
+                (
+                    format!("m{:020}-{}", message.sequence, task.task_id),
+                    role,
+                    text,
+                    message.created_at.clone(),
+                )
+            }
+            // Older public runtimes release a terminal result without a canonical
+            // Message event. Retain that released result for offline conversations.
+            RunUpdateKind::Result(result) if !result.output.is_empty() => (
+                format!("{}-final", task.task_id),
+                "assistant",
+                result.output.clone(),
+                update.created_at.clone(),
+            ),
+            _ => return Ok(None),
+        };
+        let value = CloudMessage {
+            message_id: id.clone(),
+            thread_id: thread_id.clone(),
+            project_id: node.project_id.clone(),
+            role: role.into(),
+            text,
+            created_at,
+            task_id: task.task_id.clone(),
+            revision: 1,
+        };
+        let stream = format!("cloud.message:{}:{thread_id}:{id}", node.project_id);
+        match self.read::<CloudMessage>(&stream).await {
+            Ok((existing, _)) if existing == value => Ok(None),
+            Ok(_) => Err(CloudError::Conflict),
+            Err(CloudError::NotFound) => Ok(Some(self.event(
+                &node.node_id,
+                stream,
+                0,
+                "cloud.message.released.v2",
+                &value,
+            )?)),
+            Err(error) => Err(error),
+        }
+    }
+    /// Resolve the next queued turn only after the prior turn has a known outcome.
+    pub(super) async fn dispatchable(&self, task: &CloudTask) -> CloudResult<bool> {
+        let Some(id) = &task.thread_id else {
+            return Ok(true);
+        };
+        let thread = self.thread(&task.project_id, id).await?;
+        for prior in &thread.queued_task_ids {
+            if prior == &task.task_id {
+                return Ok(true);
+            }
+            let previous = self.task(&task.project_id, prior).await?;
+            let settled = previous.snapshot.as_ref().is_some_and(|snapshot| {
+                snapshot.run.terminal.is_some()
+                    && snapshot.run.status != colossus_sdk::RunStatus::OutcomeUnknown
+            }) || previous
+                .dispatch_error
+                .as_ref()
+                .is_some_and(|error| error.code != colossus_sdk::ApiErrorCode::OutcomeUnknown);
+            if !settled {
+                return Ok(false);
+            }
+        }
+        Ok(false)
+    }
+}
+
+impl CloudRepository {
+    pub(super) async fn refresh_thread_progress(&self, task: &CloudTask) -> CloudResult<()> {
+        let Some(id) = &task.thread_id else {
+            return Ok(());
+        };
+        for _ in 0..8 {
+            let mut thread = self.thread(&task.project_id, id).await?;
+            let before = thread.clone();
+            let mut queue = Vec::new();
+            for pending in &thread.queued_task_ids {
+                let pending = self.task(&task.project_id, pending).await?;
+                let settled = pending.snapshot.as_ref().is_some_and(|snapshot| {
+                    snapshot.run.terminal.is_some()
+                        && snapshot.run.status != colossus_sdk::RunStatus::OutcomeUnknown
+                }) || pending
+                    .dispatch_error
+                    .as_ref()
+                    .is_some_and(|error| error.code != colossus_sdk::ApiErrorCode::OutcomeUnknown);
+                if !settled {
+                    queue.push(pending.task_id);
+                }
+            }
+            thread.active_task_id = queue.first().cloned();
+            thread.queued_task_ids = queue;
+            let incomplete = self.store.thread_incomplete(&task.project_id, id).await?;
+            thread.sync_status = if incomplete { "incomplete" } else { "current" }.into();
+            if thread == before {
+                return Ok(());
+            }
+            let revision = thread.revision;
+            thread.revision += 1;
+            thread.updated_at = timestamp()?;
+            match self
+                .append(
+                    "runtime",
+                    thread_stream(&task.project_id, id),
+                    revision,
+                    "cloud.thread.progress.v2",
+                    &thread,
+                )
+                .await
+            {
+                Ok(()) => return Ok(()),
+                Err(CloudError::Conflict) => continue,
+                Err(error) => return Err(error),
+            }
+        }
+        Err(CloudError::Conflict)
+    }
+}
+
+impl CloudRepository {
+    /// Read the committed ordered conversation feed after an exclusive cloud cursor.
+    pub async fn thread_updates(
+        &self,
+        caller: &CloudCaller,
+        id: &str,
+        after: u64,
+        limit: usize,
+    ) -> CloudResult<Vec<ReleasedEvent>> {
+        caller.require(CloudPermission::Read)?;
+        self.thread(caller.project_id(), id).await?;
+        let head = self
+            .store
+            .cursor(caller.project_id(), "cloud-thread", id)
+            .await?;
+        if after > head {
+            return Err(CloudError::Conflict);
+        }
+        self.store
+            .events(
+                caller.project_id(),
+                &format!("thread-{id}"),
+                after,
+                limit.min(100),
+            )
+            .await
+    }
+}
+
+impl CloudRepository {
+    /// Rebuild human conversation views from verified imported cloud data.
+    /// This operator cutover is resumable; runtime journals and grants are untouched.
+    pub async fn bootstrap_migrated_project(&self, project: &str) -> CloudResult<()> {
+        validate_identifier(project)?;
+        let mut after = None;
+        loop {
+            let records = self
+                .store
+                .list(&EntityQuery {
+                    kind: EntityKind::Task,
+                    project_id: project.into(),
+                    parent_id: None,
+                    after: after.clone(),
+                    limit: 100,
+                    node_id: None,
+                    query: None,
+                    status: None,
+                    archived: None,
+                    order: EntityOrder::IdAsc,
+                })
+                .await?;
+            if records.is_empty() {
+                break;
+            }
+            after = records.last().map(|record| record.key.id.clone());
+            for record in records {
+                let mut task: CloudTask =
+                    serde_json::from_value(record.value).map_err(|_| CloudError::Storage)?;
+                let node = self.node(project, &task.node_id).await?;
+                let session = task
+                    .snapshot
+                    .as_ref()
+                    .map(|snapshot| snapshot.run.session_id.clone());
+                let id = task.thread_id.clone().unwrap_or_else(|| {
+                    session.as_ref().map_or_else(
+                        || format!("t{}", task.task_id),
+                        |session| {
+                            format!(
+                                "t{}",
+                                &fingerprint(
+                                    format!("{project}:{}:{session}", task.node_id).as_bytes()
+                                )[..32]
+                            )
+                        },
+                    )
+                });
+                let now = timestamp()?;
+                let (mut thread, version) = match self.thread(project, &id).await {
+                    Ok(thread) => {
+                        let version = thread.revision;
+                        (thread, version)
+                    }
+                    Err(CloudError::NotFound) => (
+                        CloudThread {
+                            thread_id: id.clone(),
+                            project_id: project.into(),
+                            node_id: task.node_id.clone(),
+                            host_id: node.host_id.clone(),
+                            workspace_id: node.workspace_id.clone(),
+                            title: task
+                                .snapshot
+                                .as_ref()
+                                .map(|snapshot| snapshot.run.title.clone())
+                                .unwrap_or_else(|| "Imported cloud task".into()),
+                            created_at: if task.created_at.is_empty() {
+                                now.clone()
+                            } else {
+                                task.created_at.clone()
+                            },
+                            updated_at: now.clone(),
+                            revision: 0,
+                            archived: false,
+                            session_id: session.clone(),
+                            sync_status: if task.output_limited {
+                                "incomplete"
+                            } else {
+                                "current"
+                            }
+                            .into(),
+                            source: "cloud".into(),
+                            can_continue: !node.revoked,
+                            active_task_id: None,
+                            queued_task_ids: vec![],
+                        },
+                        0,
+                    ),
+                    Err(error) => return Err(error),
+                };
+                if thread.node_id != node.node_id || thread.session_id != session {
+                    return Err(CloudError::Conflict);
+                }
+                let mut writes = Vec::new();
+                if version == 0 {
+                    thread.revision = 1;
+                    if task.run_id.is_none() {
+                        thread.active_task_id = Some(task.task_id.clone());
+                        thread.queued_task_ids.push(task.task_id.clone());
+                    }
+                    writes.push(self.event(
+                        "operator-import",
+                        thread_stream(project, &id),
+                        0,
+                        "cloud.thread.imported.v2",
+                        &thread,
+                    )?);
+                    if let Some(session) = &session {
+                        writes.push(self.event(
+                            "operator-import",
+                            format!("cloud.session:{project}:{}:{session}", node.node_id),
+                            0,
+                            "cloud.session.imported.v2",
+                            &id,
+                        )?);
+                    }
+                }
+                if task.thread_id.is_none() {
+                    let version = task.revision;
+                    task.revision += 1;
+                    task.thread_id = Some(id.clone());
+                    task.updated_at = now;
+                    writes.push(self.event(
+                        "operator-import",
+                        tasks::stream(project, &task.task_id),
+                        version,
+                        "cloud.task.thread-imported.v2",
+                        &task,
+                    )?);
+                }
+                if !writes.is_empty() {
+                    self.commit(writes).await?;
+                }
+                let mut source_after = self
+                    .store
+                    .cursor(project, "migration-task", &task.task_id)
+                    .await?;
+                loop {
+                    let events = self
+                        .store
+                        .events(project, &task.task_id, source_after, 100)
+                        .await?;
+                    if events.is_empty() {
+                        break;
+                    }
+                    for event in events {
+                        let update: colossus_sdk::RunUpdate =
+                            serde_json::from_value(event.value).map_err(|_| CloudError::Storage)?;
+                        let mut source_task = task.clone();
+                        source_task.subject = "runtime".into();
+                        let mut writes = Vec::new();
+                        if let Some(message) =
+                            self.released_message(&node, &source_task, &update).await?
+                        {
+                            writes.push(message);
+                        }
+                        let feed_after = self.store.cursor(project, "cloud-thread", &id).await?;
+                        let mut value =
+                            serde_json::to_value(&update).map_err(|_| CloudError::Storage)?;
+                        value.as_object_mut().ok_or(CloudError::Storage)?.insert(
+                            "task_id".into(),
+                            serde_json::Value::String(task.task_id.clone()),
+                        );
+                        writes.push(Write::Event(ReleasedEvent {
+                            project_id: project.into(),
+                            scope_id: format!("thread-{id}"),
+                            sequence: feed_after + 1,
+                            value,
+                        }));
+                        writes.push(Write::Cursor(CursorMutation {
+                            project_id: project.into(),
+                            source_id: "cloud-thread".into(),
+                            scope_id: id.clone(),
+                            expected_sequence: feed_after,
+                            sequence: feed_after + 1,
+                        }));
+                        writes.push(Write::Cursor(CursorMutation {
+                            project_id: project.into(),
+                            source_id: "migration-task".into(),
+                            scope_id: task.task_id.clone(),
+                            expected_sequence: source_after,
+                            sequence: update.sequence,
+                        }));
+                        self.commit(writes).await?;
+                        source_after = update.sequence;
+                    }
+                }
+            }
+        }
+        Ok(())
+    }
+}
diff --git a/crates/colossus-cloud/src/settings.rs b/crates/colossus-cloud/src/settings.rs
new file mode 100644
index 000000000..23d21a740
--- /dev/null
+++ b/crates/colossus-cloud/src/settings.rs
@@ -0,0 +1,381 @@
+//! Audited display configuration and project policy expectations.
+use crate::storage::{CloudTransaction, EntityKey, EntityKind, EntityMutation};
+use crate::{CloudCaller, CloudError, CloudPermission, CloudRepository, CloudResult};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+
+/// Closed visual severity choices; no arbitrary CSS colors.
+#[derive(Clone, Copy, Debug, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ClassificationTone {
+    /// Neutral display marking.
+    #[default]
+    Neutral,
+    /// Informational display marking.
+    Info,
+    /// Warning display marking.
+    Warning,
+    /// High-priority display marking.
+    Danger,
+}
+/// Classification marking placement around the application chrome.
+#[derive(Clone, Copy, Debug, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ClassificationPosition {
+    /// Show the marking above the application chrome.
+    Top,
+    /// Show the marking above and below the application chrome.
+    #[default]
+    TopAndBottom,
+}
+/// Plain-text deployment marking, rendered in the application chrome and sign-in view.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ClassificationBanner {
+    /// Whether the deployment marking is visible.
+    pub enabled: bool,
+    /// Bounded plain text; rendered without HTML interpretation.
+    pub text: String,
+    /// Visual severity selected from shared design tokens.
+    pub tone: ClassificationTone,
+    /// Placement around the application chrome.
+    pub position: ClassificationPosition,
+}
+impl ClassificationBanner {
+    /// Validate bounded plain text; the tone and position are closed enums.
+    pub fn validate(&self) -> CloudResult<()> {
+        if self.text.chars().count() > 160
+            || self.text.chars().any(char::is_control)
+            || (self.enabled && self.text.trim().is_empty())
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        Ok(())
+    }
+}
+/// Public deployment display settings with an optimistic database revision.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ControlPlaneSettings {
+    /// Exact optimistic database revision; zero creates the initial setting.
+    pub revision: u64,
+    /// Public deployment marking configuration.
+    pub classification: ClassificationBanner,
+}
+/// Display baseline only; setting it never changes native execution policy or grants.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ProjectPolicyExpectation {
+    /// Exact optimistic database revision; zero creates the initial setting.
+    pub revision: u64,
+    /// Expected reported sandbox profile; absent means no profile baseline.
+    pub required_sandbox_profile: Option<String>,
+    /// Allowed reported modes; empty means no mode baseline.
+    pub allowed_approval_modes: BTreeSet<String>,
+    /// Expected tool ceiling; absent means no tool baseline, empty permits none.
+    pub allowed_tools: Option<BTreeSet<String>>,
+}
+/// Monitoring state based on fresh, authenticated runtime-reported configuration.
+#[derive(Clone, Copy, Debug, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PolicyAlignment {
+    /// No baseline, no observation, or the observation is stale.
+    Unknown,
+    /// Fresh reported metadata agrees with the configured monitoring baseline.
+    Aligned,
+    /// Fresh reported metadata differs from the configured monitoring baseline.
+    Drift,
+}
+/// A display-only monitoring difference; never an execution denial or attestation.
+#[derive(Clone, Debug, Serialize)]
+pub struct PolicyDifference {
+    /// Stable metadata-only reason code.
+    pub code: &'static str,
+    /// Human-readable bounded difference description.
+    pub description: &'static str,
+}
+/// Monitoring comparison that cannot change local authority.
+#[derive(Clone, Debug, Serialize)]
+pub struct PolicyEvaluation {
+    /// Current monitoring conclusion, preserving uncertainty.
+    pub status: PolicyAlignment,
+    /// Differences in the retained observation, which may be stale.
+    pub findings: Vec<PolicyDifference>,
+}
+impl ProjectPolicyExpectation {
+    /// Compare safe released metadata; absent, stale or unconfigured evidence stays unknown.
+    pub fn evaluate(
+        &self,
+        posture: Option<&colossus_sdk::RuntimePolicyPosture>,
+        stale: bool,
+    ) -> PolicyEvaluation {
+        let mut findings = Vec::new();
+        if let Some(posture) = posture {
+            if self
+                .required_sandbox_profile
+                .as_ref()
+                .is_some_and(|profile| profile != &posture.sandbox_profile)
+            {
+                findings.push(PolicyDifference{code:"sandbox_profile_drift",description:"Reported sandbox profile differs from the project's monitoring baseline."});
+            }
+            let mode = match posture.approval_mode {
+                colossus_sdk::PolicyApprovalMode::Ask => "ask",
+                colossus_sdk::PolicyApprovalMode::Deny => "deny",
+                colossus_sdk::PolicyApprovalMode::RiskAuto => "risk_auto",
+                colossus_sdk::PolicyApprovalMode::DangerAuto => "danger_auto",
+                colossus_sdk::PolicyApprovalMode::Unknown => "unknown",
+            };
+            if !self.allowed_approval_modes.is_empty()
+                && !self.allowed_approval_modes.contains(mode)
+            {
+                findings.push(PolicyDifference{code:"approval_mode_drift",description:"Reported approval mode falls outside the project's monitoring baseline."});
+            }
+            if self.allowed_tools.as_ref().is_some_and(|tools| {
+                posture
+                    .allowed_tools
+                    .iter()
+                    .any(|tool| !tools.contains(tool))
+            }) {
+                findings.push(PolicyDifference{code:"tool_ceiling_drift",description:"The reported tool ceiling includes tools outside the project's monitoring baseline."});
+            }
+        }
+        let configured = self.required_sandbox_profile.is_some()
+            || !self.allowed_approval_modes.is_empty()
+            || self.allowed_tools.is_some();
+        let status = if stale || posture.is_none() || !configured {
+            PolicyAlignment::Unknown
+        } else if findings.is_empty() {
+            PolicyAlignment::Aligned
+        } else {
+            PolicyAlignment::Drift
+        };
+        PolicyEvaluation { status, findings }
+    }
+}
+fn setting_key(project: &str, id: &str) -> EntityKey {
+    EntityKey {
+        kind: EntityKind::Setting,
+        project_id: project.into(),
+        parent_id: None,
+        id: id.into(),
+    }
+}
+impl CloudRepository {
+    /// Public display settings contain no operational data, user identities or secrets.
+    pub async fn display_settings(&self) -> CloudResult<ControlPlaneSettings> {
+        match self.store.read(&setting_key("__identity", "display")).await {
+            Ok(record) => serde_json::from_value(record.value).map_err(|_| CloudError::Storage),
+            Err(CloudError::NotFound) => Ok(ControlPlaneSettings::default()),
+            Err(error) => Err(error),
+        }
+    }
+    /// The host must authenticate a global administrator before entering this operation.
+    pub async fn replace_display_settings(
+        &self,
+        actor: &str,
+        mut settings: ControlPlaneSettings,
+    ) -> CloudResult<ControlPlaneSettings> {
+        if actor.is_empty() || actor.len() > 256 || actor.chars().any(char::is_control) {
+            return Err(CloudError::InvalidArgument);
+        }
+        settings.classification.validate()?;
+        settings.classification.text = settings.classification.text.trim().into();
+        let expected_revision = settings.revision;
+        settings.revision = expected_revision
+            .checked_add(1)
+            .ok_or(CloudError::InvalidArgument)?;
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![EntityMutation {
+                    key: setting_key("__identity", "display"),
+                    expected_revision,
+                    value: serde_json::to_value(&settings)
+                        .map_err(|_| CloudError::InvalidArgument)?,
+                    actor: actor.into(),
+                    operation: "control_plane.display.updated.v1".into(),
+                }],
+                ..Default::default()
+            })
+            .await?;
+        Ok(settings)
+    }
+    /// Read the exact project baseline beneath project visibility.
+    pub async fn project_policy(
+        &self,
+        caller: &CloudCaller,
+    ) -> CloudResult<ProjectPolicyExpectation> {
+        caller.require(CloudPermission::Read)?;
+        match self
+            .store
+            .read(&setting_key(caller.project_id(), "policy-expectation"))
+            .await
+        {
+            Ok(record) => serde_json::from_value(record.value).map_err(|_| CloudError::Storage),
+            Err(CloudError::NotFound) => Ok(ProjectPolicyExpectation::default()),
+            Err(error) => Err(error),
+        }
+    }
+    /// Update an audited monitoring baseline without changing runtime enforcement.
+    pub async fn replace_project_policy(
+        &self,
+        caller: &CloudCaller,
+        mut policy: ProjectPolicyExpectation,
+    ) -> CloudResult<ProjectPolicyExpectation> {
+        caller.require(CloudPermission::Administer)?;
+        if policy
+            .required_sandbox_profile
+            .as_ref()
+            .is_some_and(|profile| !label(profile))
+            || policy.allowed_approval_modes.iter().any(|mode| {
+                !matches!(
+                    mode.as_str(),
+                    "ask" | "risk_auto" | "danger_auto" | "deny" | "unknown"
+                )
+            })
+            || policy
+                .allowed_tools
+                .as_ref()
+                .is_some_and(|tools| tools.len() > 512 || tools.iter().any(|tool| !label(tool)))
+        {
+            return Err(CloudError::InvalidArgument);
+        }
+        let expected_revision = policy.revision;
+        policy.revision = expected_revision
+            .checked_add(1)
+            .ok_or(CloudError::InvalidArgument)?;
+        self.store
+            .commit(CloudTransaction {
+                entities: vec![EntityMutation {
+                    key: setting_key(caller.project_id(), "policy-expectation"),
+                    expected_revision,
+                    value: serde_json::to_value(&policy)
+                        .map_err(|_| CloudError::InvalidArgument)?,
+                    actor: caller.subject().into(),
+                    operation: "control_plane.policy_expectation.updated.v1".into(),
+                }],
+                ..Default::default()
+            })
+            .await?;
+        Ok(policy)
+    }
+}
+fn label(value: &str) -> bool {
+    !value.is_empty() && value.len() <= 128 && !value.chars().any(char::is_control)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::storage::MemoryCloudStore;
+    #[test]
+    fn stale_or_missing_policy_observations_never_establish_current_alignment() {
+        let posture:colossus_sdk::RuntimePolicyPosture=serde_json::from_value(serde_json::json!({
+            "schema_version":1,"provenance":"runtime_reported","fingerprint":"a".repeat(64),
+            "configuration_revision":null,"access_profile":"minimal","sandbox_backend":"native",
+            "sandbox_profile":"workspace","boundary_acknowledged":false,"approval_mode":"ask",
+            "allowed_roles":[],"allowed_tools":["fs.read"],"capabilities":[],"models":[],"findings":[],
+            "telemetry":{"provenance":"unavailable","denied_requests":null,"approval_requests":null,"outcome_unknown_runs":null}
+        })).unwrap();
+        assert!(posture.validate());
+        let baseline = ProjectPolicyExpectation {
+            required_sandbox_profile: Some("offline".into()),
+            allowed_approval_modes: ["deny".into()].into(),
+            allowed_tools: Some(Default::default()),
+            ..Default::default()
+        };
+        let evaluation = baseline.evaluate(Some(&posture), false);
+        assert!(matches!(evaluation.status, PolicyAlignment::Drift));
+        assert_eq!(evaluation.findings.len(), 3);
+        assert!(matches!(
+            baseline.evaluate(Some(&posture), true).status,
+            PolicyAlignment::Unknown
+        ));
+        assert!(matches!(
+            baseline.evaluate(None, false).status,
+            PolicyAlignment::Unknown
+        ));
+        assert!(matches!(
+            ProjectPolicyExpectation::default()
+                .evaluate(Some(&posture), false)
+                .status,
+            PolicyAlignment::Unknown
+        ));
+        let aligned = ProjectPolicyExpectation {
+            required_sandbox_profile: Some("workspace".into()),
+            ..Default::default()
+        };
+        assert!(matches!(
+            aligned.evaluate(Some(&posture), false).status,
+            PolicyAlignment::Aligned
+        ));
+    }
+    #[tokio::test]
+    async fn banner_is_audited_cas_plain_text_and_project_baseline_is_scoped() {
+        let repo = CloudRepository::new(std::sync::Arc::new(MemoryCloudStore::default())).unwrap();
+        let mut settings = repo.display_settings().await.unwrap();
+        settings.classification.enabled = true;
+        settings.classification.text = " INTERNAL <restricted> ".into();
+        let saved = repo
+            .replace_display_settings("administrator", settings.clone())
+            .await
+            .unwrap();
+        assert_eq!(saved.classification.text, "INTERNAL <restricted>");
+        assert_eq!(saved.revision, 1);
+        assert_eq!(
+            repo.replace_display_settings("administrator", settings)
+                .await
+                .unwrap_err(),
+            CloudError::Conflict
+        );
+        let reader = CloudCaller::new(
+            "viewer".into(),
+            "project-a".into(),
+            [CloudPermission::Read].into(),
+        )
+        .unwrap();
+        assert_eq!(
+            repo.replace_project_policy(&reader, ProjectPolicyExpectation::default())
+                .await
+                .unwrap_err(),
+            CloudError::PermissionDenied
+        );
+        let administrator = CloudCaller::new(
+            "admin".into(),
+            "project-a".into(),
+            [CloudPermission::Read, CloudPermission::Administer].into(),
+        )
+        .unwrap();
+        let baseline = ProjectPolicyExpectation {
+            required_sandbox_profile: Some("offline".into()),
+            ..Default::default()
+        };
+        assert_eq!(
+            repo.replace_project_policy(&administrator, baseline)
+                .await
+                .unwrap()
+                .revision,
+            1
+        );
+        assert_eq!(
+            repo.project_policy(&reader)
+                .await
+                .unwrap()
+                .required_sandbox_profile
+                .as_deref(),
+            Some("offline")
+        );
+        let other = CloudCaller::new(
+            "viewer".into(),
+            "project-b".into(),
+            [CloudPermission::Read].into(),
+        )
+        .unwrap();
+        assert!(
+            repo.project_policy(&other)
+                .await
+                .unwrap()
+                .required_sandbox_profile
+                .is_none()
+        );
+    }
+}
diff --git a/crates/colossus-cloud/src/storage.rs b/crates/colossus-cloud/src/storage.rs
new file mode 100644
index 000000000..21e6c7ed5
--- /dev/null
+++ b/crates/colossus-cloud/src/storage.rs
@@ -0,0 +1,1210 @@
+//! Cloud-owned relational persistence contracts. Runtime journals do not implement this port.
+//!
+//! Each transaction commits domain records, released output, audit metadata and delivery
+//! outbox entries together. Versions and cursors are local to their entity or stream.
+
+use crate::{CloudError, CloudResult};
+use colossus_ports::StoreError;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::BTreeMap;
+use tokio::sync::Mutex;
+
+/// Independently versioned cloud domain tables.
+#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EntityKind {
+    /// Persisted human account metadata and revocation epoch.
+    User,
+    /// Issuer-bound OIDC subject to stable account mapping.
+    OidcIdentity,
+    /// Salted local password credential, host-only.
+    LocalCredential,
+    /// Global control-plane product settings.
+    Setting,
+    /// Cloud project authority boundary.
+    Project,
+    /// Explicit subject membership and project permission ceiling.
+    Membership,
+    /// Single-use encrypted OIDC authorization flow.
+    AuthFlow,
+    /// Registered machine or container environment.
+    Host,
+    /// Independently enrolled runtime.
+    Node,
+    /// Runtime workspace scope.
+    Workspace,
+    /// Human-operated conversation.
+    Thread,
+    /// Ordered visible conversation message.
+    ThreadMessage,
+    /// Exact mapping from enrolled runtime session to a shared cloud thread.
+    SessionMapping,
+    /// Cloud-originated work request.
+    Task,
+    /// Closed operation and its reconciled reply.
+    Command,
+    /// Immutable runtime run allocation.
+    Run,
+    /// Fixed-node task placement.
+    NodeTask,
+    /// Per-node admission counter.
+    Admission,
+    /// Single-use credential-hash enrollment invitation.
+    Invitation,
+    /// Runtime certificate renewal receipt.
+    Renewal,
+}
+
+/// Project-scoped domain identity; parent separates node/thread child resources.
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize, Deserialize)]
+pub struct EntityKey {
+    /// Owning domain table.
+    pub kind: EntityKind,
+    /// Authenticated project, empty only for invitation-hash lookup.
+    pub project_id: String,
+    /// Optional runtime or thread parent identity.
+    pub parent_id: Option<String>,
+    /// Stable domain identity, never a credential value.
+    pub id: String,
+}
+
+impl EntityKey {
+    /// Stable diagnostic identity used by optimistic concurrency failures.
+    pub fn conflict_id(&self) -> String {
+        let kind = match self.kind {
+            EntityKind::User => "user",
+            EntityKind::OidcIdentity => "oidc-identity",
+            EntityKind::LocalCredential => "local-credential",
+            EntityKind::Setting => "setting",
+            EntityKind::Project => "project",
+            EntityKind::Membership => "membership",
+            EntityKind::AuthFlow => "auth-flow",
+            EntityKind::Host => "host",
+            EntityKind::Node => "node",
+            EntityKind::Workspace => "workspace",
+            EntityKind::Thread => "thread",
+            EntityKind::ThreadMessage => "message",
+            EntityKind::SessionMapping => "session",
+            EntityKind::Task => "task",
+            EntityKind::Command => "command",
+            EntityKind::Run => "run",
+            EntityKind::NodeTask => "node-task",
+            EntityKind::Admission => "admission",
+            EntityKind::Invitation => "invitation",
+            EntityKind::Renewal => "renewal",
+        };
+        if self.kind == EntityKind::Invitation {
+            return format!("cloud.invitation:{}", self.id);
+        }
+        match &self.parent_id {
+            Some(parent) => format!("cloud.{kind}:{}:{parent}:{}", self.project_id, self.id),
+            None => format!("cloud.{kind}:{}:{}", self.project_id, self.id),
+        }
+    }
+}
+
+/// Versioned cloud resource with its typed service representation.
+#[derive(Clone, Debug, PartialEq)]
+pub struct EntityRecord {
+    /// Project and resource identity.
+    pub key: EntityKey,
+    /// Monotonically increasing aggregate version.
+    pub revision: u64,
+    /// Validated service-owned representation; adapters project indexed columns.
+    pub value: Value,
+    /// Stable returned pagination position; absent for point reads.
+    pub page_cursor: Option<String>,
+}
+
+/// Atomic create or compare-and-swap mutation.
+#[derive(Clone, Debug)]
+pub struct EntityMutation {
+    /// Exact resource identity.
+    pub key: EntityKey,
+    /// Zero creates, otherwise the exact currently observed version.
+    pub expected_revision: u64,
+    /// New validated service representation.
+    pub value: Value,
+    /// Authenticated actor identifier, without credential data.
+    pub actor: String,
+    /// Bounded domain operation name used for audit and delivery.
+    pub operation: String,
+}
+
+/// Released output received from an independently authenticated source.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ReleasedEvent {
+    /// Owning authenticated project.
+    pub project_id: String,
+    /// Run/task or workspace feed identity.
+    pub scope_id: String,
+    /// Source stream sequence, starting at one.
+    pub sequence: u64,
+    /// Caller-released, bounded payload only.
+    pub value: Value,
+}
+
+/// Exact acknowledgement advancement for a retained source feed.
+#[derive(Clone, Debug)]
+pub struct CursorMutation {
+    /// Owning project.
+    pub project_id: String,
+    /// Runtime or feed owner.
+    pub source_id: String,
+    /// Source feed identity.
+    pub scope_id: String,
+    /// Exact current committed source cursor.
+    pub expected_sequence: u64,
+    /// New source cursor, never lower than the previous one.
+    pub sequence: u64,
+}
+
+/// One atomic cloud mutation; no cloud-wide journal-head serialization.
+#[derive(Clone, Debug, Default)]
+pub struct CloudTransaction {
+    /// Versioned domain changes.
+    pub entities: Vec<EntityMutation>,
+    /// Released stream additions.
+    pub events: Vec<ReleasedEvent>,
+    /// Synchronization acknowledgements advanced only after retention commits.
+    pub cursors: Vec<CursorMutation>,
+    /// Exact replica connection generation checked under the same transaction lock.
+    pub lease: Option<ConnectionLease>,
+}
+
+/// Stable bounded listing order.
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum EntityOrder {
+    /// Identifier ascending with an exclusive identifier cursor.
+    #[default]
+    IdAsc,
+    /// Identifier descending with an exclusive identifier cursor.
+    IdDesc,
+    /// Most recently updated first; cursor resolves the resource timestamp.
+    UpdatedDesc,
+    /// Oldest creation first with the resource identifier breaking timestamp ties.
+    CreatedAsc,
+    /// Newest creation first with the resource identifier breaking timestamp ties.
+    CreatedDesc,
+}
+
+/// Validated stable timestamp/resource position decoded from a collection cursor.
+#[derive(Clone, Debug)]
+pub struct CloudPagePosition {
+    /// Exact timestamp returned by the storage adapter for the previous page boundary.
+    pub timestamp: String,
+    /// Boundary entity identifier.
+    pub id: String,
+    /// Parent used to deterministically break equal identifier/timestamp ties.
+    pub parent_id: String,
+}
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct EncodedCloudCursor {
+    version: u8,
+    query_sha256: String,
+    timestamp: String,
+    id: String,
+    parent_id: String,
+}
+fn cursor_query_hash(query: &EntityQuery) -> CloudResult<String> {
+    use sha2::Digest;
+    let bytes = serde_json::to_vec(&(
+        query.kind,
+        &query.project_id,
+        &query.parent_id,
+        &query.node_id,
+        &query.query,
+        &query.status,
+        query.archived,
+        query.order,
+    ))
+    .map_err(|_| CloudError::InvalidArgument)?;
+    Ok(hex::encode(sha2::Sha256::digest(bytes)))
+}
+/// Encode a stable, query-bound pagination position. This is not an authorization token.
+pub fn encode_page_cursor(
+    query: &EntityQuery,
+    timestamp: &str,
+    id: &str,
+    parent: &str,
+) -> CloudResult<String> {
+    if matches!(query.order, EntityOrder::IdAsc | EntityOrder::IdDesc) {
+        return Ok(id.into());
+    }
+    time::OffsetDateTime::parse(timestamp, &time::format_description::well_known::Rfc3339)
+        .map_err(|_| CloudError::Storage)?;
+    let value = EncodedCloudCursor {
+        version: 1,
+        query_sha256: cursor_query_hash(query)?,
+        timestamp: timestamp.into(),
+        id: id.into(),
+        parent_id: parent.into(),
+    };
+    Ok(format!(
+        "cp1_{}",
+        hex::encode(serde_json::to_vec(&value).map_err(|_| CloudError::Storage)?)
+    ))
+}
+/// Decode and bind an opaque cursor to the exact project/filter/order collection.
+pub fn decode_page_cursor(query: &EntityQuery) -> CloudResult<Option<CloudPagePosition>> {
+    let Some(after) = &query.after else {
+        return Ok(None);
+    };
+    if matches!(query.order, EntityOrder::IdAsc | EntityOrder::IdDesc) {
+        return Ok(None);
+    }
+    if after.len() > 2048 {
+        return Err(CloudError::InvalidArgument);
+    }
+    let bytes = hex::decode(
+        after
+            .strip_prefix("cp1_")
+            .ok_or(CloudError::InvalidArgument)?,
+    )
+    .map_err(|_| CloudError::InvalidArgument)?;
+    let value: EncodedCloudCursor =
+        serde_json::from_slice(&bytes).map_err(|_| CloudError::InvalidArgument)?;
+    if value.version != 1
+        || value.query_sha256 != cursor_query_hash(query)?
+        || value.id.is_empty()
+        || value.id.len() > 128
+        || value.parent_id.len() > 128
+    {
+        return Err(CloudError::InvalidArgument);
+    }
+    time::OffsetDateTime::parse(
+        &value.timestamp,
+        &time::format_description::well_known::Rfc3339,
+    )
+    .map_err(|_| CloudError::InvalidArgument)?;
+    Ok(Some(CloudPagePosition {
+        timestamp: value.timestamp,
+        id: value.id,
+        parent_id: value.parent_id,
+    }))
+}
+
+/// Bounded server-side project query. Hosts supply all authority decisions.
+#[derive(Clone, Debug)]
+pub struct EntityQuery {
+    /// Domain collection.
+    pub kind: EntityKind,
+    /// Exact authenticated project.
+    pub project_id: String,
+    /// Optional node/thread parent filter.
+    pub parent_id: Option<String>,
+    /// Exclusive resource identifier cursor.
+    pub after: Option<String>,
+    /// At most 100 records; zero returns no records.
+    pub limit: usize,
+    /// Optional immutable runtime placement filter.
+    pub node_id: Option<String>,
+    /// Literal substring search against the projected title/label.
+    pub query: Option<String>,
+    /// Exact domain status filter.
+    pub status: Option<String>,
+    /// Conversation archive state filter.
+    pub archived: Option<bool>,
+    /// Deterministic ordering.
+    pub order: EntityOrder,
+}
+impl Default for EntityQuery {
+    fn default() -> Self {
+        Self {
+            kind: EntityKind::Node,
+            project_id: String::new(),
+            parent_id: None,
+            after: None,
+            limit: 100,
+            node_id: None,
+            query: None,
+            status: None,
+            archived: None,
+            order: EntityOrder::IdAsc,
+        }
+    }
+}
+impl EntityQuery {
+    /// Create a bounded default query for one explicitly selected collection.
+    pub fn new(kind: EntityKind, project_id: String) -> Self {
+        Self {
+            kind,
+            project_id,
+            ..Default::default()
+        }
+    }
+}
+
+/// Credential-free persistent browser session; raw cookie and CSRF tokens stay transient.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct AuthSession {
+    /// SHA-256 of the random browser cookie.
+    pub session_hash: String,
+    /// Verified OIDC subject identifier.
+    pub subject: String,
+    /// SHA-256 of the independently generated CSRF secret.
+    pub csrf_hash: String,
+    /// UTC Unix creation time.
+    pub created_at: u64,
+    /// UTC Unix expiry time.
+    pub expires_at: u64,
+    /// Account credential/disablement generation at authentication.
+    #[serde(default)]
+    pub security_epoch: u64,
+}
+
+/// Replica connection ownership with a monotonic fencing generation.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ConnectionLease {
+    /// Owning project.
+    pub project_id: String,
+    /// Exact enrolled runtime.
+    pub node_id: String,
+    /// Cloud replica identity.
+    pub owner_id: String,
+    /// Fencing generation; stale owners never pass verification.
+    pub generation: u64,
+    /// UTC Unix expiry.
+    pub expires_at: u64,
+}
+
+/// Bounded operational metadata retention, independent of canonical history/audit retention.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CloudMaintenancePolicy {
+    /// At most this many records per collection per maintenance transaction.
+    pub batch_limit: usize,
+    /// Keep published wakeup metadata for this many seconds before deletion.
+    pub delivered_outbox_retention_seconds: u64,
+}
+impl Default for CloudMaintenancePolicy {
+    fn default() -> Self {
+        Self {
+            batch_limit: 256,
+            delivered_outbox_retention_seconds: 86400,
+        }
+    }
+}
+/// Credential-free result of a bounded operational metadata maintenance pass.
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct CloudMaintenanceReport {
+    /// Durable hints published and marked, independently of command receipts.
+    pub published_outbox: usize,
+    /// Old published hint metadata removed.
+    pub removed_outbox: usize,
+    /// Expired browser sessions removed.
+    pub expired_sessions: usize,
+    /// Expired OIDC flows consumed and removed; import markers remain untouched.
+    pub expired_auth_flows: usize,
+}
+
+/// Object-safe asynchronous cloud persistence boundary.
+#[async_trait::async_trait]
+pub trait CloudStore: Send + Sync {
+    /// Publish durable wakeup hints and prune only bounded expired operational metadata.
+    async fn maintain(
+        &self,
+        _now: u64,
+        _policy: &CloudMaintenancePolicy,
+    ) -> CloudResult<CloudMaintenanceReport> {
+        Ok(CloudMaintenanceReport::default())
+    }
+    /// Subscribe to bounded project-only wakeups; always resume from durable rows.
+    fn subscribe(&self) -> tokio::sync::broadcast::Receiver<String>;
+    /// Verify storage is available without releasing domain payloads.
+    async fn readiness(&self) -> CloudResult<()>;
+    /// Scoped operational projections, independent of permission and policy decisions.
+    async fn statistics(
+        &self,
+        project: &str,
+        node: Option<&str>,
+        now: u64,
+        days: u16,
+    ) -> CloudResult<crate::observability::OperationalStatistics> {
+        crate::observability::collect(self, project, node, now, days).await
+    }
+    /// Read an exact project resource and its revision.
+    async fn read(&self, key: &EntityKey) -> CloudResult<EntityRecord>;
+    /// Consume an exact entity revision atomically, retaining its tombstone and audit.
+    async fn delete_entity(&self, key: &EntityKey, expected_revision: u64) -> CloudResult<()>;
+    /// Read a bounded project collection using indexed domain columns.
+    async fn list(&self, query: &EntityQuery) -> CloudResult<Vec<EntityRecord>>;
+    /// Bounded project catalog for verified global administrators only.
+    async fn list_projects(
+        &self,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<EntityRecord>>;
+    /// Host-only lookup of account bindings; callers must strip local credential values.
+    async fn user_identities(&self, user_id: &str) -> CloudResult<Vec<EntityRecord>>;
+    /// Bounded audited account batch for already authorized membership rendering.
+    async fn user_accounts(&self, user_ids: &[String]) -> CloudResult<Vec<EntityRecord>>;
+    /// Read bounded explicit project memberships for an already verified OIDC subject.
+    async fn memberships(&self, subject: &str) -> CloudResult<Vec<EntityRecord>>;
+    /// Check all retained turns using an indexed incomplete-source existence query.
+    async fn thread_incomplete(&self, project: &str, thread: &str) -> CloudResult<bool>;
+    /// Commit all effects atomically; preserve conflicts and uncertain commit outcomes.
+    async fn commit(&self, transaction: CloudTransaction) -> Result<(), StoreError>;
+    /// Read retained released events after an exclusive committed source cursor.
+    async fn events(
+        &self,
+        project: &str,
+        scope: &str,
+        after: u64,
+        limit: usize,
+    ) -> CloudResult<Vec<ReleasedEvent>>;
+    /// Read the committed acknowledgement for a runtime feed.
+    async fn cursor(&self, project: &str, source: &str, scope: &str) -> CloudResult<u64>;
+    /// Persist only opaque token hashes and verified identity metadata.
+    async fn put_session(&self, session: AuthSession) -> CloudResult<()>;
+    /// Read a nonexpired browser session; expired or unknown sessions are absent.
+    async fn read_session(&self, hash: &str, now: u64) -> CloudResult<AuthSession>;
+    /// Revoke an exact browser session.
+    async fn delete_session(&self, hash: &str) -> CloudResult<()>;
+    /// Claim a free/expired connection; concurrent live owners conflict.
+    async fn claim_lease(
+        &self,
+        project: &str,
+        node: &str,
+        owner: &str,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease>;
+    /// Read live ownership for cross-replica fleet presence.
+    async fn read_lease(&self, project: &str, node: &str, now: u64)
+    -> CloudResult<ConnectionLease>;
+    /// Extend the exact live ownership generation.
+    async fn renew_lease(
+        &self,
+        lease: &ConnectionLease,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease>;
+    /// Release only the exact ownership generation.
+    async fn release_lease(&self, lease: &ConnectionLease) -> CloudResult<()>;
+    /// Refuse an expired or superseded owner before issuing/accepting operations.
+    async fn verify_lease(&self, lease: &ConnectionLease, now: u64) -> CloudResult<()>;
+}
+
+/// Deterministic test adapter. Production compositions must use PostgreSQL.
+pub struct MemoryCloudStore {
+    state: Mutex<MemoryState>,
+    notifications: tokio::sync::broadcast::Sender<String>,
+}
+impl Default for MemoryCloudStore {
+    fn default() -> Self {
+        let (notifications, _) = tokio::sync::broadcast::channel(256);
+        Self {
+            state: Mutex::new(MemoryState::default()),
+            notifications,
+        }
+    }
+}
+
+#[derive(Clone, Default)]
+struct MemoryState {
+    entities: BTreeMap<EntityKey, EntityRecord>,
+    deleted: std::collections::BTreeSet<EntityKey>,
+    events: BTreeMap<(String, String, u64), ReleasedEvent>,
+    cursors: BTreeMap<(String, String, String), u64>,
+    sessions: BTreeMap<String, AuthSession>,
+    leases: BTreeMap<(String, String), ConnectionLease>,
+}
+fn enrolled_live(state: &MemoryState, project: &str, node: &str) -> bool {
+    let key = EntityKey {
+        kind: EntityKind::Node,
+        project_id: project.into(),
+        parent_id: None,
+        id: node.into(),
+    };
+    !state.deleted.contains(&key)
+        && state.entities.get(&key).is_some_and(|record| {
+            !record
+                .value
+                .get("revoked")
+                .and_then(Value::as_bool)
+                .unwrap_or(false)
+        })
+}
+
+#[async_trait::async_trait]
+impl CloudStore for MemoryCloudStore {
+    async fn user_accounts(&self, user_ids: &[String]) -> CloudResult<Vec<EntityRecord>> {
+        if user_ids.len() > 100 {
+            return Err(CloudError::InvalidArgument);
+        }
+        let state = self.state.lock().await;
+        Ok(user_ids
+            .iter()
+            .filter_map(|id| {
+                let key = crate::identity_key(EntityKind::User, id);
+                if state.deleted.contains(&key) {
+                    None
+                } else {
+                    state.entities.get(&key).cloned()
+                }
+            })
+            .collect())
+    }
+    async fn user_identities(&self, user_id: &str) -> CloudResult<Vec<EntityRecord>> {
+        let state = self.state.lock().await;
+        Ok(state
+            .entities
+            .values()
+            .filter(|r| {
+                matches!(
+                    r.key.kind,
+                    EntityKind::LocalCredential | EntityKind::OidcIdentity
+                ) && !state.deleted.contains(&r.key)
+                    && r.value.get("user_id").and_then(Value::as_str) == Some(user_id)
+            })
+            .take(16)
+            .cloned()
+            .collect())
+    }
+    async fn list_projects(
+        &self,
+        after: Option<&str>,
+        limit: usize,
+    ) -> CloudResult<Vec<EntityRecord>> {
+        if !(1..=100).contains(&limit) {
+            return Err(CloudError::InvalidArgument);
+        }
+        let state = self.state.lock().await;
+        Ok(state
+            .entities
+            .values()
+            .filter(|r| {
+                r.key.kind == EntityKind::Project
+                    && !state.deleted.contains(&r.key)
+                    && after.is_none_or(|id| r.key.id.as_str() > id)
+            })
+            .take(limit)
+            .cloned()
+            .collect())
+    }
+    fn subscribe(&self) -> tokio::sync::broadcast::Receiver<String> {
+        self.notifications.subscribe()
+    }
+    async fn readiness(&self) -> CloudResult<()> {
+        Ok(())
+    }
+    async fn read(&self, key: &EntityKey) -> CloudResult<EntityRecord> {
+        let state = self.state.lock().await;
+        state
+            .entities
+            .get(key)
+            .or_else(|| {
+                (key.kind == EntityKind::Invitation && key.project_id.is_empty())
+                    .then(|| {
+                        state
+                            .entities
+                            .values()
+                            .find(|r| r.key.kind == key.kind && r.key.id == key.id)
+                    })
+                    .flatten()
+            })
+            .filter(|r| !state.deleted.contains(&r.key))
+            .cloned()
+            .ok_or(CloudError::NotFound)
+    }
+    async fn delete_entity(&self, key: &EntityKey, expected_revision: u64) -> CloudResult<()> {
+        let mut state = self.state.lock().await;
+        let current = state.entities.get_mut(key).ok_or(CloudError::NotFound)?;
+        if current.revision != expected_revision {
+            return Err(CloudError::Conflict);
+        }
+        current.revision += 1;
+        state.deleted.insert(key.clone());
+        Ok(())
+    }
+    async fn list(&self, query: &EntityQuery) -> CloudResult<Vec<EntityRecord>> {
+        let state = self.state.lock().await;
+        let mut records: Vec<_> = state
+            .entities
+            .values()
+            .filter(|r| {
+                !state.deleted.contains(&r.key)
+                    && r.key.kind == query.kind
+                    && r.key.project_id == query.project_id
+                    && query.parent_id.as_ref().is_none_or(|p| {
+                        if query.kind == EntityKind::Task {
+                            r.value.get("thread_id").and_then(Value::as_str) == Some(p)
+                        } else {
+                            r.key.parent_id.as_ref() == Some(p)
+                        }
+                    })
+                    && query
+                        .node_id
+                        .as_ref()
+                        .is_none_or(|n| r.value.get("node_id").and_then(Value::as_str) == Some(n))
+                    && query.query.as_ref().is_none_or(|q| {
+                        search_text(&r.value)
+                            .to_lowercase()
+                            .contains(&q.to_lowercase())
+                    })
+                    && query.status.as_ref().is_none_or(|s| {
+                        if r.key.kind == EntityKind::User {
+                            if s == "administrator" {
+                                r.value.pointer("/user/active").and_then(Value::as_bool)
+                                    == Some(true)
+                                    && r.value.pointer("/user/is_admin").and_then(Value::as_bool)
+                                        == Some(true)
+                            } else {
+                                s == if r.value.pointer("/user/active").and_then(Value::as_bool)
+                                    == Some(true)
+                                {
+                                    "active"
+                                } else {
+                                    "disabled"
+                                }
+                            }
+                        } else if r.key.kind == EntityKind::Membership {
+                            s == if r.value.get("user_id").is_some()
+                                && r.value
+                                    .get("permissions")
+                                    .and_then(Value::as_array)
+                                    .is_some_and(|p| !p.is_empty())
+                            {
+                                "active"
+                            } else {
+                                "removed"
+                            }
+                        } else if r.key.kind == EntityKind::Command {
+                            if r.value.get("reply").is_none_or(Value::is_null) {
+                                s == "pending"
+                            } else {
+                                s == "reconciled"
+                            }
+                        } else {
+                            status(&r.value) == *s
+                        }
+                    })
+                    && query.archived.is_none_or(|a| {
+                        r.value
+                            .get("archived")
+                            .and_then(Value::as_bool)
+                            .unwrap_or(false)
+                            == a
+                    })
+            })
+            .cloned()
+            .collect();
+        let timestamp = |record: &EntityRecord| match query.order {
+            EntityOrder::UpdatedDesc => record
+                .value
+                .get("updated_at")
+                .and_then(Value::as_str)
+                .filter(|value| !value.is_empty())
+                .unwrap_or("1970-01-01T00:00:00Z")
+                .to_owned(),
+            EntityOrder::CreatedAsc | EntityOrder::CreatedDesc => record
+                .value
+                .get("created_at")
+                .or_else(|| record.value.pointer("/snapshot/run/created_at"))
+                .and_then(Value::as_str)
+                .filter(|value| !value.is_empty())
+                .unwrap_or("1970-01-01T00:00:00Z")
+                .to_owned(),
+            _ => "1970-01-01T00:00:00Z".into(),
+        };
+        let epoch = |value: &str| {
+            time::OffsetDateTime::parse(value, &time::format_description::well_known::Rfc3339)
+                .map(|time| time.unix_timestamp_nanos())
+                .unwrap_or(0)
+        };
+        let key = |record: &EntityRecord| {
+            (
+                epoch(&timestamp(record)),
+                record.key.id.clone(),
+                record.key.parent_id.clone().unwrap_or_default(),
+            )
+        };
+        records.sort_by_key(|record| key(record));
+        if matches!(
+            query.order,
+            EntityOrder::IdDesc | EntityOrder::UpdatedDesc | EntityOrder::CreatedDesc
+        ) {
+            records.reverse();
+        }
+        let position = decode_page_cursor(query)?;
+        let records = records
+            .into_iter()
+            .filter(|record| match query.order {
+                EntityOrder::IdAsc => query
+                    .after
+                    .as_ref()
+                    .is_none_or(|after| record.key.id > *after),
+                EntityOrder::IdDesc => query
+                    .after
+                    .as_ref()
+                    .is_none_or(|after| record.key.id < *after),
+                EntityOrder::CreatedAsc => position.as_ref().is_none_or(|position| {
+                    key(record)
+                        > (
+                            epoch(&position.timestamp),
+                            position.id.clone(),
+                            position.parent_id.clone(),
+                        )
+                }),
+                _ => position.as_ref().is_none_or(|position| {
+                    key(record)
+                        < (
+                            epoch(&position.timestamp),
+                            position.id.clone(),
+                            position.parent_id.clone(),
+                        )
+                }),
+            })
+            .take(query.limit.min(100));
+        records
+            .map(|mut record| {
+                record.page_cursor = Some(encode_page_cursor(
+                    query,
+                    &timestamp(&record),
+                    &record.key.id,
+                    record.key.parent_id.as_deref().unwrap_or_default(),
+                )?);
+                Ok(record)
+            })
+            .collect()
+    }
+
+    async fn commit(&self, transaction: CloudTransaction) -> Result<(), StoreError> {
+        let mut guard = self.state.lock().await;
+        let mut state = guard.clone();
+        let structural = transaction
+            .entities
+            .iter()
+            .any(|m| matches!(m.key.kind, EntityKind::User | EntityKind::Project));
+        let had_admin = state.entities.values().any(|r| {
+            r.key.kind == EntityKind::User
+                && !state.deleted.contains(&r.key)
+                && r.value.pointer("/user/active").and_then(Value::as_bool) == Some(true)
+                && r.value.pointer("/user/is_admin").and_then(Value::as_bool) == Some(true)
+        });
+        let projects: std::collections::BTreeSet<_> = transaction
+            .entities
+            .iter()
+            .map(|m| m.key.project_id.clone())
+            .chain(transaction.events.iter().map(|e| e.project_id.clone()))
+            .chain(transaction.cursors.iter().map(|c| c.project_id.clone()))
+            .collect();
+        if let Some(lease) = &transaction.lease {
+            if !enrolled_live(&state, &lease.project_id, &lease.node_id) {
+                return Err(StoreError::WriterLeaseHeld);
+            }
+            if projects.iter().any(|project| *project != lease.project_id) {
+                return Err(StoreError::Adapter(
+                    "cloud connection cannot mutate another project".into(),
+                ));
+            }
+            let now = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_err(|_| StoreError::Adapter("cloud clock unavailable".into()))?
+                .as_secs();
+            if !state
+                .leases
+                .get(&(lease.project_id.clone(), lease.node_id.clone()))
+                .is_some_and(|l| {
+                    l.generation == lease.generation
+                        && l.owner_id == lease.owner_id
+                        && l.expires_at > now
+                })
+            {
+                return Err(StoreError::WriterLeaseHeld);
+            }
+        }
+        if had_admin
+            && transaction.entities.iter().any(|m| {
+                m.key.kind == EntityKind::User
+                    && m.actor == "operator-bootstrap"
+                    && m.value.pointer("/user/is_admin").and_then(Value::as_bool) == Some(true)
+            })
+        {
+            return Err(StoreError::Conflict {
+                stream_id: "cloud.administrator-bootstrap".into(),
+                expected: 0,
+                actual: 1,
+            });
+        }
+        for mutation in transaction.entities {
+            if mutation.key.kind == EntityKind::Invitation
+                && state.entities.keys().any(|key| {
+                    key.kind == EntityKind::Invitation
+                        && key.id == mutation.key.id
+                        && key.project_id != mutation.key.project_id
+                })
+            {
+                return Err(conflict(&mutation.key, mutation.expected_revision, 1));
+            }
+            let actual = state.entities.get(&mutation.key).map_or(0, |r| r.revision);
+            if actual != mutation.expected_revision {
+                return Err(conflict(&mutation.key, mutation.expected_revision, actual));
+            }
+            state.entities.insert(
+                mutation.key.clone(),
+                EntityRecord {
+                    key: mutation.key,
+                    revision: actual + 1,
+                    value: mutation.value,
+                    page_cursor: None,
+                },
+            );
+        }
+        for event in transaction.events {
+            let key = (
+                event.project_id.clone(),
+                event.scope_id.clone(),
+                event.sequence,
+            );
+            if let Some(prior) = state.events.get(&key) {
+                if prior != &event {
+                    return Err(StoreError::Conflict {
+                        stream_id: event.scope_id,
+                        expected: event.sequence,
+                        actual: event.sequence,
+                    });
+                }
+                continue;
+            }
+            let last = state
+                .events
+                .keys()
+                .filter(|k| k.0 == key.0 && k.1 == key.1)
+                .map(|k| k.2)
+                .max()
+                .unwrap_or(0);
+            if event.sequence != last + 1 {
+                return Err(StoreError::Conflict {
+                    stream_id: event.scope_id,
+                    expected: last + 1,
+                    actual: event.sequence,
+                });
+            }
+            state.events.insert(key, event);
+        }
+        for cursor in transaction.cursors {
+            let key = (cursor.project_id, cursor.source_id, cursor.scope_id.clone());
+            let actual = state.cursors.get(&key).copied().unwrap_or(0);
+            if actual != cursor.expected_sequence || cursor.sequence < actual {
+                return Err(StoreError::Conflict {
+                    stream_id: cursor.scope_id,
+                    expected: cursor.expected_sequence,
+                    actual,
+                });
+            }
+            state.cursors.insert(key, cursor.sequence);
+        }
+        if structural {
+            let has_admin = state.entities.values().any(|r| {
+                r.key.kind == EntityKind::User
+                    && !state.deleted.contains(&r.key)
+                    && r.value.pointer("/user/active").and_then(Value::as_bool) == Some(true)
+                    && r.value.pointer("/user/is_admin").and_then(Value::as_bool) == Some(true)
+            });
+            if had_admin && !has_admin {
+                return Err(StoreError::Conflict {
+                    stream_id: "cloud.last-administrator".into(),
+                    expected: 1,
+                    actual: 0,
+                });
+            }
+            for project in state
+                .entities
+                .values()
+                .filter(|r| r.key.kind == EntityKind::Project && !state.deleted.contains(&r.key))
+            {
+                let mut path = std::collections::BTreeSet::new();
+                let mut next = Some(project.key.id.clone());
+                while let Some(id) = next {
+                    if !path.insert(id.clone()) || path.len() > 64 {
+                        return Err(StoreError::Conflict {
+                            stream_id: "cloud.project-hierarchy".into(),
+                            expected: 0,
+                            actual: 1,
+                        });
+                    }
+                    next = state
+                        .entities
+                        .get(&crate::project_key(&id))
+                        .and_then(|r| r.value.get("parent_project_id"))
+                        .and_then(Value::as_str)
+                        .map(str::to_owned);
+                }
+            }
+        }
+        *guard = state;
+        for project in projects {
+            let _ = self.notifications.send(project);
+        }
+        Ok(())
+    }
+    async fn memberships(&self, subject: &str) -> CloudResult<Vec<EntityRecord>> {
+        let state = self.state.lock().await;
+        Ok(state
+            .entities
+            .values()
+            .filter(|r| {
+                !state.deleted.contains(&r.key)
+                    && r.key.kind == EntityKind::Membership
+                    && r.value.get("subject").and_then(Value::as_str) == Some(subject)
+            })
+            .take(1024)
+            .cloned()
+            .collect())
+    }
+    async fn thread_incomplete(&self, project: &str, thread: &str) -> CloudResult<bool> {
+        let state = self.state.lock().await;
+        Ok(state.entities.values().any(|record| {
+            !state.deleted.contains(&record.key)
+                && record.key.kind == EntityKind::Task
+                && record.key.project_id == project
+                && record.value.get("thread_id").and_then(Value::as_str) == Some(thread)
+                && (record
+                    .value
+                    .get("output_limited")
+                    .and_then(Value::as_bool)
+                    .unwrap_or(false)
+                    || record
+                        .value
+                        .get("history_bounded")
+                        .and_then(Value::as_bool)
+                        .unwrap_or(false)
+                    || (record.value.get("subject").and_then(Value::as_str) == Some("runtime")
+                        && !record
+                            .value
+                            .get("history_complete")
+                            .and_then(Value::as_bool)
+                            .unwrap_or(false))
+                    || record
+                        .value
+                        .pointer("/snapshot/run/last_sequence")
+                        .and_then(Value::as_u64)
+                        .unwrap_or(0)
+                        > record
+                            .value
+                            .get("last_sequence")
+                            .and_then(Value::as_u64)
+                            .unwrap_or(0))
+        }))
+    }
+    async fn events(
+        &self,
+        project: &str,
+        scope: &str,
+        after: u64,
+        limit: usize,
+    ) -> CloudResult<Vec<ReleasedEvent>> {
+        Ok(self
+            .state
+            .lock()
+            .await
+            .events
+            .values()
+            .filter(|e| e.project_id == project && e.scope_id == scope && e.sequence > after)
+            .take(limit.min(100))
+            .cloned()
+            .collect())
+    }
+    async fn cursor(&self, project: &str, source: &str, scope: &str) -> CloudResult<u64> {
+        Ok(self
+            .state
+            .lock()
+            .await
+            .cursors
+            .get(&(project.into(), source.into(), scope.into()))
+            .copied()
+            .unwrap_or(0))
+    }
+    async fn put_session(&self, session: AuthSession) -> CloudResult<()> {
+        validate_session(&session)?;
+        self.state
+            .lock()
+            .await
+            .sessions
+            .insert(session.session_hash.clone(), session);
+        Ok(())
+    }
+    async fn read_session(&self, hash: &str, now: u64) -> CloudResult<AuthSession> {
+        self.state
+            .lock()
+            .await
+            .sessions
+            .get(hash)
+            .filter(|s| s.expires_at > now)
+            .cloned()
+            .ok_or(CloudError::NotFound)
+    }
+    async fn delete_session(&self, hash: &str) -> CloudResult<()> {
+        self.state.lock().await.sessions.remove(hash);
+        Ok(())
+    }
+    async fn claim_lease(
+        &self,
+        project: &str,
+        node: &str,
+        owner: &str,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease> {
+        validate_lease_ttl(ttl)?;
+        let mut state = self.state.lock().await;
+        if !enrolled_live(&state, project, node) {
+            return Err(CloudError::PermissionDenied);
+        }
+        let key = (project.into(), node.into());
+        let old = state.leases.get(&key);
+        if old.is_some_and(|l| l.expires_at > now && l.owner_id != owner) {
+            return Err(CloudError::Conflict);
+        }
+        let lease = ConnectionLease {
+            project_id: project.into(),
+            node_id: node.into(),
+            owner_id: owner.into(),
+            generation: old.map_or(1, |l| l.generation + 1),
+            expires_at: now.saturating_add(ttl),
+        };
+        state.leases.insert(key, lease.clone());
+        Ok(lease)
+    }
+    async fn read_lease(
+        &self,
+        project: &str,
+        node: &str,
+        now: u64,
+    ) -> CloudResult<ConnectionLease> {
+        let state = self.state.lock().await;
+        if !enrolled_live(&state, project, node) {
+            return Err(CloudError::NotFound);
+        }
+        state
+            .leases
+            .get(&(project.into(), node.into()))
+            .filter(|l| l.expires_at > now)
+            .cloned()
+            .ok_or(CloudError::NotFound)
+    }
+    async fn renew_lease(
+        &self,
+        lease: &ConnectionLease,
+        now: u64,
+        ttl: u64,
+    ) -> CloudResult<ConnectionLease> {
+        validate_lease_ttl(ttl)?;
+        let mut state = self.state.lock().await;
+        if !enrolled_live(&state, &lease.project_id, &lease.node_id) {
+            return Err(CloudError::Conflict);
+        }
+        let current = state
+            .leases
+            .get_mut(&(lease.project_id.clone(), lease.node_id.clone()))
+            .ok_or(CloudError::Conflict)?;
+        if current.owner_id != lease.owner_id
+            || current.generation != lease.generation
+            || current.expires_at <= now
+        {
+            return Err(CloudError::Conflict);
+        }
+        current.expires_at = now.saturating_add(ttl);
+        Ok(current.clone())
+    }
+    async fn release_lease(&self, lease: &ConnectionLease) -> CloudResult<()> {
+        let mut state = self.state.lock().await;
+        if let Some(current) = state
+            .leases
+            .get_mut(&(lease.project_id.clone(), lease.node_id.clone()))
+            && current.owner_id == lease.owner_id
+            && current.generation == lease.generation
+        {
+            current.expires_at = 0;
+        }
+        Ok(())
+    }
+    async fn verify_lease(&self, lease: &ConnectionLease, now: u64) -> CloudResult<()> {
+        let state = self.state.lock().await;
+        if !enrolled_live(&state, &lease.project_id, &lease.node_id) {
+            return Err(CloudError::Conflict);
+        }
+        state
+            .leases
+            .get(&(lease.project_id.clone(), lease.node_id.clone()))
+            .filter(|l| {
+                l.owner_id == lease.owner_id
+                    && l.generation == lease.generation
+                    && l.expires_at > now
+            })
+            .map(|_| ())
+            .ok_or(CloudError::Conflict)
+    }
+}
+
+/// Literal user-facing title/label projection used consistently by storage adapters.
+pub fn search_text(value: &Value) -> String {
+    value
+        .pointer("/user/display_name")
+        .or_else(|| value.get("title"))
+        .or_else(|| value.get("name"))
+        .or_else(|| value.get("label"))
+        .or_else(|| value.pointer("/request/prompt"))
+        .and_then(Value::as_str)
+        .unwrap_or_default()
+        .into()
+}
+/// Released domain status projection, including tasks with an SDK run snapshot.
+pub fn status(value: &Value) -> String {
+    if value
+        .pointer("/dispatch_error/code")
+        .and_then(Value::as_str)
+        == Some("outcome_unknown")
+    {
+        return "outcome_unknown".into();
+    }
+    if value.get("dispatch_error").is_some_and(|v| !v.is_null()) {
+        return "failed".into();
+    }
+    value
+        .get("status")
+        .or_else(|| value.pointer("/snapshot/run/status"))
+        .and_then(Value::as_str)
+        .unwrap_or_else(|| {
+            if value.get("request").is_some() {
+                "queued"
+            } else {
+                ""
+            }
+        })
+        .into()
+}
+/// Categorical conflict retaining the entity's exact observed revision.
+pub fn conflict(key: &EntityKey, expected: u64, actual: u64) -> StoreError {
+    StoreError::Conflict {
+        stream_id: key.conflict_id(),
+        expected,
+        actual,
+    }
+}
+/// Reject raw tokens in browser-session storage and enforce bounded identity/expiry.
+pub fn validate_session(session: &AuthSession) -> CloudResult<()> {
+    let hash = |value: &str| value.len() == 64 && value.bytes().all(|b| b.is_ascii_hexdigit());
+    if !hash(&session.session_hash)
+        || (!session.csrf_hash.is_empty() && !hash(&session.csrf_hash))
+        || session.subject.is_empty()
+        || session.subject.len() > 512
+        || session.expires_at <= session.created_at
+    {
+        return Err(CloudError::InvalidArgument);
+    }
+    Ok(())
+}
+/// Connection ownership expires promptly and renewal cannot create unbounded leases.
+pub fn validate_lease_ttl(ttl: u64) -> CloudResult<()> {
+    if !(5..=120).contains(&ttl) {
+        Err(CloudError::InvalidArgument)
+    } else {
+        Ok(())
+    }
+}
diff --git a/crates/colossus-cloud/src/tests.rs b/crates/colossus-cloud/src/tests.rs
new file mode 100644
index 000000000..9a3a6f857
--- /dev/null
+++ b/crates/colossus-cloud/src/tests.rs
@@ -0,0 +1,935 @@
+use super::*;
+use crate::storage::MemoryCloudStore;
+use colossus_cloud_protocol::{CloudReply, Command};
+use colossus_sdk::*;
+use std::{collections::BTreeSet, sync::Arc};
+
+#[path = "tests/inventory.rs"]
+mod inventory;
+
+fn caller(project: &str, permissions: &[CloudPermission]) -> CloudCaller {
+    CloudCaller::new(
+        "alice".into(),
+        project.into(),
+        permissions.iter().copied().collect(),
+    )
+    .unwrap()
+}
+async fn fixture() -> (CloudRepository, CloudCaller, CloudNode) {
+    let repo = CloudRepository::new(Arc::new(MemoryCloudStore::default())).unwrap();
+    let caller = caller(
+        "project-a",
+        &[
+            CloudPermission::Read,
+            CloudPermission::Execute,
+            CloudPermission::Control,
+            CloudPermission::Approve,
+            CloudPermission::Administer,
+        ],
+    );
+    let node = repo
+        .register_node(
+            &caller,
+            CloudNode {
+                node_id: "node-a".into(),
+                project_id: "project-a".into(),
+                instance_id: "instance-a".into(),
+                label: "Test runtime".into(),
+                certificate_sha256: "a".repeat(64),
+                roles: BTreeSet::from(["primary".into()]),
+                revoked: false,
+                host_id: None,
+                workspace_id: None,
+                workspace_label: None,
+                runtime_ready: false,
+                policy: None,
+                policy_observed_at: None,
+                revision: 0,
+            },
+        )
+        .await
+        .unwrap();
+    (repo, caller, node)
+}
+fn request() -> CreateRunRequest {
+    CreateRunRequest {
+        plugin_skill_ids: vec![],
+        input: vec![InputContentPart::Text("hello".into())],
+        session_id: None,
+        end_user_id: None,
+        role: "primary".into(),
+        mode: RunMode::Execute,
+        research_depth: None,
+        research_sources: vec![],
+        plan_action: None,
+        branch: None,
+        max_turns: 4,
+        idempotency_key: IdempotencyKey::new("once").unwrap(),
+    }
+}
+
+#[tokio::test]
+async fn native_revocation_is_exact_and_retryable() {
+    let (repo, caller, node) = fixture().await;
+    assert_eq!(
+        repo.revoke_own_node(
+            &node.project_id,
+            &node.node_id,
+            &"b".repeat(64),
+            &node.instance_id
+        )
+        .await,
+        Err(CloudError::PermissionDenied)
+    );
+    assert_eq!(
+        repo.revoke_own_node(
+            &node.project_id,
+            &node.node_id,
+            &node.certificate_sha256,
+            "another-instance"
+        )
+        .await,
+        Err(CloudError::PermissionDenied)
+    );
+    assert_eq!(
+        repo.revoke_own_node(
+            "another-project",
+            &node.node_id,
+            &node.certificate_sha256,
+            &node.instance_id
+        )
+        .await,
+        Err(CloudError::NotFound)
+    );
+    assert!(!repo.get_node(&caller, &node.node_id).await.unwrap().revoked);
+    repo.revoke_own_node(
+        &node.project_id,
+        &node.node_id,
+        &node.certificate_sha256,
+        &node.instance_id,
+    )
+    .await
+    .unwrap();
+    let revoked = repo.get_node(&caller, &node.node_id).await.unwrap();
+    assert!(revoked.revoked);
+    repo.revoke_own_node(
+        &node.project_id,
+        &node.node_id,
+        &node.certificate_sha256,
+        &node.instance_id,
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        repo.get_node(&caller, &node.node_id)
+            .await
+            .unwrap()
+            .revision,
+        revoked.revision
+    );
+    assert!(
+        repo.authenticate_node(
+            &node.project_id,
+            &node.node_id,
+            &node.certificate_sha256,
+            &node.instance_id
+        )
+        .await
+        .is_err()
+    );
+}
+
+#[tokio::test]
+async fn admission_is_atomic_bounded_and_reuses_settled_slots() {
+    let (repo, caller, node) = fixture().await;
+    let mut admitted = Vec::new();
+    for index in 0..16 {
+        let mut request = request();
+        request.idempotency_key = IdempotencyKey::new(format!("task-{index}")).unwrap();
+        admitted.push(
+            repo.create_task(&caller, &node.node_id, request)
+                .await
+                .unwrap(),
+        );
+    }
+    assert_eq!(
+        repo.create_task(&caller, &node.node_id, request())
+            .await
+            .unwrap_err(),
+        CloudError::ResourceExhausted
+    );
+    let mut settled = snapshot();
+    settled.run.status = RunStatus::Interrupted;
+    settled.run.terminal = Some(RunTerminal::Failure(RunFailure {
+        reason: "runtime_stopped".into(),
+        message: "Stopped before an external effect".into(),
+        outcome_certainty: OutcomeCertainty::Known,
+        recoverable: true,
+        http_status: None,
+        retry_after_ms: None,
+    }));
+    repo.record_receipt(
+        &node,
+        &admitted[0].task_id,
+        &admitted[0].task_id,
+        CloudReply::Run {
+            run: Box::new(settled),
+        },
+    )
+    .await
+    .unwrap();
+    assert!(
+        repo.create_task(&caller, &node.node_id, request())
+            .await
+            .is_ok()
+    );
+    // A retry occupies its original slot even while admission is full.
+    let mut first = request();
+    first.idempotency_key = IdempotencyKey::new("task-1").unwrap();
+    assert_eq!(
+        repo.create_task(&caller, &node.node_id, first)
+            .await
+            .unwrap()
+            .task_id,
+        admitted[1].task_id
+    );
+}
+
+#[tokio::test]
+async fn certificate_rotation_reconciles_lost_ack_and_rejects_old_leaf_or_revocation() {
+    let (repo, caller, node) = fixture().await;
+    let identity = || RenewalIdentity {
+        project_id: &node.project_id,
+        node_id: &node.node_id,
+        instance_id: &node.instance_id,
+        previous_fingerprint: &node.certificate_sha256,
+        renewal_id: "renew-1",
+    };
+    let certificate = || CertificateRedemption {
+        fingerprint: "b".repeat(64),
+        csr_sha256: "c".repeat(64),
+        certificate_pem: "public-leaf".into(),
+    };
+    assert_eq!(
+        repo.renew_certificate(identity(), certificate(), 100)
+            .await
+            .unwrap(),
+        "public-leaf"
+    );
+    let mut fresh_signing = certificate();
+    fresh_signing.certificate_pem = "different-random-serial".into();
+    fresh_signing.fingerprint = "d".repeat(64);
+    assert_eq!(
+        repo.renew_certificate(identity(), fresh_signing, 101)
+            .await
+            .unwrap(),
+        "public-leaf"
+    );
+    assert_eq!(
+        repo.authenticate_node(
+            &node.project_id,
+            &node.node_id,
+            &node.certificate_sha256,
+            &node.instance_id
+        )
+        .await
+        .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    let rotated = repo
+        .authenticate_node(
+            &node.project_id,
+            &node.node_id,
+            &"b".repeat(64),
+            &node.instance_id,
+        )
+        .await
+        .unwrap();
+    repo.revoke_node(&caller, &node.node_id, rotated.revision)
+        .await
+        .unwrap();
+    assert_eq!(
+        repo.renew_certificate(identity(), certificate(), 102)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+}
+fn snapshot() -> GetRunResponse {
+    GetRunResponse {
+        run: Run {
+            plugin_skill_ids: vec![],
+            run_id: "run-a".into(),
+            session_id: "session-a".into(),
+            title: "hello".into(),
+            role: "primary".into(),
+            mode: RunMode::Execute,
+            status: RunStatus::Running,
+            created_at: "2026-10-04T00:00:00Z".into(),
+            updated_at: "2026-10-04T00:00:00Z".into(),
+            started_at: None,
+            finished_at: None,
+            last_sequence: 2,
+            pending_interaction_count: 0,
+            terminal: None,
+            etag: "v2".into(),
+            archived: false,
+        },
+        pending_interactions: vec![],
+    }
+}
+#[tokio::test]
+async fn oversized_output_keeps_the_exact_cursor_and_run_controls_available() {
+    let (repo, caller, node) = fixture().await;
+    let task = repo
+        .create_task(&caller, &node.node_id, request())
+        .await
+        .unwrap();
+    repo.record_receipt(
+        &node,
+        &task.task_id,
+        &task.task_id,
+        CloudReply::Run {
+            run: Box::new(snapshot()),
+        },
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        repo.record_output_limit(&node, &task.task_id, "foreign-run", 0)
+            .await,
+        Err(CloudError::PermissionDenied)
+    );
+    assert_eq!(
+        repo.record_output_limit(&node, &task.task_id, "run-a", 1)
+            .await,
+        Err(CloudError::Conflict)
+    );
+    let update = RunUpdate {
+        run_id: "run-a".into(),
+        sequence: 1,
+        created_at: "2026-10-04T00:00:00Z".into(),
+        update: RunUpdateKind::OutputDelta("x".repeat(colossus_cloud_protocol::MAX_PAYLOAD_BYTES)),
+    };
+    assert_eq!(
+        repo.record_update(&node, &task.task_id, update).await,
+        Err(CloudError::ResourceExhausted)
+    );
+    let limited = repo.get_task(&caller, &task.task_id).await.unwrap();
+    assert!(limited.output_limited);
+    assert_eq!(limited.last_sequence, 0);
+    assert!(
+        repo.cancel_task(&caller, &task.task_id, "cancel-limited")
+            .await
+            .is_ok()
+    );
+    repo.record_output_limit(&node, &task.task_id, "run-a", 0)
+        .await
+        .unwrap();
+    let mut settled = snapshot();
+    settled.run.status = RunStatus::Cancelled;
+    settled.run.terminal = Some(RunTerminal::Cancellation(RunCancellation {
+        turn: 0,
+        message: "Cancelled".into(),
+        plan_id: None,
+        plan_revision: None,
+        plan_status: None,
+        goal_id: None,
+    }));
+    repo.record_snapshot(&node, &task.task_id, settled)
+        .await
+        .unwrap();
+    assert_eq!(
+        repo.get_task(&caller, &task.task_id)
+            .await
+            .unwrap()
+            .snapshot
+            .unwrap()
+            .run
+            .status,
+        RunStatus::Cancelled
+    );
+}
+
+#[tokio::test]
+async fn command_receipts_are_scoped_to_the_exact_project_and_task() {
+    let (repo, caller, node) = fixture().await;
+    let first = repo
+        .create_task(&caller, &node.node_id, request())
+        .await
+        .unwrap();
+    let command = repo
+        .get_command(&caller, &first.task_id, &first.task_id)
+        .await
+        .unwrap();
+    assert!(command.reply.is_none());
+    let mut second = request();
+    second.idempotency_key = IdempotencyKey::new("second").unwrap();
+    let second = repo
+        .create_task(&caller, &node.node_id, second)
+        .await
+        .unwrap();
+    assert_eq!(
+        repo.get_command(&caller, &second.task_id, &first.task_id)
+            .await,
+        Err(CloudError::PermissionDenied)
+    );
+    assert!(
+        repo.get_command(
+            &self::caller("foreign", &[CloudPermission::Read]),
+            &first.task_id,
+            &first.task_id
+        )
+        .await
+        .is_err()
+    );
+    assert_eq!(
+        repo.get_command(
+            &self::caller("project-a", &[CloudPermission::Execute]),
+            &first.task_id,
+            &first.task_id
+        )
+        .await,
+        Err(CloudError::PermissionDenied)
+    );
+}
+#[tokio::test]
+async fn lost_receipt_replays_one_allocation_and_conflicting_retry_fails() {
+    let (repo, caller, node) = fixture().await;
+    let first = repo
+        .create_task(&caller, &node.node_id, request())
+        .await
+        .unwrap();
+    let again = repo
+        .create_task(&caller, &node.node_id, request())
+        .await
+        .unwrap();
+    assert_eq!(first, again);
+    let commands = repo.commands(&node, None, 100).await.unwrap();
+    assert_eq!(commands.len(), 1);
+    assert!(matches!(commands[0].command, Command::Create { .. }));
+    let reply = CloudReply::Run {
+        run: Box::new(snapshot()),
+    };
+    repo.record_receipt(&node, &first.task_id, &first.task_id, reply.clone())
+        .await
+        .unwrap();
+    repo.record_receipt(&node, &first.task_id, &first.task_id, reply)
+        .await
+        .unwrap();
+    let current = repo.get_task(&caller, &first.task_id).await.unwrap();
+    assert_eq!(current.run_id.as_deref(), Some("run-a"));
+    let mut altered = request();
+    altered.input = vec![InputContentPart::Text("changed".into())];
+    assert_eq!(
+        repo.create_task(&caller, &node.node_id, altered)
+            .await
+            .unwrap_err(),
+        CloudError::Conflict
+    );
+}
+#[tokio::test]
+async fn events_require_contiguous_exact_run_sequences_and_duplicates_are_verified() {
+    let (repo, caller, node) = fixture().await;
+    let task = repo
+        .create_task(&caller, &node.node_id, request())
+        .await
+        .unwrap();
+    repo.record_receipt(
+        &node,
+        &task.task_id,
+        &task.task_id,
+        CloudReply::Run {
+            run: Box::new(snapshot()),
+        },
+    )
+    .await
+    .unwrap();
+    let mut update = RunUpdate {
+        run_id: "run-a".into(),
+        sequence: 2,
+        created_at: "2026-10-04T00:00:00Z".into(),
+        update: RunUpdateKind::OutputDelta("hello".into()),
+    };
+    assert_eq!(
+        repo.record_update(&node, &task.task_id, update.clone())
+            .await
+            .unwrap_err(),
+        CloudError::Conflict
+    );
+    update.sequence = 1;
+    assert_eq!(
+        repo.record_update(&node, &task.task_id, update.clone())
+            .await
+            .unwrap(),
+        1
+    );
+    assert_eq!(
+        repo.record_update(&node, &task.task_id, update.clone())
+            .await
+            .unwrap(),
+        1
+    );
+    update.update = RunUpdateKind::OutputDelta("tampered".into());
+    assert_eq!(
+        repo.record_update(&node, &task.task_id, update)
+            .await
+            .unwrap_err(),
+        CloudError::Conflict
+    );
+    let events = repo.updates(&caller, &task.task_id, 0, 100).await.unwrap();
+    assert_eq!(events.len(), 1);
+    assert!(
+        repo.updates(&caller, &task.task_id, 1, 100)
+            .await
+            .unwrap()
+            .is_empty()
+    );
+    assert_eq!(
+        repo.get_task(&caller, &task.task_id)
+            .await
+            .unwrap()
+            .snapshot
+            .unwrap()
+            .run
+            .last_sequence,
+        2
+    );
+}
+#[tokio::test]
+async fn project_isolation_local_role_ceiling_and_revocation_remain_independent() {
+    let (repo, admin, node) = fixture().await;
+    assert_eq!(
+        repo.create_task(
+            &caller("project-a", &[CloudPermission::Administer]),
+            &node.node_id,
+            request()
+        )
+        .await
+        .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        repo.get_node(
+            &caller("project-b", &[CloudPermission::Read]),
+            &node.node_id
+        )
+        .await
+        .unwrap_err(),
+        CloudError::NotFound
+    );
+    let mut invalid = request();
+    invalid.role = "admin".into();
+    assert_eq!(
+        repo.create_task(&admin, &node.node_id, invalid)
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    repo.revoke_node(&admin, &node.node_id, node.revision)
+        .await
+        .unwrap();
+    assert_eq!(
+        repo.commands(&node, None, 100).await.unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    assert_eq!(
+        repo.create_task(&admin, &node.node_id, request())
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+}
+
+#[tokio::test]
+async fn threads_order_human_turns_and_conflicting_writers_leave_no_orphan() {
+    let (repo, alice, node) = fixture().await;
+    let (thread, first) = repo
+        .create_thread(&alice, &node.node_id, None, request())
+        .await
+        .unwrap();
+    repo.record_receipt(
+        &node,
+        &first.task_id,
+        &first.task_id,
+        CloudReply::Run {
+            run: Box::new(snapshot()),
+        },
+    )
+    .await
+    .unwrap();
+    let current = repo
+        .get_thread(&alice, &thread.thread_id)
+        .await
+        .unwrap()
+        .thread;
+    let bob = CloudCaller::new(
+        "bob".into(),
+        alice.project_id().into(),
+        BTreeSet::from([CloudPermission::Read, CloudPermission::Execute]),
+    )
+    .unwrap();
+    let mut second = request();
+    second.idempotency_key = IdempotencyKey::new("alice-turn").unwrap();
+    let mut third = request();
+    third.idempotency_key = IdempotencyKey::new("bob-turn").unwrap();
+    let (a, b) = tokio::join!(
+        repo.send_message(&alice, &thread.thread_id, current.revision, second.clone()),
+        repo.send_message(&bob, &thread.thread_id, current.revision, third)
+    );
+    assert!(a.is_ok());
+    assert_eq!(b.unwrap_err(), CloudError::Conflict);
+    let (_, next) = a.unwrap();
+    let commands = repo.commands(&node, None, 100).await.unwrap();
+    assert_eq!(commands.len(), 1);
+    assert!(
+        !repo
+            .command_dispatchable(&node, &commands[0])
+            .await
+            .unwrap()
+    );
+    let detail = repo.get_thread(&alice, &thread.thread_id).await.unwrap();
+    assert_eq!(detail.tasks.len(), 2);
+    assert_eq!(detail.messages.len(), 2);
+    let (_, retry) = repo
+        .send_message(&alice, &thread.thread_id, current.revision, second)
+        .await
+        .unwrap();
+    assert_eq!(retry.task_id, next.task_id);
+    let mut terminal = snapshot();
+    terminal.run.status = RunStatus::Completed;
+    terminal.run.terminal = Some(RunTerminal::Result(RunResult {
+        output: "done".into(),
+        plan_id: None,
+        plan_revision: None,
+        plan_status: None,
+        goal_id: None,
+        profile: "echo".into(),
+        model_profile: "echo".into(),
+        provider_profile: "echo".into(),
+        model: "echo".into(),
+        elapsed_seconds: 0.0,
+    }));
+    repo.record_snapshot(&node, &first.task_id, terminal)
+        .await
+        .unwrap();
+    let progress = repo
+        .get_thread(&alice, &thread.thread_id)
+        .await
+        .unwrap()
+        .thread;
+    assert_eq!(
+        progress.active_task_id.as_deref(),
+        Some(next.task_id.as_str())
+    );
+    assert_eq!(progress.queued_task_ids, vec![next.task_id]);
+    assert!(
+        repo.command_dispatchable(&node, &commands[0])
+            .await
+            .unwrap()
+    );
+}
+
+#[tokio::test]
+async fn saved_thread_messages_and_replay_survive_native_disconnect() {
+    let (repo, caller, node) = fixture().await;
+    let (thread, task) = repo
+        .create_thread(&caller, &node.node_id, None, request())
+        .await
+        .unwrap();
+    repo.record_receipt(
+        &node,
+        &task.task_id,
+        &task.task_id,
+        CloudReply::Run {
+            run: Box::new(snapshot()),
+        },
+    )
+    .await
+    .unwrap();
+    let message = RunUpdate {
+        run_id: "run-a".into(),
+        sequence: 1,
+        created_at: thread.created_at.clone(),
+        update: RunUpdateKind::Message(SessionMessage {
+            session_id: "session-a".into(),
+            run_id: "run-a".into(),
+            sequence: 2,
+            role: MessageRole::Assistant,
+            content: vec![MessageContentPart::Text("saved reply".into())],
+            created_at: thread.created_at,
+        }),
+    };
+    repo.record_update(&node, &task.task_id, message.clone())
+        .await
+        .unwrap();
+    repo.record_update(&node, &task.task_id, message)
+        .await
+        .unwrap();
+    let detail = repo.get_thread(&caller, &thread.thread_id).await.unwrap();
+    assert_eq!(
+        detail
+            .messages
+            .iter()
+            .filter(|message| message.role == "assistant")
+            .count(),
+        1
+    );
+    assert_eq!(
+        detail
+            .messages
+            .iter()
+            .find(|message| message.role == "assistant")
+            .unwrap()
+            .text,
+        "saved reply"
+    );
+    let events = repo
+        .thread_updates(&caller, &thread.thread_id, 0, 100)
+        .await
+        .unwrap();
+    assert_eq!(events.len(), 1);
+    assert_eq!(events[0].value["task_id"], task.task_id);
+    assert!(
+        repo.thread_updates(&caller, &thread.thread_id, 1, 100)
+            .await
+            .unwrap()
+            .is_empty()
+    );
+    repo.revoke_own_node(
+        &node.project_id,
+        &node.node_id,
+        &node.certificate_sha256,
+        &node.instance_id,
+    )
+    .await
+    .unwrap();
+    assert_eq!(
+        repo.get_thread(&caller, &thread.thread_id)
+            .await
+            .unwrap()
+            .messages
+            .len(),
+        2
+    );
+    assert_eq!(
+        repo.send_message(
+            &caller,
+            &thread.thread_id,
+            detail.thread.revision,
+            request()
+        )
+        .await
+        .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+}
+
+#[tokio::test]
+async fn discovery_is_idempotent_and_source_controls_follow_runtime_authority() {
+    let (repo, caller, node) = fixture().await;
+    let inventory = colossus_cloud_protocol::RuntimeInventory {
+        host_id: "host-a".into(),
+        host_label: "Test host".into(),
+        platform: "macos".into(),
+        deployment_kind: colossus_cloud_protocol::DeploymentKind::Desktop,
+        workspace_id: "workspace-a".into(),
+        workspace_label: "Test workspace".into(),
+        sharing: colossus_cloud_protocol::WorkspaceSharing::SharedVisibleSessions,
+        policy: None,
+    };
+    let node = repo
+        .register_inventory(&node, inventory, 100)
+        .await
+        .unwrap();
+    let discovered = colossus_cloud_protocol::ReleasedRunInventory {
+        run: snapshot().run,
+        controllable: false,
+        continuable: true,
+    };
+    repo.discover_runs(&node, vec![discovered.clone()], "sync-a")
+        .await
+        .unwrap();
+    let threads = repo
+        .list_threads(&caller, Some(node.node_id.clone()), None, None, None, 100)
+        .await
+        .unwrap();
+    assert_eq!(threads.len(), 1);
+    let before = threads[0].revision;
+    repo.discover_runs(&node, vec![discovered], "sync-b")
+        .await
+        .unwrap();
+    let detail = repo
+        .get_thread(&caller, &threads[0].thread_id)
+        .await
+        .unwrap();
+    assert_eq!(detail.thread.revision, before);
+    assert!(detail.thread.can_continue);
+    assert!(detail.tasks[0].source_read_only);
+    assert_eq!(
+        repo.cancel_task(&caller, &detail.tasks[0].task_id, "cancel-shared")
+            .await
+            .unwrap_err(),
+        CloudError::PermissionDenied
+    );
+    repo.finish_discovery(&node, &std::collections::BTreeMap::new())
+        .await
+        .unwrap();
+    let retained = repo
+        .get_thread(&caller, &detail.thread.thread_id)
+        .await
+        .unwrap();
+    assert!(!retained.thread.can_continue);
+    assert_eq!(retained.tasks.len(), 1);
+    assert_eq!(
+        repo.list_hosts(&caller, None, 100).await.unwrap()[0].host_id,
+        "host-a"
+    );
+}
+
+#[tokio::test]
+async fn shared_history_pages_commit_messages_and_next_read_atomically() {
+    let (repo, caller, node) = fixture().await;
+    repo.discover_runs(
+        &node,
+        vec![colossus_cloud_protocol::ReleasedRunInventory {
+            run: snapshot().run,
+            controllable: false,
+            continuable: true,
+        }],
+        "history-cycle",
+    )
+    .await
+    .unwrap();
+    let task = repo.node_tasks(&node, None, 100).await.unwrap().remove(0);
+    let command = repo.commands(&node, None, 100).await.unwrap().remove(0);
+    assert!(matches!(command.command, Command::History { .. }));
+    let activity = SessionActivity {
+        activity_id: "message:1".into(),
+        run_id: Some("run-a".into()),
+        turn: None,
+        lane: SessionActivityLane::Agent,
+        kind: SessionActivityKind::User,
+        title: "User message".into(),
+        summary: "Bounded preview".into(),
+        actor: "User".into(),
+        status: Some(SessionActivityStatus::Completed),
+        started_at: "2026-10-04T00:00:00Z".into(),
+        completed_at: None,
+        duration_ms: None,
+        input: Some(SessionActivityContent {
+            format: "text".into(),
+            value: "Entire user input beyond the run title".into(),
+        }),
+        result: None,
+        attributes: Default::default(),
+        source_event_types: vec!["session.message.appended.v1".into()],
+        first_sequence: 1,
+        last_sequence: 1,
+    };
+    let response = ListSessionActivityResponse {
+        activities: vec![activity.clone()],
+        page: Some(PageResponse {
+            next_page_token: "older-page".into(),
+        }),
+        head_sequence: 10,
+        projected_through_sequence: 10,
+        caught_up: true,
+    };
+    repo.record_receipt(
+        &node,
+        &command.command_id,
+        &task.task_id,
+        CloudReply::History {
+            response: response.clone(),
+        },
+    )
+    .await
+    .unwrap();
+    let next = repo.commands(&node, None, 100).await.unwrap();
+    assert_eq!(next.len(), 1);
+    assert!(
+        matches!(&next[0].command,Command::History{page_token:Some(token),..} if token=="older-page")
+    );
+    let detail = repo
+        .get_thread(&caller, task.thread_id.as_ref().unwrap())
+        .await
+        .unwrap();
+    assert_eq!(
+        detail.messages[0].text,
+        "Entire user input beyond the run title"
+    );
+    assert!(detail.tasks[0].source_read_only);
+    let mut refreshed = response;
+    refreshed.head_sequence = 11;
+    repo.record_receipt(
+        &node,
+        &command.command_id,
+        &task.task_id,
+        CloudReply::History {
+            response: refreshed,
+        },
+    )
+    .await
+    .unwrap();
+    assert_eq!(repo.commands(&node, None, 100).await.unwrap().len(), 1);
+    let mut forbidden = activity.clone();
+    forbidden.lane = SessionActivityLane::Tools;
+    forbidden.kind = SessionActivityKind::Tool;
+    assert_eq!(
+        repo.record_receipt(
+            &node,
+            &next[0].command_id,
+            &task.task_id,
+            CloudReply::History {
+                response: ListSessionActivityResponse {
+                    activities: vec![forbidden],
+                    page: None,
+                    head_sequence: 11,
+                    projected_through_sequence: 11,
+                    caught_up: true
+                }
+            }
+        )
+        .await
+        .unwrap_err(),
+        CloudError::InvalidArgument
+    );
+    assert!(
+        repo.get_command(&caller, &task.task_id, &next[0].command_id)
+            .await
+            .unwrap()
+            .reply
+            .is_none()
+    );
+    repo.record_receipt(
+        &node,
+        &next[0].command_id,
+        &task.task_id,
+        CloudReply::History {
+            response: ListSessionActivityResponse {
+                activities: vec![],
+                page: None,
+                head_sequence: 11,
+                projected_through_sequence: 11,
+                caught_up: true,
+            },
+        },
+    )
+    .await
+    .unwrap();
+    assert!(
+        repo.get_task(&caller, &task.task_id)
+            .await
+            .unwrap()
+            .history_complete
+    );
+    assert_eq!(
+        repo.get_thread(&caller, task.thread_id.as_ref().unwrap())
+            .await
+            .unwrap()
+            .messages
+            .len(),
+        1
+    );
+}
diff --git a/crates/colossus-cloud/src/tests/inventory.rs b/crates/colossus-cloud/src/tests/inventory.rs
new file mode 100644
index 000000000..4bf6844ba
--- /dev/null
+++ b/crates/colossus-cloud/src/tests/inventory.rs
@@ -0,0 +1,246 @@
+use super::*;
+use colossus_cloud_protocol::{DeploymentKind, RuntimeInventory, WorkspaceSharing};
+
+fn inventory() -> RuntimeInventory {
+    RuntimeInventory {
+        host_id: "host-a".into(),
+        host_label: "Test host".into(),
+        platform: "macos".into(),
+        deployment_kind: DeploymentKind::Desktop,
+        workspace_id: "workspace-a".into(),
+        workspace_label: "Test workspace".into(),
+        sharing: WorkspaceSharing::CloudOwned,
+        policy: None,
+    }
+}
+
+fn policy() -> RuntimePolicyPosture {
+    RuntimePolicyPosture {
+        schema_version: 1,
+        provenance: PolicyProvenance::RuntimeReported,
+        fingerprint: "a".repeat(64),
+        configuration_revision: None,
+        access_profile: "minimal".into(),
+        sandbox_backend: PolicySandboxBackend::Native,
+        sandbox_profile: "offline-default".into(),
+        boundary_acknowledged: false,
+        approval_mode: PolicyApprovalMode::Ask,
+        allowed_roles: vec!["primary".into()],
+        allowed_tools: vec!["echo".into()],
+        capabilities: vec![],
+        models: vec![],
+        findings: vec![],
+        telemetry: PolicyTelemetry {
+            provenance: PolicyTelemetryProvenance::Unavailable,
+            denied_requests: None,
+            approval_requests: None,
+            outcome_unknown_runs: None,
+        },
+    }
+}
+
+#[tokio::test]
+async fn repeated_inventory_preserves_static_revisions_and_applies_real_changes() {
+    let (repo, caller, original) = fixture().await;
+    let mut inventory = inventory();
+    let node = repo
+        .register_inventory(&original, inventory.clone(), 100)
+        .await
+        .unwrap();
+    let host = repo.list_hosts(&caller, None, 10).await.unwrap().remove(0);
+    let workspace = repo
+        .list_workspaces(&caller, None, 10)
+        .await
+        .unwrap()
+        .remove(0);
+    let mut notifications = repo.storage().subscribe();
+    for now in 101..165 {
+        assert_eq!(
+            repo.register_inventory(&node, inventory.clone(), now)
+                .await
+                .unwrap(),
+            node
+        );
+    }
+    assert_eq!(
+        repo.list_hosts(&caller, None, 10).await.unwrap(),
+        vec![host.clone()]
+    );
+    assert_eq!(
+        repo.list_workspaces(&caller, None, 10).await.unwrap(),
+        vec![workspace.clone()]
+    );
+    assert!(matches!(
+        notifications.try_recv(),
+        Err(tokio::sync::broadcast::error::TryRecvError::Empty)
+    ));
+
+    repo.heartbeat_node(&node, true, 200).await.unwrap();
+    let heartbeat_host = repo.list_hosts(&caller, None, 10).await.unwrap().remove(0);
+    assert_eq!(heartbeat_host.last_seen_at, 200);
+    assert_eq!(heartbeat_host.revision, host.revision + 1);
+    repo.register_inventory(&node, inventory.clone(), 201)
+        .await
+        .unwrap();
+    assert_eq!(
+        repo.list_hosts(&caller, None, 10).await.unwrap(),
+        vec![heartbeat_host.clone()]
+    );
+
+    inventory.sharing = WorkspaceSharing::SharedVisibleSessions;
+    assert_eq!(
+        repo.register_inventory(&node, inventory.clone(), 202)
+            .await
+            .unwrap(),
+        node
+    );
+    let shared = repo
+        .list_workspaces(&caller, None, 10)
+        .await
+        .unwrap()
+        .remove(0);
+    assert_eq!(shared.revision, workspace.revision + 1);
+    assert_eq!(shared.sharing, "shared_visible_sessions");
+    assert_eq!(
+        repo.list_hosts(&caller, None, 10).await.unwrap(),
+        vec![heartbeat_host.clone()]
+    );
+
+    inventory.host_label = "Renamed host".into();
+    inventory.workspace_label = "Renamed workspace".into();
+    let renamed = repo
+        .register_inventory(&node, inventory.clone(), 203)
+        .await
+        .unwrap();
+    assert_eq!(
+        renamed.workspace_label.as_deref(),
+        Some("Renamed workspace")
+    );
+    assert_eq!(renamed.revision, node.revision + 1);
+    let renamed_host = repo.list_hosts(&caller, None, 10).await.unwrap().remove(0);
+    assert_eq!(renamed_host.label, "Renamed host");
+    assert_eq!(renamed_host.revision, heartbeat_host.revision + 1);
+    assert_eq!(renamed_host.last_seen_at, 200);
+    let renamed_workspace = repo
+        .list_workspaces(&caller, None, 10)
+        .await
+        .unwrap()
+        .remove(0);
+    assert_eq!(renamed_workspace.label, "Renamed workspace");
+    assert_eq!(renamed_workspace.revision, shared.revision + 1);
+    assert_eq!(
+        repo.register_inventory(&node, inventory, 204)
+            .await
+            .unwrap(),
+        renamed
+    );
+}
+
+#[tokio::test]
+async fn policy_samples_remain_fresh_without_rewriting_host_or_workspace() {
+    let (repo, caller, original) = fixture().await;
+    let mut inventory = inventory();
+    inventory.policy = Some(policy());
+    let first = repo
+        .register_inventory(&original, inventory.clone(), 100)
+        .await
+        .unwrap();
+    let hosts = repo.list_hosts(&caller, None, 10).await.unwrap();
+    let workspaces = repo.list_workspaces(&caller, None, 10).await.unwrap();
+    let observed = repo
+        .register_inventory(&first, inventory.clone(), 115)
+        .await
+        .unwrap();
+    assert_eq!(observed.policy, first.policy);
+    assert_eq!(observed.policy_observed_at, Some(115));
+    assert_eq!(observed.revision, first.revision + 1);
+    assert_eq!(
+        repo.register_inventory(&first, inventory.clone(), 115)
+            .await
+            .unwrap(),
+        observed
+    );
+    inventory.policy.as_mut().unwrap().approval_mode = PolicyApprovalMode::Deny;
+    inventory.policy.as_mut().unwrap().fingerprint = "b".repeat(64);
+    let changed = repo
+        .register_inventory(&first, inventory, 130)
+        .await
+        .unwrap();
+    assert_eq!(
+        changed.policy.as_ref().unwrap().approval_mode,
+        PolicyApprovalMode::Deny
+    );
+    assert_eq!(changed.policy_observed_at, Some(130));
+    assert_eq!(changed.revision, observed.revision + 1);
+    assert_eq!(repo.list_hosts(&caller, None, 10).await.unwrap(), hosts);
+    assert_eq!(
+        repo.list_workspaces(&caller, None, 10).await.unwrap(),
+        workspaces
+    );
+}
+
+#[tokio::test]
+async fn unchanged_inventory_still_checks_placement_enrollment_and_connection_fence() {
+    let (repo, caller, original) = fixture().await;
+    let inventory = inventory();
+    let node = repo
+        .register_inventory(&original, inventory.clone(), 100)
+        .await
+        .unwrap();
+    let mut rebound = inventory.clone();
+    rebound.host_id = "another-host".into();
+    assert_eq!(
+        repo.register_inventory(&node, rebound, 101).await,
+        Err(CloudError::Conflict)
+    );
+    let mut forged = node.clone();
+    forged.certificate_sha256 = "b".repeat(64);
+    assert_eq!(
+        repo.register_inventory(&forged, inventory.clone(), 101)
+            .await,
+        Err(CloudError::PermissionDenied)
+    );
+    forged = node.clone();
+    forged.project_id = "another-project".into();
+    assert_eq!(
+        repo.register_inventory(&forged, inventory.clone(), 101)
+            .await,
+        Err(CloudError::NotFound)
+    );
+
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    let store = repo.storage();
+    let lease = store
+        .claim_lease(&node.project_id, &node.node_id, "replica-a", now, 30)
+        .await
+        .unwrap();
+    let fenced = repo.with_lease(lease.clone());
+    assert_eq!(
+        fenced
+            .register_inventory(&node, inventory.clone(), 102)
+            .await
+            .unwrap(),
+        node
+    );
+    store.release_lease(&lease).await.unwrap();
+    store
+        .claim_lease(&node.project_id, &node.node_id, "replica-b", now, 30)
+        .await
+        .unwrap();
+    assert_eq!(
+        fenced
+            .register_inventory(&node, inventory.clone(), 103)
+            .await,
+        Err(CloudError::Storage)
+    );
+    repo.revoke_node(&caller, &node.node_id, node.revision)
+        .await
+        .unwrap();
+    assert_eq!(
+        repo.register_inventory(&node, inventory, 104).await,
+        Err(CloudError::PermissionDenied)
+    );
+}
diff --git a/crates/colossus-cloud/src/types.rs b/crates/colossus-cloud/src/types.rs
new file mode 100644
index 000000000..c2e57953e
--- /dev/null
+++ b/crates/colossus-cloud/src/types.rs
@@ -0,0 +1,223 @@
+use colossus_cloud_protocol::{CloudReply, Command};
+use colossus_sdk::{CreateRunRequest, GetRunResponse};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeSet;
+
+/// One enrolled node bound to a project, local instance, and TLS client certificate.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudNode {
+    /// Stable registered machine identity.
+    pub node_id: String,
+    /// Owning cloud project.
+    pub project_id: String,
+    /// Exact local Colossus instance independently verified by the connector SDK.
+    pub instance_id: String,
+    /// Bounded human-readable display label.
+    pub label: String,
+    /// SHA-256 of the enrolled TLS client leaf, never credential material.
+    pub certificate_sha256: String,
+    /// Additional cloud role ceiling, intersected with the local application grant.
+    pub roles: BTreeSet<String>,
+    /// Durable revocation; active streams recheck before accepting commands or output.
+    pub revoked: bool,
+    /// Explicit native host grouping; never grants execution authority.
+    #[serde(default)]
+    pub host_id: Option<String>,
+    /// Opaque workspace identity advertised by the enrolled runtime.
+    #[serde(default)]
+    pub workspace_id: Option<String>,
+    /// Sanitized display label, without a filesystem path.
+    #[serde(default)]
+    pub workspace_label: Option<String>,
+    /// Fresh authenticated heartbeat says the runtime is usable.
+    #[serde(default)]
+    pub runtime_ready: bool,
+    /// Metadata released by this authenticated runtime, never independent attestation.
+    #[serde(default)]
+    pub policy: Option<colossus_sdk::RuntimePolicyPosture>,
+    /// Last successful authenticated policy observation, UTC Unix seconds.
+    #[serde(default)]
+    pub policy_observed_at: Option<u64>,
+    /// Optimistic cloud database revision.
+    pub revision: u64,
+}
+
+/// Immutable task allocation. Accepted work is never moved to another node implicitly.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudTask {
+    /// Stable cloud identity.
+    pub task_id: String,
+    /// Owning project.
+    pub project_id: String,
+    /// Exact enrolled execution target.
+    pub node_id: String,
+    /// Authenticated submitting subject.
+    pub subject: String,
+    /// UTC RFC3339 allocation time.
+    #[serde(default)]
+    pub created_at: String,
+    /// UTC RFC3339 latest durable cloud change.
+    #[serde(default)]
+    pub updated_at: String,
+    /// Reviewed SDK request with a cloud-derived idempotency key.
+    pub request: CreateRunRequest,
+    /// Owning human conversation; legacy tasks are mapped on discovery.
+    #[serde(default)]
+    pub thread_id: Option<String>,
+    /// Imported source runs retain read-only control authority.
+    #[serde(default)]
+    pub source_read_only: bool,
+    /// Public canonical history completed its bounded synchronization.
+    #[serde(default)]
+    pub history_complete: bool,
+    /// Source public history applied its explicit content bound.
+    #[serde(default)]
+    pub history_bounded: bool,
+    /// Exact local run identity after durable allocation is acknowledged.
+    pub run_id: Option<String>,
+    /// Latest released caller-visible runtime snapshot.
+    pub snapshot: Option<GetRunResponse>,
+    /// Released failure settling initial dispatch; unknown outcomes remain explicit.
+    pub dispatch_error: Option<colossus_sdk::ApiError>,
+    /// Highest contiguous durably received local run sequence.
+    pub last_sequence: u64,
+    /// Aggregate released event bytes retained for this task.
+    pub released_bytes: usize,
+    /// Output retention reached its bound; snapshots/control continue on the fixed run.
+    #[serde(default)]
+    pub output_limited: bool,
+    /// Optimistic journal revision.
+    pub revision: u64,
+}
+
+/// Durable command and receipt; replay carries the same runtime idempotency identity.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct PendingCommand {
+    /// Stable cloud-generated dispatch/mutation identity.
+    pub command_id: String,
+    /// Exact immutable task allocation.
+    pub task_id: String,
+    /// Exact enrolled target.
+    pub node_id: String,
+    /// Closed typed SDK operation.
+    pub command: Command,
+    /// Durable reply, absent until reconciled.
+    pub reply: Option<CloudReply>,
+    /// Optimistic journal revision.
+    pub revision: u64,
+}
+
+/// Project-visible native host grouping, independent of child runtime grants.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudHost {
+    /// Stable native installation identity.
+    pub host_id: String,
+    /// Owning project.
+    pub project_id: String,
+    /// Sanitized display name.
+    pub label: String,
+    /// Native operating system name.
+    pub platform: String,
+    /// Desktop or independent CLI deployment.
+    pub deployment_kind: String,
+    /// Last authenticated contact, UTC Unix seconds.
+    pub last_seen_at: u64,
+    /// Optimistic metadata revision.
+    pub revision: u64,
+}
+/// One independently scoped workspace advertised by a native runtime.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudWorkspace {
+    /// Native opaque workspace identity.
+    pub workspace_id: String,
+    /// Owning project.
+    pub project_id: String,
+    /// Host installation grouping.
+    pub host_id: String,
+    /// Independently enrolled execution target.
+    pub node_id: String,
+    /// Sanitized label without local paths.
+    pub label: String,
+    /// Locally selected sharing mode.
+    pub sharing: String,
+    /// Optimistic metadata revision.
+    pub revision: u64,
+}
+/// Human-operated cloud conversation mapped to one exact runtime session.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudThread {
+    /// Stable cloud conversation identity.
+    pub thread_id: String,
+    /// Owning authenticated project.
+    pub project_id: String,
+    /// Immutable enrolled runtime placement.
+    pub node_id: String,
+    /// Native host grouping if advertised.
+    pub host_id: Option<String>,
+    /// Native workspace identity if advertised.
+    pub workspace_id: Option<String>,
+    /// Human-editable bounded conversation title.
+    pub title: String,
+    /// UTC RFC3339 creation time.
+    pub created_at: String,
+    /// UTC RFC3339 last conversation change.
+    pub updated_at: String,
+    /// Optimistic user-visible metadata revision.
+    pub revision: u64,
+    /// Human archive preference.
+    pub archived: bool,
+    /// Exact local session; absent until first durable receipt.
+    pub session_id: Option<String>,
+    /// Current or incomplete released history projection.
+    pub sync_status: String,
+    /// Cloud-created or runtime-discovered source.
+    pub source: String,
+    /// Runtime-declared continuation authority.
+    pub can_continue: bool,
+    /// Current cloud turn, including durable queued allocation.
+    pub active_task_id: Option<String>,
+    /// Ordered bounded human submission queue.
+    #[serde(default)]
+    pub queued_task_ids: Vec<String>,
+}
+/// Ordered released conversation message retained for offline cloud viewing.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct CloudMessage {
+    /// Stable source or submitted-message identity.
+    pub message_id: String,
+    /// Owning cloud thread.
+    pub thread_id: String,
+    /// Authenticated project.
+    pub project_id: String,
+    /// User or assistant message role.
+    pub role: String,
+    /// Released human-visible text.
+    pub text: String,
+    /// UTC RFC3339 creation time.
+    pub created_at: String,
+    /// Associated cloud task/run mapping.
+    pub task_id: String,
+    /// Optimistic representation revision.
+    pub revision: u64,
+}
+/// Complete released conversation view with bounded pages for older history.
+#[derive(Clone, Debug, Serialize)]
+pub struct CloudThreadDetail {
+    /// Conversation metadata.
+    pub thread: CloudThread,
+    /// Bounded newest-first task page.
+    pub tasks: Vec<CloudTask>,
+    /// Bounded ordered message page.
+    pub messages: Vec<CloudMessage>,
+    /// Older tasks require an explicit next page.
+    pub next_task_cursor: Option<String>,
+    /// Older messages require an explicit next page.
+    pub next_message_cursor: Option<String>,
+}
diff --git a/crates/colossus-cloud/src/validation.rs b/crates/colossus-cloud/src/validation.rs
new file mode 100644
index 000000000..522ba5b77
--- /dev/null
+++ b/crates/colossus-cloud/src/validation.rs
@@ -0,0 +1,26 @@
+use crate::{CloudError, CloudResult};
+
+/// Validate a path-safe identity before composing stream identifiers or HTTP routes.
+pub fn validate_identifier(value: &str) -> CloudResult<()> {
+    if value.is_empty()
+        || value.len() > 128
+        || !value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
+    {
+        return Err(CloudError::InvalidArgument);
+    }
+    Ok(())
+}
+
+pub(crate) fn fingerprint(bytes: &[u8]) -> String {
+    use sha2::{Digest, Sha256};
+    hex::encode(Sha256::digest(bytes))
+}
+
+pub(crate) fn bounded_fingerprint(value: &str) -> CloudResult<()> {
+    if value.len() != 64 || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return Err(CloudError::InvalidArgument);
+    }
+    Ok(())
+}
diff --git a/crates/colossus-codex-auth/Cargo.toml b/crates/colossus-codex-auth/Cargo.toml
index 81cefb92a..3fc03f0a3 100644
--- a/crates/colossus-codex-auth/Cargo.toml
+++ b/crates/colossus-codex-auth/Cargo.toml
@@ -8,6 +8,7 @@ license.workspace = true
 
 [dependencies]
 base64.workspace = true
+colossus-home.workspace = true
 directories.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/crates/colossus-codex-auth/src/confined_store.rs b/crates/colossus-codex-auth/src/confined_store.rs
new file mode 100644
index 000000000..1a48da0a9
--- /dev/null
+++ b/crates/colossus-codex-auth/src/confined_store.rs
@@ -0,0 +1,162 @@
+//! Opt-in parent-bound official account storage, without a key or account cache.
+
+use crate::CodexAuthError;
+use colossus_home::{ConfinedFile, ConfinedRoot};
+use std::{
+    io::{Read as _, Write as _},
+    path::{Component, Path, PathBuf},
+};
+use zeroize::Zeroizing;
+
+const MAX_AUTH_FILE_BYTES: u64 = 256 * 1024;
+
+#[derive(Clone)]
+pub(crate) struct ConfinedAuthStore {
+    root: ConfinedRoot,
+    name: PathBuf,
+}
+
+pub(crate) struct ConfinedUpdateLock {
+    file: ConfinedFile,
+    root: ConfinedRoot,
+}
+impl ConfinedUpdateLock {
+    pub(crate) fn revalidate(&self) -> Result<(), CodexAuthError> {
+        self.file.revalidate(&self.root).map_err(|_| unsafe_store())
+    }
+}
+
+impl ConfinedAuthStore {
+    pub(crate) fn new(root: ConfinedRoot, name: &Path) -> Result<Self, CodexAuthError> {
+        if name.components().count() != 1
+            || !matches!(name.components().next(), Some(Component::Normal(_)))
+        {
+            return Err(unsafe_store());
+        }
+        let selected = Self {
+            root,
+            name: name.to_owned(),
+        };
+        selected.open()?;
+        Ok(selected)
+    }
+
+    pub(crate) fn path(&self) -> PathBuf {
+        self.root.path().join(&self.name)
+    }
+
+    fn open(&self) -> Result<ConfinedFile, CodexAuthError> {
+        self.root.revalidate().map_err(|_| unsafe_store())?;
+        let file = self
+            .root
+            .open_existing_file(&self.name)
+            .map_err(|_| unsafe_store())?;
+        validate_file(&file)?;
+        file.revalidate(&self.root).map_err(|_| unsafe_store())?;
+        Ok(file)
+    }
+
+    pub(crate) fn read(&self) -> Result<Zeroizing<Vec<u8>>, CodexAuthError> {
+        let file = self.open()?;
+        // A bounded upfront allocation prevents credential bytes from being left
+        // in discarded buffers if the file grows between metadata and the read.
+        let mut bytes = Zeroizing::new(Vec::with_capacity(MAX_AUTH_FILE_BYTES as usize + 1));
+        file.file()
+            .take(MAX_AUTH_FILE_BYTES + 1)
+            .read_to_end(&mut bytes)
+            .map_err(|_| unsafe_store())?;
+        if bytes.len() as u64 > MAX_AUTH_FILE_BYTES {
+            return Err(unsafe_store());
+        }
+        validate_file(&file)?;
+        file.revalidate(&self.root).map_err(|_| unsafe_store())?;
+        Ok(bytes)
+    }
+
+    pub(crate) fn lock(&self) -> Result<ConfinedUpdateLock, CodexAuthError> {
+        self.root.revalidate().map_err(|_| unsafe_store())?;
+        self.open()?;
+        let name = self.name.to_str().ok_or_else(unsafe_store)?;
+        let file = self
+            .root
+            .open_file(Path::new(&format!("{name}.lock")))
+            .map_err(|_| unsafe_store())?;
+        validate_file(&file)?;
+        #[cfg(unix)]
+        rustix::fs::flock(file.file(), rustix::fs::FlockOperation::LockExclusive)
+            .map_err(|_| unsafe_store())?;
+        #[cfg(windows)]
+        fs4::fs_std::FileExt::lock_exclusive(file.file()).map_err(|_| unsafe_store())?;
+        #[cfg(not(any(unix, windows)))]
+        return Err(unsafe_store());
+        let guard = ConfinedUpdateLock {
+            file,
+            root: self.root.clone(),
+        };
+        guard.revalidate()?;
+        Ok(guard)
+    }
+
+    pub(crate) fn write(&self, bytes: &[u8]) -> Result<(), CodexAuthError> {
+        if bytes.len() as u64 > MAX_AUTH_FILE_BYTES {
+            return Err(unsafe_store());
+        }
+        let current = self.open()?;
+        // Reuse only tempfile's bounded unpredictable-name selection. Actual file
+        // creation is descriptor-confined; cleanup never follows a directory path.
+        let staging = tempfile::Builder::new()
+            .prefix(".codex-refresh-")
+            .rand_bytes(16)
+            .disable_cleanup(true)
+            .make_in(self.root.path(), |candidate| {
+                let name = candidate
+                    .file_name()
+                    .ok_or_else(|| std::io::Error::from(std::io::ErrorKind::InvalidInput))?;
+                let file = self
+                    .root
+                    .open_file(Path::new(name))
+                    .map_err(|_| std::io::Error::from(std::io::ErrorKind::PermissionDenied))?;
+                if !file.was_created() {
+                    return Err(std::io::Error::from(std::io::ErrorKind::AlreadyExists));
+                }
+                Ok(file)
+            })
+            .map_err(|_| unsafe_store())?;
+        let staged = staging.as_file();
+        staged.revalidate(&self.root).map_err(|_| unsafe_store())?;
+        staged.file().write_all(bytes).map_err(|_| unsafe_store())?;
+        staged
+            .file()
+            .set_len(bytes.len() as u64)
+            .map_err(|_| unsafe_store())?;
+        staged.file().sync_all().map_err(|_| unsafe_store())?;
+        self.root
+            .replace_existing_file(staged, &current)
+            .map_err(|_| unsafe_store())?;
+        Ok(())
+    }
+}
+
+// Failed staging may leave one private file. Do not follow a possibly changed
+// directory path to remove it; original/unrelated files take priority over cleanup.
+
+fn validate_file(file: &ConfinedFile) -> Result<(), CodexAuthError> {
+    let metadata = file.file().metadata().map_err(|_| unsafe_store())?;
+    if metadata.len() > MAX_AUTH_FILE_BYTES {
+        return Err(unsafe_store());
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt as _;
+        if metadata.permissions().mode() & 0o077 != 0 {
+            return Err(unsafe_store());
+        }
+    }
+    Ok(())
+}
+
+fn unsafe_store() -> CodexAuthError {
+    CodexAuthError::Storage(
+        "the explicitly selected Codex credential namespace is unsafe or changed".into(),
+    )
+}
diff --git a/crates/colossus-codex-auth/src/lib.rs b/crates/colossus-codex-auth/src/lib.rs
index 4e7fcd9f5..5032635b3 100644
--- a/crates/colossus-codex-auth/src/lib.rs
+++ b/crates/colossus-codex-auth/src/lib.rs
@@ -3,6 +3,7 @@
 #![allow(clippy::missing_errors_doc)]
 
 mod cli;
+mod confined_store;
 mod store;
 
 pub use cli::*;
diff --git a/crates/colossus-codex-auth/src/store.rs b/crates/colossus-codex-auth/src/store.rs
index 9bc15ad2f..96dda56f9 100644
--- a/crates/colossus-codex-auth/src/store.rs
+++ b/crates/colossus-codex-auth/src/store.rs
@@ -97,6 +97,7 @@ impl<'a> CodexRefreshRequest<'a> {
 pub struct CodexAuthStore {
     path: PathBuf,
     update_lock: Arc<Mutex<()>>,
+    confined: Option<crate::confined_store::ConfinedAuthStore>,
 }
 
 impl CodexAuthStore {
@@ -123,9 +124,26 @@ impl CodexAuthStore {
         Self {
             path: path.into(),
             update_lock: Arc::new(Mutex::new(())),
+            confined: None,
         }
     }
 
+    /// Bind one existing private file to a retained owner-private parent directory.
+    /// Construction inspects metadata only. Every load/refresh revalidates the
+    /// directory and current single-link leaf, permitting legitimate atomic refresh
+    /// replacement but refusing changed parent aliases without another store fallback.
+    pub fn confined(
+        root: colossus_home::ConfinedRoot,
+        name: impl AsRef<Path>,
+    ) -> Result<Self, CodexAuthError> {
+        let binding = crate::confined_store::ConfinedAuthStore::new(root, name.as_ref())?;
+        Ok(Self {
+            path: binding.path(),
+            update_lock: Arc::new(Mutex::new(())),
+            confined: Some(binding),
+        })
+    }
+
     /// Credential file path without reading it.
     pub fn path(&self) -> &Path {
         &self.path
@@ -133,7 +151,17 @@ impl CodexAuthStore {
 
     /// Load and validate the current ChatGPT authorization without logging secrets.
     pub fn load(&self) -> Result<CodexAuthorization, CodexAuthError> {
-        authorization_from_file(&read_stored_auth(&self.path)?)
+        authorization_from_file(&self.read_selected_auth()?)
+    }
+
+    fn read_selected_auth(&self) -> Result<StoredAuth, CodexAuthError> {
+        if let Some(binding) = &self.confined {
+            let bytes = binding.read()?;
+            serde_json::from_slice(&bytes)
+                .map_err(|_| CodexAuthError::Unavailable("Codex auth file is invalid JSON".into()))
+        } else {
+            read_stored_auth(&self.path)
+        }
     }
 
     /// Atomically merge a successful bounded refresh response into Codex storage.
@@ -152,8 +180,17 @@ impl CodexAuthStore {
             .update_lock
             .lock()
             .map_err(|_| CodexAuthError::Storage("credential update lock was poisoned".into()))?;
-        let _file_guard = AuthUpdateLock::acquire(&self.path)?;
-        let mut stored = read_stored_auth(&self.path)?;
+        let confined_lock = self
+            .confined
+            .as_ref()
+            .map(|binding| binding.lock())
+            .transpose()?;
+        let _file_guard = if self.confined.is_none() {
+            Some(AuthUpdateLock::acquire(&self.path)?)
+        } else {
+            None
+        };
+        let mut stored = self.read_selected_auth()?;
         let witness = AuthWitness::capture(&stored)?;
         let tokens = stored.tokens.as_mut().ok_or_else(missing_tokens)?;
         if tokens.refresh_token != expected.refresh_token() {
@@ -197,10 +234,21 @@ impl CodexAuthStore {
                 .format(&Rfc3339)
                 .map_err(|error| CodexAuthError::Storage(error.to_string()))?,
         );
-        if !witness.matches(&read_stored_auth(&self.path)?) {
+        if !witness.matches(&self.read_selected_auth()?) {
             return Err(credentials_changed());
         }
-        write_stored_auth(&self.path, &stored)?;
+        if let Some(binding) = &self.confined {
+            if let Some(guard) = &confined_lock {
+                guard.revalidate()?;
+            }
+            let bytes = auth_bytes(&stored)?;
+            binding.write(&bytes)?;
+            if let Some(guard) = &confined_lock {
+                guard.revalidate()?;
+            }
+        } else {
+            write_stored_auth(&self.path, &stored)?;
+        }
         authorization_from_file(&stored)
     }
 }
@@ -692,6 +740,10 @@ fn zeroize_json_value(value: &mut Value) {
 }
 
 fn write_stored_auth(path: &Path, stored: &StoredAuth) -> Result<(), CodexAuthError> {
+    write_auth_bytes(path, &auth_bytes(stored)?)
+}
+
+fn auth_bytes(stored: &StoredAuth) -> Result<Zeroizing<Vec<u8>>, CodexAuthError> {
     let bytes = Zeroizing::new(
         serde_json::to_vec_pretty(stored)
             .map_err(|error| CodexAuthError::Storage(error.to_string()))?,
@@ -701,7 +753,7 @@ fn write_stored_auth(path: &Path, stored: &StoredAuth) -> Result<(), CodexAuthEr
             "updated Codex auth file exceeds the safety bound".into(),
         ));
     }
-    write_auth_bytes(path, &bytes)
+    Ok(bytes)
 }
 
 #[cfg(unix)]
@@ -1162,7 +1214,6 @@ mod tests {
         }
     }
 
-    #[cfg(windows)]
     fn valid_auth(refresh_token: &str) -> Value {
         json!({
             "auth_mode": "chatgpt",
@@ -1176,6 +1227,97 @@ mod tests {
         })
     }
 
+    fn confined_fixture() -> (tempfile::TempDir, colossus_home::ConfinedRoot) {
+        let temporary = test_tempdir();
+        let parent = fs::canonicalize(temporary.path()).expect("canonical private parent");
+        let path = parent.join("account");
+        #[cfg(windows)]
+        colossus_windows_native::create_private_directory(&path)
+            .expect("private account directory");
+        #[cfg(not(windows))]
+        {
+            fs::create_dir(&path).expect("private account directory");
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt as _;
+                fs::set_permissions(&path, fs::Permissions::from_mode(0o700)).unwrap();
+            }
+        }
+        (
+            temporary,
+            colossus_home::ConfinedRoot::bind(path).expect("private account binding"),
+        )
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn confined_store_refuses_parent_alias_after_selection_for_load_and_refresh() {
+        use std::os::unix::fs::symlink;
+        let (_temporary, root) = confined_fixture();
+        let path = root.path().join("auth.json");
+        write_auth(&path, &valid_auth("refresh-1"));
+        let store = CodexAuthStore::confined(root.clone(), Path::new("auth.json")).unwrap();
+        let snapshot = store.load().unwrap();
+        let displaced = root.path().with_file_name("displaced");
+        fs::rename(root.path(), &displaced).unwrap();
+        symlink(&displaced, root.path()).unwrap();
+        assert!(matches!(store.load(), Err(CodexAuthError::Storage(_))));
+        assert!(matches!(
+            store.apply_refresh(&snapshot, b"{}"),
+            Err(CodexAuthError::Storage(_))
+        ));
+        assert!(!displaced.join("auth.json.lock").exists());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn confined_store_refuses_new_hardlink_after_selection_without_update() {
+        let (_temporary, root) = confined_fixture();
+        let path = root.path().join("auth.json");
+        write_auth(&path, &valid_auth("refresh-1"));
+        let store = CodexAuthStore::confined(root.clone(), Path::new("auth.json")).unwrap();
+        let snapshot = store.load().unwrap();
+        let original = fs::read(&path).unwrap();
+        fs::hard_link(&path, root.path().join("alias.json")).unwrap();
+        assert!(matches!(store.load(), Err(CodexAuthError::Storage(_))));
+        assert!(matches!(
+            store.apply_refresh(&snapshot, b"{}"),
+            Err(CodexAuthError::Storage(_))
+        ));
+        assert_eq!(fs::read(&path).unwrap(), original);
+        assert!(!root.path().join("auth.json.lock").exists());
+    }
+
+    #[test]
+    fn confined_store_accepts_atomic_refresh_and_preserves_unknown_metadata_and_cas() {
+        let (_temporary, root) = confined_fixture();
+        let path = root.path().join("auth.json");
+        let mut initial = valid_auth("refresh-1");
+        initial["fixture_metadata"] = json!({"retained": true});
+        write_auth(&path, &initial);
+        let store = CodexAuthStore::confined(root.clone(), Path::new("auth.json")).unwrap();
+        let snapshot = store.load().unwrap();
+        let old = root.open_existing_file(Path::new("auth.json")).unwrap();
+        let response = serde_json::to_vec(&json!({
+            "access_token": jwt(json!({"exp": OffsetDateTime::now_utc().unix_timestamp() + 7200})),
+            "refresh_token": "refresh-2"
+        }))
+        .unwrap();
+        let refreshed = store.apply_refresh(&snapshot, &response).unwrap();
+        assert_eq!(refreshed.refresh_token(), "refresh-2");
+        let current = root.open_existing_file(Path::new("auth.json")).unwrap();
+        assert!(!old.shares_identity(current.file()).unwrap());
+        assert_eq!(store.load().unwrap().refresh_token(), "refresh-2");
+        let document: Value = serde_json::from_slice(&fs::read(&path).unwrap()).unwrap();
+        assert_eq!(document["fixture_metadata"], json!({"retained": true}));
+        let committed = fs::read(&path).unwrap();
+        assert!(matches!(
+            store.apply_refresh(&snapshot, &response),
+            Err(CodexAuthError::Storage(_))
+        ));
+        assert_eq!(fs::read(&path).unwrap(), committed);
+    }
+
     #[cfg(windows)]
     fn grant_everyone(path: &Path, rights: &str) {
         let status = std::process::Command::new("icacls.exe")
diff --git a/crates/colossus-connector/Cargo.toml b/crates/colossus-connector/Cargo.toml
new file mode 100644
index 000000000..d3f8c6971
--- /dev/null
+++ b/crates/colossus-connector/Cargo.toml
@@ -0,0 +1,38 @@
+[package]
+name = "colossus-connector"
+publish = false
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+clap.workspace = true
+colossus-cloud-protocol.workspace = true
+colossus-credentials.workspace = true
+colossus-contracts.workspace = true
+colossus-home.workspace = true
+colossus-ports.workspace = true
+colossus-sdk = { workspace = true, features = ["serialization", "keyring"] }
+async-trait.workspace = true
+futures.workspace = true
+fs4.workspace = true
+hex.workspace = true
+rcgen.workspace = true
+reqwest.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+tokio.workspace = true
+tokio-stream.workspace = true
+tonic = { workspace = true, features = ["transport", "tls-ring"] }
+url.workspace = true
+uuid.workspace = true
+zeroize = { workspace = true, features = ["derive"] }
+x509-parser.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+
+[lints]
+workspace = true
diff --git a/crates/colossus-connector/src/cli.rs b/crates/colossus-connector/src/cli.rs
new file mode 100644
index 000000000..3996526d2
--- /dev/null
+++ b/crates/colossus-connector/src/cli.rs
@@ -0,0 +1,377 @@
+use crate::cli_control::{Control, Report};
+use crate::{ConnectorStatus, EnrollmentStore, RuntimeConnector};
+use clap::{Args, Subcommand};
+use colossus_credentials::{EnvironmentKeyStore, PlatformCredentialVault};
+use colossus_home::{ColossusHome, ConfinedRoot};
+use colossus_ports::CredentialVault;
+use colossus_sdk::{
+    ApiMajor, Colossus, DaemonConnectOptions, InstanceId, KeyringCredentialProvider, TlsFingerprint,
+};
+use serde::Deserialize;
+use std::{
+    io::{BufRead, BufReader, Read, Write},
+    path::PathBuf,
+    str::FromStr,
+    sync::Arc,
+};
+use zeroize::Zeroizing;
+
+/// Portable CLI and standalone connector lifecycle operations.
+#[derive(Subcommand)]
+pub enum ConnectorCommand {
+    /// Read metadata-only policy beneath the dedicated local application's authority.
+    Policy(LocalArguments),
+    /// Explicitly share the local application's workspace sessions with a dedicated cloud application.
+    ShareWorkspace(ShareWorkspaceArguments),
+    /// Enroll one independently verified local daemon; invitation is read from stdin.
+    Enroll(EnrollArguments),
+    /// Maintain its outbound connection until Ctrl-C; accepted runs survive disconnect.
+    Run(LocalArguments),
+    /// Show the saved non-secret enrollment identity.
+    Status(StorageArguments),
+    /// Rotate the native-held certificate/key; retries reconcile the saved exchange.
+    Renew(StorageArguments),
+    /// Stop this CLI connection without cancelling accepted runtime work.
+    Disconnect(StorageArguments),
+    /// Disconnect and revoke this exact native enrollment in the cloud.
+    Revoke(StorageArguments),
+    /// Forget local enrollment after stopping the connector; remote authority remains revoked separately.
+    Forget(StorageArguments),
+}
+/// Local operator disclosure beneath its own authenticated application credential.
+#[derive(Args)]
+pub struct ShareWorkspaceArguments {
+    /// Exact independently enrolled cloud application ID, such as app:colossus-cloud.
+    #[arg(long)]
+    pub recipient_application_id: String,
+    /// Revoke future reads and continuation; synchronized cloud history remains retained.
+    #[arg(long)]
+    pub disable: bool,
+    /// Allow new recipient-owned runs to continue source conversations under its own grant.
+    #[arg(long, conflicts_with = "disable")]
+    pub allow_continuation: bool,
+    /// Source application's protected native connection references.
+    #[command(flatten)]
+    pub local: LocalArguments,
+}
+/// Secret-storage references shared by all connector commands.
+#[derive(Args)]
+pub struct StorageArguments {
+    /// Opaque local enrollment name, permitting multiple explicitly selected nodes.
+    #[arg(long, default_value = "active")]
+    pub name: String,
+    /// Explicit headless authority; variable must hold a secret 32-byte hex wrapping key.
+    #[arg(long)]
+    pub vault_key_variable: Option<String>,
+}
+/// Independently enrolled local daemon connection references.
+#[derive(Args)]
+pub struct LocalArguments {
+    /// Owner-private JSON containing exact descriptor, instance, pin, and dedicated keyring references.
+    #[arg(long)]
+    pub local_config: PathBuf,
+    /// Native credential authority and enrollment identity.
+    #[command(flatten)]
+    pub storage: StorageArguments,
+}
+/// Single-use cloud enrollment references; no invitation is accepted through argv or environment.
+#[derive(Args)]
+pub struct EnrollArguments {
+    /// Exact HTTPS enrollment endpoint obtained from the authenticated web fleet view.
+    #[arg(long)]
+    pub enrollment_url: String,
+    /// Explicitly permit HTTP enrollment on loopback for local acceptance only.
+    #[arg(long)]
+    pub allow_loopback_http: bool,
+    /// Independently verified local daemon and native vault references.
+    #[command(flatten)]
+    pub local: LocalArguments,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct LocalConfig {
+    descriptor: PathBuf,
+    certificate: PathBuf,
+    instance_id: String,
+    certificate_sha256: String,
+    keyring_service: String,
+    keyring_account: String,
+    #[serde(default)]
+    headless_authority: Option<HeadlessAuthority>,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct HeadlessAuthority {
+    directory: PathBuf,
+    key_variable: String,
+}
+fn store(arguments: &StorageArguments) -> Result<EnrollmentStore, Box<dyn std::error::Error>> {
+    let home = ColossusHome::resolve_and_ensure()?;
+    let development =
+        colossus_credentials::DevelopmentAuthority::selected(home.confined_root(), &[])?;
+    if development.is_some() && arguments.vault_key_variable.is_some() {
+        return Err("development authority conflicts with an explicit vault-key variable".into());
+    }
+    let root = ConfinedRoot::bind(
+        home.confined_root()
+            .prepare_directory(std::path::Path::new("cloud-connector"))?,
+    )?;
+    let vault: Arc<dyn CredentialVault> = if let Some(authority) = development {
+        Arc::new(PlatformCredentialVault::with_key_store(
+            root,
+            "cloud-connector",
+            Arc::new(
+                authority.store(colossus_credentials::DevelopmentStoreScope::ControlPlaneVault)?,
+            ),
+        )?)
+    } else {
+        match &arguments.vault_key_variable {
+            Some(variable) => Arc::new(PlatformCredentialVault::with_key_store(
+                root.clone(),
+                "cloud-connector",
+                Arc::new(EnvironmentKeyStore::new(root, variable.clone())?),
+            )?),
+            None => Arc::new(PlatformCredentialVault::new(root, "cloud-connector")?),
+        }
+    };
+    Ok(EnrollmentStore::new(vault, &arguments.name)?)
+}
+async fn local(arguments: &LocalArguments) -> Result<Colossus, Box<dyn std::error::Error>> {
+    let parent = arguments
+        .local_config
+        .parent()
+        .ok_or("local config must be an absolute protected file")?;
+    let root = ConfinedRoot::bind(parent)?;
+    let file = root.open_existing_file(
+        arguments
+            .local_config
+            .file_name()
+            .ok_or("invalid local config")?
+            .as_ref(),
+    )?;
+    let mut bytes = Vec::new();
+    file.file().take(16385).read_to_end(&mut bytes)?;
+    if bytes.len() > 16384 {
+        return Err("local config exceeds bound".into());
+    }
+    let config: LocalConfig = serde_json::from_slice(&bytes)?;
+    if config.headless_authority.is_some()
+        && std::env::var_os(colossus_credentials::DEVELOPMENT_AUTHORITY_VARIABLE).is_some()
+    {
+        return Err(
+            "development authority conflicts with an explicit headless credential authority".into(),
+        );
+    }
+    file.revalidate(&root)?;
+    let credential: Arc<dyn colossus_sdk::CredentialProvider> = match config.headless_authority {
+        Some(authority) => Arc::new(crate::HeadlessCredentialProvider::new(
+            ConfinedRoot::bind(authority.directory)?,
+            authority.key_variable,
+            &config.keyring_service,
+            &config.keyring_account,
+        )?),
+        None => {
+            let home = ColossusHome::resolve_and_ensure()?;
+            if let Some(authority) =
+                colossus_credentials::DevelopmentAuthority::selected(home.confined_root(), &[])?
+            {
+                Arc::new(crate::HeadlessCredentialProvider::from_store(
+                    Arc::new(
+                        authority.store(colossus_credentials::DevelopmentStoreScope::PublicApi)?,
+                    ),
+                    &config.keyring_service,
+                    &config.keyring_account,
+                )?)
+            } else {
+                Arc::new(KeyringCredentialProvider::new(
+                    config.keyring_service,
+                    config.keyring_account,
+                )?)
+            }
+        }
+    };
+    let options = DaemonConnectOptions::new(
+        InstanceId::from_str(&config.instance_id)?,
+        config.descriptor,
+        TlsFingerprint::from_hex(&config.certificate_sha256)?,
+        ApiMajor::new(1)?,
+        credential,
+    )?
+    .with_certificate_path(config.certificate)?;
+    Ok(Colossus::connect_installed(options).await?)
+}
+/// Execute the shared `colossus control-plane` / `colossus-connector` command surface.
+/// Credentials and tokens never appear in status output or process arguments.
+pub async fn run_cli(command: ConnectorCommand) -> Result<(), Box<dyn std::error::Error>> {
+    match command {
+        ConnectorCommand::Policy(arguments) => {
+            let client = local(&arguments).await?;
+            let result = client.agent_runs().get_runtime_policy_posture().await;
+            client.close().await?;
+            println!("{}", serde_json::to_string(&result?)?);
+        }
+        ConnectorCommand::ShareWorkspace(arguments) => {
+            let client = local(&arguments.local).await?;
+            let state = client
+                .agent_runs()
+                .set_workspace_sharing(colossus_sdk::SetWorkspaceSharingRequest {
+                    recipient_application_id: arguments.recipient_application_id,
+                    enabled: !arguments.disable,
+                    allow_continuation: arguments.allow_continuation,
+                })
+                .await?;
+            println!("{}", serde_json::to_string(&state)?);
+            client.close().await?;
+        }
+        ConnectorCommand::Renew(arguments) => {
+            Control::new(&arguments.name)?.disconnect().await?;
+            let enrollment = store(&arguments)?;
+            enrollment.renew(true).await?;
+            println!("connector certificate renewed");
+        }
+        ConnectorCommand::Enroll(arguments) => {
+            let client = local(&arguments.local).await?;
+            eprint!("One-use Control Plane invitation: ");
+            std::io::stderr().flush()?;
+            let mut token = Zeroizing::new(String::new());
+            BufReader::new(std::io::stdin())
+                .take(66)
+                .read_line(&mut token)?;
+            let token = Zeroizing::new(token.trim().to_owned());
+            let enrollment = store(&arguments.local.storage)?;
+            let config = enrollment
+                .enroll(
+                    arguments.enrollment_url,
+                    token,
+                    client
+                        .instance_id()
+                        .ok_or("local instance unavailable")?
+                        .to_string(),
+                    client.capabilities().iter().map(str::to_owned).collect(),
+                    arguments.allow_loopback_http,
+                )
+                .await?;
+            Control::new(&arguments.local.storage.name)?.save(&Report::saved(Some(&config)))?;
+            println!(
+                "{}",
+                serde_json::json!({"node_id":config.node_id,"project_id":config.project_id,"endpoint":config.endpoint,"status":"enrolled"})
+            );
+            client.close().await?;
+        }
+        ConnectorCommand::Run(arguments) => {
+            let control = Control::new(&arguments.storage.name)?;
+            eprintln!(
+                "connecting to the pinned local runtime; the native credential store may require unlocking"
+            );
+            let client = local(&arguments).await?;
+            let enrollment = store(&arguments.storage)?;
+            let (mut config, key) = enrollment.load()?.ok_or("enroll this connector first")?;
+            if client.instance_id().map(|id| id.to_string()).as_deref() != Some(&config.instance_id)
+            {
+                return Err("local enrolled instance changed".into());
+            }
+            if config.inventory.is_none() {
+                let inventory = crate::native_inventory(
+                    format!("workspace:{}", config.instance_id),
+                    "CLI workspace".into(),
+                    crate::DeploymentKind::Cli,
+                )?;
+                config = enrollment.set_inventory(inventory).await?;
+            }
+            let mut report = Report::saved(Some(&config));
+            report.run_instance = Some(uuid::Uuid::now_v7().simple().to_string());
+            let connector = RuntimeConnector::new(config, key, client.agent_runs())?
+                .with_enrollment_store(enrollment);
+            control.heartbeat(&mut report, ConnectorStatus::Connecting)?;
+            let (shutdown, receiver) = tokio::sync::watch::channel(false);
+            let (status, mut updates) = tokio::sync::watch::channel(ConnectorStatus::Connecting);
+            let final_status = updates.clone();
+            let interrupt = shutdown.clone();
+            let interrupt_task = tokio::spawn(async move {
+                let _ = tokio::signal::ctrl_c().await;
+                let _ = interrupt.send(true);
+            });
+            let monitor_control = control.clone();
+            let mut monitor_report = report.clone();
+            let monitor = tokio::spawn(async move {
+                let mut poll = tokio::time::interval(std::time::Duration::from_millis(200));
+                let mut ticks = 0;
+                loop {
+                    tokio::select! {
+                        result = updates.changed() => {
+                            if result.is_err() { break; }
+                            let state = *updates.borrow_and_update();
+                            eprintln!("connector {}", serde_json::to_string(&state).unwrap_or_default());
+                            if let Err(error) = monitor_control.heartbeat(&mut monitor_report, state) {
+                                eprintln!("connector status unavailable: {error}");
+                                let _ = shutdown.send(true);
+                                break;
+                            }
+                        }
+                        _ = poll.tick() => {
+                            let stop = monitor_control.stopped(monitor_report.run_instance.as_deref().unwrap_or_default());
+                            if !matches!(stop, Ok(false)) { let _ = shutdown.send(true); break; }
+                            ticks += 1;
+                            if ticks % 10 == 0 && monitor_control.heartbeat(&mut monitor_report, *updates.borrow()).is_err() {
+                                let _ = shutdown.send(true); break;
+                            }
+                        }
+                    }
+                }
+            });
+            let result = connector.run(receiver, status).await;
+            monitor.abort();
+            interrupt_task.abort();
+            client.close().await?;
+            report.run_instance = None;
+            control.heartbeat(
+                &mut report,
+                if *final_status.borrow() == ConnectorStatus::Revoked {
+                    ConnectorStatus::Revoked
+                } else {
+                    ConnectorStatus::Disconnected
+                },
+            )?;
+            result?;
+        }
+        ConnectorCommand::Status(arguments) => {
+            let control = Control::new(&arguments.name)?;
+            if let Some(report) = control.report()? {
+                println!("{}", Control::output(&report));
+                return Ok(());
+            }
+            let saved = store(&arguments)?.load()?;
+            println!(
+                "{}",
+                Control::output(&Report::saved(saved.as_ref().map(|(config, _)| config)))
+            );
+        }
+        ConnectorCommand::Disconnect(arguments) => {
+            let control = Control::new(&arguments.name)?;
+            control.disconnect().await?;
+            if let Some(report) = control.report()? {
+                println!("{}", Control::output(&report));
+            } else {
+                println!("{}", serde_json::json!({"status":"disconnected"}));
+            }
+        }
+        ConnectorCommand::Revoke(arguments) => {
+            let control = Control::new(&arguments.name)?;
+            control.disconnect().await?;
+            let enrollment = store(&arguments)?;
+            enrollment.revoke().await?;
+            let saved = enrollment.load()?;
+            let report = Report::saved(saved.as_ref().map(|(config, _)| config));
+            control.save(&report)?;
+            println!("{}", Control::output(&report));
+        }
+        ConnectorCommand::Forget(arguments) => {
+            let control = Control::new(&arguments.name)?;
+            control.disconnect().await?;
+            store(&arguments)?.forget()?;
+            control.save(&Report::saved(None))?;
+            println!("{}", serde_json::json!({"enrolled":false}));
+        }
+    }
+    Ok(())
+}
diff --git a/crates/colossus-connector/src/cli_control.rs b/crates/colossus-connector/src/cli_control.rs
new file mode 100644
index 000000000..665a99192
--- /dev/null
+++ b/crates/colossus-connector/src/cli_control.rs
@@ -0,0 +1,239 @@
+//! Owner-private non-secret CLI lifecycle control; never authorizes cloud work.
+use crate::{ConnectionConfig, ConnectorStatus};
+use colossus_home::{ColossusHome, ConfinedRoot};
+use fs4::fs_std::FileExt;
+use serde::{Deserialize, Serialize, de::DeserializeOwned};
+use sha2::{Digest, Sha256};
+use std::{
+    io::{Read, Seek, Write},
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+type Error = Box<dyn std::error::Error>;
+#[derive(Clone)]
+pub(super) struct Control {
+    root: ConfinedRoot,
+    name: String,
+}
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Report {
+    pub enrolled: bool,
+    pub node_id: Option<String>,
+    pub project_id: Option<String>,
+    pub endpoint: Option<String>,
+    #[serde(default)]
+    pub host_id: Option<String>,
+    #[serde(default)]
+    pub workspace_id: Option<String>,
+    pub status: ConnectorStatus,
+    pub run_instance: Option<String>,
+    pub reported_at_ms: u64,
+}
+impl Report {
+    pub fn saved(config: Option<&ConnectionConfig>) -> Self {
+        Self {
+            enrolled: config.is_some(),
+            node_id: config.map(|config| config.node_id.clone()),
+            project_id: config.map(|config| config.project_id.clone()),
+            endpoint: config.map(|config| config.endpoint.clone()),
+            host_id: config
+                .and_then(|config| config.inventory.as_ref())
+                .map(|inventory| inventory.host_id.clone()),
+            workspace_id: config
+                .and_then(|config| config.inventory.as_ref())
+                .map(|inventory| inventory.workspace_id.clone()),
+            status: if config.is_some_and(|config| config.revoked) {
+                ConnectorStatus::Revoked
+            } else {
+                ConnectorStatus::Disconnected
+            },
+            run_instance: None,
+            reported_at_ms: now(),
+        }
+    }
+    fn live(&self) -> bool {
+        self.run_instance.is_some()
+            && now().saturating_sub(self.reported_at_ms) < 10_000
+            && matches!(
+                self.status,
+                ConnectorStatus::Connected
+                    | ConnectorStatus::Connecting
+                    | ConnectorStatus::Reconnecting
+            )
+    }
+}
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Stop {
+    run_instance: String,
+}
+fn now() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|duration| duration.as_millis().min(u64::MAX as u128) as u64)
+        .unwrap_or(0)
+}
+impl Control {
+    pub fn new(name: &str) -> Result<Self, Error> {
+        colossus_ports::CredentialKey::new("cloud-connector", name)?;
+        let home = ColossusHome::resolve_and_ensure()?;
+        let root = ConfinedRoot::bind(
+            home.confined_root()
+                .prepare_directory(Path::new("cloud-connector/cli-control"))?,
+        )?;
+        Ok(Self {
+            root,
+            name: hex::encode(Sha256::digest(name.as_bytes())),
+        })
+    }
+    fn path(&self, suffix: &str) -> PathBuf {
+        PathBuf::from(format!("{}-{suffix}.json", self.name))
+    }
+    fn read<T: DeserializeOwned>(&self, suffix: &str) -> Result<Option<T>, Error> {
+        let retained = match self.root.open_existing_file(&self.path(suffix)) {
+            Ok(file) => file,
+            Err(colossus_home::HomeError::Io { source, .. })
+                if source.kind() == std::io::ErrorKind::NotFound =>
+            {
+                return Ok(None);
+            }
+            Err(error) => return Err(error.into()),
+        };
+        let mut file = retained.file();
+        FileExt::lock_shared(file)?;
+        let result = (|| {
+            retained.revalidate(&self.root)?;
+            let mut bytes = Vec::new();
+            Read::by_ref(&mut file)
+                .take(16_385)
+                .read_to_end(&mut bytes)?;
+            if bytes.len() > 16_384 {
+                return Err("connector control record exceeds bound".into());
+            }
+            if bytes.is_empty() {
+                return Ok(None);
+            }
+            let value = serde_json::from_slice(&bytes)?;
+            retained.revalidate(&self.root)?;
+            Ok(Some(value))
+        })();
+        FileExt::unlock(file)?;
+        result
+    }
+    fn write<T: Serialize>(&self, suffix: &str, value: &T) -> Result<(), Error> {
+        let bytes = serde_json::to_vec(value)?;
+        if bytes.len() > 16_384 {
+            return Err("connector control record exceeds bound".into());
+        }
+        let retained = self.root.open_file(&self.path(suffix))?;
+        let mut file = retained.file();
+        FileExt::lock_exclusive(file)?;
+        let result = (|| {
+            retained.revalidate(&self.root)?;
+            file.rewind()?;
+            file.write_all(&bytes)?;
+            file.set_len(bytes.len() as u64)?;
+            file.sync_data()?;
+            retained.revalidate(&self.root)?;
+            Ok(())
+        })();
+        FileExt::unlock(file)?;
+        result
+    }
+    pub fn report(&self) -> Result<Option<Report>, Error> {
+        self.read("status")
+    }
+    pub fn save(&self, report: &Report) -> Result<(), Error> {
+        self.write("status", report)
+    }
+    pub fn stopped(&self, run: &str) -> Result<bool, Error> {
+        Ok(self
+            .read::<Stop>("stop")?
+            .is_some_and(|request| request.run_instance == run))
+    }
+    pub async fn disconnect(&self) -> Result<(), Error> {
+        let Some(report) = self.report()?.filter(Report::live) else {
+            return Ok(());
+        };
+        let run = report
+            .run_instance
+            .ok_or("connector run identity unavailable")?;
+        self.write(
+            "stop",
+            &Stop {
+                run_instance: run.clone(),
+            },
+        )?;
+        for _ in 0..50 {
+            tokio::time::sleep(Duration::from_millis(200)).await;
+            if self
+                .report()?
+                .is_none_or(|report| report.run_instance.as_deref() != Some(&run) || !report.live())
+            {
+                return Ok(());
+            }
+        }
+        Err("connector disconnect timed out; inspect its process before retrying".into())
+    }
+    pub fn output(report: &Report) -> serde_json::Value {
+        let mut value = serde_json::to_value(report).unwrap_or(serde_json::Value::Null);
+        if let Some(object) = value.as_object_mut() {
+            object.remove("run_instance");
+            object.insert(
+                "status_fresh".into(),
+                serde_json::Value::Bool(now().saturating_sub(report.reported_at_ms) < 10_000),
+            );
+            if report.run_instance.is_some()
+                && !report.live()
+                && !matches!(
+                    report.status,
+                    ConnectorStatus::Disconnected | ConnectorStatus::Revoked
+                )
+            {
+                object.insert("status".into(), serde_json::Value::String("unknown".into()));
+            }
+        }
+        value
+    }
+    pub fn heartbeat(&self, report: &mut Report, status: ConnectorStatus) -> Result<(), Error> {
+        report.status = status;
+        report.reported_at_ms = now();
+        self.save(report)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn restart_ignores_stale_stop_and_stale_status_is_unknown() {
+        let temporary = tempfile::tempdir().unwrap();
+        let control = Control {
+            root: ConfinedRoot::bind(temporary.path().canonicalize().unwrap().join("control"))
+                .unwrap(),
+            name: "fixture".into(),
+        };
+        control
+            .write(
+                "stop",
+                &Stop {
+                    run_instance: "previous-run".into(),
+                },
+            )
+            .unwrap();
+        assert!(control.stopped("previous-run").unwrap());
+        assert!(!control.stopped("new-run").unwrap());
+        let mut report = Report::saved(None);
+        report.run_instance = Some("new-run".into());
+        report.status = ConnectorStatus::Connected;
+        report.reported_at_ms = 0;
+        control.save(&report).unwrap();
+        let output = Control::output(&control.report().unwrap().unwrap());
+        assert_eq!(output["status"], "unknown");
+        assert_eq!(output["status_fresh"], false);
+        assert!(output.get("run_instance").is_none());
+    }
+}
diff --git a/crates/colossus-connector/src/connection.rs b/crates/colossus-connector/src/connection.rs
new file mode 100644
index 000000000..c05c039c5
--- /dev/null
+++ b/crates/colossus-connector/src/connection.rs
@@ -0,0 +1,602 @@
+use colossus_cloud_protocol::{
+    CloudReply, Command, MAX_ACTIVE_TASKS, MAX_PAYLOAD_BYTES, PROTOCOL_MAJOR, RuntimeInventory,
+    decode, encode,
+    v1alpha1::{
+        self as wire, control_frame, runtime_connection_client::RuntimeConnectionClient,
+        runtime_frame,
+    },
+};
+use colossus_sdk::{
+    AgentRunClient, ApiErrorCode, CancelRunRequest, GetRunRequest, ListRunsRequest, PageRequest,
+    WatchRunRequest,
+};
+use futures::StreamExt;
+use serde::{Deserialize, Serialize};
+use std::{collections::HashSet, sync::Arc, time::Duration};
+use tokio::{
+    sync::{Semaphore, watch},
+    task::JoinSet,
+};
+use tonic::{
+    Status,
+    transport::{Certificate, ClientTlsConfig, Endpoint, Identity},
+};
+use zeroize::Zeroizing;
+
+#[cfg(test)]
+mod readiness_tests;
+#[cfg(test)]
+mod watcher_tests;
+
+/// Non-secret persisted enrollment and local runtime identity binding.
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ConnectionConfig {
+    /// HTTPS cloud endpoint with independently enrolled CA trust.
+    pub endpoint: String,
+    /// Fixed project namespace.
+    pub project_id: String,
+    /// Stable cloud node identity.
+    pub node_id: String,
+    /// Independently verified local runtime instance.
+    pub instance_id: String,
+    /// PEM client leaf issued for this enrollment.
+    pub certificate_pem: String,
+    /// Independently obtained cloud TLS CA chain.
+    pub ca_pem: String,
+    /// Local runtime's authenticated optional capabilities.
+    pub capabilities: Vec<String>,
+    /// Native acknowledgement that this enrollment has been revoked.
+    #[serde(default)]
+    pub revoked: bool,
+    /// Opaque host and workspace grouping, independent from authorization.
+    #[serde(default)]
+    pub inventory: Option<RuntimeInventory>,
+    /// Local acknowledgement that explicitly shared sessions may be continued.
+    #[serde(default)]
+    pub shared_continuation: bool,
+}
+/// Sanitized lifecycle state, suitable for CLI and Desktop projection.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum ConnectorStatus {
+    /// Opening an outbound stream.
+    Connecting,
+    /// Authenticated cloud stream is live.
+    Connected,
+    /// Transport disappeared; fixed-node work continues locally.
+    Reconnecting,
+    /// Explicit disconnect completed without cancelling agent work.
+    Disconnected,
+    /// Cloud enrollment or client certificate was rejected; no retry occurs.
+    Revoked,
+}
+/// Outbound connector bound to an independently authorized local application.
+pub struct RuntimeConnector {
+    config: ConnectionConfig,
+    key: Zeroizing<String>,
+    runs: Arc<dyn AgentRunClient>,
+    enrollment: Option<crate::EnrollmentStore>,
+}
+impl RuntimeConnector {
+    /// Bind native-held credentials and an SDK client carrying a dedicated cloud grant.
+    /// No renderer credential or generic worker tunnel is accepted.
+    pub fn new(
+        config: ConnectionConfig,
+        key: Zeroizing<String>,
+        runs: Arc<dyn AgentRunClient>,
+    ) -> Result<Self, &'static str> {
+        if config.revoked {
+            return Err("cloud enrollment was revoked");
+        }
+        let url = url::Url::parse(&config.endpoint).map_err(|_| "invalid cloud endpoint")?;
+        if url.scheme() != "https"
+            || !url.username().is_empty()
+            || url.password().is_some()
+            || url.query().is_some()
+            || url.fragment().is_some()
+            || url.path() != "/"
+        {
+            return Err("cloud endpoint must be HTTPS");
+        }
+        if config.project_id.is_empty()
+            || config.node_id.is_empty()
+            || config.instance_id.is_empty()
+            || key.len() > 16384
+            || key.is_empty()
+        {
+            return Err("invalid connector enrollment");
+        }
+        if let Some(inventory) = &config.inventory {
+            inventory
+                .validate()
+                .map_err(|_| "invalid connector inventory")?;
+        }
+        Ok(Self {
+            config,
+            key,
+            runs,
+            enrollment: None,
+        })
+    }
+    /// Retain the native enrollment authority for automatic, durable certificate renewal.
+    pub fn with_enrollment_store(mut self, store: crate::EnrollmentStore) -> Self {
+        self.enrollment = Some(store);
+        self
+    }
+    /// Reconnect with bounded backoff until explicit shutdown or SDK lifetime closure. Dropping this future
+    /// cancels watches only; it never cancels accepted runtime tasks or closes a daemon.
+    pub async fn run(
+        mut self,
+        mut shutdown: watch::Receiver<bool>,
+        status: watch::Sender<ConnectorStatus>,
+    ) -> Result<(), &'static str> {
+        let mut delay = 1u64;
+        loop {
+            if self.runs.is_closed() {
+                status.send_replace(ConnectorStatus::Disconnected);
+                return Ok(());
+            }
+            if *shutdown.borrow() {
+                status.send_replace(ConnectorStatus::Disconnected);
+                return Ok(());
+            }
+            // Reconcile a persisted rotation even when the old certificate is
+            // still fresh: the host may have committed it before the ACK was lost.
+            if let Some(store) = &self.enrollment {
+                let renewed = tokio::select! {
+                    result = store.renew(false) => result,
+                    _ = shutdown.changed() => {
+                        status.send_replace(ConnectorStatus::Disconnected);
+                        return Ok(());
+                    }
+                };
+                if let Err(error) = renewed {
+                    if error == "cloud enrollment was revoked" {
+                        status.send_replace(ConnectorStatus::Revoked);
+                        return Err(error);
+                    }
+                    status.send_replace(ConnectorStatus::Reconnecting);
+                    tokio::select! {
+                        _ = tokio::time::sleep(Duration::from_secs(delay)) => {},
+                        _ = shutdown.changed() => {
+                            status.send_replace(ConnectorStatus::Disconnected);
+                            return Ok(());
+                        }
+                    }
+                    delay = (delay * 2).min(30);
+                    continue;
+                }
+                let store = store.clone();
+                let (config, key) = tokio::task::spawn_blocking(move || store.load())
+                    .await
+                    .map_err(|_| "enrollment vault unavailable")??
+                    .ok_or("enrollment unavailable")?;
+                self.config = config;
+                self.key = key;
+            }
+            status.send_replace(if delay == 1 {
+                ConnectorStatus::Connecting
+            } else {
+                ConnectorStatus::Reconnecting
+            });
+            // Keep child watches outside the cancellable connection future. A
+            // cooperative shutdown must join their cancellation, not merely drop
+            // a JoinSet whose child uploads may still be executing.
+            let mut watchers = JoinSet::new();
+            let result = tokio::select! {
+                result = self.connect_once(&status, &mut watchers) => Some(result),
+                _ = shutdown.changed() => None,
+            };
+            quiesce_watchers(&mut watchers).await;
+            let Some(result) = result else {
+                status.send_replace(ConnectorStatus::Disconnected);
+                return Ok(());
+            };
+            if let Err(error) = &result {
+                // Transport categories are diagnostic metadata. Never log server
+                // messages, provider bodies, identifiers, or credential material.
+                let reason = match error.message() {
+                    "local runtime unavailable"
+                    | "local runtime closed"
+                    | "local readiness timeout" => "local readiness",
+                    "local snapshot unavailable" => "local snapshot",
+                    "local watch unavailable" => "local watch admission",
+                    "local feed unavailable" => "local event feed",
+                    "local discovery unavailable" | "local discovery timeout" => "local discovery",
+                    "cloud storage unavailable" => "cloud storage",
+                    _ => "cloud transport",
+                };
+                eprintln!("connector transport {:?} ({reason})", error.code());
+            }
+            if self.runs.is_closed() {
+                status.send_replace(ConnectorStatus::Disconnected);
+                return Ok(());
+            }
+            if result.as_ref().err().is_some_and(|error| {
+                matches!(
+                    error.code(),
+                    tonic::Code::PermissionDenied | tonic::Code::Unauthenticated
+                )
+            }) {
+                status.send_replace(ConnectorStatus::Revoked);
+                return Err("cloud enrollment was rejected or revoked");
+            }
+            status.send_replace(ConnectorStatus::Reconnecting);
+            tokio::select! {_=tokio::time::sleep(Duration::from_secs(delay))=>{},_=shutdown.changed()=>{status.send_replace(ConnectorStatus::Disconnected);return Ok(());}}
+            delay = (delay * 2).min(30);
+        }
+    }
+    async fn connect_once(
+        &self,
+        status: &watch::Sender<ConnectorStatus>,
+        watchers: &mut JoinSet<Result<(), Status>>,
+    ) -> Result<(), Status> {
+        check_local_readiness(self.runs.as_ref()).await?;
+        let tls = ClientTlsConfig::new()
+            .ca_certificate(Certificate::from_pem(self.config.ca_pem.clone()))
+            .identity(Identity::from_pem(
+                self.config.certificate_pem.clone(),
+                self.key.as_bytes(),
+            ));
+        let endpoint = Endpoint::from_shared(self.config.endpoint.clone())
+            .map_err(|_| Status::invalid_argument("invalid endpoint"))?
+            .tls_config(tls)
+            .map_err(|_| Status::invalid_argument("invalid TLS identity"))?
+            .connect_timeout(Duration::from_secs(10));
+        // Endpoint's connect_timeout covers TCP. Bound TLS and HTTP/2 startup too.
+        let channel = tokio::time::timeout(Duration::from_secs(10), endpoint.connect())
+            .await
+            .map_err(|_| Status::deadline_exceeded("cloud channel startup timeout"))?
+            .map_err(|_| Status::unavailable("cloud transport unavailable"))?;
+        let mut client = RuntimeConnectionClient::new(channel)
+            .max_decoding_message_size(MAX_PAYLOAD_BYTES + 16384)
+            .max_encoding_message_size(MAX_PAYLOAD_BYTES + 16384);
+        let (sender, receiver) = crate::outbound::channel();
+        send(
+            &sender,
+            runtime_frame::Body::Hello(wire::RuntimeHello {
+                protocol_major: PROTOCOL_MAJOR,
+                node_id: self.config.node_id.clone(),
+                instance_id: self.config.instance_id.clone(),
+                capabilities: self.config.capabilities.clone(),
+                project_id: self.config.project_id.clone(),
+                inventory_json: self
+                    .config
+                    .inventory
+                    .as_ref()
+                    .map(|inventory| {
+                        let mut legacy = inventory.clone();
+                        legacy.policy = None;
+                        encode(&legacy)
+                    })
+                    .transpose()
+                    .map_err(|_| Status::invalid_argument("invalid native inventory"))?
+                    .unwrap_or_default(),
+            }),
+        )
+        .await?;
+        let mut stream = tokio::time::timeout(Duration::from_secs(10), client.connect(receiver))
+            .await
+            .map_err(|_| Status::deadline_exceeded("cloud response headers timeout"))??
+            .into_inner();
+        let welcome = tokio::time::timeout(Duration::from_secs(10), stream.message())
+            .await
+            .map_err(|_| Status::deadline_exceeded("cloud welcome timeout"))??
+            .ok_or_else(|| Status::unavailable("cloud closed"))?;
+        if !matches!(welcome.body,Some(control_frame::Body::Welcome(ref welcome)) if welcome.protocol_major==PROTOCOL_MAJOR)
+        {
+            return Err(Status::failed_precondition("cloud protocol mismatch"));
+        }
+        status.send_replace(ConnectorStatus::Connected);
+        let mut heartbeat = tokio::time::interval(Duration::from_secs(5));
+        heartbeat.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+        let permits = Arc::new(Semaphore::new(MAX_ACTIVE_TASKS));
+        let mut watched = HashSet::new();
+        let mut discovery: Option<wire::ReleasedDiscoveryPage> = None;
+        let mut acknowledged_discovery: Option<(String, String)> = None;
+        let mut policy_refresh = tokio::time::Instant::now() - Duration::from_secs(15);
+        loop {
+            tokio::select! {
+                _=heartbeat.tick()=>{
+                    check_local_readiness(self.runs.as_ref()).await?;
+                    if self.enrollment.is_some() && crate::enrollment::certificate_due(&self.config.certificate_pem).map_err(|_|Status::failed_precondition("invalid connector certificate"))? { return Ok(()); }
+                    let mut inventory_json = Vec::new();
+                    if policy_refresh.elapsed() >= Duration::from_secs(15) {
+                        policy_refresh = tokio::time::Instant::now();
+                        if let Some(mut inventory) = self.config.inventory.clone()
+                            && let Ok(Ok(policy)) = tokio::time::timeout(Duration::from_secs(2), self.runs.get_runtime_policy_posture()).await {
+                            inventory.policy = Some(policy);
+                            inventory_json = encode(&inventory).map_err(|_| Status::failed_precondition("invalid native inventory"))?;
+                        }
+                    }
+                    send(&sender,runtime_frame::Body::Heartbeat(wire::RuntimeHeartbeat{ready:true,inventory_json})).await?;
+                },
+                finished=watchers.join_next(),if !watchers.is_empty()=>{
+                    finished.ok_or_else(||Status::internal("watch lost"))?.map_err(|_|Status::internal("watch failed"))??;
+                }
+                frame=stream.message()=>{
+                    let Some(frame)=frame? else{return Ok(());};
+                    match frame.body {
+                        Some(control_frame::Body::Command(command))=>{
+                            let operation:Command=decode(&command.command_json).map_err(|_|Status::invalid_argument("invalid cloud command"))?;
+                            if let Command::Watch{run_id,snapshot_only}=operation {
+                                if watched.contains(&command.task_id){continue;}
+                                let permit=permits.clone().try_acquire_owned().map_err(|_|Status::resource_exhausted("local watch bound"))?;
+                                if watched.len()>=4096{return Err(Status::resource_exhausted("connection task bound"));}
+                                watched.insert(command.task_id.clone());
+                                let runs=self.runs.clone();let sender=sender.clone();
+                                watchers.spawn(async move{let _permit=permit;watch_task(runs,sender,command.task_id,run_id,command.after_sequence,snapshot_only).await});
+                            } else {
+                                let mut reply=execute(self.runs.as_ref(),operation).await;
+                                // An unavailable reply can follow an accepted mutation. Reconnect
+                                // with its stable runtime idempotency key to reconcile it.
+                                if matches!(&reply,CloudReply::Failed{error} if error.code==ApiErrorCode::Unavailable){return Err(Status::unavailable("local runtime unavailable"));}
+                                if let CloudReply::Cancelled { response } = &mut reply {
+                                    crate::released::compact_cancellation(response).map_err(Status::resource_exhausted)?;
+                                }
+                                let limited_run = if let CloudReply::Run {run} = &mut reply {
+                                    crate::released::compact_snapshot(run).map_err(Status::resource_exhausted)?.then(||run.run.run_id.clone())
+                                } else {None};
+                                send(&sender,runtime_frame::Body::Receipt(wire::CommandReceipt{command_id:command.command_id,task_id:command.task_id.clone(),reply_json:encode(&reply).map_err(|_|Status::resource_exhausted("receipt too large"))?})).await?;
+                                if let Some(run_id) = limited_run {
+                                    send(&sender,runtime_frame::Body::OutputLimit(wire::ReleasedOutputLimit{task_id:command.task_id, run_id, after_sequence:0})).await?;
+                                }
+                            }
+                        }
+                        Some(control_frame::Body::Acknowledgement(_))=>{},
+                        Some(control_frame::Body::Discover(request))=>{
+                            if let Some(page) = &discovery {
+                                if page.sync_id != request.sync_id || page.page_token != request.page_token {
+                                    return Err(Status::failed_precondition("discovery page not acknowledged"));
+                                }
+                                send(&sender, runtime_frame::Body::Discovery(page.clone())).await?;
+                            } else {
+                                let page = crate::discovery::discover(self.runs.as_ref(), request).await?;
+                                send(&sender, runtime_frame::Body::Discovery(page.clone())).await?;
+                                discovery = Some(page);
+                            }
+                        },
+                        Some(control_frame::Body::DiscoveryAcknowledgement(ack))=>{
+                            if discovery.as_ref().is_some_and(|page|page.sync_id == ack.sync_id && page.page_token == ack.page_token) {
+                                discovery = None;
+                                acknowledged_discovery = Some((ack.sync_id,ack.page_token));
+                            } else if !acknowledged_discovery.as_ref().is_some_and(|(sync_id,page_token)|sync_id == &ack.sync_id && page_token == &ack.page_token) {
+                                return Err(Status::invalid_argument("unexpected discovery acknowledgement"));
+                            }
+                        },
+                        _=>return Err(Status::invalid_argument("unexpected cloud frame")),
+                    }
+                }
+            }
+        }
+    }
+}
+
+// An external daemon's SDK client stays open across daemon outages. Probe its
+// authenticated, caller-scoped read API before advertising execution readiness.
+// The one-item page is discarded locally and never forwarded to the cloud.
+async fn check_local_readiness(runs: &dyn AgentRunClient) -> Result<(), Status> {
+    if runs.is_closed() {
+        return Err(Status::unavailable("local runtime closed"));
+    }
+    tokio::time::timeout(Duration::from_secs(3), async {
+        loop {
+            let result = runs
+                .list_runs(ListRunsRequest {
+                    session_id: None,
+                    statuses: Vec::new(),
+                    page: Some(PageRequest {
+                        page_size: 1,
+                        page_token: String::new(),
+                    }),
+                    include_archived: false,
+                })
+                .await;
+            match result {
+                Ok(_) => return Ok(()),
+                Err(error) if error.code == ApiErrorCode::ResourceExhausted => {
+                    tokio::time::sleep(Duration::from_millis(500)).await;
+                }
+                Err(error) => return Err(local_read_error(error, "local runtime unavailable")),
+            }
+        }
+    })
+    .await
+    .map_err(|_| Status::deadline_exceeded("local readiness timeout"))??;
+    if runs.is_closed() {
+        return Err(Status::unavailable("local runtime closed"));
+    }
+    Ok(())
+}
+fn local_read_error(error: colossus_sdk::ApiError, message: &'static str) -> Status {
+    match error.code {
+        ApiErrorCode::ResourceExhausted => Status::resource_exhausted(message),
+        ApiErrorCode::Unavailable => Status::unavailable(message),
+        ApiErrorCode::PermissionDenied | ApiErrorCode::Unauthenticated => {
+            Status::failed_precondition("local SDK grant rejected")
+        }
+        _ => Status::failed_precondition(message),
+    }
+}
+async fn execute(runs: &dyn AgentRunClient, command: Command) -> CloudReply {
+    let result = match command {
+        Command::History {
+            source_run_id,
+            page_token,
+            page_size,
+        } => crate::history::read(runs, source_run_id, page_token, page_size).await,
+        Command::Create { request } => match runs.create_run(*request).await {
+            Ok(created) => runs
+                .get_run(GetRunRequest {
+                    run_id: created.run.run_id,
+                })
+                .await
+                .map(|run| CloudReply::Run { run: Box::new(run) }),
+            Err(error) => Err(error),
+        },
+        Command::Cancel {
+            run_id,
+            idempotency_key,
+        } => runs
+            .cancel_run(CancelRunRequest {
+                run_id,
+                idempotency_key,
+            })
+            .await
+            .map(|response| CloudReply::Cancelled { response }),
+        Command::Respond { request } => runs
+            .respond_interaction(*request)
+            .await
+            .map(|response| CloudReply::Responded { response }),
+        Command::Watch { .. } => unreachable!("watch dispatch is handled separately"),
+    };
+    result.unwrap_or_else(|error| CloudReply::Failed { error })
+}
+async fn watch_task(
+    runs: Arc<dyn AgentRunClient>,
+    sender: crate::outbound::FrameSender,
+    task_id: String,
+    run_id: String,
+    after: u64,
+    snapshot_only: bool,
+) -> Result<(), Status> {
+    let mut snapshot = runs
+        .get_run(GetRunRequest {
+            run_id: run_id.clone(),
+        })
+        .await
+        .map_err(|error| local_read_error(error, "local snapshot unavailable"))?;
+    let limited =
+        crate::released::compact_snapshot(&mut snapshot).map_err(Status::resource_exhausted)?;
+    send(
+        &sender,
+        runtime_frame::Body::Snapshot(wire::RuntimeSnapshot {
+            task_id: task_id.clone(),
+            snapshot_json: encode(&snapshot)
+                .map_err(|_| Status::resource_exhausted("snapshot bound"))?,
+        }),
+    )
+    .await?;
+    if limited && !snapshot_only {
+        send(
+            &sender,
+            runtime_frame::Body::OutputLimit(wire::ReleasedOutputLimit {
+                task_id: task_id.clone(),
+                run_id: run_id.clone(),
+                after_sequence: after,
+            }),
+        )
+        .await?;
+        return Ok(());
+    }
+    if snapshot_only {
+        let mut snapshot = snapshot;
+        loop {
+            if snapshot.run.terminal.is_some() {
+                return Ok(());
+            }
+            tokio::time::sleep(Duration::from_secs(2)).await;
+            snapshot = runs
+                .get_run(GetRunRequest {
+                    run_id: run_id.clone(),
+                })
+                .await
+                .map_err(|error| local_read_error(error, "local snapshot unavailable"))?;
+            crate::released::compact_snapshot(&mut snapshot).map_err(Status::resource_exhausted)?;
+            send(
+                &sender,
+                runtime_frame::Body::Snapshot(wire::RuntimeSnapshot {
+                    task_id: task_id.clone(),
+                    snapshot_json: encode(&snapshot)
+                        .map_err(|_| Status::resource_exhausted("snapshot bound"))?,
+                }),
+            )
+            .await?;
+        }
+    }
+    let mut stream = runs
+        .watch_run(WatchRunRequest {
+            run_id: run_id.clone(),
+            after_sequence: after,
+        })
+        .await
+        .map_err(|error| local_read_error(error, "local watch unavailable"))?;
+    while let Some(update) = stream.next().await {
+        let update = update.map_err(|error| local_read_error(error, "local feed unavailable"))?;
+        let update_json = match encode(&update) {
+            Ok(bytes) => bytes,
+            Err(_) => {
+                send(
+                    &sender,
+                    runtime_frame::Body::OutputLimit(wire::ReleasedOutputLimit {
+                        task_id: task_id.clone(),
+                        run_id: run_id.clone(),
+                        after_sequence: update.sequence.saturating_sub(1),
+                    }),
+                )
+                .await?;
+                // Let the host durably record the limit and close this stream.
+                // Closing locally here could discard the queued limit frame.
+                return Ok(());
+            }
+        };
+        send(
+            &sender,
+            runtime_frame::Body::Event(wire::ReleasedRunEvent {
+                task_id: task_id.clone(),
+                run_id: run_id.clone(),
+                sequence: update.sequence,
+                update_json,
+            }),
+        )
+        .await?;
+        let mut snapshot = runs
+            .get_run(GetRunRequest {
+                run_id: run_id.clone(),
+            })
+            .await
+            .map_err(|error| local_read_error(error, "local snapshot unavailable"))?;
+        let limited =
+            crate::released::compact_snapshot(&mut snapshot).map_err(Status::resource_exhausted)?;
+        send(
+            &sender,
+            runtime_frame::Body::Snapshot(wire::RuntimeSnapshot {
+                task_id: task_id.clone(),
+                snapshot_json: encode(&snapshot)
+                    .map_err(|_| Status::resource_exhausted("snapshot bound"))?,
+            }),
+        )
+        .await?;
+        if limited {
+            send(
+                &sender,
+                runtime_frame::Body::OutputLimit(wire::ReleasedOutputLimit {
+                    task_id: task_id.clone(),
+                    run_id: run_id.clone(),
+                    after_sequence: update.sequence,
+                }),
+            )
+            .await?;
+            return Ok(());
+        }
+    }
+    Ok(())
+}
+async fn send(
+    sender: &crate::outbound::FrameSender,
+    body: runtime_frame::Body,
+) -> Result<(), Status> {
+    tokio::time::timeout(
+        Duration::from_secs(10),
+        sender.send(wire::RuntimeFrame { body: Some(body) }),
+    )
+    .await
+    .map_err(|_| Status::resource_exhausted("outbound backpressure deadline"))?
+    .map_err(|_| Status::cancelled("cloud stream closed"))
+}
+
+async fn quiesce_watchers(watchers: &mut JoinSet<Result<(), Status>>) {
+    // These tasks own released-output watches, never the accepted local run.
+    watchers.shutdown().await;
+}
diff --git a/crates/colossus-connector/src/connection/readiness_tests.rs b/crates/colossus-connector/src/connection/readiness_tests.rs
new file mode 100644
index 000000000..c2ba69d64
--- /dev/null
+++ b/crates/colossus-connector/src/connection/readiness_tests.rs
@@ -0,0 +1,135 @@
+use super::*;
+use async_trait::async_trait;
+use colossus_sdk::{
+    ApiError, ApiErrorReason, ApiResult, CancelRunResponse, CreateRunRequest, CreateRunResponse,
+    GetRunResponse, ListRunsResponse, RespondInteractionRequest, RespondInteractionResponse,
+    RunUpdateStream,
+};
+use std::sync::atomic::{AtomicU8, AtomicUsize, Ordering};
+
+const HEALTHY: u8 = 0;
+const UNAVAILABLE: u8 = 1;
+const STALLED: u8 = 2;
+const CLOSE_DURING_READ: u8 = 3;
+const CLOSED: u8 = 4;
+const REJECTED_GRANT: u8 = 5;
+
+struct LocalClient {
+    state: AtomicU8,
+    reads: AtomicUsize,
+}
+
+impl LocalClient {
+    fn new(state: u8) -> Self {
+        Self {
+            state: AtomicU8::new(state),
+            reads: AtomicUsize::new(0),
+        }
+    }
+}
+
+#[async_trait]
+impl AgentRunClient for LocalClient {
+    async fn create_run(&self, _: CreateRunRequest) -> ApiResult<CreateRunResponse> {
+        unreachable!("readiness must never execute work")
+    }
+    async fn get_run(&self, _: GetRunRequest) -> ApiResult<GetRunResponse> {
+        unreachable!("readiness must not require an existing run")
+    }
+    async fn list_runs(&self, request: ListRunsRequest) -> ApiResult<ListRunsResponse> {
+        assert_eq!(
+            request.page.expect("bounded readiness page").page_size,
+            1,
+            "readiness must bound its local read"
+        );
+        self.reads.fetch_add(1, Ordering::AcqRel);
+        match self.state.load(Ordering::Acquire) {
+            UNAVAILABLE => {
+                return Err(ApiError {
+                    code: ApiErrorCode::Unavailable,
+                    retryable: true,
+                    ..ApiError::failed_precondition(
+                        ApiErrorReason::InternalInvariant,
+                        "private adapter detail must not reach cloud status",
+                    )
+                });
+            }
+            REJECTED_GRANT => {
+                return Err(ApiError::permission_denied(
+                    ApiErrorReason::ScopeDenied,
+                    "private adapter detail must not reach cloud status",
+                ));
+            }
+            STALLED => return std::future::pending().await,
+            CLOSE_DURING_READ => self.state.store(CLOSED, Ordering::Release),
+            CLOSED => unreachable!("closed clients must not be probed"),
+            _ => {}
+        }
+        Ok(ListRunsResponse {
+            runs: Vec::new(),
+            page: None,
+        })
+    }
+    async fn watch_run(&self, _: WatchRunRequest) -> ApiResult<RunUpdateStream> {
+        unreachable!("readiness must not open an event feed")
+    }
+    async fn cancel_run(&self, _: CancelRunRequest) -> ApiResult<CancelRunResponse> {
+        unreachable!("readiness must never cancel work")
+    }
+    async fn respond_interaction(
+        &self,
+        _: RespondInteractionRequest,
+    ) -> ApiResult<RespondInteractionResponse> {
+        unreachable!("readiness must never answer an interaction")
+    }
+    fn is_closed(&self) -> bool {
+        self.state.load(Ordering::Acquire) == CLOSED
+    }
+}
+
+#[tokio::test]
+async fn daemon_readiness_detects_outage_and_recovery_without_client_closure() {
+    let client = LocalClient::new(HEALTHY);
+    check_local_readiness(&client).await.unwrap();
+    client.state.store(UNAVAILABLE, Ordering::Release);
+    assert!(!client.is_closed());
+    let error = check_local_readiness(&client).await.unwrap_err();
+    assert_eq!(error.code(), tonic::Code::Unavailable);
+    assert_eq!(error.message(), "local runtime unavailable");
+    client.state.store(HEALTHY, Ordering::Release);
+    check_local_readiness(&client).await.unwrap();
+    assert_eq!(client.reads.load(Ordering::Acquire), 3);
+}
+
+#[tokio::test]
+async fn daemon_readiness_distinguishes_rejected_local_grant_from_transport_outage() {
+    let client = LocalClient::new(REJECTED_GRANT);
+    let error = check_local_readiness(&client).await.unwrap_err();
+    assert_eq!(error.code(), tonic::Code::FailedPrecondition);
+    assert_eq!(error.message(), "local SDK grant rejected");
+    assert!(!client.is_closed());
+    client.state.store(HEALTHY, Ordering::Release);
+    check_local_readiness(&client).await.unwrap();
+    assert_eq!(client.reads.load(Ordering::Acquire), 2);
+}
+
+#[tokio::test]
+async fn daemon_readiness_bounds_a_stalled_local_transport() {
+    let client = LocalClient::new(STALLED);
+    let error = tokio::time::timeout(Duration::from_secs(4), check_local_readiness(&client))
+        .await
+        .expect("stalled local transport must return to bounded reconnect")
+        .unwrap_err();
+    assert_eq!(error.code(), tonic::Code::DeadlineExceeded);
+    assert_eq!(error.message(), "local readiness timeout");
+}
+
+#[tokio::test]
+async fn daemon_readiness_rejects_shutdown_before_and_during_a_probe() {
+    let closed = LocalClient::new(CLOSED);
+    assert!(check_local_readiness(&closed).await.is_err());
+    assert_eq!(closed.reads.load(Ordering::Acquire), 0);
+    let closing = LocalClient::new(CLOSE_DURING_READ);
+    assert!(check_local_readiness(&closing).await.is_err());
+    assert!(closing.is_closed());
+}
diff --git a/crates/colossus-connector/src/connection/watcher_tests.rs b/crates/colossus-connector/src/connection/watcher_tests.rs
new file mode 100644
index 000000000..79ffdc40f
--- /dev/null
+++ b/crates/colossus-connector/src/connection/watcher_tests.rs
@@ -0,0 +1,61 @@
+use super::*;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+struct WatchLifetime(Arc<AtomicUsize>);
+impl Drop for WatchLifetime {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, Ordering::SeqCst);
+    }
+}
+
+#[tokio::test]
+async fn quiescence_joins_every_watch_and_releases_its_outbound_sender() {
+    let (sender, mut stream) = crate::outbound::channel();
+    let alive = Arc::new(AtomicUsize::new(3));
+    let mut watchers = JoinSet::new();
+    for _ in 0..3 {
+        let sender = sender.clone();
+        let lifetime = WatchLifetime(Arc::clone(&alive));
+        let (started, ready) = tokio::sync::oneshot::channel();
+        watchers.spawn(async move {
+            let _lifetime = lifetime;
+            let _sender = sender;
+            started.send(()).unwrap();
+            std::future::pending::<Result<(), Status>>().await
+        });
+        ready.await.unwrap();
+    }
+    drop(sender);
+    quiesce_watchers(&mut watchers).await;
+    assert_eq!(
+        alive.load(Ordering::SeqCst),
+        0,
+        "all upload futures dropped before granting new sharing"
+    );
+    assert!(watchers.is_empty());
+    assert!(
+        tokio::time::timeout(Duration::from_secs(1), stream.next())
+            .await
+            .unwrap()
+            .is_none(),
+        "no cancelled watch retains an outbound stream sender"
+    );
+}
+
+#[tokio::test]
+async fn transport_error_cleanup_preserves_accepted_runtime_work() {
+    let (release, accepted_work) = tokio::sync::oneshot::channel();
+    let accepted = tokio::spawn(async move { accepted_work.await.unwrap() });
+    let mut watchers = JoinSet::new();
+    watchers.spawn(async { Err(Status::unavailable("synthetic transport failure")) });
+    watchers.spawn(std::future::pending::<Result<(), Status>>());
+    let failure = watchers.join_next().await.unwrap().unwrap().unwrap_err();
+    assert_eq!(failure.code(), tonic::Code::Unavailable);
+    quiesce_watchers(&mut watchers).await;
+    assert!(
+        !accepted.is_finished(),
+        "watch cleanup cannot cancel independently accepted local work"
+    );
+    release.send("retained result").unwrap();
+    assert_eq!(accepted.await.unwrap(), "retained result");
+}
diff --git a/crates/colossus-connector/src/discovery.rs b/crates/colossus-connector/src/discovery.rs
new file mode 100644
index 000000000..f9bb3f827
--- /dev/null
+++ b/crates/colossus-connector/src/discovery.rs
@@ -0,0 +1,66 @@
+//! Bounded caller-visible discovery; no worker filesystem or primary credential access.
+use colossus_cloud_protocol::{MAX_DISCOVERY_PAGE_SIZE, encode, v1alpha1 as wire};
+use colossus_sdk::{AgentRunClient, ListRunsRequest, PageRequest};
+use std::time::Duration;
+use tonic::Status;
+
+pub(crate) async fn discover(
+    runs: &dyn AgentRunClient,
+    request: wire::DiscoverRuns,
+) -> Result<wire::ReleasedDiscoveryPage, Status> {
+    if request.sync_id.is_empty()
+        || request.sync_id.len() > 128
+        || !request
+            .sync_id
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b':' | b'.'))
+        || request.page_token.len() > 512
+        || request.page_size == 0
+        || request.page_size > MAX_DISCOVERY_PAGE_SIZE
+    {
+        return Err(Status::invalid_argument("invalid discovery request"));
+    }
+    let query = ListRunsRequest {
+        session_id: None,
+        statuses: Vec::new(),
+        page: Some(PageRequest {
+            page_size: request.page_size,
+            page_token: request.page_token.clone(),
+        }),
+        include_archived: request.include_archived,
+    };
+    // Discovery shares the public listing admission pool with readiness and local
+    // callers. Respect its small token bucket instead of dropping the connection
+    // while paginating historical sessions.
+    let page = tokio::time::timeout(Duration::from_secs(10), async {
+        loop {
+            match runs.list_visible_runs(query.clone()).await {
+                Ok(page) => return Ok(page),
+                Err(error) if error.code == colossus_sdk::ApiErrorCode::ResourceExhausted => {
+                    tokio::time::sleep(Duration::from_millis(500)).await;
+                }
+                Err(_) => return Err(Status::unavailable("local discovery unavailable")),
+            }
+        }
+    })
+    .await
+    .map_err(|_| Status::deadline_exceeded("local discovery timeout"))??;
+    // Discovery carries identities and lifecycle. Durable Watch owns released text,
+    // so terminal output cannot multiply the inventory page's memory budget.
+    let mut released = page.runs;
+    for value in &mut released {
+        if let Some(colossus_sdk::RunTerminal::Result(result)) = &mut value.run.terminal {
+            result.output.clear();
+        }
+    }
+    Ok(wire::ReleasedDiscoveryPage {
+        sync_id: request.sync_id,
+        page_token: request.page_token,
+        runs_json: encode(&released)
+            .map_err(|_| Status::resource_exhausted("discovery page too large"))?,
+        next_page_token: page
+            .page
+            .map(|page| page.next_page_token)
+            .unwrap_or_default(),
+    })
+}
diff --git a/crates/colossus-connector/src/enrollment.rs b/crates/colossus-connector/src/enrollment.rs
new file mode 100644
index 000000000..094b1ae45
--- /dev/null
+++ b/crates/colossus-connector/src/enrollment.rs
@@ -0,0 +1,258 @@
+use crate::ConnectionConfig;
+use colossus_contracts::VaultRecord;
+use colossus_ports::{CredentialKey, CredentialVault};
+use rcgen::{CertificateParams, KeyPair};
+use serde::{Deserialize, Serialize};
+use std::{sync::Arc, time::Duration};
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
+mod renewal;
+mod revocation;
+pub(crate) use renewal::certificate_due;
+
+/// Native enrollment store, shared by CLI and Desktop; secrets stay in the encrypted vault.
+#[derive(Clone)]
+pub struct EnrollmentStore {
+    vault: Arc<dyn CredentialVault>,
+    key: CredentialKey,
+}
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Record {
+    config: Option<ConnectionConfig>,
+    pending: Pending,
+    #[serde(default)]
+    rotation: Option<renewal::Rotation>,
+}
+#[derive(Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
+#[serde(deny_unknown_fields)]
+struct Pending {
+    client_key_pem: String,
+    csr_pem: String,
+    token: String,
+    enrollment_url: String,
+    instance_id: String,
+}
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Enrolled {
+    node: EnrolledNode,
+    certificate_pem: String,
+    ca_pem: String,
+    grpc_endpoint: String,
+}
+// Only the enrollment binding crosses this native boundary. The cloud's
+// relational repository and fleet presentation types are not runtime dependencies.
+#[derive(Deserialize)]
+struct EnrolledNode {
+    project_id: String,
+    node_id: String,
+    instance_id: String,
+}
+impl EnrollmentStore {
+    /// Exact native encrypted record selector for an explicitly reviewed named
+    /// enrollment copy. This does not load a vault or create/rotate any grant.
+    pub fn credential_key(id: &str) -> Result<CredentialKey, &'static str> {
+        CredentialKey::new("cloud-connector", id).map_err(|_| "invalid enrollment identity")
+    }
+    /// Bind an opaque enrollment record under the caller's protected native vault.
+    pub fn new(vault: Arc<dyn CredentialVault>, id: &str) -> Result<Self, &'static str> {
+        Ok(Self {
+            vault,
+            key: Self::credential_key(id)?,
+        })
+    }
+    /// Generate the key locally and persist the pending exchange before contacting
+    /// the host. Retrying uses the same CSR and invitation after a lost response.
+    pub async fn enroll(
+        &self,
+        url: String,
+        token: Zeroizing<String>,
+        instance_id: String,
+        capabilities: Vec<String>,
+        allow_loopback_http: bool,
+    ) -> Result<ConnectionConfig, &'static str> {
+        let endpoint = url::Url::parse(&url).map_err(|_| "invalid enrollment URL")?;
+        let local = matches!(
+            endpoint.host_str(),
+            Some("localhost" | "127.0.0.1" | "[::1]")
+        );
+        if !endpoint.username().is_empty()
+            || endpoint.password().is_some()
+            || endpoint.query().is_some()
+            || endpoint.fragment().is_some()
+            || !(endpoint.scheme() == "https"
+                || (allow_loopback_http && local && endpoint.scheme() == "http"))
+        {
+            return Err("enrollment requires HTTPS");
+        }
+        let store = self.clone();
+        let existing = tokio::task::spawn_blocking(move || store.vault.read(&store.key))
+            .await
+            .map_err(|_| "enrollment vault unavailable")?
+            .map_err(|_| "enrollment vault unavailable")?;
+        let mut record: Record = if let Some(existing) = existing {
+            serde_json::from_slice(existing.expose()).map_err(|_| "enrollment record invalid")?
+        } else {
+            if token.len() != 64 || !token.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+                return Err("invalid enrollment invitation");
+            }
+            let key = KeyPair::generate().map_err(|_| "connector key generation failed")?;
+            let csr = CertificateParams::default()
+                .serialize_request(&key)
+                .map_err(|_| "connector certificate request failed")?
+                .pem()
+                .map_err(|_| "connector certificate encoding failed")?;
+            Record {
+                config: None,
+                rotation: None,
+                pending: Pending {
+                    client_key_pem: key.serialize_pem(),
+                    csr_pem: csr,
+                    token: token.to_string(),
+                    enrollment_url: url.clone(),
+                    instance_id: instance_id.clone(),
+                },
+            }
+        };
+        if record.pending.enrollment_url != url || record.pending.instance_id != instance_id {
+            return Err("pending enrollment belongs to another runtime or cloud");
+        }
+        if let Some(config) = &record.config {
+            return Ok(config.clone());
+        }
+        self.save_async(&record).await?;
+        let client = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .timeout(Duration::from_secs(15))
+            .build()
+            .map_err(|_| "enrollment HTTP unavailable")?;
+        let response=client.post(&url).json(&serde_json::json!({"token":record.pending.token,"instance_id":record.pending.instance_id,"csr_pem":record.pending.csr_pem})).send().await.map_err(|_|"enrollment transport unavailable; retry the same exchange")?;
+        if !response.status().is_success() {
+            return Err("cloud enrollment rejected");
+        }
+        if response.content_length().is_some_and(|bytes| bytes > 65536) {
+            return Err("enrollment response too large");
+        }
+        use futures::StreamExt as _;
+        let mut body = response.bytes_stream();
+        let mut bytes = Vec::new();
+        while let Some(chunk) = body.next().await {
+            let chunk = chunk.map_err(|_| "enrollment response unavailable")?;
+            if bytes.len().saturating_add(chunk.len()) > 65536 {
+                return Err("enrollment response too large");
+            }
+            bytes.extend_from_slice(&chunk);
+        }
+        let enrolled: Enrolled =
+            serde_json::from_slice(&bytes).map_err(|_| "invalid enrollment response")?;
+        if enrolled.node.instance_id != instance_id {
+            return Err("enrolled runtime identity mismatch");
+        }
+        let config = ConnectionConfig {
+            endpoint: enrolled.grpc_endpoint,
+            project_id: enrolled.node.project_id,
+            node_id: enrolled.node.node_id,
+            instance_id: instance_id.clone(),
+            certificate_pem: enrolled.certificate_pem,
+            ca_pem: enrolled.ca_pem,
+            capabilities,
+            revoked: false,
+            inventory: Some(crate::native_inventory(
+                format!("workspace:{instance_id}"),
+                "CLI workspace".into(),
+                colossus_cloud_protocol::DeploymentKind::Cli,
+            )?),
+            shared_continuation: false,
+        };
+        record.config = Some(config.clone());
+        record.pending.token.zeroize();
+        self.save_async(&record).await?;
+        Ok(config)
+    }
+    /// Load native enrollment and private TLS key without serializing secrets to UI.
+    pub fn load(&self) -> Result<Option<(ConnectionConfig, Zeroizing<String>)>, &'static str> {
+        let Some(record) = self
+            .vault
+            .read(&self.key)
+            .map_err(|_| "enrollment vault unavailable")?
+        else {
+            return Ok(None);
+        };
+        let record: Record =
+            serde_json::from_slice(record.expose()).map_err(|_| "enrollment record invalid")?;
+        Ok(record.config.map(|config| {
+            (
+                config,
+                Zeroizing::new(record.pending.client_key_pem.clone()),
+            )
+        }))
+    }
+    /// Remove the local enrollment after disconnect. This does not revoke the remote node.
+    pub fn forget(&self) -> Result<(), &'static str> {
+        self.vault
+            .delete(&self.key)
+            .map_err(|_| "enrollment cleanup failed")
+    }
+    /// Persist native-sourced presentation and sharing posture, without replacing authority.
+    pub async fn set_inventory(
+        &self,
+        inventory: colossus_cloud_protocol::RuntimeInventory,
+    ) -> Result<ConnectionConfig, &'static str> {
+        inventory
+            .validate()
+            .map_err(|_| "invalid connector inventory")?;
+        let store = self.clone();
+        let record = tokio::task::spawn_blocking(move || store.vault.read(&store.key))
+            .await
+            .map_err(|_| "enrollment vault unavailable")?
+            .map_err(|_| "enrollment vault unavailable")?
+            .ok_or("enrollment unavailable")?;
+        let mut record: Record =
+            serde_json::from_slice(record.expose()).map_err(|_| "enrollment record invalid")?;
+        let config = record.config.as_mut().ok_or("enrollment unavailable")?;
+        config.inventory = Some(inventory);
+        let config = config.clone();
+        self.save_async(&record).await?;
+        Ok(config)
+    }
+    /// Persist the confirmed native sharing posture after runtime authorization commits.
+    pub async fn set_sharing(
+        &self,
+        enabled: bool,
+        allow_continuation: bool,
+    ) -> Result<ConnectionConfig, &'static str> {
+        let store = self.clone();
+        let record = tokio::task::spawn_blocking(move || store.vault.read(&store.key))
+            .await
+            .map_err(|_| "enrollment vault unavailable")?
+            .map_err(|_| "enrollment vault unavailable")?
+            .ok_or("enrollment unavailable")?;
+        let mut record: Record =
+            serde_json::from_slice(record.expose()).map_err(|_| "enrollment record invalid")?;
+        let config = record.config.as_mut().ok_or("enrollment unavailable")?;
+        let inventory = config
+            .inventory
+            .as_mut()
+            .ok_or("native inventory unavailable")?;
+        inventory.sharing = if enabled {
+            crate::WorkspaceSharing::SharedVisibleSessions
+        } else {
+            crate::WorkspaceSharing::CloudOwned
+        };
+        config.shared_continuation = enabled && allow_continuation;
+        let config = config.clone();
+        self.save_async(&record).await?;
+        Ok(config)
+    }
+    async fn save_async(&self, record: &Record) -> Result<(), &'static str> {
+        let encoded =
+            Zeroizing::new(serde_json::to_vec(record).map_err(|_| "enrollment encoding failed")?);
+        let record =
+            VaultRecord::new(encoded.to_vec()).map_err(|_| "enrollment record exceeds bound")?;
+        let store = self.clone();
+        tokio::task::spawn_blocking(move || store.vault.write(&store.key, &record))
+            .await
+            .map_err(|_| "enrollment persistence failed")?
+            .map_err(|_| "enrollment persistence failed")
+    }
+}
diff --git a/crates/colossus-connector/src/enrollment/renewal.rs b/crates/colossus-connector/src/enrollment/renewal.rs
new file mode 100644
index 000000000..75521b698
--- /dev/null
+++ b/crates/colossus-connector/src/enrollment/renewal.rs
@@ -0,0 +1,122 @@
+use super::*;
+use colossus_cloud_protocol::v1alpha1::{
+    CertificateRenewal, runtime_connection_client::RuntimeConnectionClient,
+};
+use tonic::transport::{Certificate, ClientTlsConfig, Endpoint, Identity};
+
+#[derive(Serialize, Deserialize, Zeroize, ZeroizeOnDrop)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Rotation {
+    client_key_pem: String,
+    csr_pem: String,
+    renewal_id: String,
+}
+pub(crate) fn certificate_due(pem: &str) -> Result<bool, &'static str> {
+    let (_, pem) = x509_parser::pem::parse_x509_pem(pem.as_bytes())
+        .map_err(|_| "invalid connector certificate")?;
+    let certificate = pem
+        .parse_x509()
+        .map_err(|_| "invalid connector certificate")?;
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_err(|_| "invalid system clock")?
+        .as_secs();
+    Ok(certificate.validity().not_after.timestamp() <= now as i64 + 7 * 24 * 60 * 60)
+}
+impl EnrollmentStore {
+    /// Renew at seven days remaining, or explicitly rotate before expiry. Persisting
+    /// the next key/CSR before RPC makes a lost response recoverable with the old leaf.
+    pub async fn renew(&self, force: bool) -> Result<(), &'static str> {
+        let store = self.clone();
+        let stored = tokio::task::spawn_blocking(move || store.vault.read(&store.key))
+            .await
+            .map_err(|_| "enrollment vault unavailable")?
+            .map_err(|_| "enrollment vault unavailable")?
+            .ok_or("connector is not enrolled")?;
+        let mut record: Record =
+            serde_json::from_slice(stored.expose()).map_err(|_| "invalid enrollment record")?;
+        let config = record
+            .config
+            .as_ref()
+            .ok_or("connector is not enrolled")?
+            .clone();
+        if config.revoked {
+            return Err("cloud enrollment was revoked");
+        }
+        if record.rotation.is_none() && !force && !certificate_due(&config.certificate_pem)? {
+            return Ok(());
+        }
+        if record.rotation.is_none() {
+            let key = KeyPair::generate().map_err(|_| "connector key generation failed")?;
+            let csr = CertificateParams::default()
+                .serialize_request(&key)
+                .map_err(|_| "certificate request failed")?
+                .pem()
+                .map_err(|_| "certificate request failed")?;
+            record.rotation = Some(Rotation {
+                client_key_pem: key.serialize_pem(),
+                csr_pem: csr,
+                renewal_id: uuid::Uuid::now_v7().simple().to_string(),
+            });
+            self.save_async(&record).await?;
+        }
+        let rotation = record
+            .rotation
+            .as_ref()
+            .ok_or("renewal state unavailable")?;
+        let tls = ClientTlsConfig::new()
+            .ca_certificate(Certificate::from_pem(config.ca_pem))
+            .identity(Identity::from_pem(
+                config.certificate_pem,
+                record.pending.client_key_pem.as_bytes(),
+            ));
+        let endpoint = Endpoint::from_shared(config.endpoint)
+            .map_err(|_| "invalid cloud endpoint")?
+            .tls_config(tls)
+            .map_err(|_| "invalid connector identity")?
+            .connect_timeout(Duration::from_secs(10))
+            .timeout(Duration::from_secs(15));
+        let channel = tokio::time::timeout(Duration::from_secs(10), endpoint.connect())
+            .await
+            .map_err(|_| "certificate renewal channel startup timeout")?
+            .map_err(|_| "certificate renewal transport unavailable")?;
+        let certificate = RuntimeConnectionClient::new(channel)
+            .max_decoding_message_size(65536)
+            .max_encoding_message_size(65536)
+            .renew_certificate(CertificateRenewal {
+                project_id: config.project_id,
+                node_id: config.node_id,
+                instance_id: config.instance_id,
+                renewal_id: rotation.renewal_id.clone(),
+                csr_pem: rotation.csr_pem.clone(),
+            })
+            .await
+            .map_err(|error| match error.code() {
+                tonic::Code::PermissionDenied | tonic::Code::Unauthenticated => {
+                    "cloud enrollment was revoked"
+                }
+                _ => "certificate renewal rejected; retry the same exchange",
+            })?
+            .into_inner()
+            .certificate_pem;
+        if certificate_due(&certificate)? {
+            return Err("renewed certificate lifetime invalid");
+        }
+        let (_, pem) = x509_parser::pem::parse_x509_pem(certificate.as_bytes())
+            .map_err(|_| "invalid renewed certificate")?;
+        let leaf = pem
+            .parse_x509()
+            .map_err(|_| "invalid renewed certificate")?;
+        let key = KeyPair::from_pem(&rotation.client_key_pem).map_err(|_| "invalid renewal key")?;
+        if leaf.public_key().subject_public_key.data.as_ref() != key.public_key_raw() {
+            return Err("renewed certificate does not bind the requested key");
+        }
+        if let Some(config) = &mut record.config {
+            config.certificate_pem = certificate;
+        }
+        record.pending.client_key_pem.zeroize();
+        record.pending.client_key_pem = rotation.client_key_pem.clone();
+        record.rotation = None;
+        self.save_async(&record).await
+    }
+}
diff --git a/crates/colossus-connector/src/enrollment/revocation.rs b/crates/colossus-connector/src/enrollment/revocation.rs
new file mode 100644
index 000000000..69feb39cc
--- /dev/null
+++ b/crates/colossus-connector/src/enrollment/revocation.rs
@@ -0,0 +1,63 @@
+use super::*;
+use colossus_cloud_protocol::v1alpha1::{
+    EnrollmentIdentity, runtime_connection_client::RuntimeConnectionClient,
+};
+use tonic::transport::{Certificate, ClientTlsConfig, Endpoint, Identity};
+
+impl EnrollmentStore {
+    /// Revoke this exact native enrollment using its own client certificate.
+    /// Persist the acknowledgement locally; a lost acknowledgement can be retried.
+    pub async fn revoke(&self) -> Result<(), &'static str> {
+        let mut record = self.read_record().await?;
+        if record.rotation.is_some() {
+            self.renew(false).await?;
+            record = self.read_record().await?;
+        }
+        let config = record.config.as_ref().ok_or("connector is not enrolled")?;
+        if config.revoked {
+            return Ok(());
+        }
+        let tls = ClientTlsConfig::new()
+            .ca_certificate(Certificate::from_pem(&config.ca_pem))
+            .identity(Identity::from_pem(
+                &config.certificate_pem,
+                record.pending.client_key_pem.as_bytes(),
+            ));
+        let endpoint = Endpoint::from_shared(config.endpoint.clone())
+            .map_err(|_| "invalid cloud endpoint")?
+            .tls_config(tls)
+            .map_err(|_| "invalid connector identity")?
+            .connect_timeout(Duration::from_secs(10))
+            .timeout(Duration::from_secs(15));
+        let channel = tokio::time::timeout(Duration::from_secs(10), endpoint.connect())
+            .await
+            .map_err(|_| "revocation channel startup timeout; retry the same enrollment")?
+            .map_err(|_| "revocation transport unavailable; retry the same enrollment")?;
+        RuntimeConnectionClient::new(channel)
+            .max_decoding_message_size(65536)
+            .max_encoding_message_size(65536)
+            .revoke_enrollment(EnrollmentIdentity {
+                project_id: config.project_id.clone(),
+                node_id: config.node_id.clone(),
+                instance_id: config.instance_id.clone(),
+            })
+            .await
+            .map_err(|_| "cloud revocation rejected; retry or revoke in the web fleet")?;
+        record
+            .config
+            .as_mut()
+            .ok_or("connector is not enrolled")?
+            .revoked = true;
+        self.save_async(&record).await
+    }
+
+    async fn read_record(&self) -> Result<Record, &'static str> {
+        let store = self.clone();
+        let stored = tokio::task::spawn_blocking(move || store.vault.read(&store.key))
+            .await
+            .map_err(|_| "enrollment vault unavailable")?
+            .map_err(|_| "enrollment vault unavailable")?
+            .ok_or("connector is not enrolled")?;
+        serde_json::from_slice(stored.expose()).map_err(|_| "invalid enrollment record")
+    }
+}
diff --git a/crates/colossus-connector/src/headless.rs b/crates/colossus-connector/src/headless.rs
new file mode 100644
index 000000000..37ed0cc84
--- /dev/null
+++ b/crates/colossus-connector/src/headless.rs
@@ -0,0 +1,72 @@
+use colossus_credentials::{EnvironmentKeyStore, PlatformKeyStore};
+use colossus_home::ConfinedRoot;
+use colossus_sdk::{CredentialProvider, SdkError, SdkResult, Secret};
+use std::sync::Arc;
+
+/// Domain-separated native secret reference shared with offline CLI administration.
+/// This names encrypted material; it never contains the application bearer.
+pub fn headless_credential_account(service: &str, account: &str) -> String {
+    colossus_credentials::headless_credential_account(service, account)
+}
+
+/// Explicit headless alternative to OS-keyring delivery, using owner-private sealed
+/// credential envelopes and an operator-injected wrapping key. No bearer is read
+/// from an environment variable or plaintext configuration.
+pub struct HeadlessCredentialProvider {
+    store: Arc<dyn PlatformKeyStore>,
+    account: String,
+}
+impl HeadlessCredentialProvider {
+    /// Bind the exact private authority used by offline enrollment.
+    pub fn new(
+        root: ConfinedRoot,
+        variable: String,
+        service: &str,
+        account: &str,
+    ) -> SdkResult<Self> {
+        let store =
+            EnvironmentKeyStore::new(root, variable).map_err(|_| SdkError::Authentication)?;
+        Ok(Self {
+            store: Arc::new(store),
+            account: headless_credential_account(service, account),
+        })
+    }
+
+    /// Bind a validated trusted-native encrypted authority using the exact same
+    /// service/account mapping. No fallback or alternate application is selected.
+    pub fn from_store(
+        store: Arc<dyn PlatformKeyStore>,
+        service: &str,
+        account: &str,
+    ) -> SdkResult<Self> {
+        if service.is_empty()
+            || account.is_empty()
+            || service.trim() != service
+            || account.trim() != account
+            || service.len() > 256
+            || account.len() > 256
+            || service.chars().chain(account.chars()).any(char::is_control)
+        {
+            return Err(SdkError::InvalidConfiguration(
+                "invalid native credential selector",
+            ));
+        }
+        Ok(Self {
+            store,
+            account: headless_credential_account(service, account),
+        })
+    }
+}
+#[async_trait::async_trait]
+impl CredentialProvider for HeadlessCredentialProvider {
+    async fn load(&self) -> SdkResult<Secret> {
+        let store = self.store.clone();
+        let account = self.account.clone();
+        let value = tokio::task::spawn_blocking(move || store.read(&account))
+            .await
+            .map_err(|_| SdkError::Authentication)?
+            .map_err(|_| SdkError::Authentication)?
+            .ok_or(SdkError::Authentication)?;
+        Secret::new(value.to_vec())
+    }
+}
diff --git a/crates/colossus-connector/src/history.rs b/crates/colossus-connector/src/history.rs
new file mode 100644
index 000000000..d5e29c6e8
--- /dev/null
+++ b/crates/colossus-connector/src/history.rs
@@ -0,0 +1,148 @@
+//! Canonical released conversation reads with a bounded JSON transport budget.
+use colossus_cloud_protocol::{CloudReply, MAX_DISCOVERY_PAGE_SIZE, encode};
+use colossus_sdk::{
+    AgentRunClient, ApiError, ApiErrorReason, ApiResult, ListSessionActivityRequest,
+    ListSessionActivityResponse, PageRequest, SessionActivityKind, SessionActivityLane,
+};
+use std::future::Future;
+
+pub(crate) async fn read(
+    runs: &dyn AgentRunClient,
+    source_run_id: String,
+    page_token: Option<String>,
+    page_size: u32,
+) -> ApiResult<CloudReply> {
+    bounded(source_run_id, page_token, page_size, |request| {
+        runs.list_session_activity(request)
+    })
+    .await
+}
+
+async fn bounded<F, Fut>(
+    source_run_id: String,
+    page_token: Option<String>,
+    mut page_size: u32,
+    fetch: F,
+) -> ApiResult<CloudReply>
+where
+    F: Fn(ListSessionActivityRequest) -> Fut,
+    Fut: Future<Output = ApiResult<ListSessionActivityResponse>>,
+{
+    if page_size == 0
+        || page_size > MAX_DISCOVERY_PAGE_SIZE
+        || page_token
+            .as_ref()
+            .is_some_and(|token| token.is_empty() || token.len() > 512)
+    {
+        return Err(ApiError::invalid(
+            ApiErrorReason::InvalidArgument,
+            "page",
+            "invalid history page",
+        ));
+    }
+    loop {
+        let response = fetch(ListSessionActivityRequest {
+            source_run_id: source_run_id.clone(),
+            query: String::new(),
+            lanes: vec![SessionActivityLane::Agent],
+            kinds: vec![SessionActivityKind::User, SessionActivityKind::Assistant],
+            statuses: vec![],
+            page: Some(PageRequest {
+                page_size,
+                page_token: page_token.clone().unwrap_or_default(),
+            }),
+        })
+        .await?;
+        let reply = CloudReply::History { response };
+        if encode(&reply).is_ok() {
+            return Ok(reply);
+        }
+        if page_size == 1 {
+            return Err(ApiError::bounded_resource_exhausted(
+                ApiErrorReason::CapacityExceeded,
+                "released history exceeds the cloud frame bound",
+            ));
+        }
+        // Activity cursors bind the caller/session/filters, deliberately excluding
+        // page size. Retrying this read rechecks sharing and never skips a record.
+        page_size = (page_size / 2).max(1);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use colossus_sdk::{PageResponse, SessionActivity, SessionActivityContent};
+    use std::{
+        collections::BTreeMap,
+        sync::{Arc, Mutex},
+    };
+
+    #[tokio::test]
+    async fn json_escaping_shrinks_read_page_without_changing_source_cursor() {
+        let requests = Arc::new(Mutex::new(Vec::new()));
+        let calls = requests.clone();
+        let reply = bounded(
+            "source-run".into(),
+            Some("opaque-cursor".into()),
+            32,
+            move |request| {
+                let calls = calls.clone();
+                async move {
+                    let page = request.page.expect("bounded page");
+                    calls
+                        .lock()
+                        .expect("requests")
+                        .push((page.page_size, page.page_token.clone()));
+                    assert_eq!(request.lanes, vec![SessionActivityLane::Agent]);
+                    let activity = SessionActivity {
+                        activity_id: "message-1".into(),
+                        run_id: Some(request.source_run_id),
+                        turn: None,
+                        lane: SessionActivityLane::Agent,
+                        kind: SessionActivityKind::User,
+                        title: "User".into(),
+                        summary: String::new(),
+                        actor: "local".into(),
+                        status: None,
+                        started_at: "2026-10-05T00:00:00Z".into(),
+                        completed_at: None,
+                        duration_ms: None,
+                        input: Some(SessionActivityContent {
+                            format: "text".into(),
+                            value: "\"\n\\".repeat(21845),
+                        }),
+                        result: None,
+                        attributes: BTreeMap::new(),
+                        source_event_types: vec!["session.message.appended.v1".into()],
+                        first_sequence: 1,
+                        last_sequence: 1,
+                    };
+                    Ok(ListSessionActivityResponse {
+                        activities: vec![activity; page.page_size as usize],
+                        page: Some(PageResponse {
+                            next_page_token: "next-cursor".into(),
+                        }),
+                        head_sequence: 1,
+                        projected_through_sequence: 1,
+                        caught_up: true,
+                    })
+                }
+            },
+        )
+        .await
+        .expect("smaller released page fits");
+        let pages = requests.lock().expect("requests");
+        assert!(pages.len() > 1);
+        assert_eq!(pages[0].0, 32);
+        assert!(pages.iter().all(|(_, token)| token == "opaque-cursor"));
+        assert!(encode(&reply).is_ok());
+        match reply {
+            CloudReply::History { response } => assert_eq!(
+                response.page.expect("next page").next_page_token,
+                "next-cursor"
+            ),
+            _ => panic!("history reply"),
+        }
+    }
+}
diff --git a/crates/colossus-connector/src/inventory.rs b/crates/colossus-connector/src/inventory.rs
new file mode 100644
index 000000000..745e0f3df
--- /dev/null
+++ b/crates/colossus-connector/src/inventory.rs
@@ -0,0 +1,78 @@
+//! Installation inventory identities; never derived from machine identifiers or paths.
+use colossus_cloud_protocol::{DeploymentKind, RuntimeInventory, WorkspaceSharing};
+use colossus_home::{ColossusHome, ConfinedRoot};
+use fs4::fs_std::FileExt;
+use sha2::{Digest, Sha256};
+use std::{
+    io::{Read, Seek, Write},
+    path::Path,
+};
+
+/// Return the native installation's stable opaque host identity and a workspace scope.
+/// All CLI deployments and Desktop workspaces using this owner-private Colossus home
+/// share a host group; the grouping never changes their independent grants.
+pub fn native_inventory(
+    workspace_id: String,
+    workspace_label: String,
+    deployment_kind: DeploymentKind,
+) -> Result<RuntimeInventory, &'static str> {
+    let home =
+        ColossusHome::resolve_and_ensure().map_err(|_| "native host identity unavailable")?;
+    let root = ConfinedRoot::bind(
+        home.confined_root()
+            .prepare_directory(Path::new("cloud-connector"))
+            .map_err(|_| "native host identity unavailable")?,
+    )
+    .map_err(|_| "native host identity unavailable")?;
+    let retained = root
+        .open_file(Path::new("host-id"))
+        .map_err(|_| "native host identity unavailable")?;
+    let mut file = retained.file();
+    FileExt::lock_exclusive(file).map_err(|_| "native host identity unavailable")?;
+    let result = (|| {
+        retained
+            .revalidate(&root)
+            .map_err(|_| "native host identity changed")?;
+        let mut bytes = Vec::new();
+        Read::by_ref(&mut file)
+            .take(129)
+            .read_to_end(&mut bytes)
+            .map_err(|_| "native host identity unavailable")?;
+        let host_id = if bytes.is_empty() {
+            let id = format!("host-{}", uuid::Uuid::now_v7().simple());
+            file.rewind()
+                .map_err(|_| "native host identity unavailable")?;
+            file.write_all(id.as_bytes())
+                .map_err(|_| "native host identity unavailable")?;
+            file.set_len(id.len() as u64)
+                .map_err(|_| "native host identity unavailable")?;
+            file.sync_all()
+                .map_err(|_| "native host identity unavailable")?;
+            id
+        } else {
+            String::from_utf8(bytes).map_err(|_| "native host identity invalid")?
+        };
+        let inventory = RuntimeInventory {
+            policy: None,
+            host_id,
+            host_label: "Colossus host".into(),
+            platform: std::env::consts::OS.into(),
+            deployment_kind,
+            workspace_id: format!(
+                "workspace-{}",
+                hex::encode(Sha256::digest(workspace_id.as_bytes()))
+            ),
+            workspace_label,
+            sharing: WorkspaceSharing::CloudOwned,
+        };
+        inventory
+            .validate()
+            .map_err(|_| "native inventory invalid")?;
+        retained
+            .revalidate(&root)
+            .map_err(|_| "native host identity changed")?;
+        Ok(inventory)
+    })();
+    FileExt::unlock(file).map_err(|_| "native host identity unavailable")?;
+    result
+}
diff --git a/crates/colossus-connector/src/lib.rs b/crates/colossus-connector/src/lib.rs
new file mode 100644
index 000000000..d913f2e90
--- /dev/null
+++ b/crates/colossus-connector/src/lib.rs
@@ -0,0 +1,20 @@
+//! Outbound, caller-bound runtime connector. Cloud traffic cannot access worker IPC.
+mod connection;
+pub use connection::{ConnectionConfig, ConnectorStatus, RuntimeConnector};
+mod enrollment;
+pub use enrollment::EnrollmentStore;
+mod cli;
+mod cli_control;
+mod discovery;
+mod headless;
+mod history;
+mod inventory;
+mod outbound;
+mod released;
+pub use cli::{
+    ConnectorCommand, EnrollArguments, LocalArguments, ShareWorkspaceArguments, StorageArguments,
+    run_cli,
+};
+pub use colossus_cloud_protocol::{DeploymentKind, RuntimeInventory, WorkspaceSharing};
+pub use headless::{HeadlessCredentialProvider, headless_credential_account};
+pub use inventory::native_inventory;
diff --git a/crates/colossus-connector/src/main.rs b/crates/colossus-connector/src/main.rs
new file mode 100644
index 000000000..c0c961c6c
--- /dev/null
+++ b/crates/colossus-connector/src/main.rs
@@ -0,0 +1,15 @@
+//! Standalone cross-platform outbound connector executable.
+use clap::Parser;
+#[derive(Parser)]
+#[command(
+    name = "colossus-connector",
+    about = "Connect an independently enrolled Colossus runtime to its Control Plane"
+)]
+struct Arguments {
+    #[command(subcommand)]
+    command: colossus_connector::ConnectorCommand,
+}
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    colossus_connector::run_cli(Arguments::parse().command).await
+}
diff --git a/crates/colossus-connector/src/outbound.rs b/crates/colossus-connector/src/outbound.rs
new file mode 100644
index 000000000..785b2b2d1
--- /dev/null
+++ b/crates/colossus-connector/src/outbound.rs
@@ -0,0 +1,132 @@
+//! Keep native health and durable command receipts ahead of queued released output.
+use colossus_cloud_protocol::{
+    MAX_QUEUED_FRAMES,
+    v1alpha1::{RuntimeFrame, runtime_frame},
+};
+use std::{
+    pin::Pin,
+    task::{Context, Poll},
+};
+use tokio::sync::mpsc;
+use tokio_stream::Stream;
+
+const PRIORITY_FRAMES: usize = 4;
+
+#[derive(Clone)]
+pub(crate) struct FrameSender {
+    priority: mpsc::Sender<RuntimeFrame>,
+    data: mpsc::Sender<RuntimeFrame>,
+}
+pub(crate) struct FrameStream {
+    priority: mpsc::Receiver<RuntimeFrame>,
+    data: mpsc::Receiver<RuntimeFrame>,
+}
+
+pub(crate) fn channel() -> (FrameSender, FrameStream) {
+    let (priority, priority_receiver) = mpsc::channel(PRIORITY_FRAMES);
+    let (data, data_receiver) = mpsc::channel(MAX_QUEUED_FRAMES - PRIORITY_FRAMES);
+    (
+        FrameSender { priority, data },
+        FrameStream {
+            priority: priority_receiver,
+            data: data_receiver,
+        },
+    )
+}
+
+impl FrameSender {
+    pub(crate) async fn send(
+        &self,
+        frame: RuntimeFrame,
+    ) -> Result<(), mpsc::error::SendError<RuntimeFrame>> {
+        // Output-limit markers remain behind the data whose committed cursor they
+        // reference. Only health and independent durable receipts may overtake it.
+        let priority = matches!(
+            &frame.body,
+            Some(
+                runtime_frame::Body::Hello(_)
+                    | runtime_frame::Body::Heartbeat(_)
+                    | runtime_frame::Body::Receipt(_)
+            )
+        );
+        if priority {
+            self.priority.send(frame).await
+        } else {
+            self.data.send(frame).await
+        }
+    }
+}
+
+impl Stream for FrameStream {
+    type Item = RuntimeFrame;
+    fn poll_next(mut self: Pin<&mut Self>, context: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        let priority = self.priority.poll_recv(context);
+        if let Poll::Ready(Some(frame)) = priority {
+            return Poll::Ready(Some(frame));
+        }
+        match self.data.poll_recv(context) {
+            Poll::Ready(Some(frame)) => Poll::Ready(Some(frame)),
+            Poll::Ready(None) if priority.is_ready() => Poll::Ready(None),
+            _ => Poll::Pending,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio_stream::StreamExt;
+
+    #[tokio::test]
+    async fn saturated_data_queue_cannot_delay_native_health_or_receipts() {
+        let (sender, mut stream) = channel();
+        for _ in 0..MAX_QUEUED_FRAMES - PRIORITY_FRAMES {
+            sender
+                .send(RuntimeFrame {
+                    body: Some(runtime_frame::Body::Snapshot(Default::default())),
+                })
+                .await
+                .expect("fill bounded data");
+        }
+        sender
+            .send(RuntimeFrame {
+                body: Some(runtime_frame::Body::Heartbeat(Default::default())),
+            })
+            .await
+            .expect("health slot");
+        sender
+            .send(RuntimeFrame {
+                body: Some(runtime_frame::Body::Receipt(Default::default())),
+            })
+            .await
+            .expect("receipt slot");
+        assert!(matches!(
+            stream.next().await.expect("health").body,
+            Some(runtime_frame::Body::Heartbeat(_))
+        ));
+        assert!(matches!(
+            stream.next().await.expect("receipt").body,
+            Some(runtime_frame::Body::Receipt(_))
+        ));
+        assert!(matches!(
+            stream.next().await.expect("data").body,
+            Some(runtime_frame::Body::Snapshot(_))
+        ));
+        sender
+            .send(RuntimeFrame {
+                body: Some(runtime_frame::Body::OutputLimit(Default::default())),
+            })
+            .await
+            .expect("ordered limit");
+        for _ in 0..MAX_QUEUED_FRAMES - PRIORITY_FRAMES - 1 {
+            assert!(matches!(
+                stream.next().await.expect("data before limit").body,
+                Some(runtime_frame::Body::Snapshot(_))
+            ));
+        }
+        assert!(matches!(
+            stream.next().await.expect("limit after data").body,
+            Some(runtime_frame::Body::OutputLimit(_))
+        ));
+    }
+}
diff --git a/crates/colossus-connector/src/released.rs b/crates/colossus-connector/src/released.rs
new file mode 100644
index 000000000..ce10308ed
--- /dev/null
+++ b/crates/colossus-connector/src/released.rs
@@ -0,0 +1,117 @@
+use colossus_cloud_protocol::{CloudReply, encode};
+use colossus_sdk::{CancelRunResponse, GetRunResponse, RunTerminal};
+
+/// Cancellation of an already-terminal run can return its large released result.
+/// The receipt confirms the exact run; snapshots own the explicit output-limit marker.
+pub(crate) fn compact_cancellation(response: &mut CancelRunResponse) -> Result<(), &'static str> {
+    let mut snapshot = GetRunResponse {
+        run: response.run.clone(),
+        pending_interactions: vec![],
+    };
+    compact_snapshot(&mut snapshot)?;
+    response.run = snapshot.run;
+    Ok(())
+}
+
+/// Keep lifecycle/identity metadata observable when released content exceeds the
+/// cloud frame budget. Whole interactions are omitted, never partially approved.
+/// The caller must durably mark the cloud projection incomplete.
+pub(crate) fn compact_snapshot(snapshot: &mut GetRunResponse) -> Result<bool, &'static str> {
+    let fits = |snapshot: &GetRunResponse| {
+        encode(&CloudReply::Run {
+            run: Box::new(snapshot.clone()),
+        })
+        .is_ok()
+    };
+    if fits(snapshot) {
+        return Ok(false);
+    }
+    if let Some(terminal) = &mut snapshot.run.terminal {
+        match terminal {
+            RunTerminal::Result(result) => result.output.clear(),
+            RunTerminal::Failure(failure) => {
+                failure.message =
+                    "Run details exceed the cloud frame budget; open this run locally.".into()
+            }
+            RunTerminal::Cancellation(cancellation) => {
+                cancellation.message =
+                    "Run details exceed the cloud frame budget; open this run locally.".into()
+            }
+        }
+    }
+    if !fits(snapshot) {
+        snapshot.pending_interactions.clear();
+    }
+    if fits(snapshot) {
+        Ok(true)
+    } else {
+        Err("run metadata exceeds cloud frame budget")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use colossus_cloud_protocol::MAX_PAYLOAD_BYTES;
+    use colossus_sdk::{Run, RunMode, RunResult, RunStatus};
+
+    #[test]
+    fn oversized_terminal_output_keeps_identity_lifecycle_and_cursor() {
+        let mut snapshot = GetRunResponse {
+            run: Run {
+                plugin_skill_ids: vec![],
+                run_id: "run-1".into(),
+                session_id: "session-1".into(),
+                title: "Test task".into(),
+                role: "primary".into(),
+                mode: RunMode::Execute,
+                status: RunStatus::Completed,
+                created_at: "2026-10-05T00:00:00Z".into(),
+                updated_at: "2026-10-05T00:00:01Z".into(),
+                started_at: None,
+                finished_at: None,
+                last_sequence: 17,
+                pending_interaction_count: 0,
+                etag: "revision-17".into(),
+                archived: false,
+                terminal: Some(RunTerminal::Result(RunResult {
+                    output: "x".repeat(MAX_PAYLOAD_BYTES),
+                    plan_id: None,
+                    plan_revision: None,
+                    plan_status: None,
+                    goal_id: None,
+                    profile: "fixture".into(),
+                    model_profile: "fixture".into(),
+                    provider_profile: "fixture".into(),
+                    model: "fixture".into(),
+                    elapsed_seconds: 1.0,
+                })),
+            },
+            pending_interactions: vec![],
+        };
+        let mut cancelled = CancelRunResponse {
+            run: snapshot.run.clone(),
+        };
+        compact_cancellation(&mut cancelled).unwrap();
+        assert_eq!(cancelled.run.run_id, "run-1");
+        assert_eq!(cancelled.run.status, RunStatus::Completed);
+        assert!(
+            encode(&CloudReply::Cancelled {
+                response: cancelled
+            })
+            .is_ok()
+        );
+        assert!(compact_snapshot(&mut snapshot).unwrap());
+        assert_eq!(snapshot.run.run_id, "run-1");
+        assert_eq!(snapshot.run.status, RunStatus::Completed);
+        assert_eq!(snapshot.run.last_sequence, 17);
+        assert_eq!(snapshot.run.etag, "revision-17");
+        assert!(
+            encode(&CloudReply::Run {
+                run: Box::new(snapshot.clone())
+            })
+            .is_ok()
+        );
+        assert!(!compact_snapshot(&mut snapshot).unwrap());
+    }
+}
diff --git a/crates/colossus-credentials/src/database.rs b/crates/colossus-credentials/src/database.rs
index e3677d7ee..bd6b1148f 100644
--- a/crates/colossus-credentials/src/database.rs
+++ b/crates/colossus-credentials/src/database.rs
@@ -66,13 +66,61 @@ impl Metadata {
 pub(crate) struct OpenedVault {
     pub database: Database,
     pub master: Option<crate::crypto::MasterKey>,
-    pub file: ConfinedFile,
+    // The database uses a clone of this open-file description. Explicit unlock
+    // after Database drop also releases any transient fork-inherited duplicate.
+    pub file: VaultLease,
     // The lease outlives the database. Never unlink the lock file: another owner may
     // already hold its inode/handle while this process releases its own lease.
-    pub lease: ConfinedFile,
+    pub lease: VaultLease,
+}
+
+/// Explicit unlock also releases a transient fork-inherited duplicate of the same
+/// open file description. This field drops after the database and its file handles.
+pub(crate) struct VaultLease(pub ConfinedFile);
+impl std::ops::Deref for VaultLease {
+    type Target = ConfinedFile;
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+impl Drop for VaultLease {
+    fn drop(&mut self) {
+        let _ = fs4::fs_std::FileExt::unlock(self.0.file());
+    }
 }
 
 impl OpenedVault {
+    pub(crate) fn open(file: ConfinedFile, lease: VaultLease) -> Result<Self, CredentialError> {
+        // Unix can inherit redb's cloned open-file description during a fork.
+        // Own the lock before redb initialization, including its error paths.
+        // Windows cannot re-lock an overlapping exclusive range, so redb keeps
+        // its original acquisition there and the guard follows successful open.
+        #[cfg(unix)]
+        let file = {
+            if !fs4::fs_std::FileExt::try_lock_exclusive(file.file())
+                .map_err(|_| CredentialError::Io)?
+            {
+                return Err(CredentialError::Busy);
+            }
+            VaultLease(file)
+        };
+        let database = Database::builder()
+            .create_file(file.file().try_clone().map_err(|_| CredentialError::Io)?)
+            .map_err(|error| match error {
+                redb::DatabaseError::DatabaseAlreadyOpen => CredentialError::Busy,
+                redb::DatabaseError::Storage(redb::StorageError::Io(_)) => CredentialError::Io,
+                _ => CredentialError::Corrupt,
+            })?;
+        #[cfg(not(unix))]
+        let file = VaultLease(file);
+        Ok(Self {
+            database,
+            master: None,
+            file,
+            lease,
+        })
+    }
+
     pub fn revalidate(&self, root: &ConfinedRoot) -> Result<(), CredentialError> {
         self.file
             .revalidate(root)
diff --git a/crates/colossus-credentials/src/development.rs b/crates/colossus-credentials/src/development.rs
new file mode 100644
index 000000000..f6911d297
--- /dev/null
+++ b/crates/colossus-credentials/src/development.rs
@@ -0,0 +1,503 @@
+//! Explicit development-only custody; selection never discovers or migrates keys.
+
+use crate::PlatformKeyStore;
+use crate::{EnvironmentKeyStore, crypto};
+use colossus_contracts::CredentialError;
+use colossus_contracts::VaultRecord;
+use colossus_home::{ConfinedFile, ConfinedRoot};
+use colossus_ports::{CredentialKey, CredentialVault};
+use fs4::fs_std::FileExt as _;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::sync::Arc;
+use std::{
+    fmt,
+    io::{Read, Write},
+    path::{Path, PathBuf},
+};
+use subtle::ConstantTimeEq as _;
+use zeroize::Zeroizing;
+
+/// Nonsecret explicit authority-path selector. Never carries a key or credential.
+pub const DEVELOPMENT_AUTHORITY_VARIABLE: &str = "COLOSSUS_DEVELOPMENT_CREDENTIAL_AUTHORITY";
+const DIRECTORY: &str = "development-credentials";
+const KEY_FILE: &str = ".authority-key.env";
+const MANIFEST: &str = "authority.json";
+const LOCK: &str = "authority.lock";
+
+/// Closed native storage scopes prevent a renderer from choosing arbitrary roots.
+#[derive(Clone, Copy, Debug)]
+pub enum DevelopmentStoreScope {
+    /// Native Desktop provider/client/enrollment vault master envelopes.
+    DesktopVault,
+    /// Standalone Control Plane enrollment vault master envelopes.
+    ControlPlaneVault,
+    /// Fixed original public API key and application bearer selectors.
+    PublicApi,
+    /// Canonical journal keys, checkpoint seeds and protected anchor records.
+    Journal,
+    /// Runtime-owned OAuth vault master envelopes, retaining their original scope.
+    RuntimeOAuthVault,
+}
+impl DevelopmentStoreScope {
+    fn directory(self) -> &'static str {
+        match self {
+            Self::DesktopVault => "desktop-vault",
+            Self::ControlPlaneVault => "control-plane-vault",
+            Self::PublicApi => "public-api",
+            Self::Journal => "journal",
+            Self::RuntimeOAuthVault => "runtime-oauth-vault",
+        }
+    }
+}
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Manifest {
+    schema_version: u16,
+    home_fingerprint: String,
+    active: bool,
+}
+/// Read-only public development custody state; never contains key material.
+#[derive(Debug, Clone, Serialize)]
+pub struct DevelopmentAuthorityMetadata {
+    /// Exact existing private authority directory beneath the selected home.
+    pub authority_path: PathBuf,
+    /// Whether explicit offline preparation/rewrap completed activation.
+    pub active: bool,
+}
+
+/// Private zeroizing authority opened only by trusted native composition.
+pub struct DevelopmentAuthority {
+    root: ConfinedRoot,
+    key_file: ConfinedFile,
+    key: Zeroizing<[u8; 32]>,
+}
+impl fmt::Debug for DevelopmentAuthority {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("DevelopmentAuthority")
+            .finish_non_exhaustive()
+    }
+}
+impl DevelopmentAuthority {
+    /// Inspect only existing nonsecret metadata without reading a wrapping key.
+    pub fn metadata(
+        home: &ConfinedRoot,
+        path: &Path,
+        workspaces: &[PathBuf],
+    ) -> Result<DevelopmentAuthorityMetadata, CredentialError> {
+        let (root, manifest) = validated_manifest(home, path, workspaces)?;
+        Ok(DevelopmentAuthorityMetadata {
+            authority_path: root.path().to_owned(),
+            active: manifest.active,
+        })
+    }
+    /// Exact home-owned path; no arbitrary environment-selected root is accepted.
+    pub fn path_for_home(home: &ConfinedRoot) -> PathBuf {
+        home.path().join(DIRECTORY)
+    }
+
+    /// Initialize only an empty authority. A missing/partial/invalid existing key
+    /// is never regenerated, and no platform key or credential is read or moved.
+    pub fn initialize(
+        home: &ConfinedRoot,
+        workspaces: &[PathBuf],
+    ) -> Result<Self, CredentialError> {
+        validate_workspaces(&Self::path_for_home(home), workspaces)?;
+        let path = home
+            .prepare_directory(Path::new(DIRECTORY))
+            .map_err(invalid)?;
+        let root = ConfinedRoot::bind(path).map_err(invalid)?;
+        let lock = root.open_file(Path::new(LOCK)).map_err(invalid)?;
+        if !lock
+            .file()
+            .try_lock_exclusive()
+            .map_err(|_| CredentialError::Io)?
+        {
+            return Err(CredentialError::Busy);
+        }
+        let _lock = crate::database::VaultLease(lock);
+        let has_key = root
+            .path()
+            .join(KEY_FILE)
+            .try_exists()
+            .map_err(|_| CredentialError::Io)?;
+        let has_manifest = root
+            .path()
+            .join(MANIFEST)
+            .try_exists()
+            .map_err(|_| CredentialError::Io)?;
+        if has_key || has_manifest {
+            return Self::open(home, root.path(), workspaces);
+        }
+        if std::fs::read_dir(root.path())
+            .map_err(|_| CredentialError::Io)?
+            .any(|entry| entry.map(|item| item.file_name() != LOCK).unwrap_or(true))
+        {
+            return Err(CredentialError::Corrupt);
+        }
+        let key = crypto::new_key()?;
+        let mut encoded = Zeroizing::new([0_u8; 65]);
+        hex::encode_to_slice(key.as_ref(), &mut encoded[..64])
+            .map_err(|_| CredentialError::Corrupt)?;
+        encoded[64] = b'\n';
+        write_new(&root, KEY_FILE, encoded.as_ref())?;
+        let metadata = serde_json::to_vec(&Manifest {
+            schema_version: 1,
+            home_fingerprint: home_fingerprint(home)?,
+            active: false,
+        })
+        .map_err(|_| CredentialError::Io)?;
+        for scope in [
+            DevelopmentStoreScope::DesktopVault,
+            DevelopmentStoreScope::ControlPlaneVault,
+            DevelopmentStoreScope::PublicApi,
+            DevelopmentStoreScope::Journal,
+            DevelopmentStoreScope::RuntimeOAuthVault,
+        ] {
+            root.prepare_directory(Path::new(scope.directory()))
+                .map_err(invalid)?;
+        }
+        write_new(&root, MANIFEST, &metadata)?;
+        root.sync_directory().map_err(invalid)?;
+        Self::open(home, root.path(), workspaces)
+    }
+
+    /// Open an exact initialized home-bound authority. This never falls back to a
+    /// platform store or creates missing files, even when a protected vault exists.
+    pub fn open(
+        home: &ConfinedRoot,
+        path: &Path,
+        workspaces: &[PathBuf],
+    ) -> Result<Self, CredentialError> {
+        let (root, _) = validated_manifest(home, path, workspaces)?;
+        let manifest_file = root
+            .open_existing_file(Path::new(MANIFEST))
+            .map_err(invalid)?;
+        let mut metadata = Vec::new();
+        manifest_file
+            .file()
+            .take(1025)
+            .read_to_end(&mut metadata)
+            .map_err(|_| CredentialError::Io)?;
+        if metadata.len() > 1024 {
+            return Err(CredentialError::Corrupt);
+        }
+        let manifest: Manifest =
+            serde_json::from_slice(&metadata).map_err(|_| CredentialError::Corrupt)?;
+        if manifest.schema_version != 1 || manifest.home_fingerprint != home_fingerprint(home)? {
+            return Err(CredentialError::Corrupt);
+        }
+        manifest_file.revalidate(&root).map_err(invalid)?;
+        let key_file = root
+            .open_existing_file(Path::new(KEY_FILE))
+            .map_err(invalid)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt as _;
+            if key_file
+                .file()
+                .metadata()
+                .map_err(invalid)?
+                .permissions()
+                .mode()
+                & 0o777
+                != 0o600
+            {
+                return Err(CredentialError::InvalidInput);
+            }
+        }
+        let mut bytes = Zeroizing::new(Vec::with_capacity(66));
+        key_file
+            .file()
+            .take(66)
+            .read_to_end(&mut bytes)
+            .map_err(|_| CredentialError::Io)?;
+        let content = match bytes.as_slice() {
+            bytes if bytes.len() == 64 => bytes,
+            bytes if bytes.len() == 65 && bytes[64] == b'\n' => &bytes[..64],
+            _ => return Err(CredentialError::Corrupt),
+        };
+        let mut key = Zeroizing::new([0_u8; 32]);
+        hex::decode_to_slice(content, key.as_mut()).map_err(|_| CredentialError::Corrupt)?;
+        key_file.revalidate(&root).map_err(invalid)?;
+        Ok(Self {
+            root,
+            key_file,
+            key,
+        })
+    }
+
+    /// Resolve only the nonsecret explicit selector and marker, before any key or
+    /// runtime acquisition. Release builds reject this development opt-in.
+    pub fn selected_root(
+        home: &ConfinedRoot,
+        workspaces: &[PathBuf],
+    ) -> Result<Option<ConfinedRoot>, CredentialError> {
+        let path = std::env::var_os(DEVELOPMENT_AUTHORITY_VARIABLE);
+        selected_root(
+            home,
+            path.as_deref().map(Path::new),
+            workspaces,
+            cfg!(debug_assertions),
+        )
+    }
+
+    /// Open only an active explicitly selected development authority.
+    pub fn selected(
+        home: &ConfinedRoot,
+        workspaces: &[PathBuf],
+    ) -> Result<Option<Self>, CredentialError> {
+        Self::selected_root(home, workspaces)?
+            .map(|root| Self::open(home, root.path(), workspaces))
+            .transpose()
+    }
+
+    /// Explicit offline completion boundary. Call only after fresh-home checks or
+    /// every approved source selector was sealed and verified; preparation alone
+    /// never enables runtime use of incomplete migrated custody.
+    pub fn activate(&self, home: &ConfinedRoot) -> Result<(), CredentialError> {
+        let lock = self.root.open_file(Path::new(LOCK)).map_err(invalid)?;
+        if !lock
+            .file()
+            .try_lock_exclusive()
+            .map_err(|_| CredentialError::Io)?
+        {
+            return Err(CredentialError::Busy);
+        }
+        let lock = crate::database::VaultLease(lock);
+        lock.revalidate(&self.root).map_err(invalid)?;
+        let (_, mut manifest) = validated_manifest(home, self.root.path(), &[])?;
+        manifest.active = true;
+        let bytes = serde_json::to_vec(&manifest).map_err(|_| CredentialError::Io)?;
+        let file = self
+            .root
+            .open_file(Path::new("authority.next.json"))
+            .map_err(invalid)?;
+        file.file()
+            .write_all(&bytes)
+            .map_err(|_| CredentialError::Io)?;
+        file.file()
+            .set_len(bytes.len() as u64)
+            .map_err(|_| CredentialError::Io)?;
+        file.file().sync_all().map_err(|_| CredentialError::Io)?;
+        file.revalidate(&self.root).map_err(invalid)?;
+        lock.revalidate(&self.root).map_err(invalid)?;
+        let current = self
+            .root
+            .open_existing_file(Path::new(MANIFEST))
+            .map_err(invalid)?;
+        current.revalidate(&self.root).map_err(invalid)?;
+        self.key_file.revalidate(&self.root).map_err(invalid)?;
+        std::fs::rename(file.path(), self.root.path().join(MANIFEST))
+            .map_err(|_| CredentialError::Io)?;
+        self.root.sync_directory().map_err(invalid)?;
+        let metadata = Self::metadata(home, self.root.path(), &[])?;
+        if !metadata.active {
+            return Err(CredentialError::Corrupt);
+        }
+        Ok(())
+    }
+
+    /// Select only an existing fixed private store; no secret enters an environment.
+    pub fn store(
+        &self,
+        scope: DevelopmentStoreScope,
+    ) -> Result<EnvironmentKeyStore, CredentialError> {
+        self.key_file.revalidate(&self.root).map_err(invalid)?;
+        let path = self.root.path().join(scope.directory());
+        self.root.revalidate_directory(&path).map_err(invalid)?;
+        let root = ConfinedRoot::bind(path).map_err(invalid)?;
+        Ok(EnvironmentKeyStore::with_wrapping_key(
+            root,
+            Zeroizing::new(*self.key),
+        ))
+    }
+
+    /// Larger journal anchor/checkpoint records use the existing bounded encrypted
+    /// vault; its small random master envelope uses this same authority.
+    pub fn journal_vault(&self) -> Result<Arc<crate::PlatformCredentialVault>, CredentialError> {
+        let keys = self.store(DevelopmentStoreScope::Journal)?;
+        let root = ConfinedRoot::bind(
+            self.root
+                .path()
+                .join(DevelopmentStoreScope::Journal.directory()),
+        )
+        .map_err(invalid)?;
+        crate::PlatformCredentialVault::with_key_store(root, "development-journal", Arc::new(keys))
+            .map(Arc::new)
+    }
+
+    /// Validate each active workspace before granting its tools access to a runtime.
+    pub fn validate_workspaces(&self, workspaces: &[PathBuf]) -> Result<(), CredentialError> {
+        validate_workspaces(self.root.path(), workspaces)
+    }
+}
+
+fn validated_manifest(
+    home: &ConfinedRoot,
+    path: &Path,
+    workspaces: &[PathBuf],
+) -> Result<(ConfinedRoot, Manifest), CredentialError> {
+    if path != DevelopmentAuthority::path_for_home(home) || !path.is_absolute() {
+        return Err(CredentialError::InvalidInput);
+    }
+    let metadata = std::fs::symlink_metadata(path).map_err(invalid)?;
+    if !metadata.is_dir() || metadata.file_type().is_symlink() {
+        return Err(CredentialError::InvalidInput);
+    }
+    let root = ConfinedRoot::bind(path).map_err(invalid)?;
+    if root.path() != DevelopmentAuthority::path_for_home(home) {
+        return Err(CredentialError::InvalidInput);
+    }
+    validate_workspaces(root.path(), workspaces)?;
+    let file = root
+        .open_existing_file(Path::new(MANIFEST))
+        .map_err(invalid)?;
+    let mut bytes = Vec::new();
+    file.file()
+        .take(1025)
+        .read_to_end(&mut bytes)
+        .map_err(|_| CredentialError::Io)?;
+    if bytes.len() > 1024 {
+        return Err(CredentialError::Corrupt);
+    }
+    let manifest: Manifest =
+        serde_json::from_slice(&bytes).map_err(|_| CredentialError::Corrupt)?;
+    if manifest.schema_version != 1 || manifest.home_fingerprint != home_fingerprint(home)? {
+        return Err(CredentialError::Corrupt);
+    }
+    file.revalidate(&root).map_err(invalid)?;
+    Ok((root, manifest))
+}
+fn selected_root(
+    home: &ConfinedRoot,
+    path: Option<&Path>,
+    workspaces: &[PathBuf],
+    development_build: bool,
+) -> Result<Option<ConfinedRoot>, CredentialError> {
+    let Some(path) = path else {
+        return Ok(None);
+    };
+    if !development_build {
+        return Err(CredentialError::InvalidInput);
+    }
+    let (root, manifest) = validated_manifest(home, path, workspaces)?;
+    if !manifest.active {
+        return Err(CredentialError::Unavailable);
+    }
+    Ok(Some(root))
+}
+
+/// Seal one already-validated existing small envelope, retaining the old source.
+/// Existing different material is a terminal conflict, never overwritten.
+pub fn seal_existing(
+    target: &dyn PlatformKeyStore,
+    account: &str,
+    original: &[u8],
+) -> Result<bool, CredentialError> {
+    if original.is_empty() || original.len() > 256 {
+        return Err(CredentialError::Oversized);
+    }
+    if let Some(existing) = target.read(account)? {
+        if existing.len() != original.len() || !bool::from(existing.as_slice().ct_eq(original)) {
+            return Err(CredentialError::Corrupt);
+        }
+        return Ok(false);
+    }
+    target.write(account, original)?;
+    let readback = target.read(account)?.ok_or(CredentialError::MissingKey)?;
+    if readback.len() != original.len() || !bool::from(readback.as_slice().ct_eq(original)) {
+        return Err(CredentialError::Corrupt);
+    }
+    Ok(true)
+}
+
+/// Exact native public-API selector mapping shared by CLI, connector and journal
+/// development custody. This never contains or derives an application bearer.
+pub fn headless_credential_account(service: &str, account: &str) -> String {
+    let mut hash = Sha256::new();
+    hash.update(b"colossus-headless-public-api-v1\0");
+    hash.update((service.len() as u64).to_be_bytes());
+    hash.update(service.as_bytes());
+    hash.update(account.as_bytes());
+    hex::encode(hash.finalize())
+}
+
+/// Shared opaque slot for original journal keys/checkpoint seeds/anchor records.
+pub fn development_journal_key(
+    service: &str,
+    account: &str,
+) -> Result<CredentialKey, CredentialError> {
+    CredentialKey::new(
+        "development-journal",
+        &headless_credential_account(service, account),
+    )
+}
+
+/// Preserve a larger existing journal record without plaintext export or overwrite.
+pub fn seal_existing_record(
+    target: &dyn CredentialVault,
+    key: &CredentialKey,
+    original: &[u8],
+) -> Result<bool, CredentialError> {
+    if let Some(existing) = target.read(key)? {
+        if existing.expose().len() != original.len()
+            || !bool::from(existing.expose().ct_eq(original))
+        {
+            return Err(CredentialError::Corrupt);
+        }
+        return Ok(false);
+    }
+    let record = VaultRecord::new(original.to_vec())?;
+    target.write(key, &record)?;
+    let readback = target.read(key)?.ok_or(CredentialError::MissingKey)?;
+    if readback.expose().len() != original.len() || !bool::from(readback.expose().ct_eq(original)) {
+        return Err(CredentialError::Corrupt);
+    }
+    Ok(true)
+}
+
+fn home_fingerprint(home: &ConfinedRoot) -> Result<String, CredentialError> {
+    home.revalidate().map_err(invalid)?;
+    let text = home.path().to_str().ok_or(CredentialError::InvalidInput)?;
+    Ok(hex::encode(Sha256::digest(text.as_bytes())))
+}
+fn validate_workspaces(authority: &Path, workspaces: &[PathBuf]) -> Result<(), CredentialError> {
+    if workspaces.is_empty() {
+        return Ok(());
+    }
+    // Compare the same physical path spelling on both sides. Windows homes may
+    // use ordinary drive paths while canonical workspaces use verbatim prefixes.
+    // Initialization also checks overlap before the authority directory exists.
+    let authority = match std::fs::canonicalize(authority) {
+        Ok(path) => path,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            let parent = authority.parent().ok_or(CredentialError::InvalidInput)?;
+            let leaf = authority.file_name().ok_or(CredentialError::InvalidInput)?;
+            std::fs::canonicalize(parent).map_err(invalid)?.join(leaf)
+        }
+        Err(error) => return Err(invalid(error)),
+    };
+    for workspace in workspaces {
+        let canonical = std::fs::canonicalize(workspace).map_err(invalid)?;
+        if authority.starts_with(&canonical) || canonical.starts_with(&authority) {
+            return Err(CredentialError::InvalidInput);
+        }
+    }
+    Ok(())
+}
+fn write_new(root: &ConfinedRoot, name: &str, bytes: &[u8]) -> Result<(), CredentialError> {
+    let file = root.open_file(Path::new(name)).map_err(invalid)?;
+    if !file.was_created() {
+        return Err(CredentialError::Corrupt);
+    }
+    file.file()
+        .write_all(bytes)
+        .map_err(|_| CredentialError::Io)?;
+    file.file().sync_all().map_err(|_| CredentialError::Io)?;
+    file.revalidate(root).map_err(invalid)?;
+    root.sync_directory().map_err(invalid)
+}
+fn invalid(_: impl fmt::Debug) -> CredentialError {
+    CredentialError::InvalidInput
+}
diff --git a/crates/colossus-credentials/src/environment.rs b/crates/colossus-credentials/src/environment.rs
new file mode 100644
index 000000000..242173be6
--- /dev/null
+++ b/crates/colossus-credentials/src/environment.rs
@@ -0,0 +1,138 @@
+use crate::{PlatformKeyStore, crypto};
+use colossus_contracts::CredentialError;
+use colossus_home::ConfinedRoot;
+use sha2::{Digest, Sha256};
+use std::{
+    io::{Read, Seek, SeekFrom, Write},
+    path::PathBuf,
+};
+use zeroize::Zeroizing;
+
+/// Explicit headless credential authority. A configured 32-byte environment key
+/// seals small vault-key envelopes inside an owner-private root. There is no
+/// fallback to an OS store, plaintext, an ephemeral key, or another environment name.
+/// Kubernetes/systemd should inject the key from their secret authority.
+pub struct EnvironmentKeyStore {
+    root: ConfinedRoot,
+    authority: WrappingAuthority,
+}
+enum WrappingAuthority {
+    Environment(String),
+    Native(crypto::MasterKey),
+}
+impl EnvironmentKeyStore {
+    /// Bind an explicit key reference and protected root; creation happens on write.
+    pub fn new(root: ConfinedRoot, variable: String) -> Result<Self, CredentialError> {
+        if variable.is_empty()
+            || variable.len() > 128
+            || !variable
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || byte == b'_')
+        {
+            return Err(CredentialError::InvalidInput);
+        }
+        Ok(Self {
+            root,
+            authority: WrappingAuthority::Environment(variable),
+        })
+    }
+    /// Bind an explicit trusted-native zeroizing key without reading process
+    /// environment or selecting another authority on failure. Development custody
+    /// uses this same sealed format after confined native-only key-file validation.
+    pub fn with_wrapping_key(root: ConfinedRoot, key: Zeroizing<[u8; 32]>) -> Self {
+        Self {
+            root,
+            authority: WrappingAuthority::Native(key),
+        }
+    }
+    fn key(&self) -> Result<crypto::MasterKey, CredentialError> {
+        let WrappingAuthority::Environment(variable) = &self.authority else {
+            let WrappingAuthority::Native(key) = &self.authority else {
+                unreachable!()
+            };
+            return Ok(Zeroizing::new(**key));
+        };
+        let value =
+            Zeroizing::new(std::env::var(variable).map_err(|_| CredentialError::Unavailable)?);
+        let mut key = Zeroizing::new([0u8; 32]);
+        hex::decode_to_slice(value.trim(), key.as_mut()).map_err(|_| CredentialError::Corrupt)?;
+        Ok(key)
+    }
+    fn path(account: &str) -> Result<PathBuf, CredentialError> {
+        if account.is_empty() || account.len() > 512 {
+            return Err(CredentialError::InvalidInput);
+        }
+        Ok(PathBuf::from(format!(
+            "headless-keys/{}.sealed",
+            hex::encode(Sha256::digest(account.as_bytes()))
+        )))
+    }
+}
+impl PlatformKeyStore for EnvironmentKeyStore {
+    fn read(&self, account: &str) -> Result<Option<Zeroizing<Vec<u8>>>, CredentialError> {
+        let path = Self::path(account)?;
+        if !self
+            .root
+            .path()
+            .join(&path)
+            .try_exists()
+            .map_err(|_| CredentialError::Io)?
+        {
+            return Ok(None);
+        }
+        let file = self
+            .root
+            .open_existing_file(&path)
+            .map_err(|_| CredentialError::Io)?;
+        let mut encoded = Vec::new();
+        file.file()
+            .take(513)
+            .read_to_end(&mut encoded)
+            .map_err(|_| CredentialError::Io)?;
+        if encoded.len() > 512 {
+            return Err(CredentialError::Corrupt);
+        }
+        let plaintext = crypto::decrypt(&self.key()?, account.as_bytes(), &encoded)?;
+        file.revalidate(&self.root)
+            .map_err(|_| CredentialError::Io)?;
+        if plaintext.len() > 256 {
+            return Err(CredentialError::Corrupt);
+        }
+        Ok(Some(plaintext))
+    }
+    fn write(&self, account: &str, envelope: &[u8]) -> Result<(), CredentialError> {
+        if envelope.len() > 256 {
+            return Err(CredentialError::Oversized);
+        }
+        let encoded = crypto::encrypt(&self.key()?, account.as_bytes(), envelope)?;
+        let file = self
+            .root
+            .open_file(&Self::path(account)?)
+            .map_err(|_| CredentialError::Io)?;
+        let mut handle = file.file();
+        handle
+            .seek(SeekFrom::Start(0))
+            .map_err(|_| CredentialError::Io)?;
+        handle
+            .write_all(&encoded)
+            .map_err(|_| CredentialError::Io)?;
+        handle
+            .set_len(encoded.len() as u64)
+            .map_err(|_| CredentialError::Io)?;
+        handle.sync_all().map_err(|_| CredentialError::Io)?;
+        file.revalidate(&self.root)
+            .map_err(|_| CredentialError::Io)?;
+        self.root.sync_directory().map_err(|_| CredentialError::Io)
+    }
+    fn delete(&self, account: &str) -> Result<(), CredentialError> {
+        let path = self.root.path().join(Self::path(account)?);
+        if !path.try_exists().map_err(|_| CredentialError::Io)? {
+            return Ok(());
+        }
+        self.root
+            .revalidate_file(&path)
+            .map_err(|_| CredentialError::Io)?;
+        std::fs::remove_file(path).map_err(|_| CredentialError::Io)?;
+        self.root.sync_directory().map_err(|_| CredentialError::Io)
+    }
+}
diff --git a/crates/colossus-credentials/src/lib.rs b/crates/colossus-credentials/src/lib.rs
index d83633e0d..5332d042e 100644
--- a/crates/colossus-credentials/src/lib.rs
+++ b/crates/colossus-credentials/src/lib.rs
@@ -2,11 +2,20 @@
 
 mod crypto;
 mod database;
+mod metadata_view;
 mod platform;
 mod vault;
 
 pub use platform::{PlatformKeyStore, SystemKeyStore};
-pub use vault::PlatformCredentialVault;
+pub use vault::{PlatformCredentialVault, VaultKeyMetadata, VaultRecordMetadata, VaultSourceGuard};
 
+mod development;
+mod environment;
 #[cfg(test)]
 mod tests;
+pub use development::{
+    DEVELOPMENT_AUTHORITY_VARIABLE, DevelopmentAuthority, DevelopmentAuthorityMetadata,
+    DevelopmentStoreScope, development_journal_key, headless_credential_account, seal_existing,
+    seal_existing_record,
+};
+pub use environment::EnvironmentKeyStore;
diff --git a/crates/colossus-credentials/src/metadata_view.rs b/crates/colossus-credentials/src/metadata_view.rs
new file mode 100644
index 000000000..41fdd61fa
--- /dev/null
+++ b/crates/colossus-credentials/src/metadata_view.rs
@@ -0,0 +1,279 @@
+//! Source-read-only vault metadata, including bounded volatile allocator recovery.
+
+use crate::{
+    database::{DATABASE_FILE, Initialization, LEASE_FILE, Metadata, VaultLease},
+    vault::home_error,
+};
+use colossus_contracts::CredentialError;
+use colossus_home::{ConfinedFile, ConfinedRoot, HomeError};
+use fs4::fs_std::FileExt;
+use redb::{Database, ReadableDatabase as _, ReadableTableMetadata as _, StorageBackend};
+use sha2::{Digest as _, Sha256};
+use std::{
+    fmt,
+    io::{self, Read as _, Seek as _, SeekFrom},
+    path::Path,
+};
+use zeroize::Zeroizing;
+
+const MAX_SNAPSHOT_BYTES: u64 = 64 * 1024 * 1024;
+
+pub(crate) struct MetadataView {
+    database: Database,
+    source: VaultLease,
+    lease: VaultLease,
+    source_hash: [u8; 32],
+}
+
+/// Lightweight writer exclusion after the volatile database has been dropped.
+pub(crate) struct SourceObservation {
+    source: VaultLease,
+    lease: VaultLease,
+    source_hash: [u8; 32],
+}
+
+impl SourceObservation {
+    pub(crate) fn revalidate(&self, root: &ConfinedRoot) -> Result<(), CredentialError> {
+        revalidate_source(root, &self.source, &self.lease, self.source_hash)
+    }
+}
+
+impl MetadataView {
+    pub(crate) fn open_existing(root: &ConfinedRoot) -> Result<Option<Self>, CredentialError> {
+        let source = match root.open_existing_file(Path::new(DATABASE_FILE)) {
+            Ok(source) => source,
+            Err(HomeError::Io { source, .. }) if source.kind() == io::ErrorKind::NotFound => {
+                return Ok(None);
+            }
+            Err(error) => return Err(home_error(error)),
+        };
+        Self::open(root, source).map(Some)
+    }
+
+    pub(crate) fn open(root: &ConfinedRoot, source: ConfinedFile) -> Result<Self, CredentialError> {
+        // Observation never creates a lock or database. Share the existing vault
+        // lease, and also lock the retained descriptor against direct redb writers.
+        let lease = root
+            .open_existing_file(Path::new(LEASE_FILE))
+            .map_err(home_error)?;
+        let lease = owned_shared_lease(root, lease)?;
+        let source = owned_shared_lease(root, source)?;
+        let length = source
+            .file()
+            .metadata()
+            .map_err(|_| CredentialError::Io)?
+            .len();
+        if length == 0 {
+            return Err(CredentialError::Corrupt);
+        }
+        if length > MAX_SNAPSHOT_BYTES {
+            return Err(CredentialError::Oversized);
+        }
+        // Pinned redb's read-only API opens another path-based descriptor whose
+        // shared flock can be inherited by a concurrent fork. Observe encrypted
+        // bytes only through our owned descriptor, and keep all redb IO in memory.
+        // Metadata/apply paths remain bounded; ordinary runtime vault IO stays disk.
+        let bytes = snapshot_bytes(&source)?;
+        let source_hash = Sha256::digest(bytes.as_slice()).into();
+        source.revalidate(root).map_err(home_error)?;
+        lease.revalidate(root).map_err(home_error)?;
+        let backend = BoundedMemoryBackend(redb::backends::InMemoryBackend::new());
+        backend
+            .set_len(bytes.len() as u64)
+            .map_err(|_| CredentialError::Oversized)?;
+        backend
+            .write(0, &bytes)
+            .map_err(|_| CredentialError::Corrupt)?;
+        let database = Database::builder()
+            .set_cache_size(1024 * 1024)
+            .create_with_backend(backend)
+            .map_err(|_| CredentialError::Corrupt)?;
+        let view = Self {
+            database,
+            source,
+            lease,
+            source_hash,
+        };
+        view.revalidate(root)?;
+        Ok(view)
+    }
+
+    pub(crate) fn begin_read(&self) -> Result<redb::ReadTransaction, CredentialError> {
+        self.database.begin_read().map_err(|_| CredentialError::Io)
+    }
+
+    pub(crate) fn metadata(&self, owner_scope_hash: &str) -> Result<Metadata, CredentialError> {
+        let read = self.begin_read()?;
+        let table = read
+            .open_table(crate::database::METADATA)
+            .map_err(|_| CredentialError::Corrupt)?;
+        if table.len().map_err(|_| CredentialError::Corrupt)? != 1 {
+            return Err(CredentialError::Corrupt);
+        }
+        let bytes = table
+            .get("state")
+            .map_err(|_| CredentialError::Corrupt)?
+            .ok_or(CredentialError::Corrupt)?;
+        if bytes.value().len() > 2048 {
+            return Err(CredentialError::Corrupt);
+        }
+        let metadata: Metadata =
+            serde_json::from_slice(bytes.value()).map_err(|_| CredentialError::Corrupt)?;
+        metadata.validate(owner_scope_hash)?;
+        if metadata.state != Initialization::Ready {
+            return Err(CredentialError::Corrupt);
+        }
+        Ok(metadata)
+    }
+
+    pub(crate) fn revalidate(&self, root: &ConfinedRoot) -> Result<(), CredentialError> {
+        revalidate_source(root, &self.source, &self.lease, self.source_hash)
+    }
+
+    pub(crate) fn into_observation(self) -> SourceObservation {
+        let Self {
+            database,
+            source,
+            lease,
+            source_hash,
+        } = self;
+        drop(database);
+        SourceObservation {
+            source,
+            lease,
+            source_hash,
+        }
+    }
+}
+
+fn owned_shared_lease(
+    root: &ConfinedRoot,
+    file: ConfinedFile,
+) -> Result<VaultLease, CredentialError> {
+    if !FileExt::try_lock_shared(file.file()).map_err(|_| CredentialError::Io)? {
+        return Err(CredentialError::Busy);
+    }
+    // Wrap immediately after success, before validation or the next acquisition.
+    let lease = VaultLease(file);
+    lease.revalidate(root).map_err(home_error)?;
+    Ok(lease)
+}
+
+fn revalidate_source(
+    root: &ConfinedRoot,
+    source: &ConfinedFile,
+    lease: &ConfinedFile,
+    source_hash: [u8; 32],
+) -> Result<(), CredentialError> {
+    source.revalidate(root).map_err(home_error)?;
+    lease.revalidate(root).map_err(home_error)?;
+    if source_digest(source)? != source_hash {
+        return Err(CredentialError::Corrupt);
+    }
+    source.revalidate(root).map_err(home_error)?;
+    Ok(())
+}
+
+fn source_digest(file: &ConfinedFile) -> Result<[u8; 32], CredentialError> {
+    let length = file
+        .file()
+        .metadata()
+        .map_err(|_| CredentialError::Io)?
+        .len();
+    if length == 0 || length > MAX_SNAPSHOT_BYTES {
+        return Err(CredentialError::Oversized);
+    }
+    let mut reader = file.file().try_clone().map_err(|_| CredentialError::Io)?;
+    reader
+        .seek(SeekFrom::Start(0))
+        .map_err(|_| CredentialError::Io)?;
+    let mut digest = Sha256::new();
+    let mut count = 0_u64;
+    let mut buffer = [0_u8; 32 * 1024];
+    loop {
+        let read = reader.read(&mut buffer).map_err(|_| CredentialError::Io)?;
+        if read == 0 {
+            break;
+        }
+        count = count
+            .checked_add(read as u64)
+            .ok_or(CredentialError::Oversized)?;
+        if count > MAX_SNAPSHOT_BYTES {
+            return Err(CredentialError::Oversized);
+        }
+        digest.update(&buffer[..read]);
+    }
+    if count != length {
+        return Err(CredentialError::Corrupt);
+    }
+    Ok(digest.finalize().into())
+}
+
+fn snapshot_bytes(file: &ConfinedFile) -> Result<Zeroizing<Vec<u8>>, CredentialError> {
+    let length = file
+        .file()
+        .metadata()
+        .map_err(|_| CredentialError::Io)?
+        .len();
+    if length == 0 || length > MAX_SNAPSHOT_BYTES {
+        return Err(CredentialError::Oversized);
+    }
+    let mut reader = file.file().try_clone().map_err(|_| CredentialError::Io)?;
+    reader
+        .seek(SeekFrom::Start(0))
+        .map_err(|_| CredentialError::Io)?;
+    let mut bytes = Zeroizing::new(Vec::new());
+    reader
+        .take(MAX_SNAPSHOT_BYTES + 1)
+        .read_to_end(&mut bytes)
+        .map_err(|_| CredentialError::Io)?;
+    if bytes.len() as u64 != length {
+        return Err(CredentialError::Corrupt);
+    }
+    Ok(bytes)
+}
+
+// Recovery may resize storage. Bound both the initial encrypted snapshot and all
+// allocator writes so malformed input cannot grow the volatile backend unchecked.
+struct BoundedMemoryBackend(redb::backends::InMemoryBackend);
+impl fmt::Debug for BoundedMemoryBackend {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("BoundedMemoryBackend")
+            .finish_non_exhaustive()
+    }
+}
+impl StorageBackend for BoundedMemoryBackend {
+    fn len(&self) -> io::Result<u64> {
+        StorageBackend::len(&self.0)
+    }
+    fn read(&self, offset: u64, out: &mut [u8]) -> io::Result<()> {
+        bounded_range(offset, out.len())?;
+        StorageBackend::read(&self.0, offset, out)
+    }
+    fn set_len(&self, length: u64) -> io::Result<()> {
+        if length > MAX_SNAPSHOT_BYTES {
+            return Err(io::Error::from(io::ErrorKind::InvalidInput));
+        }
+        StorageBackend::set_len(&self.0, length)
+    }
+    fn sync_data(&self) -> io::Result<()> {
+        StorageBackend::sync_data(&self.0)
+    }
+    fn write(&self, offset: u64, bytes: &[u8]) -> io::Result<()> {
+        bounded_range(offset, bytes.len())?;
+        StorageBackend::write(&self.0, offset, bytes)
+    }
+}
+fn bounded_range(offset: u64, length: usize) -> io::Result<()> {
+    if offset
+        .checked_add(length as u64)
+        .is_none_or(|end| end > MAX_SNAPSHOT_BYTES)
+    {
+        return Err(io::Error::from(io::ErrorKind::InvalidInput));
+    }
+    Ok(())
+}
+
+#[cfg(all(test, unix))]
+mod lease_tests;
diff --git a/crates/colossus-credentials/src/metadata_view/lease_tests.rs b/crates/colossus-credentials/src/metadata_view/lease_tests.rs
new file mode 100644
index 000000000..1af708eb1
--- /dev/null
+++ b/crates/colossus-credentials/src/metadata_view/lease_tests.rs
@@ -0,0 +1,131 @@
+use super::*;
+use crate::database::OpenedVault;
+use std::io::Write as _;
+use std::os::unix::fs::PermissionsExt as _;
+
+#[test]
+fn failed_database_initialization_releases_owned_lock_without_unlocking_a_competitor() {
+    let temporary = tempfile::tempdir().unwrap();
+    let path = std::fs::canonicalize(temporary.path()).unwrap();
+    std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o700)).unwrap();
+    let root = ConfinedRoot::bind(path).unwrap();
+    let file = root.open_file(Path::new(DATABASE_FILE)).unwrap();
+    let invalid_header = vec![0x5a; 4096];
+    let mut writer = file.file();
+    writer.write_all(&invalid_header).unwrap();
+    writer.sync_all().unwrap();
+    let _inherited_database = file.file().try_clone().unwrap();
+    let lease = root.open_file(Path::new(LEASE_FILE)).unwrap();
+    assert!(FileExt::try_lock_exclusive(lease.file()).unwrap());
+    assert!(matches!(
+        OpenedVault::open(file, VaultLease(lease)),
+        Err(CredentialError::Io)
+    ));
+    assert_eq!(
+        std::fs::read(root.path().join(DATABASE_FILE)).unwrap(),
+        invalid_header
+    );
+    let competitor = root
+        .open_existing_file_read_write(Path::new(DATABASE_FILE))
+        .unwrap();
+    assert!(
+        FileExt::try_lock_exclusive(competitor.file()).unwrap(),
+        "failed initialization must release its lock despite an inherited duplicate"
+    );
+    let lease = root.open_file(Path::new(LEASE_FILE)).unwrap();
+    assert!(FileExt::try_lock_exclusive(lease.file()).unwrap());
+    assert!(matches!(
+        OpenedVault::open(
+            root.open_existing_file_read_write(Path::new(DATABASE_FILE))
+                .unwrap(),
+            VaultLease(lease)
+        ),
+        Err(CredentialError::Busy)
+    ));
+    let probe = root
+        .open_existing_file_read_write(Path::new(DATABASE_FILE))
+        .unwrap();
+    assert!(
+        !FileExt::try_lock_exclusive(probe.file()).unwrap(),
+        "failed acquisition must retain the actual competing owner's lock"
+    );
+    FileExt::unlock(competitor.file()).unwrap();
+}
+
+#[test]
+fn owned_database_and_observer_leases_release_duplicates_only_after_close() {
+    let temporary = tempfile::tempdir().unwrap();
+    let path = std::fs::canonicalize(temporary.path()).unwrap();
+    std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o700)).unwrap();
+    let root = ConfinedRoot::bind(path).unwrap();
+    let file = root.open_file(Path::new(DATABASE_FILE)).unwrap();
+    let database = Database::builder()
+        .create_file(file.file().try_clone().unwrap())
+        .unwrap();
+    let lease = root.open_file(Path::new(LEASE_FILE)).unwrap();
+    assert!(FileExt::try_lock_exclusive(lease.file()).unwrap());
+    let opened = OpenedVault {
+        database,
+        master: None,
+        file: VaultLease(file),
+        lease: VaultLease(lease),
+    };
+    let _inherited_database = opened.file.file().try_clone().unwrap();
+    assert!(matches!(
+        Database::open(root.path().join(DATABASE_FILE)),
+        Err(redb::DatabaseError::DatabaseAlreadyOpen)
+    ));
+    drop(opened);
+    drop(
+        Database::open(root.path().join(DATABASE_FILE))
+            .expect("closed writer explicitly releases inherited OFD"),
+    );
+
+    let observer = MetadataView::open_existing(&root).unwrap().unwrap();
+    let _inherited_source = observer.source.file().try_clone().unwrap();
+    let _inherited_lease = observer.lease.file().try_clone().unwrap();
+    assert!(matches!(
+        Database::open(root.path().join(DATABASE_FILE)),
+        Err(redb::DatabaseError::DatabaseAlreadyOpen)
+    ));
+    drop(observer);
+    drop(
+        Database::open(root.path().join(DATABASE_FILE))
+            .expect("observer holds no hidden disk reader and releases owned OFDs"),
+    );
+
+    let source = root
+        .open_existing_file_read_write(Path::new(DATABASE_FILE))
+        .unwrap();
+    assert!(FileExt::try_lock_exclusive(source.file()).unwrap());
+    let acquired = owned_shared_lease(
+        &root,
+        root.open_existing_file(Path::new(LEASE_FILE)).unwrap(),
+    )
+    .unwrap();
+    let _inherited_first_lease = acquired.file().try_clone().unwrap();
+    assert!(matches!(
+        owned_shared_lease(
+            &root,
+            root.open_existing_file(Path::new(DATABASE_FILE)).unwrap()
+        ),
+        Err(CredentialError::Busy)
+    ));
+    drop(acquired);
+    let probe = root
+        .open_existing_file_read_write(Path::new(LEASE_FILE))
+        .unwrap();
+    assert!(
+        FileExt::try_lock_exclusive(probe.file()).unwrap(),
+        "partial acquisition's first guard cannot outlive its logical return"
+    );
+    assert!(
+        matches!(
+            Database::open(root.path().join(DATABASE_FILE)),
+            Err(redb::DatabaseError::DatabaseAlreadyOpen)
+        ),
+        "failed acquisition never unlocks the real competing owner"
+    );
+    FileExt::unlock(source.file()).unwrap();
+    FileExt::unlock(probe.file()).unwrap();
+}
diff --git a/crates/colossus-credentials/src/tests.rs b/crates/colossus-credentials/src/tests.rs
index ed5a1aa03..35c05b19f 100644
--- a/crates/colossus-credentials/src/tests.rs
+++ b/crates/colossus-credentials/src/tests.rs
@@ -1,3 +1,4 @@
+mod development;
 mod support;
 
 use crate::{
@@ -727,6 +728,23 @@ fn vault_process_child() {
             assert!(vault.read(&key()).unwrap().unwrap().expose() == record(8192).expose());
             vault.write(&key(), &record(65536)).unwrap();
         }
+        "unclean-exit" => {
+            use fs4::fs_std::FileExt as _;
+            let lease = root
+                .open_existing_file_read_write(Path::new(crate::database::LEASE_FILE))
+                .unwrap();
+            assert!(lease.file().try_lock_exclusive().unwrap());
+            let file = root
+                .open_existing_file_read_write(Path::new(DATABASE_FILE))
+                .unwrap();
+            let database = redb::Database::builder()
+                .create_file(file.into_file())
+                .unwrap();
+            database.begin_write().unwrap().commit().unwrap();
+            // OS process teardown releases locks without redb's clean allocator
+            // shutdown; no platform key or encrypted record is read or changed.
+            std::process::exit(0);
+        }
         _ => panic!("unknown credential subprocess mode"),
     }
 }
diff --git a/crates/colossus-credentials/src/tests/development.rs b/crates/colossus-credentials/src/tests/development.rs
new file mode 100644
index 000000000..6eade8555
--- /dev/null
+++ b/crates/colossus-credentials/src/tests/development.rs
@@ -0,0 +1,419 @@
+use super::{Fixture, MemoryKeys, key, record};
+use crate::{
+    DevelopmentAuthority, DevelopmentStoreScope, PlatformCredentialVault, PlatformKeyStore,
+};
+use colossus_contracts::CredentialError;
+use colossus_ports::CredentialVault as _;
+use std::sync::Arc;
+
+#[test]
+fn development_authority_is_home_bound_private_and_never_regenerates_partial_keys() {
+    let home = Fixture::new();
+    let other = Fixture::new();
+    let path = DevelopmentAuthority::path_for_home(&home.root);
+    assert!(DevelopmentAuthority::initialize(&home.root, &[home.root.path().to_owned()]).is_err());
+    assert!(!path.exists());
+    let authority = DevelopmentAuthority::initialize(&home.root, &[]).unwrap();
+    let key_path = path.join(".authority-key.env");
+    let original = std::fs::read(&key_path).unwrap();
+    assert_eq!(original.len(), 65);
+    assert!(!format!("{authority:?}").contains(std::str::from_utf8(&original[..64]).unwrap()));
+    let store = authority.store(DevelopmentStoreScope::PublicApi).unwrap();
+    store.write("opaque", b"original-token").unwrap();
+    assert_eq!(
+        store.read("opaque").unwrap().unwrap().as_slice(),
+        b"original-token"
+    );
+    assert!(DevelopmentAuthority::open(&other.root, &path, &[]).is_err());
+    let wrong_path = other.root.path().join("must-remain-absent");
+    assert!(DevelopmentAuthority::open(&home.root, &wrong_path, &[]).is_err());
+    assert!(!wrong_path.exists());
+    assert!(DevelopmentAuthority::initialize(&home.root, &[home.root.path().to_owned()]).is_err());
+    drop(store);
+    drop(authority);
+    std::fs::remove_file(path.join("authority.json")).unwrap();
+    assert!(DevelopmentAuthority::initialize(&home.root, &[]).is_err());
+    assert_eq!(std::fs::read(key_path).unwrap(), original);
+}
+
+#[cfg(unix)]
+#[test]
+fn development_authority_rejects_symlink_and_hardlink_key_aliases_without_writes() {
+    use std::os::unix::fs::symlink;
+    let home = Fixture::new();
+    let authority = DevelopmentAuthority::initialize(&home.root, &[]).unwrap();
+    let path = DevelopmentAuthority::path_for_home(&home.root);
+    let key_path = path.join(".authority-key.env");
+    let original = std::fs::read(&key_path).unwrap();
+    drop(authority);
+    let outside = home.root.path().join("outside.env");
+    std::fs::rename(&key_path, &outside).unwrap();
+    symlink(&outside, &key_path).unwrap();
+    assert!(DevelopmentAuthority::open(&home.root, &path, &[]).is_err());
+    assert_eq!(std::fs::read(&outside).unwrap(), original);
+    std::fs::remove_file(&key_path).unwrap();
+    std::fs::hard_link(&outside, &key_path).unwrap();
+    assert!(DevelopmentAuthority::open(&home.root, &path, &[]).is_err());
+    assert_eq!(std::fs::read(&outside).unwrap(), original);
+}
+
+#[cfg(unix)]
+#[test]
+fn development_authority_rejects_broadened_key_permissions_without_repair() {
+    use std::os::unix::fs::PermissionsExt as _;
+    let home = Fixture::new();
+    let authority = DevelopmentAuthority::initialize(&home.root, &[]).unwrap();
+    let path = DevelopmentAuthority::path_for_home(&home.root);
+    let key = path.join(".authority-key.env");
+    drop(authority);
+    std::fs::set_permissions(&key, std::fs::Permissions::from_mode(0o644)).unwrap();
+    assert!(DevelopmentAuthority::open(&home.root, &path, &[]).is_err());
+    assert_eq!(
+        std::fs::metadata(key).unwrap().permissions().mode() & 0o777,
+        0o644
+    );
+}
+
+#[test]
+fn development_rewrap_preserves_vault_identity_records_and_old_platform_envelope() {
+    let source = Fixture::new();
+    let authority_home = Fixture::new();
+    let keys = Arc::new(MemoryKeys::default());
+    let vault = source.vault(keys.clone());
+    let value = record(100);
+    vault.write(&key(), &value).unwrap();
+    drop(vault);
+    let metadata = PlatformCredentialVault::key_metadata(&source.root, "test-owner")
+        .unwrap()
+        .unwrap();
+    let old_values = keys.state.lock().unwrap().values.clone();
+    let authority = DevelopmentAuthority::initialize(&authority_home.root, &[]).unwrap();
+    let target = Arc::new(
+        authority
+            .store(DevelopmentStoreScope::DesktopVault)
+            .unwrap(),
+    );
+    let source_vault = source.vault(keys.clone());
+    assert!(source_vault.rewrap_key(target.as_ref(), &metadata).unwrap());
+    assert!(!source_vault.rewrap_key(target.as_ref(), &metadata).unwrap());
+    assert_eq!(keys.state.lock().unwrap().values, old_values);
+    drop(source_vault);
+    assert_eq!(
+        PlatformCredentialVault::key_metadata(&source.root, "test-owner")
+            .unwrap()
+            .unwrap(),
+        metadata
+    );
+    let reopened =
+        PlatformCredentialVault::with_key_store(source.root.clone(), "test-owner", target.clone())
+            .unwrap();
+    assert_eq!(
+        reopened.read(&key()).unwrap().unwrap().expose(),
+        value.expose()
+    );
+    drop(reopened);
+    let conflicting = Arc::new(MemoryKeys::default());
+    conflicting
+        .write(&metadata.account, b"different-value")
+        .unwrap();
+    let source_vault = source.vault(keys);
+    assert!(matches!(
+        source_vault.rewrap_key(conflicting.as_ref(), &metadata),
+        Err(CredentialError::Corrupt)
+    ));
+    assert_eq!(
+        conflicting
+            .read(&metadata.account)
+            .unwrap()
+            .unwrap()
+            .as_slice(),
+        b"different-value"
+    );
+}
+
+#[test]
+fn metadata_plan_of_absent_vault_creates_nothing() {
+    let source = Fixture::new();
+    assert!(
+        PlatformCredentialVault::key_metadata(&source.root, "test-owner")
+            .unwrap()
+            .is_none()
+    );
+    assert_eq!(std::fs::read_dir(source.root.path()).unwrap().count(), 0);
+}
+
+#[test]
+fn named_record_copy_preserves_only_selected_enrollment_and_keeps_global_source() {
+    use colossus_ports::CredentialKey;
+    let source = Fixture::new();
+    let target = Fixture::new();
+    let authority_home = Fixture::new();
+    let keys = Arc::new(MemoryKeys::default());
+    let selected = CredentialKey::new("cloud-connector", "cloud-e2e-cli").unwrap();
+    let unrelated = CredentialKey::new("cloud-connector", "unrelated").unwrap();
+    let value = record(200);
+    let source_vault = source.vault_with_scope(keys.clone(), "cloud-connector");
+    source_vault.write(&selected, &value).unwrap();
+    source_vault.write(&unrelated, &record(20)).unwrap();
+    drop(source_vault);
+    let metadata =
+        PlatformCredentialVault::record_metadata(&source.root, "cloud-connector", &selected)
+            .unwrap()
+            .unwrap();
+    let source_keys = keys.state.lock().unwrap().values.clone();
+    let authority = DevelopmentAuthority::initialize(&authority_home.root, &[]).unwrap();
+    let target_keys = Arc::new(
+        authority
+            .store(DevelopmentStoreScope::ControlPlaneVault)
+            .unwrap(),
+    );
+    let target_vault = PlatformCredentialVault::with_key_store(
+        target.root.clone(),
+        "cloud-connector",
+        target_keys,
+    )
+    .unwrap();
+    let source_vault = source.vault_with_scope(keys.clone(), "cloud-connector");
+    assert!(matches!(
+        source_vault.copy_existing_record(&source_vault, &selected, &metadata),
+        Err(CredentialError::InvalidInput)
+    ));
+    assert!(
+        source_vault
+            .copy_existing_record(&target_vault, &selected, &metadata)
+            .unwrap()
+    );
+    assert!(
+        !source_vault
+            .copy_existing_record(&target_vault, &selected, &metadata)
+            .unwrap()
+    );
+    assert!(target_vault.read(&selected).unwrap().unwrap().expose() == value.expose());
+    assert!(target_vault.read(&unrelated).unwrap().is_none());
+    assert!(source_vault.read(&unrelated).unwrap().is_some());
+    assert!(keys.state.lock().unwrap().values == source_keys);
+    drop(source_vault);
+    assert!(
+        PlatformCredentialVault::record_metadata(&source.root, "cloud-connector", &selected)
+            .unwrap()
+            .unwrap()
+            == metadata
+    );
+}
+
+#[test]
+fn unclean_metadata_recovers_only_in_memory_without_source_writes_or_key_reads() {
+    use std::{io::Write as _, path::Path};
+    let source = Fixture::new();
+    let snapshot = Fixture::new();
+    let keys = Arc::new(MemoryKeys::default());
+    let vault = source.vault(keys.clone());
+    vault.write(&key(), &record(100)).unwrap();
+    let sibling = colossus_ports::CredentialKey::new("manual-token", "unrelated").unwrap();
+    vault.write(&sibling, &record(20)).unwrap();
+    // Exit a committed writer without Drop so allocator recovery is genuinely
+    // required. Read only after its mandatory Windows file locks are released.
+    drop(vault);
+    super::run_child(&source, "unclean-exit");
+    let bytes = std::fs::read(source.root.path().join("credentials-v1.redb")).unwrap();
+    let source_writer = source.vault(keys.clone());
+    source_writer.read(&key()).unwrap();
+    snapshot
+        .root
+        .open_file(Path::new("credentials-v1.redb"))
+        .unwrap()
+        .file()
+        .write_all(&bytes)
+        .unwrap();
+    drop(
+        snapshot
+            .root
+            .open_file(Path::new("credentials-v1.lock"))
+            .unwrap(),
+    );
+    assert!(matches!(
+        redb::ReadOnlyDatabase::open(snapshot.root.path().join("credentials-v1.redb")),
+        Err(redb::DatabaseError::RepairAborted)
+    ));
+    let key_reads = keys.state.lock().unwrap().reads;
+    let file_names = || {
+        let mut paths = std::fs::read_dir(snapshot.root.path())
+            .unwrap()
+            .map(|entry| entry.unwrap().file_name())
+            .collect::<Vec<_>>();
+        paths.sort();
+        paths
+    };
+    let before_files = file_names();
+    let metadata = PlatformCredentialVault::key_metadata(&snapshot.root, "test-owner")
+        .unwrap()
+        .unwrap();
+    let selected = PlatformCredentialVault::record_metadata(&snapshot.root, "test-owner", &key())
+        .unwrap()
+        .unwrap();
+    assert_eq!(selected.vault, metadata);
+    assert!(matches!(
+        PlatformCredentialVault::key_metadata(&snapshot.root, "wrong-owner"),
+        Err(CredentialError::Corrupt)
+    ));
+    assert!(
+        PlatformCredentialVault::record_metadata(
+            &snapshot.root,
+            "test-owner",
+            &colossus_ports::CredentialKey::new("manual-token", "absent").unwrap()
+        )
+        .unwrap()
+        .is_none()
+    );
+    assert_eq!(keys.state.lock().unwrap().reads, key_reads);
+    assert_eq!(file_names(), before_files);
+    assert_eq!(
+        std::fs::read(snapshot.root.path().join("credentials-v1.redb")).unwrap(),
+        bytes
+    );
+    // Apply retains the same encrypted original too: verify the original envelope
+    // in memory, rewrap only that envelope, and independently copy one exact record.
+    let original_keys = keys.state.lock().unwrap().values.clone();
+    let destination = Fixture::new();
+    let destination_keys = Arc::new(MemoryKeys::default());
+    let destination_vault = destination.vault(destination_keys.clone());
+    let snapshot_vault = snapshot.vault(keys.clone());
+    let wrapping_store = MemoryKeys::default();
+    assert!(
+        snapshot_vault
+            .rewrap_key(&wrapping_store, &metadata)
+            .unwrap()
+    );
+    assert!(
+        !snapshot_vault
+            .rewrap_key(&wrapping_store, &metadata)
+            .unwrap()
+    );
+    assert!(
+        snapshot_vault
+            .copy_existing_record(&destination_vault, &key(), &selected)
+            .unwrap()
+    );
+    assert!(
+        !snapshot_vault
+            .copy_existing_record(&destination_vault, &key(), &selected)
+            .unwrap()
+    );
+    assert_eq!(
+        destination_vault.read(&key()).unwrap().unwrap().expose(),
+        record(100).expose()
+    );
+    assert!(destination_vault.read(&sibling).unwrap().is_none());
+    assert_eq!(keys.state.lock().unwrap().values, original_keys);
+    assert_eq!(file_names(), before_files);
+    assert_eq!(
+        std::fs::read(snapshot.root.path().join("credentials-v1.redb")).unwrap(),
+        bytes
+    );
+    assert!(matches!(
+        redb::ReadOnlyDatabase::open(snapshot.root.path().join("credentials-v1.redb")),
+        Err(redb::DatabaseError::RepairAborted)
+    ));
+    assert!(matches!(
+        PlatformCredentialVault::key_metadata(&source.root, "test-owner"),
+        Err(CredentialError::Busy)
+    ));
+}
+
+#[test]
+fn metadata_recovery_refuses_missing_lease_corruption_and_oversized_snapshots() {
+    use std::{
+        io::{Seek as _, SeekFrom, Write as _},
+        path::Path,
+    };
+    let source = Fixture::new();
+    let keys = Arc::new(MemoryKeys::default());
+    let vault = source.vault(keys);
+    vault.write(&key(), &record(100)).unwrap();
+    drop(vault);
+    let bytes = std::fs::read(source.root.path().join("credentials-v1.redb")).unwrap();
+    let snapshot = Fixture::new();
+    let file = snapshot
+        .root
+        .open_file(Path::new("credentials-v1.redb"))
+        .unwrap();
+    file.file().write_all(&bytes).unwrap();
+    assert!(PlatformCredentialVault::key_metadata(&snapshot.root, "test-owner").is_err());
+    assert!(!snapshot.root.path().join("credentials-v1.lock").exists());
+    drop(
+        snapshot
+            .root
+            .open_file(Path::new("credentials-v1.lock"))
+            .unwrap(),
+    );
+    file.file().set_len(64 * 1024 * 1024 + 1).unwrap();
+    let mut corrupt = file.file().try_clone().unwrap();
+    corrupt.seek(SeekFrom::Start(0)).unwrap();
+    corrupt.write_all(b"invalid-header-before-parser").unwrap();
+    // Oversize wins even over an invalid header, proving the bound precedes redb.
+    assert!(matches!(
+        PlatformCredentialVault::key_metadata(&snapshot.root, "test-owner"),
+        Err(CredentialError::Oversized)
+    ));
+    file.file().set_len(0).unwrap();
+    corrupt.seek(SeekFrom::Start(0)).unwrap();
+    corrupt.write_all(b"not-a-vault").unwrap();
+    assert!(matches!(
+        PlatformCredentialVault::key_metadata(&snapshot.root, "test-owner"),
+        Err(CredentialError::Corrupt)
+    ));
+    assert_eq!(std::fs::read(file.path()).unwrap(), b"not-a-vault");
+}
+
+#[test]
+fn source_observation_excludes_writers_until_drop_and_detects_modified_source() {
+    use std::{
+        io::{Seek as _, SeekFrom, Write as _},
+        path::Path,
+    };
+    let source = Fixture::new();
+    let keys = Arc::new(MemoryKeys::default());
+    let vault = source.vault(keys.clone());
+    vault.write(&key(), &record(100)).unwrap();
+    drop(vault);
+    let original = std::fs::read(source.root.path().join("credentials-v1.redb")).unwrap();
+    let observer = source.vault(keys.clone());
+    let key_reads = keys.state.lock().unwrap().reads;
+    let guard = observer.source_guard().unwrap();
+    assert_eq!(keys.state.lock().unwrap().reads, key_reads);
+    let writer = source.vault(keys);
+    assert!(matches!(writer.read(&key()), Err(CredentialError::Busy)));
+    guard.revalidate().unwrap();
+    assert_eq!(
+        std::fs::read(source.root.path().join("credentials-v1.redb")).unwrap(),
+        original
+    );
+    let file = source
+        .root
+        .open_existing_file_read_write(Path::new("credentials-v1.redb"))
+        .unwrap();
+    let mut bytes = file.file().try_clone().unwrap();
+    bytes.seek(SeekFrom::Start(0)).unwrap();
+    #[cfg(unix)]
+    {
+        // Bypass advisory locks: same-inode mutation must fail the final digest
+        // revalidation even though the pathname and retained identity still match.
+        bytes.write_all(&[original[0] ^ 1]).unwrap();
+        assert!(matches!(guard.revalidate(), Err(CredentialError::Corrupt)));
+        bytes.seek(SeekFrom::Start(0)).unwrap();
+        bytes.write_all(&original[..1]).unwrap();
+    }
+    #[cfg(windows)]
+    {
+        // Windows enforces the observer's shared byte-range lock on other write
+        // handles, so the hostile write must be rejected before changing bytes.
+        let error = bytes.write_all(&[original[0] ^ 1]).unwrap_err();
+        assert_eq!(error.raw_os_error(), Some(33)); // ERROR_LOCK_VIOLATION
+    }
+    guard.revalidate().unwrap();
+    drop(guard);
+    assert_eq!(
+        writer.read(&key()).unwrap().unwrap().expose(),
+        record(100).expose()
+    );
+}
diff --git a/crates/colossus-credentials/src/vault.rs b/crates/colossus-credentials/src/vault.rs
index aedb4e9b6..df3225bb5 100644
--- a/crates/colossus-credentials/src/vault.rs
+++ b/crates/colossus-credentials/src/vault.rs
@@ -5,7 +5,8 @@ use colossus_contracts::{CredentialError, VaultRecord};
 use colossus_home::{ConfinedRoot, HomeError};
 use colossus_ports::{CredentialKey, CredentialVault};
 use fs4::fs_std::FileExt as _;
-use redb::{Database, Durability, ReadableDatabase as _};
+use redb::{Durability, ReadableDatabase as _};
+use serde::{Deserialize, Serialize};
 use sha2::{Digest as _, Sha256};
 use std::{
     fmt,
@@ -23,6 +24,60 @@ use crate::{
 
 const VERIFICATION: &[u8] = b"colossus-native-credential-vault-key-v1";
 
+/// Nonsecret exact vault identity for an explicitly reviewed offline rewrap.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct VaultKeyMetadata {
+    /// Original versioned vault identity, retained during rewrap.
+    pub vault_id: String,
+    /// Original master-key identity, retained during rewrap.
+    pub key_id: String,
+    /// Original native owner-purpose binding, never a caller authorization claim.
+    pub owner_scope_hash: String,
+    /// Exact fixed-service platform envelope selector derived from the identity.
+    pub account: String,
+}
+impl From<&Metadata> for VaultKeyMetadata {
+    fn from(value: &Metadata) -> Self {
+        Self {
+            vault_id: value.vault_id.clone(),
+            key_id: value.key_id.clone(),
+            owner_scope_hash: value.owner_scope_hash.clone(),
+            account: value.account(),
+        }
+    }
+}
+/// Ciphertext-only identity of one exact existing credential record.
+#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct VaultRecordMetadata {
+    /// Exact original vault identity; its master is never exported for record copy.
+    pub vault: VaultKeyMetadata,
+    /// SHA-256 of the selected ciphertext, binding reviewed source content.
+    pub ciphertext_sha256: String,
+}
+
+/// Opaque source-read-only observation retained through an offline custody apply.
+/// Holds writer exclusion and identity/hash proof, never a key or recovered database.
+pub struct VaultSourceGuard {
+    root: ConfinedRoot,
+    observation: crate::metadata_view::SourceObservation,
+}
+impl fmt::Debug for VaultSourceGuard {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("VaultSourceGuard")
+            .finish_non_exhaustive()
+    }
+}
+impl VaultSourceGuard {
+    /// Recheck the retained original source immediately before activating custody.
+    /// A replaced, modified or unsafe source fails without reading any credential.
+    pub fn revalidate(&self) -> Result<(), CredentialError> {
+        self.observation.revalidate(&self.root)
+    }
+}
+
 #[cfg(test)]
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub(crate) enum InitializationCheckpoint {
@@ -60,6 +115,137 @@ impl fmt::Debug for PlatformCredentialVault {
 }
 
 impl PlatformCredentialVault {
+    /// Retain a read-only source lease/hash through a multi-source offline apply.
+    /// Validates existing public metadata only. No source file or key is created,
+    /// repaired or read from a platform store; dropping the guard releases writers.
+    pub fn source_guard(&self) -> Result<VaultSourceGuard, CredentialError> {
+        let view = crate::metadata_view::MetadataView::open_existing(&self.root)?
+            .ok_or(CredentialError::MissingKey)?;
+        view.metadata(&self.owner_scope_hash)?;
+        view.revalidate(&self.root)?;
+        Ok(VaultSourceGuard {
+            root: self.root.clone(),
+            observation: view.into_observation(),
+        })
+    }
+
+    /// Read one existing ciphertext identity only, without initializing any source
+    /// or reading an OS key. Missing records fail rather than selecting another.
+    pub fn record_metadata(
+        root: &ConfinedRoot,
+        owner_scope: &str,
+        key: &CredentialKey,
+    ) -> Result<Option<VaultRecordMetadata>, CredentialError> {
+        let Some(database) = crate::metadata_view::MetadataView::open_existing(root)? else {
+            return Ok(None);
+        };
+        let metadata = database.metadata(&hex::encode(Sha256::digest(owner_scope.as_bytes())))?;
+        let read = database.begin_read()?;
+        let table = read
+            .open_table(RECORDS)
+            .map_err(|_| CredentialError::Corrupt)?;
+        let id = record_id(key);
+        let Some(value) = table.get(id.as_str()).map_err(|_| CredentialError::Io)? else {
+            database.revalidate(root)?;
+            return Ok(None);
+        };
+        if value.value().len() > crypto::MAX_CIPHERTEXT_BYTES {
+            return Err(CredentialError::Oversized);
+        }
+        let ciphertext_sha256 = hex::encode(Sha256::digest(value.value()));
+        database.revalidate(root)?;
+        Ok(Some(VaultRecordMetadata {
+            vault: VaultKeyMetadata::from(&metadata),
+            ciphertext_sha256,
+        }))
+    }
+
+    /// Copy only one approved record into an independently keyed target vault.
+    /// No source master, sibling record, grant or enrollment is exported/rotated.
+    pub fn copy_existing_record(
+        &self,
+        target: &dyn CredentialVault,
+        key: &CredentialKey,
+        expected: &VaultRecordMetadata,
+    ) -> Result<bool, CredentialError> {
+        if std::ptr::addr_eq(self as &dyn CredentialVault, target) {
+            return Err(CredentialError::InvalidInput);
+        }
+        let source = crate::metadata_view::MetadataView::open_existing(&self.root)?
+            .ok_or(CredentialError::MissingKey)?;
+        let metadata = source.metadata(&self.owner_scope_hash)?;
+        if VaultKeyMetadata::from(&metadata) != expected.vault {
+            return Err(CredentialError::Corrupt);
+        }
+        let id = record_id(key);
+        let ciphertext = {
+            let read = source.begin_read()?;
+            let table = read
+                .open_table(RECORDS)
+                .map_err(|_| CredentialError::Corrupt)?;
+            let value = table
+                .get(id.as_str())
+                .map_err(|_| CredentialError::Io)?
+                .ok_or(CredentialError::MissingKey)?;
+            if value.value().len() > crypto::MAX_CIPHERTEXT_BYTES {
+                return Err(CredentialError::Oversized);
+            }
+            if hex::encode(Sha256::digest(value.value())) != expected.ciphertext_sha256 {
+                return Err(CredentialError::Corrupt);
+            }
+            value.value().to_vec()
+        };
+        source.revalidate(&self.root)?;
+        let envelope = self
+            .keys
+            .read(&metadata.account())?
+            .ok_or(CredentialError::MissingKey)?;
+        let master = verified_source_key(&metadata, &envelope)?;
+        let plaintext = crypto::decrypt(&master, &metadata.aad(&id), &ciphertext)?;
+        source.revalidate(&self.root)?;
+        let copied = crate::development::seal_existing_record(target, key, &plaintext)?;
+        source.revalidate(&self.root)?;
+        Ok(copied)
+    }
+    /// Inspect existing public metadata only. Missing sources stay absent; no
+    /// lease file, vault, platform entry or key is created. An active writer fails.
+    pub fn key_metadata(
+        root: &ConfinedRoot,
+        owner_scope: &str,
+    ) -> Result<Option<VaultKeyMetadata>, CredentialError> {
+        let Some(database) = crate::metadata_view::MetadataView::open_existing(root)? else {
+            return Ok(None);
+        };
+        let metadata = database.metadata(&hex::encode(Sha256::digest(owner_scope.as_bytes())))?;
+        database.revalidate(root)?;
+        Ok(Some(VaultKeyMetadata::from(&metadata)))
+    }
+
+    /// Rewrap only this reviewed ready vault's verified small master envelope.
+    /// Source records/metadata and the old platform entry remain unchanged. It
+    /// holds read-only source leases that exclude writers and never repairs or
+    /// initializes the original source database.
+    pub fn rewrap_key(
+        &self,
+        target: &dyn PlatformKeyStore,
+        expected: &VaultKeyMetadata,
+    ) -> Result<bool, CredentialError> {
+        let source = crate::metadata_view::MetadataView::open_existing(&self.root)?
+            .ok_or(CredentialError::MissingKey)?;
+        let metadata = source.metadata(&self.owner_scope_hash)?;
+        if VaultKeyMetadata::from(&metadata) != *expected {
+            return Err(CredentialError::Corrupt);
+        }
+        let envelope = self
+            .keys
+            .read(&metadata.account())?
+            .ok_or(CredentialError::MissingKey)?;
+        let _key = verified_source_key(&metadata, &envelope)?;
+        source.revalidate(&self.root)?;
+        let copied = crate::development::seal_existing(target, &metadata.account(), &envelope)?;
+        source.revalidate(&self.root)?;
+        Ok(copied)
+    }
     /// Bind an existing owner-private root without creating any file or OS-store entry.
     pub fn new(
         root: ConfinedRoot,
@@ -150,6 +336,7 @@ impl PlatformCredentialVault {
         {
             return Err(CredentialError::Busy);
         }
+        let lease = crate::database::VaultLease(lease);
         let file = if create {
             self.root.open_file(Path::new(DATABASE_FILE))
         } else {
@@ -157,19 +344,7 @@ impl PlatformCredentialVault {
                 .open_existing_file_read_write(Path::new(DATABASE_FILE))
         }
         .map_err(home_error)?;
-        let database = Database::builder()
-            .create_file(file.file().try_clone().map_err(|_| CredentialError::Io)?)
-            .map_err(|error| match error {
-                redb::DatabaseError::DatabaseAlreadyOpen => CredentialError::Busy,
-                redb::DatabaseError::Storage(redb::StorageError::Io(_)) => CredentialError::Io,
-                _ => CredentialError::Corrupt,
-            })?;
-        let vault = OpenedVault {
-            database,
-            master: None,
-            file,
-            lease,
-        };
+        let vault = OpenedVault::open(file, lease)?;
         vault.revalidate(&self.root)?;
         *guard = Some(vault);
         #[cfg(test)]
@@ -376,7 +551,28 @@ pub(crate) fn record_id(key: &CredentialKey) -> String {
     format!("{}\0{}", key.purpose(), key.id())
 }
 
-fn home_error(error: HomeError) -> CredentialError {
+fn verified_source_key(
+    metadata: &Metadata,
+    envelope: &[u8],
+) -> Result<crypto::MasterKey, CredentialError> {
+    let key = crypto::decode_key(envelope, &metadata.vault_id, &metadata.key_id)?;
+    let verification = metadata
+        .verification
+        .as_deref()
+        .ok_or(CredentialError::Corrupt)?;
+    if verification.len() > 256 {
+        return Err(CredentialError::Corrupt);
+    }
+    let encoded = STANDARD
+        .decode(verification)
+        .map_err(|_| CredentialError::Corrupt)?;
+    if crypto::decrypt(&key, &metadata.aad("verification"), &encoded)?.as_slice() != VERIFICATION {
+        return Err(CredentialError::Corrupt);
+    }
+    Ok(key)
+}
+
+pub(crate) fn home_error(error: HomeError) -> CredentialError {
     match error {
         HomeError::Io { .. } => CredentialError::Io,
         _ => CredentialError::Corrupt,
diff --git a/crates/colossus-credentials/tests/headless.rs b/crates/colossus-credentials/tests/headless.rs
new file mode 100644
index 000000000..f63d2922a
--- /dev/null
+++ b/crates/colossus-credentials/tests/headless.rs
@@ -0,0 +1,69 @@
+//! Headless key rotation/restart acceptance runs in isolated processes. Keeping
+//! subprocess creation outside vault unit tests avoids inherited flock lifetimes.
+use colossus_contracts::CredentialError;
+use colossus_credentials::{EnvironmentKeyStore, PlatformKeyStore};
+use colossus_home::ColossusHome;
+
+#[test]
+fn sealed_authority_survives_restart_and_rejects_changed_key() {
+    let directory = tempfile::tempdir().unwrap();
+    let home =
+        ColossusHome::ensure_at(directory.path().canonicalize().unwrap().join("private")).unwrap();
+    for (mode, wrapping_key) in [
+        ("write", "a".repeat(64)),
+        ("read", "a".repeat(64)),
+        ("wrong-key", "b".repeat(64)),
+    ] {
+        let result = std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", "headless_child", "--ignored"])
+            .env("COLOSSUS_HEADLESS_TEST_ROOT", home.root())
+            .env("COLOSSUS_HEADLESS_TEST_MODE", mode)
+            .env("COLOSSUS_HEADLESS_ACCEPTANCE_KEY", wrapping_key)
+            .output()
+            .unwrap();
+        assert!(
+            result.status.success(),
+            "{}",
+            String::from_utf8_lossy(&result.stderr)
+        );
+    }
+    for entry in std::fs::read_dir(home.root().join("headless-keys")).unwrap() {
+        let bytes = std::fs::read(entry.unwrap().path()).unwrap();
+        assert!(
+            !bytes
+                .windows(b"public-api-bearer".len())
+                .any(|window| window == b"public-api-bearer")
+        );
+    }
+}
+
+#[test]
+#[ignore = "isolated process helper invoked by sealed authority acceptance"]
+fn headless_child() {
+    let path = std::env::var_os("COLOSSUS_HEADLESS_TEST_ROOT").unwrap();
+    let home = ColossusHome::ensure_at(path).unwrap();
+    let store = EnvironmentKeyStore::new(
+        home.confined_root().clone(),
+        "COLOSSUS_HEADLESS_ACCEPTANCE_KEY".into(),
+    )
+    .unwrap();
+    match std::env::var("COLOSSUS_HEADLESS_TEST_MODE")
+        .unwrap()
+        .as_str()
+    {
+        "write" => {
+            assert!(store.read("authority").unwrap().is_none());
+            assert_eq!(std::fs::read_dir(home.root()).unwrap().count(), 0);
+            store.write("authority", b"public-api-bearer").unwrap();
+        }
+        "read" => assert_eq!(
+            store.read("authority").unwrap().unwrap().as_slice(),
+            b"public-api-bearer"
+        ),
+        "wrong-key" => assert_eq!(
+            store.read("authority").unwrap_err(),
+            CredentialError::Corrupt
+        ),
+        _ => panic!("unknown mode"),
+    }
+}
diff --git a/crates/colossus-credentials/tests/native_linux.rs b/crates/colossus-credentials/tests/native_linux.rs
new file mode 100644
index 000000000..b6c12e665
--- /dev/null
+++ b/crates/colossus-credentials/tests/native_linux.rs
@@ -0,0 +1,71 @@
+//! Operator-owned native Secret Service acceptance, isolated from user collections.
+#![cfg(target_os = "linux")]
+use colossus_contracts::VaultRecord;
+use colossus_credentials::PlatformCredentialVault;
+use colossus_home::ColossusHome;
+use colossus_ports::{CredentialKey, CredentialVault};
+
+#[test]
+#[ignore = "requires an isolated, unlocked Secret Service session; Linux Desktop builder runs this"]
+fn native_secret_service_survives_process_restart() {
+    assert!(std::env::var_os("DBUS_SESSION_BUS_ADDRESS").is_some());
+    let temporary = tempfile::tempdir().unwrap();
+    let home =
+        ColossusHome::ensure_at(temporary.path().canonicalize().unwrap().join("private")).unwrap();
+    for operation in ["write", "read", "delete"] {
+        let child = std::process::Command::new(std::env::current_exe().unwrap())
+            .args(["--exact", "native_secret_service_child", "--ignored"])
+            .env("COLOSSUS_NATIVE_ACCEPTANCE_ROOT", home.root())
+            .env("COLOSSUS_NATIVE_ACCEPTANCE_OPERATION", operation)
+            .output()
+            .unwrap();
+        assert!(
+            child.status.success(),
+            "{}",
+            String::from_utf8_lossy(&child.stderr)
+        );
+    }
+    for entry in std::fs::read_dir(home.root()).unwrap() {
+        let path = entry.unwrap().path();
+        if path.is_file() {
+            let bytes = std::fs::read(path).unwrap();
+            assert!(
+                !bytes
+                    .windows(b"synthetic-native-secret".len())
+                    .any(|part| part == b"synthetic-native-secret")
+            );
+        }
+    }
+}
+
+#[test]
+#[ignore = "isolated native credential acceptance subprocess"]
+fn native_secret_service_child() {
+    let home =
+        ColossusHome::ensure_at(std::env::var_os("COLOSSUS_NATIVE_ACCEPTANCE_ROOT").unwrap())
+            .unwrap();
+    let vault =
+        PlatformCredentialVault::new(home.confined_root().clone(), "native-linux-acceptance")
+            .unwrap();
+    let key = CredentialKey::new("acceptance", "native-restart").unwrap();
+    match std::env::var("COLOSSUS_NATIVE_ACCEPTANCE_OPERATION")
+        .unwrap()
+        .as_str()
+    {
+        "write" => vault
+            .write(
+                &key,
+                &VaultRecord::new(b"synthetic-native-secret".to_vec()).unwrap(),
+            )
+            .unwrap(),
+        "read" => assert_eq!(
+            vault.read(&key).unwrap().unwrap().expose(),
+            b"synthetic-native-secret"
+        ),
+        "delete" => {
+            vault.delete(&key).unwrap();
+            vault.delete_key_for_uninstall().unwrap();
+        }
+        _ => panic!("invalid acceptance operation"),
+    }
+}
diff --git a/crates/colossus-grpc/src/agent_run.rs b/crates/colossus-grpc/src/agent_run.rs
index 797ca07c3..802f23f13 100644
--- a/crates/colossus-grpc/src/agent_run.rs
+++ b/crates/colossus-grpc/src/agent_run.rs
@@ -149,6 +149,123 @@ impl AgentRunServiceAdapter {
 
 #[tonic::async_trait]
 impl AgentRunService for AgentRunServiceAdapter {
+    async fn get_runtime_policy_posture(
+        &self,
+        request: Request<colossus_api_proto::v1alpha1::GetRuntimePolicyPostureRequest>,
+    ) -> Result<Response<colossus_api_proto::v1alpha1::GetRuntimePolicyPostureResponse>, Status>
+    {
+        let caller = caller_context(&request)?;
+        let posture = self
+            .api
+            .get_runtime_policy_posture(caller)
+            .await
+            .map_err(api_status)?;
+        if !posture.validate() {
+            return Err(Status::internal("runtime policy metadata is unavailable"));
+        }
+        let policy_json = serde_json::to_vec(&posture)
+            .map_err(|_| Status::internal("runtime policy metadata is unavailable"))?;
+        if policy_json.len() > 65536 {
+            return Err(Status::resource_exhausted(
+                "runtime policy metadata exceeds its bound",
+            ));
+        }
+        Ok(Response::new(
+            colossus_api_proto::v1alpha1::GetRuntimePolicyPostureResponse { policy_json },
+        ))
+    }
+    async fn set_workspace_sharing(
+        &self,
+        request: Request<colossus_api_proto::v1alpha1::SetWorkspaceSharingRequest>,
+    ) -> Result<Response<colossus_api_proto::v1alpha1::SetWorkspaceSharingResponse>, Status> {
+        let caller = caller_context(&request)?.clone();
+        let request = request.into_inner();
+        validate_identifier(
+            &caller,
+            "recipient_application_id",
+            &request.recipient_application_id,
+        )?;
+        let response = self
+            .api
+            .set_workspace_sharing(
+                &caller,
+                colossus_api::SetWorkspaceSharingRequest {
+                    recipient_application_id: request.recipient_application_id,
+                    enabled: request.enabled,
+                    allow_continuation: request.allow_continuation,
+                },
+            )
+            .await
+            .map_err(api_status)?;
+        Ok(Response::new(
+            colossus_api_proto::v1alpha1::SetWorkspaceSharingResponse {
+                recipient_application_id: response.recipient_application_id,
+                enabled: response.enabled,
+                allow_continuation: response.allow_continuation,
+            },
+        ))
+    }
+
+    async fn list_visible_runs(
+        &self,
+        request: Request<colossus_api_proto::v1alpha1::ListVisibleRunsRequest>,
+    ) -> Result<Response<colossus_api_proto::v1alpha1::ListVisibleRunsResponse>, Status> {
+        let caller = caller_context(&request)?.clone();
+        let request = request.into_inner();
+        if let Some(session_id) = &request.session_id {
+            validate_identifier(&caller, "session_id", session_id)?;
+        }
+        if request.statuses.len() > MAX_RUN_STATUS_FILTERS {
+            return Err(invalid(&caller, "statuses", "too many lifecycle states"));
+        }
+        let statuses = request
+            .statuses
+            .into_iter()
+            .map(|status| core_run_status(&caller, status))
+            .collect::<Result<Vec<_>, _>>()?;
+        let (page_size, page_token) = request.page.map_or((0, None), |page| {
+            (
+                page.page_size,
+                (!page.page_token.is_empty()).then_some(page.page_token),
+            )
+        });
+        if let Some(token) = &page_token {
+            validate_opaque(&caller, "page.page_token", token)?;
+        }
+        let response = self
+            .api
+            .list_visible_runs(
+                &caller,
+                CoreListRunsRequest {
+                    session_id: request.session_id,
+                    statuses,
+                    page_size,
+                    page_token,
+                    include_archived: request.include_archived,
+                },
+            )
+            .await
+            .map_err(api_status)?;
+        let runs = response
+            .runs
+            .into_iter()
+            .map(|value| {
+                Ok(colossus_api_proto::v1alpha1::VisibleRun {
+                    run: Some(proto_run(value.run)?),
+                    controllable: value.controllable,
+                    continuable: value.continuable,
+                })
+            })
+            .collect::<Result<Vec<_>, Status>>()?;
+        Ok(Response::new(
+            colossus_api_proto::v1alpha1::ListVisibleRunsResponse {
+                runs,
+                page: Some(PageResponse {
+                    next_page_token: response.next_page_token.unwrap_or_default(),
+                }),
+            },
+        ))
+    }
     async fn list_process_sessions(
         &self,
         request: Request<colossus_api_proto::v1alpha1::ListProcessSessionsRequest>,
diff --git a/crates/colossus-grpc/src/auth.rs b/crates/colossus-grpc/src/auth.rs
index cb0426b93..a2db87c69 100644
--- a/crates/colossus-grpc/src/auth.rs
+++ b/crates/colossus-grpc/src/auth.rs
@@ -22,7 +22,8 @@ const TOKEN_PREFIX: &str = "cls_v1";
 const TOKEN_SECRET_BYTES: usize = 32;
 const MAX_AUTHORIZATION_BYTES: usize = 768;
 const CREDENTIAL_DOMAIN: &[u8] = b"colossus-public-api-credential-v1\0";
-pub(crate) const MAX_CREDENTIAL_BATCH_SIZE: usize = 2;
+// Primary, native approval broker, and independently authorized cloud connector.
+pub(crate) const MAX_CREDENTIAL_BATCH_SIZE: usize = 3;
 /// Maximum authenticated protobuf decodes in progress across all applications.
 pub const MAX_CONCURRENT_AUTHENTICATED_DECODES: usize = 8;
 /// Maximum authenticated protobuf decodes in progress for one application.
@@ -686,7 +687,7 @@ mod tests {
         let authenticator = CredentialAuthenticator::new([19_u8; 32], repository);
         assert!(
             authenticator
-                .issue_pending_batch(&[grant(), grant(), grant()])
+                .issue_pending_batch(&[grant(), grant(), grant(), grant()])
                 .is_err(),
             "credential batches are bounded before allocation or random generation"
         );
@@ -721,6 +722,7 @@ mod tests {
             credential_ids[0].clone(),
             credential_ids[1].clone(),
             Uuid::now_v7().to_string(),
+            Uuid::now_v7().to_string(),
         ];
         assert!(authenticator.activate_batch(&oversized_ids).is_err());
         assert!(authenticator.revoke_batch(&oversized_ids).is_err());
diff --git a/crates/colossus-grpc/src/server.rs b/crates/colossus-grpc/src/server.rs
index a109541b3..6317d7eef 100644
--- a/crates/colossus-grpc/src/server.rs
+++ b/crates/colossus-grpc/src/server.rs
@@ -285,6 +285,11 @@ impl BoundPublicGrpcServer {
         if !local_addr.ip().is_loopback() || local_addr.port() == 0 {
             return Err(PublicGrpcServerError::NonLoopbackBind);
         }
+        let system = if agent_runs.supports_runtime_policy_posture() {
+            system.with_policy_posture()
+        } else {
+            system
+        };
         Ok(Self {
             listener,
             local_addr,
diff --git a/crates/colossus-grpc/src/system.rs b/crates/colossus-grpc/src/system.rs
index d338d99cf..d428f9a63 100644
--- a/crates/colossus-grpc/src/system.rs
+++ b/crates/colossus-grpc/src/system.rs
@@ -87,6 +87,7 @@ pub struct SystemServiceAdapter {
     application_limits: Vec<ApiLimit>,
     plugin_discovery: bool,
     workflows: bool,
+    policy_posture: bool,
 }
 
 impl SystemServiceAdapter {
@@ -98,6 +99,7 @@ impl SystemServiceAdapter {
             application_limits: default_application_limits(),
             plugin_discovery: false,
             workflows: false,
+            policy_posture: false,
         }
     }
 
@@ -115,6 +117,10 @@ impl SystemServiceAdapter {
         self.workflows = true;
         self
     }
+    pub(crate) fn with_policy_posture(mut self) -> Self {
+        self.policy_posture = true;
+        self
+    }
 }
 
 #[tonic::async_trait]
@@ -127,6 +133,7 @@ impl SystemService for SystemServiceAdapter {
         let capabilities = [
             ("agent_runs.create", scopes::RUNS_EXECUTE),
             ("agent_runs.read", scopes::RUNS_READ),
+            ("runtime.policy_posture.v1", scopes::RUNS_READ),
             (SESSION_ACTIVITY_CAPABILITY, scopes::RUNS_READ),
             ("process_sessions.v1", scopes::RUNS_READ),
             ("agent_runs.cancel", scopes::RUNS_CONTROL),
@@ -138,7 +145,8 @@ impl SystemService for SystemServiceAdapter {
         .into_iter()
         .map(|(name, scope)| Capability {
             name: name.into(),
-            enabled: caller.principal().has_scope(scope),
+            enabled: caller.principal().has_scope(scope)
+                && (name != "runtime.policy_posture.v1" || self.policy_posture),
             detail: String::new(),
         })
         .chain(
diff --git a/crates/colossus-home/src/confined.rs b/crates/colossus-home/src/confined.rs
index e136471f7..254292355 100644
--- a/crates/colossus-home/src/confined.rs
+++ b/crates/colossus-home/src/confined.rs
@@ -106,6 +106,62 @@ impl ConfinedRoot {
         })
     }
 
+    /// Atomically replace an existing direct child with a staged direct child.
+    ///
+    /// Both distinct leaves must still identify their retained private single-link
+    /// files beneath this exact root. The staged contents are flushed before the
+    /// native replacement; the destination is reopened and must identify that same
+    /// staged object. Success removes the staged name and syncs the directory.
+    /// An error after the rename may mean replacement committed but subsequent
+    /// namespace or durability verification failed; callers must not retry blindly.
+    pub fn replace_existing_file(
+        &self,
+        staged: &ConfinedFile,
+        existing: &ConfinedFile,
+    ) -> Result<ConfinedFile, HomeError> {
+        let (staged_parents, staged_leaf) = relative_file_parts(self.relative(staged.path())?)?;
+        let (existing_parents, existing_leaf) =
+            relative_file_parts(self.relative(existing.path())?)?;
+        if !staged_parents.is_empty()
+            || !existing_parents.is_empty()
+            || staged_leaf == existing_leaf
+            || staged.shares_identity(existing.file())?
+        {
+            return Err(HomeError::UnsafeConfinedPath(existing.path().to_owned()));
+        }
+        staged.revalidate(self)?;
+        existing.revalidate(self)?;
+        staged
+            .file()
+            .sync_all()
+            .map_err(|error| HomeError::io(staged.path(), error))?;
+        staged.revalidate(self)?;
+        existing.revalidate(self)?;
+        #[cfg(unix)]
+        rustix::fs::renameat(
+            &self.directory,
+            &staged_leaf,
+            &self.directory,
+            &existing_leaf,
+        )
+        .map_err(|error| HomeError::io(existing.path(), error.into()))?;
+        #[cfg(windows)]
+        colossus_windows_native::replace_private_file(staged.path(), existing.path())
+            .map_err(|_| HomeError::UnsafeConfinedPath(existing.path().to_owned()))?;
+        #[cfg(not(any(unix, windows)))]
+        return Err(HomeError::UnsafeConfinedPath(existing.path().to_owned()));
+        #[cfg(any(unix, windows))]
+        {
+            let committed = self.open_existing_file(Path::new(&existing_leaf))?;
+            if !staged.shares_identity(committed.file())? {
+                return Err(HomeError::UnsafeConfinedPath(existing.path().to_owned()));
+            }
+            self.sync_directory()?;
+            committed.revalidate(self)?;
+            Ok(committed)
+        }
+    }
+
     /// Ensure and bind a confined owner-private directory path.
     pub fn prepare_directory(&self, relative: &Path) -> Result<PathBuf, HomeError> {
         let components = relative_components(relative)?;
@@ -209,6 +265,37 @@ impl ConfinedFile {
         &self.file
     }
 
+    /// Compare another open descriptor with this retained private file without
+    /// reading either file's contents. Both descriptors remain alive during the
+    /// comparison, including on Windows where file identity can otherwise be reused.
+    pub fn shares_identity(&self, other: &File) -> Result<bool, HomeError> {
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::MetadataExt as _;
+            let retained = self
+                .file
+                .metadata()
+                .map_err(|error| HomeError::io(&self.path, error))?;
+            let candidate = other
+                .metadata()
+                .map_err(|error| HomeError::io(&self.path, error))?;
+            Ok(retained.dev() == candidate.dev() && retained.ino() == candidate.ino())
+        }
+        #[cfg(windows)]
+        {
+            let retained = colossus_windows_native::FileIdentity::of(&self.file)
+                .map_err(|_| HomeError::UnsafeConfinedPath(self.path.clone()))?;
+            let candidate = colossus_windows_native::FileIdentity::of(other)
+                .map_err(|_| HomeError::UnsafeConfinedPath(self.path.clone()))?;
+            Ok(retained == candidate)
+        }
+        #[cfg(not(any(unix, windows)))]
+        {
+            let _ = other;
+            Err(HomeError::UnsafeConfinedPath(self.path.clone()))
+        }
+    }
+
     /// Prove this private file is still named by its original confined leaf.
     ///
     /// Unlike path preparation, a missing leaf is an error. Both the retained file
@@ -849,10 +936,91 @@ mod tests {
     use super::*;
     use crate::test_support::private_tempdir;
 
+    #[test]
+    fn retained_direct_file_replacement_is_atomic_and_preserves_staged_identity() {
+        use std::io::{Read as _, Seek as _, Write as _};
+        let temporary = private_tempdir();
+        let root =
+            ConfinedRoot::bind(temporary.path().canonicalize().unwrap().join("private")).unwrap();
+        let existing = root.open_file(Path::new("current.json")).unwrap();
+        let staged = root.open_file(Path::new(".next.json")).unwrap();
+        existing.file().write_all(b"original").unwrap();
+        staged.file().write_all(b"replacement").unwrap();
+        let committed = root.replace_existing_file(&staged, &existing).unwrap();
+        assert_eq!(committed.path(), existing.path());
+        assert!(!committed.was_created());
+        assert!(staged.shares_identity(committed.file()).unwrap());
+        assert!(!existing.shares_identity(committed.file()).unwrap());
+        assert!(!staged.path().exists());
+        assert_eq!(fs::read(committed.path()).unwrap(), b"replacement");
+        let mut original = existing.file();
+        original.rewind().unwrap();
+        let mut bytes = Vec::new();
+        original.read_to_end(&mut bytes).unwrap();
+        assert_eq!(bytes, b"original");
+        committed.revalidate(&root).unwrap();
+        assert!(existing.revalidate(&root).is_err());
+    }
+
+    #[test]
+    fn retained_file_replacement_refuses_cross_root_nested_and_identical_sources() {
+        use std::io::Write as _;
+        let temporary = private_tempdir();
+        let parent = temporary.path().canonicalize().unwrap();
+        let root = ConfinedRoot::bind(parent.join("private")).unwrap();
+        let other = ConfinedRoot::bind(parent.join("other")).unwrap();
+        let existing = root.open_file(Path::new("current.json")).unwrap();
+        let external = other.open_file(Path::new(".next.json")).unwrap();
+        let nested = root.open_file(Path::new("nested/.next.json")).unwrap();
+        existing.file().write_all(b"original").unwrap();
+        external.file().write_all(b"external").unwrap();
+        nested.file().write_all(b"nested").unwrap();
+        assert!(root.replace_existing_file(&external, &existing).is_err());
+        assert!(root.replace_existing_file(&nested, &existing).is_err());
+        assert!(root.replace_existing_file(&existing, &existing).is_err());
+        assert_eq!(fs::read(existing.path()).unwrap(), b"original");
+        assert_eq!(fs::read(external.path()).unwrap(), b"external");
+        assert_eq!(fs::read(nested.path()).unwrap(), b"nested");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn retained_file_replacement_refuses_parent_namespace_swaps_without_writing() {
+        use std::io::Write as _;
+        let temporary = private_tempdir();
+        let parent = temporary.path().canonicalize().unwrap();
+        let original_path = parent.join("private");
+        let root = ConfinedRoot::bind(&original_path).unwrap();
+        let existing = root.open_file(Path::new("current.json")).unwrap();
+        let staged = root.open_file(Path::new(".next.json")).unwrap();
+        existing.file().write_all(b"original").unwrap();
+        staged.file().write_all(b"staged").unwrap();
+        let displaced = parent.join("displaced");
+        fs::rename(&original_path, &displaced).unwrap();
+        let replacement = ConfinedRoot::bind(&original_path).unwrap();
+        replacement
+            .open_file(Path::new("current.json"))
+            .unwrap()
+            .file()
+            .write_all(b"different-root")
+            .unwrap();
+        assert!(root.replace_existing_file(&staged, &existing).is_err());
+        assert_eq!(
+            fs::read(displaced.join("current.json")).unwrap(),
+            b"original"
+        );
+        assert_eq!(fs::read(displaced.join(".next.json")).unwrap(), b"staged");
+        assert_eq!(
+            fs::read(original_path.join("current.json")).unwrap(),
+            b"different-root"
+        );
+    }
+
     #[test]
     fn retained_file_revalidation_rejects_missing_and_replaced_leaf_names() {
         let temporary = private_tempdir();
-        let root = ConfinedRoot::bind(temporary.path().join("private")).unwrap();
+        let root =
+            ConfinedRoot::bind(temporary.path().canonicalize().unwrap().join("private")).unwrap();
         let retained = root.open_file(Path::new("state.redb")).unwrap();
         retained.revalidate(&root).unwrap();
         fs::rename(retained.path(), root.path().join("moved.redb")).unwrap();
@@ -867,7 +1035,8 @@ mod tests {
     fn existing_read_write_open_never_creates_a_missing_leaf_or_parent() {
         use std::io::{Read as _, Seek as _, Write as _};
         let temporary = private_tempdir();
-        let root = ConfinedRoot::bind(temporary.path().join("private")).unwrap();
+        let root =
+            ConfinedRoot::bind(temporary.path().canonicalize().unwrap().join("private")).unwrap();
         assert!(
             root.open_existing_file_read_write(Path::new("missing.redb"))
                 .is_err()
@@ -893,7 +1062,8 @@ mod tests {
     #[test]
     fn existing_read_write_open_rejects_hard_links_and_escaping_paths() {
         let temporary = private_tempdir();
-        let root = ConfinedRoot::bind(temporary.path().join("private")).unwrap();
+        let root =
+            ConfinedRoot::bind(temporary.path().canonicalize().unwrap().join("private")).unwrap();
         drop(root.open_file(Path::new("state.redb")).unwrap());
         fs::hard_link(
             root.path().join("state.redb"),
diff --git a/crates/colossus-journal-redb/src/key_metadata.rs b/crates/colossus-journal-redb/src/key_metadata.rs
new file mode 100644
index 000000000..5642dedda
--- /dev/null
+++ b/crates/colossus-journal-redb/src/key_metadata.rs
@@ -0,0 +1,107 @@
+//! Read-only encrypted-header discovery for explicitly reviewed custody rewraps.
+use super::*;
+use std::collections::BTreeSet;
+
+/// Public key identifiers only; no payloads, keys, signing seeds or anchors.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct JournalKeyMetadata {
+    /// Unique encryption identifiers referenced by retained public payload headers.
+    pub encryption_key_ids: Vec<String>,
+    /// Signing identifier of the retained latest checkpoint, if one exists.
+    pub checkpoint_key_id: Option<String>,
+}
+
+/// Inspect frozen existing redb metadata without opening a key provider, creating
+/// files, decrypting payloads or repairing the journal. An active writer fails.
+pub fn journal_key_metadata(path: &Path) -> Result<JournalKeyMetadata, StoreError> {
+    #[derive(Deserialize)]
+    struct Header<'a> {
+        #[serde(borrow)]
+        payload: PayloadHeader<'a>,
+    }
+    #[derive(Deserialize)]
+    struct PayloadHeader<'a> {
+        algorithm: &'a str,
+        key_id: &'a str,
+    }
+    let database = redb::ReadOnlyDatabase::open(path).map_err(|_| {
+        StoreError::Adapter("journal metadata source is unavailable or requires recovery".into())
+    })?;
+    let transaction = database
+        .begin_read()
+        .map_err(|_| StoreError::Adapter("journal metadata is unavailable".into()))?;
+    let events = transaction
+        .open_table(EVENTS)
+        .map_err(|_| StoreError::Verification("journal event metadata is missing".into()))?;
+    let mut ids = BTreeSet::new();
+    for (position, entry) in events
+        .iter()
+        .map_err(|_| StoreError::Adapter("journal metadata is unavailable".into()))?
+        .enumerate()
+    {
+        if position >= 1_000_000 {
+            return Err(StoreError::Verification(
+                "journal metadata scan exceeds bound".into(),
+            ));
+        }
+        let (_, value) =
+            entry.map_err(|_| StoreError::Adapter("journal metadata is unavailable".into()))?;
+        if value.value().len() > 8 * 1024 * 1024 {
+            return Err(StoreError::Verification(
+                "journal envelope exceeds metadata bound".into(),
+            ));
+        }
+        let header: Header<'_> = serde_json::from_slice(value.value())
+            .map_err(|_| StoreError::Verification("journal payload metadata is invalid".into()))?;
+        match header.payload.algorithm {
+            ENCRYPTED_PAYLOAD_ALGORITHM => {
+                validate_id(header.payload.key_id)?;
+                ids.insert(header.payload.key_id.to_owned());
+                if ids.len() > 256 {
+                    return Err(StoreError::Verification(
+                        "journal key metadata exceeds bound".into(),
+                    ));
+                }
+            }
+            PLAINTEXT_PAYLOAD_ALGORITHM if header.payload.key_id == "none" => {}
+            _ => {
+                return Err(StoreError::Verification(
+                    "journal payload protection is unsupported".into(),
+                ));
+            }
+        }
+    }
+    let metadata = transaction
+        .open_table(METADATA)
+        .map_err(|_| StoreError::Verification("journal metadata is missing".into()))?;
+    let checkpoint_key_id = metadata
+        .get("latest_checkpoint")
+        .map_err(|_| StoreError::Verification("journal checkpoint metadata is invalid".into()))?
+        .map(|bytes| {
+            if bytes.value().len() > 4096 {
+                return Err(StoreError::Verification(
+                    "journal checkpoint metadata exceeds bound".into(),
+                ));
+            }
+            let checkpoint: SignedCheckpoint =
+                serde_json::from_slice(bytes.value()).map_err(|_| {
+                    StoreError::Verification("journal checkpoint metadata is invalid".into())
+                })?;
+            validate_id(&checkpoint.key_id)?;
+            Ok(checkpoint.key_id)
+        })
+        .transpose()?;
+    Ok(JournalKeyMetadata {
+        encryption_key_ids: ids.into_iter().collect(),
+        checkpoint_key_id,
+    })
+}
+fn validate_id(id: &str) -> Result<(), StoreError> {
+    if id.is_empty() || id.len() > 256 || id.trim() != id || id.chars().any(char::is_control) {
+        Err(StoreError::Verification(
+            "journal key identifier is invalid".into(),
+        ))
+    } else {
+        Ok(())
+    }
+}
diff --git a/crates/colossus-journal-redb/src/keys.rs b/crates/colossus-journal-redb/src/keys.rs
index f9f57232a..2654c8a91 100644
--- a/crates/colossus-journal-redb/src/keys.rs
+++ b/crates/colossus-journal-redb/src/keys.rs
@@ -325,3 +325,16 @@ fn decode_anchor(value: &Value) -> Result<SecureAnchor, StoreError> {
         status,
     })
 }
+
+/// Decode the canonical current or legacy protected anchor without changing its
+/// sequence, hash, verification profile or status during explicit custody rewrap.
+pub fn decode_secure_anchor(bytes: &[u8]) -> Result<SecureAnchor, StoreError> {
+    if bytes.len() > 8192 {
+        return Err(StoreError::Verification(
+            "secure anchor exceeds bound".into(),
+        ));
+    }
+    let value: Value = serde_json::from_slice(bytes)
+        .map_err(|_| StoreError::Verification("secure anchor is invalid".into()))?;
+    decode_anchor(&value)
+}
diff --git a/crates/colossus-journal-redb/src/lib.rs b/crates/colossus-journal-redb/src/lib.rs
index 105e2e83f..0e2931ec0 100644
--- a/crates/colossus-journal-redb/src/lib.rs
+++ b/crates/colossus-journal-redb/src/lib.rs
@@ -46,7 +46,7 @@ mod keys;
 use keys::cached_platform_secret;
 pub use keys::{
     EnvironmentKeyProvider, PlaintextKeyProvider, PlatformKeyProvider, StaticKeyProvider,
-    platform_secret,
+    decode_secure_anchor, platform_secret,
 };
 
 mod crypto;
@@ -55,6 +55,8 @@ pub use crypto::{DisabledCheckpointSigner, Ed25519CheckpointSigner};
 
 mod journal;
 pub use journal::RedbEventJournal;
+mod key_metadata;
+pub use key_metadata::{JournalKeyMetadata, journal_key_metadata};
 
 #[cfg(test)]
 mod tests;
diff --git a/crates/colossus-runtime/src/composition.rs b/crates/colossus-runtime/src/composition.rs
index 2a5fd54ad..8bcb65477 100644
--- a/crates/colossus-runtime/src/composition.rs
+++ b/crates/colossus-runtime/src/composition.rs
@@ -272,6 +272,12 @@ impl Runtime {
                 workspace.display()
             )));
         }
+        let development_protection =
+            crate::development_credentials::runtime_development_protection(
+                config,
+                colossus_home_root.as_ref(),
+                &workspace,
+            )?;
         let mut tls_roots = config
             .network
             .ca_bundle_path
@@ -327,7 +333,12 @@ impl Runtime {
         let repository_id = repository_identity(&workspace);
         let storage =
             observe_startup_phase("colossus.runtime.storage.open", "storage_open", || {
-                compose_storage(config, &storage_path, &tls_roots)
+                compose_storage(
+                    config,
+                    &storage_path,
+                    &tls_roots,
+                    colossus_home_root.as_ref(),
+                )
             })?;
         let StorageComposition {
             keys,
@@ -531,15 +542,16 @@ impl Runtime {
         };
         let raw_filesystem_executor = Arc::new(
             FilesystemExecutor::new()
-                .with_workspace_search_exclusions(colossus_home.iter().cloned().collect()),
+                .with_workspace_search_exclusions(colossus_home.iter().cloned().collect())
+                .with_protected_filesystem(development_protection.clone()),
         );
         let filesystem_executor: Arc<dyn EffectExecutor> = Arc::new(
             WorkspaceBoundEffectExecutor::new(workspace_identity.clone(), raw_filesystem_executor),
         );
-        let raw_process_executor = Arc::new(SandboxProcessExecutor::new(
-            sandbox_executor_config.clone(),
-            sandbox_job_key,
-        ));
+        let raw_process_executor = Arc::new(
+            SandboxProcessExecutor::new(sandbox_executor_config.clone(), sandbox_job_key)
+                .with_protected_filesystem(development_protection),
+        );
         let process_executor: Arc<dyn EffectExecutor> =
             Arc::new(WorkspaceBoundEffectExecutor::new(
                 workspace_identity.clone(),
diff --git a/crates/colossus-runtime/src/credential_vault.rs b/crates/colossus-runtime/src/credential_vault.rs
index e9ceaebb9..8ebb883cc 100644
--- a/crates/colossus-runtime/src/credential_vault.rs
+++ b/crates/colossus-runtime/src/credential_vault.rs
@@ -5,14 +5,50 @@ use colossus_credentials::PlatformCredentialVault;
 use colossus_home::ConfinedRoot;
 use colossus_ports::CredentialVault;
 use sha2::{Digest as _, Sha256};
-use std::{path::Path, sync::Arc};
+use std::{
+    path::{Path, PathBuf},
+    sync::Arc,
+};
+
+/// Existing native OAuth vault location and its exact nonsecret owner binding.
+#[derive(Clone, Debug)]
+pub struct RuntimeOAuthVaultBinding {
+    /// Canonical existing state directory; no vault or key is created.
+    pub directory: PathBuf,
+    /// Original purpose bound into every encrypted vault record.
+    pub owner_scope: String,
+}
+/// Inspect only the canonical existing directory identity used by OAuth custody.
+/// Callers inspect vault metadata separately; this reads no vault or credential.
+pub fn runtime_oauth_vault_binding(
+    storage_path: &Path,
+) -> Result<RuntimeOAuthVaultBinding, RuntimeError> {
+    let (root, scope) = platform_oauth_vault_binding(None, storage_path)?;
+    Ok(RuntimeOAuthVaultBinding {
+        directory: root.path().to_owned(),
+        owner_scope: scope,
+    })
+}
 
 pub(crate) fn platform_oauth_vault(
     home: Option<&ConfinedRoot>,
     storage_path: &Path,
 ) -> Result<Arc<dyn CredentialVault>, RuntimeError> {
     let (root, scope) = platform_oauth_vault_binding(home, storage_path)?;
-    let vault = PlatformCredentialVault::new(root, scope).map_err(|_| unavailable())?;
+    let development = home
+        .map(|home| colossus_credentials::DevelopmentAuthority::selected(home, &[]))
+        .transpose()
+        .map_err(|_| unavailable())?
+        .flatten();
+    let vault = if let Some(authority) = development {
+        let store = authority
+            .store(colossus_credentials::DevelopmentStoreScope::RuntimeOAuthVault)
+            .map_err(|_| unavailable())?;
+        PlatformCredentialVault::with_key_store(root, scope, Arc::new(store))
+            .map_err(|_| unavailable())?
+    } else {
+        PlatformCredentialVault::new(root, scope).map_err(|_| unavailable())?
+    };
     Ok(Arc::new(vault))
 }
 
@@ -25,10 +61,8 @@ fn platform_oauth_vault_binding(
     let directory = storage_path.parent().ok_or_else(unavailable)?;
     // ConfinedRoot::bind can create a missing directory for other callers. OAuth
     // composition only binds the state directory that runtime already prepared.
-    if !std::fs::symlink_metadata(directory)
-        .map_err(|_| unavailable())?
-        .is_dir()
-    {
+    let metadata = std::fs::symlink_metadata(directory).map_err(|_| unavailable())?;
+    if !metadata.is_dir() || metadata.file_type().is_symlink() {
         return Err(unavailable());
     }
     if let Some(home) = home {
diff --git a/crates/colossus-runtime/src/development_credentials.rs b/crates/colossus-runtime/src/development_credentials.rs
new file mode 100644
index 000000000..cf33ab937
--- /dev/null
+++ b/crates/colossus-runtime/src/development_credentials.rs
@@ -0,0 +1,96 @@
+use super::*;
+use colossus_credentials::{DEVELOPMENT_AUTHORITY_VARIABLE, DevelopmentAuthority};
+use colossus_sandbox::ProtectedFilesystem;
+
+/// Check an explicitly selected development authority's process boundary before
+/// native hosts acquire runtime state or credentials. This never changes policy.
+pub fn validate_development_credential_boundary(
+    config: &RuntimeConfig,
+) -> Result<(), RuntimeError> {
+    validate_selected_boundary(
+        config,
+        std::env::var_os(DEVELOPMENT_AUTHORITY_VARIABLE).is_some(),
+    )
+}
+
+fn validate_selected_boundary(config: &RuntimeConfig, selected: bool) -> Result<(), RuntimeError> {
+    if !selected {
+        return Ok(());
+    }
+    let supported = match config.sandbox.backend.as_str() {
+        "native" => cfg!(any(target_os = "linux", target_os = "macos")),
+        "oci" => cfg!(unix),
+        "windows_job" => cfg!(windows),
+        _ => false,
+    };
+    if !cfg!(debug_assertions) || !supported || config.sandbox.allow_broker_fallback {
+        return Err(RuntimeError::Config(
+            "explicit development credential custody requires a supported isolating sandbox without broker fallback".into(),
+        ));
+    }
+    if config.sandbox.environment.iter().any(|name| {
+        let name = name.to_ascii_uppercase();
+        name.starts_with("COLOSSUS_DEVELOPMENT_")
+            || matches!(
+                name.as_str(),
+                "COLOSSUS_JOURNAL_KEY"
+                    | "COLOSSUS_SIGNING_KEY"
+                    | "COLOSSUS_DEV_JOURNAL_KEY"
+                    | "COLOSSUS_DEV_SIGNING_KEY"
+            )
+    }) {
+        return Err(RuntimeError::Config(
+            "development credential control variables cannot be granted to tools".into(),
+        ));
+    }
+    Ok(())
+}
+
+pub(super) fn runtime_development_protection(
+    config: &RuntimeConfig,
+    home: Option<&ConfinedRoot>,
+    workspace: &Path,
+) -> Result<ProtectedFilesystem, RuntimeError> {
+    runtime_development_protection_selected(
+        config,
+        home,
+        std::env::var_os(DEVELOPMENT_AUTHORITY_VARIABLE).is_some(),
+        |home| DevelopmentAuthority::selected_root(home, &[workspace.to_owned()]),
+    )
+}
+
+fn runtime_development_protection_selected(
+    config: &RuntimeConfig,
+    home: Option<&ConfinedRoot>,
+    selected: bool,
+    resolve: impl FnOnce(
+        &ConfinedRoot,
+    ) -> Result<Option<ConfinedRoot>, colossus_contracts::CredentialError>,
+) -> Result<ProtectedFilesystem, RuntimeError> {
+    validate_selected_boundary(config, selected)?;
+    if !selected {
+        return Ok(ProtectedFilesystem::default());
+    }
+    let home = home.ok_or_else(|| {
+        RuntimeError::Config(
+            "explicit development credential custody requires a retained Colossus home".into(),
+        )
+    })?;
+    let root = resolve(home)
+        .map_err(|_| {
+            RuntimeError::Config(
+                "explicit development credential authority is invalid or inactive".into(),
+            )
+        })?
+        .ok_or_else(|| {
+            RuntimeError::Config(
+                "development credential selector changed during composition".into(),
+            )
+        })?;
+    ProtectedFilesystem::new(vec![root]).map_err(|_| {
+        RuntimeError::Config("development credential authority confinement is invalid".into())
+    })
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/colossus-runtime/src/development_credentials/tests.rs b/crates/colossus-runtime/src/development_credentials/tests.rs
new file mode 100644
index 000000000..2d1b2910c
--- /dev/null
+++ b/crates/colossus-runtime/src/development_credentials/tests.rs
@@ -0,0 +1,89 @@
+use super::*;
+use crate::test_support::private_tempdir;
+
+#[test]
+fn development_custody_rejects_unsafe_boundaries_before_authority_or_runtime_acquisition() {
+    let directory = private_tempdir();
+    let home = ConfinedRoot::bind(fs::canonicalize(directory.path()).expect("canonical home"))
+        .expect("private home");
+    for backend in [
+        "danger_full_access",
+        "external",
+        "broker",
+        "unknown",
+        if cfg!(windows) {
+            "native"
+        } else {
+            "windows_job"
+        },
+    ] {
+        let mut config = RuntimeConfig::offline_template("state.redb");
+        config.sandbox.backend = backend.into();
+        config.sandbox.profile = "workspace-development".into();
+        let error = runtime_development_protection_selected(&config, Some(&home), true, |_| {
+            panic!("unsafe boundary must fail before authority/key/runtime acquisition")
+        })
+        .err()
+        .expect("unsafe explicit custody rejected");
+        assert!(error.to_string().contains("supported isolating sandbox"));
+        assert_eq!(
+            config.sandbox.backend, backend,
+            "never silently change policy"
+        );
+        assert_eq!(
+            fs::read_dir(home.path())
+                .expect("home remains readable")
+                .count(),
+            0
+        );
+    }
+}
+
+#[test]
+fn development_custody_rejects_fallback_and_reserved_tool_environment() {
+    let mut config = RuntimeConfig::offline_template("state.redb");
+    config.sandbox.backend = if cfg!(windows) {
+        "windows_job"
+    } else {
+        "native"
+    }
+    .into();
+    config.sandbox.allow_broker_fallback = true;
+    assert!(validate_selected_boundary(&config, true).is_err());
+    config.sandbox.allow_broker_fallback = false;
+    for name in [
+        DEVELOPMENT_AUTHORITY_VARIABLE,
+        "colossus_development_wrapping_key",
+        "COLOSSUS_JOURNAL_KEY",
+        "COLOSSUS_SIGNING_KEY",
+        "COLOSSUS_DEV_JOURNAL_KEY",
+        "colossus_dev_signing_key",
+    ] {
+        config.sandbox.environment = vec![name.into()];
+        assert!(
+            validate_selected_boundary(&config, true).is_err(),
+            "reserved {name}"
+        );
+    }
+    config.sandbox.environment = vec!["PATH".into(), "HOME".into()];
+    validate_selected_boundary(&config, true).expect("supported isolation with safe environment");
+}
+
+#[test]
+fn development_custody_requires_explicit_home_and_leaves_unselected_runtime_unchanged() {
+    let mut config = RuntimeConfig::offline_template("state.redb");
+    config.sandbox.backend = if cfg!(windows) {
+        "windows_job"
+    } else {
+        "native"
+    }
+    .into();
+    let error = runtime_development_protection_selected(&config, None, true, |_| panic!("no home"))
+        .err()
+        .expect("missing retained home rejected");
+    assert!(error.to_string().contains("retained Colossus home"));
+    config.sandbox.backend = "danger_full_access".into();
+    runtime_development_protection_selected(&config, None, false, |_| panic!("no selector"))
+        .expect("unselected runtime behavior unchanged");
+    assert_eq!(config.sandbox.backend, "danger_full_access");
+}
diff --git a/crates/colossus-runtime/src/development_journal.rs b/crates/colossus-runtime/src/development_journal.rs
new file mode 100644
index 000000000..e99a40932
--- /dev/null
+++ b/crates/colossus-runtime/src/development_journal.rs
@@ -0,0 +1,106 @@
+//! Explicit active development custody retains canonical journal protection.
+use super::*;
+use colossus_contracts::{SecureAnchor, VaultRecord};
+use colossus_credentials::{
+    DevelopmentAuthority, PlatformCredentialVault, development_journal_key,
+};
+use colossus_ports::{CredentialVault, StoreError};
+
+pub(super) const ENVIRONMENT_JOURNAL_SERVICE: &str = "development-environment-journal-v1";
+
+type JournalProtection = (Arc<dyn KeyProvider>, Arc<dyn CheckpointSigner>);
+
+pub(super) fn compose_development_keys(
+    config: &KeyConfig,
+    authority: &DevelopmentAuthority,
+) -> Result<JournalProtection, RuntimeError> {
+    let (service, journal_id, signing_id) = match config {
+        KeyConfig::Platform {
+            service,
+            journal_key_id,
+            signing_key_id,
+        } => (
+            service.as_str(),
+            journal_key_id.as_str(),
+            signing_key_id.as_str(),
+        ),
+        KeyConfig::Environment { journal_key_id, .. } => (
+            ENVIRONMENT_JOURNAL_SERVICE,
+            journal_key_id.as_str(),
+            "environment-checkpoint-v1",
+        ),
+        KeyConfig::None => {
+            return Err(RuntimeError::Config(
+                "keyless journal has no development key authority".into(),
+            ));
+        }
+    };
+    let vault = authority.journal_vault().map_err(|_| unavailable())?;
+    let provider = DevelopmentJournalKeys {
+        vault,
+        service: service.to_owned(),
+        active_id: journal_id.to_owned(),
+    };
+    // Missing slots are terminal. No platform lookup or new key creation can
+    // replace an existing journal identity when development mode is selected.
+    provider.active_key()?;
+    let signing = provider.read_key(&format!("signing-key:{signing_id}"))?;
+    Ok((
+        Arc::new(provider),
+        Arc::new(Ed25519CheckpointSigner::new(signing_id, signing)),
+    ))
+}
+fn unavailable() -> RuntimeError {
+    RuntimeError::Config(
+        "explicit development journal authority is unavailable or incomplete".into(),
+    )
+}
+
+struct DevelopmentJournalKeys {
+    vault: Arc<PlatformCredentialVault>,
+    service: String,
+    active_id: String,
+}
+impl DevelopmentJournalKeys {
+    fn read_key(&self, account: &str) -> Result<[u8; 32], StoreError> {
+        let key = development_journal_key(&self.service, account).map_err(|_| key_error())?;
+        let value = self
+            .vault
+            .read(&key)
+            .map_err(|_| key_error())?
+            .ok_or_else(key_error)?;
+        value.expose().try_into().map_err(|_| key_error())
+    }
+    fn anchor_key(&self) -> Result<colossus_ports::CredentialKey, StoreError> {
+        development_journal_key(&self.service, &format!("journal-anchor:{}", self.active_id))
+            .map_err(|_| key_error())
+    }
+}
+fn key_error() -> StoreError {
+    StoreError::KeyUnavailable("explicit development journal material is unavailable".into())
+}
+impl KeyProvider for DevelopmentJournalKeys {
+    fn active_key(&self) -> Result<(String, [u8; 32]), StoreError> {
+        Ok((self.active_id.clone(), self.key_by_id(&self.active_id)?))
+    }
+    fn key_by_id(&self, id: &str) -> Result<[u8; 32], StoreError> {
+        if id.is_empty() || id.len() > 256 || id.chars().any(char::is_control) {
+            return Err(key_error());
+        }
+        self.read_key(&format!("journal-key:{id}"))
+    }
+    fn store_anchor(&self, anchor: &SecureAnchor) -> Result<(), StoreError> {
+        let bytes = serde_json::to_vec(anchor).map_err(|_| key_error())?;
+        let value = VaultRecord::new(bytes).map_err(|_| key_error())?;
+        self.vault
+            .write(&self.anchor_key()?, &value)
+            .map_err(|_| key_error())
+    }
+    fn load_anchor(&self) -> Result<Option<SecureAnchor>, StoreError> {
+        self.vault
+            .read(&self.anchor_key()?)
+            .map_err(|_| key_error())?
+            .map(|value| colossus_journal_redb::decode_secure_anchor(value.expose()))
+            .transpose()
+    }
+}
diff --git a/crates/colossus-runtime/src/diagnostics.rs b/crates/colossus-runtime/src/diagnostics.rs
index a5c166186..93ab52612 100644
--- a/crates/colossus-runtime/src/diagnostics.rs
+++ b/crates/colossus-runtime/src/diagnostics.rs
@@ -88,6 +88,21 @@ impl Runtime {
         &self.sandbox_profile
     }
 
+    /// Resolved tool/action selection, without resource paths or credentials.
+    pub fn access_resolution(&self) -> &colossus_access::AccessResolution {
+        &self.access
+    }
+
+    /// Configured execution boundary identifier, without resource configuration.
+    pub fn sandbox_backend(&self) -> &str {
+        &self.sandbox_backend
+    }
+
+    /// Global boundary acknowledgment; session-specific acknowledgments are separate.
+    pub fn policy_boundary_acknowledged(&self) -> bool {
+        self.sandbox_boundary_gate.globally_acknowledged()
+    }
+
     /// Credential- and content-free hashes for currently discoverable AGENTS.md inputs.
     pub fn instruction_source_diagnostics(&self) -> Result<Value, RuntimeError> {
         self._workspace_lease.identity().revalidate()?;
diff --git a/crates/colossus-runtime/src/lib.rs b/crates/colossus-runtime/src/lib.rs
index 427d62b33..32b6f9908 100644
--- a/crates/colossus-runtime/src/lib.rs
+++ b/crates/colossus-runtime/src/lib.rs
@@ -17,7 +17,10 @@ mod composition;
 mod config;
 mod context_tools;
 mod credential_vault;
+pub use credential_vault::{RuntimeOAuthVaultBinding, runtime_oauth_vault_binding};
+mod development_credentials;
 mod development_sandbox;
+pub use development_credentials::validate_development_credential_boundary;
 mod diagnostics;
 mod direct_effects;
 mod error;
@@ -32,6 +35,7 @@ mod mcp_diagnostics;
 mod mcp_search;
 mod memory;
 pub use mcp_diagnostics::McpHealthCheck;
+mod development_journal;
 mod memory_gateway;
 mod operations;
 mod plan_runs;
diff --git a/crates/colossus-runtime/src/plugin_authorization_tests.rs b/crates/colossus-runtime/src/plugin_authorization_tests.rs
index 59676ce4c..808503e49 100644
--- a/crates/colossus-runtime/src/plugin_authorization_tests.rs
+++ b/crates/colossus-runtime/src/plugin_authorization_tests.rs
@@ -2,6 +2,7 @@ use super::*;
 use colossus_contracts::PluginManagementRequest as Op;
 
 pub(super) fn open(root: &Path, plugins: PluginsConfig) -> Runtime {
+    let root = root.canonicalize().expect("canonical fixture root");
     let workspace = root.join("workspace");
     fs::create_dir_all(&workspace).expect("workspace");
     let home = colossus_home::ColossusHome::ensure_at(root.join("home")).expect("home");
diff --git a/crates/colossus-runtime/src/storage_composition.rs b/crates/colossus-runtime/src/storage_composition.rs
index 32adb94e3..5c0209523 100644
--- a/crates/colossus-runtime/src/storage_composition.rs
+++ b/crates/colossus-runtime/src/storage_composition.rs
@@ -14,6 +14,7 @@ pub(super) fn compose_storage(
     config: &RuntimeConfig,
     storage_path: &Path,
     tls_roots: &AdditionalRootCertificates,
+    home: Option<&ConfinedRoot>,
 ) -> Result<StorageComposition, RuntimeError> {
     if config.storage.adapter != StorageAdapter::Ephemeral
         && !config.has_resolved_home_workspace()
@@ -21,47 +22,61 @@ pub(super) fn compose_storage(
     {
         fs::create_dir_all(parent)?;
     }
+    let development = if matches!(config.storage.keys, KeyConfig::None) {
+        None
+    } else {
+        home.map(|home| colossus_credentials::DevelopmentAuthority::selected(home, &[]))
+            .transpose()
+            .map_err(|_| {
+                RuntimeError::Config("explicit development authority is unavailable".into())
+            })?
+            .flatten()
+    };
     let (keys, signer): (Arc<dyn KeyProvider>, Arc<dyn CheckpointSigner>) =
-        match &config.storage.keys {
-            KeyConfig::None => (
-                Arc::new(PlaintextKeyProvider),
-                Arc::new(DisabledCheckpointSigner),
-            ),
-            KeyConfig::Platform {
-                service,
-                journal_key_id,
-                signing_key_id,
-            } => {
-                let signing_key =
-                    platform_secret(service, &format!("signing-key:{signing_key_id}"))?;
-                (
-                    Arc::new(PlatformKeyProvider::new(service, journal_key_id)?),
-                    Arc::new(Ed25519CheckpointSigner::new(
-                        signing_key_id.clone(),
-                        signing_key,
-                    )),
-                )
-            }
-            KeyConfig::Environment {
-                journal_variable,
-                journal_key_id,
-                signing_variable,
-                anchor_path,
-            } => {
-                config.revalidate_resolved_home_file(anchor_path)?;
-                config.revalidate_resolved_home_file(&anchor_path.with_extension("tmp"))?;
-                let signing_key = explicit_secret(signing_variable)?;
-                (
-                    Arc::new(EnvironmentKeyProvider::new(
-                        journal_variable,
-                        journal_key_id,
-                        anchor_path,
-                    )),
-                    Arc::new(Ed25519CheckpointSigner::new(
-                        "environment-checkpoint-v1",
-                        signing_key,
-                    )),
-                )
+        if let Some(authority) = development.as_ref() {
+            super::development_journal::compose_development_keys(&config.storage.keys, authority)?
+        } else {
+            match &config.storage.keys {
+                KeyConfig::None => (
+                    Arc::new(PlaintextKeyProvider),
+                    Arc::new(DisabledCheckpointSigner),
+                ),
+                KeyConfig::Platform {
+                    service,
+                    journal_key_id,
+                    signing_key_id,
+                } => {
+                    let signing_key =
+                        platform_secret(service, &format!("signing-key:{signing_key_id}"))?;
+                    (
+                        Arc::new(PlatformKeyProvider::new(service, journal_key_id)?),
+                        Arc::new(Ed25519CheckpointSigner::new(
+                            signing_key_id.clone(),
+                            signing_key,
+                        )),
+                    )
+                }
+                KeyConfig::Environment {
+                    journal_variable,
+                    journal_key_id,
+                    signing_variable,
+                    anchor_path,
+                } => {
+                    config.revalidate_resolved_home_file(anchor_path)?;
+                    config.revalidate_resolved_home_file(&anchor_path.with_extension("tmp"))?;
+                    let signing_key = explicit_secret(signing_variable)?;
+                    (
+                        Arc::new(EnvironmentKeyProvider::new(
+                            journal_variable,
+                            journal_key_id,
+                            anchor_path,
+                        )),
+                        Arc::new(Ed25519CheckpointSigner::new(
+                            "environment-checkpoint-v1",
+                            signing_key,
+                        )),
+                    )
+                }
             }
         };
     Ok(match config.storage.adapter {
diff --git a/crates/colossus-sandbox/Cargo.toml b/crates/colossus-sandbox/Cargo.toml
index 1686f9466..9818edb49 100644
--- a/crates/colossus-sandbox/Cargo.toml
+++ b/crates/colossus-sandbox/Cargo.toml
@@ -10,6 +10,7 @@ license.workspace = true
 async-trait.workspace = true
 base64.workspace = true
 colossus-contracts.workspace = true
+colossus-home.workspace = true
 colossus-network.workspace = true
 colossus-policy.workspace = true
 colossus-windows-process.workspace = true
diff --git a/crates/colossus-sandbox/src/filesystem.rs b/crates/colossus-sandbox/src/filesystem.rs
index cb1fc511e..78dd9afd7 100644
--- a/crates/colossus-sandbox/src/filesystem.rs
+++ b/crates/colossus-sandbox/src/filesystem.rs
@@ -4,6 +4,7 @@ use super::*;
 #[derive(Default)]
 pub struct FilesystemExecutor {
     workspace_search_exclusions: Vec<PathBuf>,
+    protected: ProtectedFilesystem,
 }
 
 impl FilesystemExecutor {
@@ -18,6 +19,12 @@ impl FilesystemExecutor {
         self.workspace_search_exclusions = paths;
         self
     }
+
+    /// Restrict native-owned private state independently of the effect's grants.
+    pub fn with_protected_filesystem(mut self, protected: ProtectedFilesystem) -> Self {
+        self.protected = protected;
+        self
+    }
 }
 
 #[async_trait]
@@ -29,18 +36,28 @@ impl EffectExecutor for FilesystemExecutor {
     ) -> Result<QuarantinedEffectResult, ExecutionError> {
         let mode = filesystem_mode(&request.action)?;
         let target = authorized_path(Path::new(&request.resource), mode, permit.obligations())?;
+        let protected = self.protected.snapshot()?;
+        protected.check_path(&target)?;
         let max_output =
             usize::try_from(permit.obligations().max_output_bytes).map_err(adapter_failure)?;
-        match request.action.as_str() {
+        let result = match request.action.as_str() {
             "filesystem.read" | "filesystem.read_run_input" => {
-                let metadata = fs::metadata(&target).map_err(adapter_failure)?;
+                let file = fs::File::open(&target).map_err(adapter_failure)?;
+                protected.check_file(&file)?;
+                let metadata = file.metadata().map_err(adapter_failure)?;
                 if !metadata.is_file() {
                     return Err(adapter_failure("filesystem.read requires a regular file"));
                 }
                 if metadata.len() > permit.obligations().max_output_bytes {
                     return Err(adapter_failure("file exceeds the permitted output bound"));
                 }
-                let bytes = fs::read(target).map_err(adapter_failure)?;
+                let mut bytes = Vec::new();
+                file.take(permit.obligations().max_output_bytes.saturating_add(1))
+                    .read_to_end(&mut bytes)
+                    .map_err(adapter_failure)?;
+                if bytes.len() > max_output {
+                    return Err(adapter_failure("file exceeds the permitted output bound"));
+                }
                 Ok(QuarantinedEffectResult {
                     media_type: "application/octet-stream".into(),
                     bytes,
@@ -62,6 +79,10 @@ impl EffectExecutor for FilesystemExecutor {
             "filesystem.list" => {
                 let mut entries = fs::read_dir(&target)
                     .map_err(adapter_failure)?
+                    .filter(|entry| match entry {
+                        Ok(entry) => protected.discoverable(&entry.path()),
+                        Err(_) => true,
+                    })
                     .map(|entry| {
                         let entry = entry.map_err(adapter_failure)?;
                         let metadata =
@@ -83,16 +104,19 @@ impl EffectExecutor for FilesystemExecutor {
                 max_output,
                 permit.obligations().resource_authority == ResourceAuthority::Ambient,
                 &self.workspace_search_exclusions,
+                &protected,
             ),
             "filesystem.write" | "audit.export.write" => {
-                write_file(&target, &request.content, max_output)
+                write_file(&target, &request.content, max_output, &protected)
             }
-            "patch.preview" => preview_patch(&target, &request.content, max_output),
+            "patch.preview" => preview_patch(&target, &request.content, max_output, &protected),
             "patch.apply" | "patch.reverse" | "trace.export" => {
-                write_file(&target, &request.content, max_output)
+                write_file(&target, &request.content, max_output, &protected)
             }
             _ => Err(adapter_failure("unsupported filesystem action")),
-        }
+        }?;
+        protected.revalidate()?;
+        Ok(result)
     }
 }
 
@@ -119,6 +143,7 @@ pub(super) fn search_files(
     max_output: usize,
     ambient: bool,
     workspace_search_exclusions: &[PathBuf],
+    protected: &ProtectedFilesystemSnapshot,
 ) -> Result<QuarantinedEffectResult, ExecutionError> {
     if !root.is_dir() {
         return Err(adapter_failure(
@@ -185,9 +210,16 @@ pub(super) fn search_files(
     } else {
         Vec::new()
     };
+    let protected_roots = protected.paths();
     walker
         .follow_links(false)
-        .filter_entry(move |entry| !exclusions.iter().any(|root| entry.path().starts_with(root)))
+        .filter_entry(move |entry| {
+            !exclusions.iter().any(|root| entry.path().starts_with(root))
+                && (protected_roots.is_empty()
+                    || fs::canonicalize(entry.path()).is_ok_and(|path| {
+                        !protected_roots.iter().any(|root| path.starts_with(root))
+                    }))
+        })
         .hidden(false)
         .ignore(respect_repository_ignores)
         .git_ignore(respect_repository_ignores)
@@ -196,6 +228,9 @@ pub(super) fn search_files(
         .max_filesize(Some(MAX_SEARCH_FILE_BYTES));
     for entry in walker.build().filter_map(Result::ok) {
         let path = entry.path();
+        if !protected.discoverable(path) {
+            continue;
+        }
         if !entry
             .file_type()
             .is_some_and(|file_type| file_type.is_file())
@@ -208,9 +243,18 @@ pub(super) fn search_files(
         {
             continue;
         }
-        let Ok(bytes) = fs::read(path) else {
+        let Ok(file) = fs::File::open(path) else {
             continue;
         };
+        protected.check_file(&file)?;
+        let mut bytes = Vec::new();
+        if file
+            .take(MAX_SEARCH_FILE_BYTES.saturating_add(1))
+            .read_to_end(&mut bytes)
+            .is_err()
+        {
+            continue;
+        }
         if bytes.len() > usize::try_from(MAX_SEARCH_FILE_BYTES).unwrap_or(usize::MAX)
             || bytes.contains(&0)
         {
@@ -402,6 +446,7 @@ pub(super) fn write_file(
     target: &Path,
     content: &Value,
     max_output: usize,
+    protected: &ProtectedFilesystemSnapshot,
 ) -> Result<QuarantinedEffectResult, ExecutionError> {
     if content.get("content_base64").is_some() {
         let bytes = proposed_write_bytes(content, max_output)?;
@@ -422,7 +467,7 @@ pub(super) fn write_file(
         .get("operation")
         .and_then(Value::as_str)
         .unwrap_or("write");
-    let existing = existing_text(target, max_output)?;
+    let existing = existing_text(target, max_output, protected)?;
     let (updated, replacements, create_only) = match operation {
         "write" => {
             let supplied = content
@@ -523,8 +568,9 @@ pub(super) fn preview_patch(
     target: &Path,
     content: &Value,
     max_output: usize,
+    protected: &ProtectedFilesystemSnapshot,
 ) -> Result<QuarantinedEffectResult, ExecutionError> {
-    let original = existing_text(target, max_output)?
+    let original = existing_text(target, max_output, protected)?
         .ok_or_else(|| adapter_failure("patch.preview requires an existing file"))?;
     let old = content
         .get("old")
@@ -569,6 +615,7 @@ pub(super) fn preview_patch(
 pub(super) fn existing_text(
     target: &Path,
     max_bytes: usize,
+    protected: &ProtectedFilesystemSnapshot,
 ) -> Result<Option<String>, ExecutionError> {
     match fs::metadata(target) {
         Ok(metadata) if !metadata.is_file() => Err(adapter_failure(
@@ -577,9 +624,24 @@ pub(super) fn existing_text(
         Ok(metadata) if metadata.len() > u64::try_from(max_bytes).unwrap_or(u64::MAX) => Err(
             adapter_failure("existing file exceeds the permitted mutation bound"),
         ),
-        Ok(_) => fs::read_to_string(target)
-            .map(Some)
-            .map_err(adapter_failure),
+        Ok(_) => {
+            let file = fs::File::open(target).map_err(adapter_failure)?;
+            protected.check_file(&file)?;
+            let mut bytes = Vec::new();
+            file.take(
+                u64::try_from(max_bytes)
+                    .unwrap_or(u64::MAX)
+                    .saturating_add(1),
+            )
+            .read_to_end(&mut bytes)
+            .map_err(adapter_failure)?;
+            if bytes.len() > max_bytes {
+                return Err(adapter_failure(
+                    "existing file exceeds the permitted mutation bound",
+                ));
+            }
+            String::from_utf8(bytes).map(Some).map_err(adapter_failure)
+        }
         Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(None),
         Err(error) => Err(adapter_failure(error)),
     }
diff --git a/crates/colossus-sandbox/src/http.rs b/crates/colossus-sandbox/src/http.rs
index 70cdf8b80..eb1bd7a86 100644
--- a/crates/colossus-sandbox/src/http.rs
+++ b/crates/colossus-sandbox/src/http.rs
@@ -407,7 +407,7 @@ pub async fn run_oci_proxy_from_environment() -> Result<(), ExecutionError> {
 impl AllowlistProxy {
     #[cfg(test)]
     pub(super) async fn start(origins: Vec<String>) -> Result<Self, ExecutionError> {
-        Self::start_with_authorization(origins, None).await
+        Self::start_with_authorization(origins, None, cfg!(target_os = "macos")).await
     }
 
     pub(super) async fn start_authenticated(
@@ -415,16 +415,16 @@ impl AllowlistProxy {
         credential: &str,
     ) -> Result<Self, ExecutionError> {
         let authorization = format!("Basic {}", BASE64.encode(format!("colossus:{credential}")));
-        Self::start_with_authorization(origins, Some(authorization)).await
+        Self::start_with_authorization(origins, Some(authorization), cfg!(target_os = "macos"))
+            .await
     }
 
-    async fn start_with_authorization(
+    pub(super) async fn start_with_authorization(
         origins: Vec<String>,
         authorization: Option<String>,
+        dual_stack: bool,
     ) -> Result<Self, ExecutionError> {
-        let listener = TcpListener::bind(("127.0.0.1", 0))
-            .await
-            .map_err(adapter_failure)?;
+        let (listener, ipv6_listener) = bind_proxy_loopbacks(dual_stack).await?;
         let address = listener.local_addr().map_err(adapter_failure)?;
         let allowed = Arc::new(origins);
         let resolved = Arc::new(BTreeMap::new());
@@ -436,7 +436,16 @@ impl AllowlistProxy {
             loop {
                 tokio::select! {
                     _ = &mut shutdown_rx => break,
-                    accepted = listener.accept() => {
+                    accepted = async {
+                        if let Some(ipv6_listener) = &ipv6_listener {
+                            tokio::select! {
+                                accepted = listener.accept() => accepted,
+                                accepted = ipv6_listener.accept() => accepted,
+                            }
+                        } else {
+                            listener.accept().await
+                        }
+                    } => {
                         let Ok((stream, _)) = accepted else { break };
                         let allowed = Arc::clone(&allowed);
                         let resolved = Arc::clone(&resolved);
@@ -480,6 +489,30 @@ impl AllowlistProxy {
     }
 }
 
+async fn bind_proxy_loopbacks(
+    dual_stack: bool,
+) -> Result<(TcpListener, Option<TcpListener>), ExecutionError> {
+    for _ in 0..8 {
+        let ipv4 = TcpListener::bind(("127.0.0.1", 0))
+            .await
+            .map_err(adapter_failure)?;
+        if !dual_stack {
+            return Ok((ipv4, None));
+        }
+        let port = ipv4.local_addr().map_err(adapter_failure)?.port();
+        // Own both localhost addresses before exposing its URL. Seatbelt already
+        // grants this one loopback port; native IPv6 avoids IPv4-mapped socket denials.
+        match TcpListener::bind((std::net::Ipv6Addr::LOCALHOST, port)).await {
+            Ok(ipv6) => return Ok((ipv4, Some(ipv6))),
+            Err(error) if error.kind() == std::io::ErrorKind::AddrInUse => continue,
+            Err(error) => return Err(adapter_failure(error)),
+        }
+    }
+    Err(adapter_failure(
+        "could not reserve both private proxy loopbacks",
+    ))
+}
+
 impl Drop for AllowlistProxy {
     fn drop(&mut self) {
         if let Some(shutdown) = self.shutdown.take() {
diff --git a/crates/colossus-sandbox/src/lib.rs b/crates/colossus-sandbox/src/lib.rs
index 4f5b97c81..0d05c5e1a 100644
--- a/crates/colossus-sandbox/src/lib.rs
+++ b/crates/colossus-sandbox/src/lib.rs
@@ -69,6 +69,10 @@ mod filesystem;
 pub use filesystem::FilesystemExecutor;
 use filesystem::*;
 
+mod protected_filesystem;
+pub use protected_filesystem::ProtectedFilesystem;
+use protected_filesystem::ProtectedFilesystemSnapshot;
+
 mod process;
 pub use process::SandboxProcessExecutor;
 use process::*;
diff --git a/crates/colossus-sandbox/src/oci.rs b/crates/colossus-sandbox/src/oci.rs
index 535838975..2d4bd70f7 100644
--- a/crates/colossus-sandbox/src/oci.rs
+++ b/crates/colossus-sandbox/src/oci.rs
@@ -706,9 +706,14 @@ pub(super) fn configure_proxy_environment(command: &mut Command, proxy: &str) {
 }
 
 pub(super) fn authenticated_proxy_url(port: u16, credential: Option<&str>) -> String {
+    let host = if cfg!(target_os = "macos") {
+        "localhost"
+    } else {
+        "127.0.0.1"
+    };
     credential.map_or_else(
-        || format!("http://127.0.0.1:{port}"),
-        |credential| format!("http://colossus:{credential}@127.0.0.1:{port}"),
+        || format!("http://{host}:{port}"),
+        |credential| format!("http://colossus:{credential}@{host}:{port}"),
     )
 }
 
diff --git a/crates/colossus-sandbox/src/process.rs b/crates/colossus-sandbox/src/process.rs
index 699305561..2a9461f19 100644
--- a/crates/colossus-sandbox/src/process.rs
+++ b/crates/colossus-sandbox/src/process.rs
@@ -6,6 +6,7 @@ pub struct SandboxProcessExecutor {
     config: SandboxExecutorConfig,
     job_key: [u8; 32],
     pub(super) control: ProcessControl,
+    pub(super) protected: ProtectedFilesystem,
 }
 
 pub(super) struct OciCancellationGuard {
@@ -103,6 +104,7 @@ impl SandboxProcessExecutor {
             config,
             job_key,
             control: ProcessControl::default(),
+            protected: ProtectedFilesystem::default(),
         }
     }
 
@@ -112,8 +114,15 @@ impl SandboxProcessExecutor {
             config: self.config.clone(),
             job_key: self.job_key,
             control,
+            protected: self.protected.clone(),
         }
     }
+
+    /// Add native-owned mandatory deny roots without expanding policy grants.
+    pub fn with_protected_filesystem(mut self, protected: ProtectedFilesystem) -> Self {
+        self.protected = protected;
+        self
+    }
 }
 
 pub(super) fn is_sandbox_process_action(action: &str) -> bool {
@@ -195,6 +204,8 @@ impl SandboxProcessExecutor {
         }
         let mut spec: ProcessSpec = serde_json::from_value(request.content.clone())
             .map_err(|error| adapter_failure(format!("invalid process request: {error}")))?;
+        let mut job_obligations = permit.obligations().clone();
+        self.protected.restrict_process(&mut job_obligations)?;
         validate_process_spec(&spec, &request.resource, permit.obligations())?;
         validate_stdin_completion(&spec, &request.action)?;
         normalize_path_arguments(&mut spec, permit.obligations())?;
@@ -285,7 +296,6 @@ impl SandboxProcessExecutor {
             ));
         }
         let streaming = observer.is_some();
-        let mut job_obligations = permit.obligations().clone();
         job_obligations.timeout_ms = effective_timeout_ms;
         job_obligations.max_output_bytes = effective_output_bytes;
         let temporary_root = sandbox_temporary_root(&job_obligations.sandbox_backend)?;
@@ -527,7 +537,8 @@ pub(super) fn validate_process_spec(
         return Err(adapter_failure("process environment exceeds entry bound"));
     }
     for (name, value) in &spec.environment {
-        if (!danger_full_access && !obligations.allowed_environment.contains(name))
+        if reserved_credential_environment(name)
+            || (!danger_full_access && !obligations.allowed_environment.contains(name))
             || !valid_environment_name(name)
             || value.len() > 64 * 1024
             || value.contains('\0')
@@ -610,8 +621,25 @@ pub(super) fn inherit_ambient_environment(
         valid_environment_name(name)
             && !control_name.starts_with("COLOSSUS_SANDBOX_")
             && control_name != OCI_PROXY_CONFIG_VARIABLE
+            && !reserved_credential_environment(name)
     }));
-    environment.extend(explicit);
+    environment.extend(
+        explicit
+            .into_iter()
+            .filter(|(name, _)| !reserved_credential_environment(name)),
+    );
+}
+
+pub(super) fn reserved_credential_environment(name: &str) -> bool {
+    let name = name.to_ascii_uppercase();
+    name.starts_with("COLOSSUS_DEVELOPMENT_")
+        || matches!(
+            name.as_str(),
+            "COLOSSUS_JOURNAL_KEY"
+                | "COLOSSUS_SIGNING_KEY"
+                | "COLOSSUS_DEV_JOURNAL_KEY"
+                | "COLOSSUS_DEV_SIGNING_KEY"
+        )
 }
 
 pub(super) fn normalize_path_arguments(
diff --git a/crates/colossus-sandbox/src/protected_filesystem.rs b/crates/colossus-sandbox/src/protected_filesystem.rs
new file mode 100644
index 000000000..2087bc127
--- /dev/null
+++ b/crates/colossus-sandbox/src/protected_filesystem.rs
@@ -0,0 +1,164 @@
+use super::*;
+use colossus_home::{ConfinedFile, ConfinedRoot};
+
+// Bound metadata validation before an effect; exhausting the bound fails closed.
+const MAX_PROTECTED_ENTRIES: usize = 100_000;
+
+/// Native-owned deny roots added independently of caller policy or grants.
+/// Retained confinement rejects replaced roots, symbolic links and hard links.
+#[derive(Clone, Default)]
+pub struct ProtectedFilesystem {
+    roots: Vec<ConfinedRoot>,
+}
+
+impl ProtectedFilesystem {
+    /// Bind already validated private roots. This reads metadata, never contents,
+    /// and neither creates paths nor grants access to them.
+    pub fn new(roots: Vec<ConfinedRoot>) -> Result<Self, ExecutionError> {
+        let protection = Self { roots };
+        protection.snapshot()?;
+        Ok(protection)
+    }
+
+    pub(super) fn is_empty(&self) -> bool {
+        self.roots.is_empty()
+    }
+
+    pub(super) fn snapshot(&self) -> Result<ProtectedFilesystemSnapshot, ExecutionError> {
+        let mut files = Vec::new();
+        let mut count = 0_usize;
+        for root in &self.roots {
+            root.revalidate().map_err(protected_failure)?;
+            let mut directories = vec![root.path().to_owned()];
+            while let Some(directory) = directories.pop() {
+                for entry in fs::read_dir(directory).map_err(protected_failure)? {
+                    let path = entry.map_err(protected_failure)?.path();
+                    count = count.saturating_add(1);
+                    if count > MAX_PROTECTED_ENTRIES {
+                        return Err(protected_failure("entry bound"));
+                    }
+                    let metadata = fs::symlink_metadata(&path).map_err(protected_failure)?;
+                    if metadata.file_type().is_symlink() {
+                        return Err(protected_failure("symbolic link"));
+                    }
+                    if metadata.is_dir() {
+                        root.revalidate_directory(&path)
+                            .map_err(protected_failure)?;
+                        directories.push(path);
+                    } else if metadata.is_file() {
+                        let relative = root.relative(&path).map_err(protected_failure)?;
+                        let file = root
+                            .open_existing_file(relative)
+                            .map_err(protected_failure)?;
+                        file.revalidate(root).map_err(protected_failure)?;
+                        files.push((root.clone(), file));
+                    } else {
+                        return Err(protected_failure("nonregular entry"));
+                    }
+                }
+            }
+            root.revalidate().map_err(protected_failure)?;
+        }
+        Ok(ProtectedFilesystemSnapshot {
+            roots: self.roots.clone(),
+            files,
+        })
+    }
+
+    pub(super) fn restrict_process(
+        &self,
+        obligations: &mut PolicyObligations,
+    ) -> Result<(), ExecutionError> {
+        if self.is_empty() {
+            return Ok(());
+        }
+        if !isolating_backend(&obligations.sandbox_backend)
+            || obligations.resource_authority == ResourceAuthority::Ambient
+            || obligations.allow_sandbox_downgrade
+        {
+            return Err(adapter_failure(
+                "development credential custody requires an isolating sandbox",
+            ));
+        }
+        self.snapshot()?.revalidate()?;
+        for root in &self.roots {
+            let path = root
+                .path()
+                .to_str()
+                .ok_or_else(|| protected_failure("non-UTF-8 root"))?;
+            if !obligations
+                .protected_filesystem
+                .iter()
+                .any(|existing| existing == path)
+            {
+                obligations.protected_filesystem.push(path.to_owned());
+            }
+        }
+        Ok(())
+    }
+}
+
+pub(super) struct ProtectedFilesystemSnapshot {
+    roots: Vec<ConfinedRoot>,
+    files: Vec<(ConfinedRoot, ConfinedFile)>,
+}
+
+impl ProtectedFilesystemSnapshot {
+    pub(super) fn paths(&self) -> Vec<PathBuf> {
+        self.roots
+            .iter()
+            .map(|root| root.path().to_owned())
+            .collect()
+    }
+
+    pub(super) fn check_path(&self, path: &Path) -> Result<(), ExecutionError> {
+        if self.roots.iter().any(|root| path.starts_with(root.path())) {
+            return Err(adapter_failure(
+                "native credential authority is unavailable to filesystem effects",
+            ));
+        }
+        Ok(())
+    }
+
+    pub(super) fn discoverable(&self, path: &Path) -> bool {
+        self.roots.is_empty()
+            || fs::canonicalize(path).is_ok_and(|path| self.check_path(&path).is_ok())
+    }
+
+    pub(super) fn check_file(&self, file: &fs::File) -> Result<(), ExecutionError> {
+        for (_, protected) in &self.files {
+            if protected.shares_identity(file).map_err(protected_failure)? {
+                return Err(adapter_failure(
+                    "native credential authority is unavailable to filesystem effects",
+                ));
+            }
+        }
+        Ok(())
+    }
+
+    pub(super) fn revalidate(&self) -> Result<(), ExecutionError> {
+        for root in &self.roots {
+            root.revalidate().map_err(protected_failure)?;
+        }
+        for (root, file) in &self.files {
+            file.revalidate(root).map_err(protected_failure)?;
+        }
+        Ok(())
+    }
+}
+
+pub(super) fn isolating_backend(backend: &str) -> bool {
+    match backend {
+        "native" => cfg!(any(target_os = "linux", target_os = "macos")),
+        "windows_job" => cfg!(windows),
+        "oci" => cfg!(unix),
+        _ => false,
+    }
+}
+
+fn protected_failure(_: impl std::fmt::Display) -> ExecutionError {
+    adapter_failure("native credential authority confinement is invalid")
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/colossus-sandbox/src/protected_filesystem/tests.rs b/crates/colossus-sandbox/src/protected_filesystem/tests.rs
new file mode 100644
index 000000000..f9cf93520
--- /dev/null
+++ b/crates/colossus-sandbox/src/protected_filesystem/tests.rs
@@ -0,0 +1,409 @@
+use super::*;
+use colossus_contracts::DecisionOutcome;
+use colossus_policy::{
+    BuiltInPolicy, DenyApproval, EffectGateway, SafetyKernel, SandboxBoundaryGate, effect_request,
+    system_actor,
+};
+use colossus_testkit::InMemoryEventJournal;
+
+const SYNTHETIC_SECRET: &str = "synthetic-private-authority-needle";
+
+fn fixture() -> (tempfile::TempDir, ConfinedRoot, ProtectedFilesystem) {
+    #[cfg(windows)]
+    let directory = tempfile::Builder::new()
+        .prefix("colossus-protected-")
+        .tempdir_in(std::env::var_os("USERPROFILE").expect("test user profile"))
+        .expect("fixture below owner profile");
+    #[cfg(not(windows))]
+    let directory = tempfile::tempdir().expect("fixture");
+    let canonical = fs::canonicalize(directory.path()).expect("canonical fixture");
+    let root =
+        ConfinedRoot::bind(canonical.join("development-credentials")).expect("private authority");
+    root.open_file(Path::new(".authority-key.env"))
+        .expect("synthetic key file")
+        .file()
+        .write_all(SYNTHETIC_SECRET.as_bytes())
+        .expect("synthetic contents");
+    let protection = ProtectedFilesystem::new(vec![root.clone()]).expect("protected authority");
+    (directory, root, protection)
+}
+
+#[tokio::test]
+async fn acknowledged_full_access_permit_cannot_launch_with_development_custody() {
+    let (directory, _root, protection) = fixture();
+    let parent = fs::canonicalize(directory.path()).expect("cwd");
+    let executable = std::env::current_exe().expect("test executable");
+    let policy = BuiltInPolicy::offline_default()
+        .with_action("process.spawn", DecisionOutcome::Allow)
+        .with_sandbox("danger_full_access", "test", false)
+        .with_resource_authority(ResourceAuthority::Ambient);
+    let gateway = EffectGateway::new(
+        Arc::new(InMemoryEventJournal::default()),
+        Arc::new(policy),
+        Arc::new(DenyApproval),
+        SafetyKernel::new(["process.spawn".into()]).with_sandbox_boundary_gate(Arc::new(
+            SandboxBoundaryGate::new(Some(SandboxBoundaryMode::DangerFullAccess), true),
+        )),
+        [78_u8; 32],
+    );
+    let executor = SandboxProcessExecutor::new(
+        SandboxExecutorConfig {
+            helper_executable: parent.join("must-not-launch"),
+            oci_runtime: None,
+            oci_image: None,
+            oci_proxy_image: None,
+        },
+        [77_u8; 32],
+    )
+    .with_protected_filesystem(protection);
+    let mut request = effect_request(
+        system_actor("full-access-custody"),
+        "process.spawn",
+        executable.display().to_string(),
+        json!({"cwd": parent, "args": [], "environment": {}}),
+    );
+    request.capabilities = vec!["process.spawn".into()];
+    let error = gateway
+        .execute(request, &executor)
+        .await
+        .expect_err("native-owned custody restriction overrides acknowledged Full permit");
+    assert!(
+        error.to_string().contains("requires an isolating sandbox"),
+        "{error}"
+    );
+    assert!(
+        !error.to_string().contains("must-not-launch"),
+        "rejection precedes helper acquisition"
+    );
+}
+
+fn gateway(root: &Path, action: &str) -> EffectGateway {
+    EffectGateway::new(
+        Arc::new(InMemoryEventJournal::default()),
+        Arc::new(
+            BuiltInPolicy::offline_default()
+                .with_action(action, DecisionOutcome::Allow)
+                .with_filesystem_root(root.display().to_string(), "write"),
+        ),
+        Arc::new(DenyApproval),
+        SafetyKernel::new([action.into()]),
+        [73_u8; 32],
+    )
+}
+
+#[tokio::test]
+async fn private_authority_overrides_real_read_metadata_list_write_and_patch_permits() {
+    let (directory, root, protection) = fixture();
+    let parent = fs::canonicalize(directory.path()).expect("parent");
+    let executor = FilesystemExecutor::new().with_protected_filesystem(protection);
+    let key = root.path().join(".authority-key.env");
+    for action in [
+        "filesystem.read",
+        "filesystem.metadata",
+        "filesystem.list",
+        "filesystem.write",
+        "patch.preview",
+        "audit.export.write",
+    ] {
+        let target = if action == "filesystem.list" {
+            root.path()
+        } else {
+            &key
+        };
+        let mut request = effect_request(
+            system_actor("protection-test"),
+            action,
+            target.display().to_string(),
+            json!({"text": "replacement", "old": "synthetic", "new": "replacement"}),
+        );
+        request.capabilities = vec![action.into()];
+        let error = gateway(&parent, action)
+            .execute(request, &executor)
+            .await
+            .expect_err("native denial wins over permit");
+        assert!(
+            error.to_string().contains("native credential authority"),
+            "{action}: {error}"
+        );
+        assert!(!error.to_string().contains(SYNTHETIC_SECRET));
+    }
+    assert_eq!(
+        fs::read_to_string(&key).expect("fixture key unchanged"),
+        SYNTHETIC_SECRET
+    );
+    let ordinary = parent.join("ordinary.txt");
+    fs::write(&ordinary, "ordinary content").expect("ordinary file");
+    let mut request = effect_request(
+        system_actor("protection-test"),
+        "filesystem.read",
+        ordinary.display().to_string(),
+        json!({}),
+    );
+    request.capabilities = vec!["filesystem.read".into()];
+    let result = gateway(&parent, "filesystem.read")
+        .execute(request, &executor)
+        .await
+        .expect("ordinary granted read");
+    assert_eq!(result.bytes, b"ordinary content");
+}
+
+#[tokio::test]
+async fn hard_link_alias_fails_closed_before_direct_read_or_process_launch() {
+    let (directory, root, protection) = fixture();
+    let parent = fs::canonicalize(directory.path()).expect("parent");
+    let alias = parent.join("apparently-ordinary.txt");
+    fs::hard_link(root.path().join(".authority-key.env"), &alias)
+        .expect("hard-link attack fixture");
+    let mut request = effect_request(
+        system_actor("alias-test"),
+        "filesystem.read",
+        alias.display().to_string(),
+        json!({}),
+    );
+    request.capabilities = vec!["filesystem.read".into()];
+    let error = gateway(&parent, "filesystem.read")
+        .execute(
+            request,
+            &FilesystemExecutor::new().with_protected_filesystem(protection.clone()),
+        )
+        .await
+        .expect_err("unsafe alias rejected before contents");
+    assert!(error.to_string().contains("confinement is invalid"));
+    assert!(!error.to_string().contains(SYNTHETIC_SECRET));
+    let mut obligations = PolicyObligations {
+        sandbox_backend: if cfg!(windows) {
+            "windows_job"
+        } else {
+            "native"
+        }
+        .into(),
+        ..PolicyObligations::default()
+    };
+    assert!(
+        protection.restrict_process(&mut obligations).is_err(),
+        "alias blocks isolated job before helper launch"
+    );
+    fs::remove_file(&alias).expect("remove test alias");
+    protection.snapshot().expect("single-link custody restored");
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn canonical_parent_alias_and_open_descriptor_cannot_reveal_authority() {
+    use std::os::unix::fs::symlink;
+    let (directory, root, protection) = fixture();
+    let parent = fs::canonicalize(directory.path()).expect("parent");
+    let alias = parent.join("linked-parent");
+    symlink(root.path(), &alias).expect("directory alias");
+    let mut request = effect_request(
+        system_actor("alias-test"),
+        "filesystem.read",
+        alias.join(".authority-key.env").display().to_string(),
+        json!({}),
+    );
+    request.capabilities = vec!["filesystem.read".into()];
+    let error = gateway(&parent, "filesystem.read")
+        .execute(
+            request,
+            &FilesystemExecutor::new().with_protected_filesystem(protection.clone()),
+        )
+        .await
+        .expect_err("canonical private parent rejected");
+    assert!(error.to_string().contains("native credential authority"));
+    let snapshot = protection.snapshot().expect("snapshot");
+    let swapped = parent.join("swap-target");
+    fs::write(&swapped, "ordinary").expect("ordinary leaf");
+    let original = fs::File::open(&swapped).expect("ordinary descriptor");
+    snapshot
+        .check_file(&original)
+        .expect("ordinary descriptor allowed");
+    fs::remove_file(&swapped).expect("remove leaf");
+    symlink(root.path().join(".authority-key.env"), &swapped)
+        .expect("swap leaf after pathname check");
+    let opened = fs::File::open(&swapped).expect("simulated raced descriptor");
+    assert!(
+        snapshot.check_file(&opened).is_err(),
+        "descriptor identity rejected before bytes are read"
+    );
+    snapshot
+        .check_file(&original)
+        .expect("retained ordinary descriptor stays ordinary");
+}
+
+#[test]
+fn private_authority_is_hidden_in_all_search_modes_and_isolated_jobs_only_add_denials() {
+    let (directory, root, protection) = fixture();
+    let parent = fs::canonicalize(directory.path()).expect("parent");
+    fs::write(parent.join("visible.txt"), "public needle").expect("ordinary searchable file");
+    let snapshot = protection.snapshot().expect("snapshot");
+    for ambient in [false, true] {
+        for scoped in [false, true] {
+            let result = search_files(
+                &parent,
+                &json!({"pattern": "needle", "workspace_scoped": scoped}),
+                64 * 1024,
+                ambient,
+                &[],
+                &snapshot,
+            )
+            .expect("search");
+            let value: Value = serde_json::from_slice(&result.bytes).expect("search JSON");
+            assert_eq!(value["matches"].as_array().expect("matches").len(), 1);
+            assert_eq!(value["matches"][0]["path"], "visible.txt");
+            assert!(
+                !String::from_utf8(result.bytes)
+                    .expect("JSON text")
+                    .contains(SYNTHETIC_SECRET)
+            );
+        }
+    }
+    let mut obligations = PolicyObligations {
+        sandbox_backend: if cfg!(windows) {
+            "windows_job"
+        } else {
+            "native"
+        }
+        .into(),
+        filesystem: vec![FilesystemGrant {
+            root: parent.join("workspace").display().to_string(),
+            mode: "write".into(),
+        }],
+        protected_filesystem: vec!["existing-policy-denial".into()],
+        ..PolicyObligations::default()
+    };
+    let grants = obligations.filesystem.clone();
+    protection
+        .restrict_process(&mut obligations)
+        .expect("supported isolated job");
+    assert_eq!(
+        obligations.filesystem, grants,
+        "deny root never expands a grant"
+    );
+    assert_eq!(
+        obligations.protected_filesystem,
+        vec![
+            "existing-policy-denial".to_owned(),
+            root.path().display().to_string()
+        ]
+    );
+    obligations.allow_sandbox_downgrade = true;
+    assert!(
+        protection.restrict_process(&mut obligations).is_err(),
+        "fallback cannot bypass native-owned deny root"
+    );
+    obligations.allow_sandbox_downgrade = false;
+    for backend in ["external", "danger_full_access", "broker", "unknown"] {
+        obligations.sandbox_backend = backend.into();
+        assert!(
+            protection.restrict_process(&mut obligations).is_err(),
+            "reject {backend}"
+        );
+    }
+}
+
+#[test]
+fn managed_process_clone_preserves_native_owned_denials() {
+    let (_directory, root, protection) = fixture();
+    let executor = SandboxProcessExecutor::new(
+        SandboxExecutorConfig {
+            helper_executable: std::env::current_exe().expect("helper path"),
+            oci_runtime: None,
+            oci_image: None,
+            oci_proxy_image: None,
+        },
+        [79_u8; 32],
+    )
+    .with_protected_filesystem(protection);
+    let controlled = executor.controlled(ProcessControl::default());
+    let mut obligations = PolicyObligations {
+        sandbox_backend: if cfg!(windows) {
+            "windows_job"
+        } else {
+            "native"
+        }
+        .into(),
+        ..PolicyObligations::default()
+    };
+    controlled
+        .protected
+        .restrict_process(&mut obligations)
+        .expect("managed adapter retains protection");
+    assert_eq!(
+        obligations.protected_filesystem,
+        vec![root.path().display().to_string()]
+    );
+}
+
+#[test]
+fn credential_control_variables_never_reach_ambient_or_explicit_process_environment() {
+    let directory = tempfile::tempdir().expect("cwd");
+    let cwd = fs::canonicalize(directory.path()).expect("cwd");
+    let executable = std::env::current_exe().expect("fixture executable");
+    let mut obligations = PolicyObligations {
+        sandbox_backend: "danger_full_access".into(),
+        resource_authority: ResourceAuthority::Ambient,
+        max_output_bytes: 64 * 1024,
+        ..PolicyObligations::default()
+    };
+    let mut spec = ProcessSpec {
+        lifetime: None,
+        cwd,
+        args: vec![],
+        environment: BTreeMap::new(),
+        stdin_base64: None,
+        stdin_completion: None,
+        timeout_ms: None,
+        max_output_bytes: None,
+    };
+    for name in [
+        "COLOSSUS_DEVELOPMENT_CREDENTIAL_AUTHORITY",
+        "colossus_development_wrapping_key",
+        "COLOSSUS_JOURNAL_KEY",
+        "COLOSSUS_SIGNING_KEY",
+        "COLOSSUS_DEV_JOURNAL_KEY",
+        "colossus_dev_signing_key",
+    ] {
+        spec.environment = [(name.into(), SYNTHETIC_SECRET.into())].into();
+        obligations.allowed_environment = vec![name.into()];
+        let error = validate_process_spec(&spec, &executable.display().to_string(), &obligations)
+            .expect_err("explicit reserved overlay rejected even under Full access");
+        assert!(!error.to_string().contains(SYNTHETIC_SECRET));
+        let mut environment = spec.environment.clone();
+        inherit_ambient_environment(
+            &mut environment,
+            [
+                (name.into(), SYNTHETIC_SECRET.into()),
+                ("PATH".into(), "safe-path".into()),
+            ],
+        );
+        assert!(
+            !environment.contains_key(name),
+            "reserved explicit/ambient {name} stripped"
+        );
+        assert_eq!(environment["PATH"], "safe-path");
+    }
+}
+
+#[test]
+fn replacing_retained_private_root_invalidates_protection() {
+    let (directory, root, protection) = fixture();
+    let replacement = fs::canonicalize(directory.path())
+        .expect("parent")
+        .join("old-authority");
+    #[cfg(unix)]
+    {
+        fs::rename(root.path(), replacement).expect("replace private root");
+        ConfinedRoot::bind(root.path()).expect("new empty private directory");
+        assert!(
+            protection.snapshot().is_err(),
+            "retained authority cannot retarget"
+        );
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = (replacement, root);
+        protection
+            .snapshot()
+            .expect("retained root revalidates on platform");
+    }
+}
diff --git a/crates/colossus-sandbox/src/tests.rs b/crates/colossus-sandbox/src/tests.rs
index dda54afa0..e2db9a715 100644
--- a/crates/colossus-sandbox/src/tests.rs
+++ b/crates/colossus-sandbox/src/tests.rs
@@ -1294,6 +1294,9 @@ fn ambient_workspace_search_respects_repository_ignores_and_releases_context() {
         1024 * 1024,
         true,
         &[application_home],
+        &super::ProtectedFilesystem::default()
+            .snapshot()
+            .expect("unprotected snapshot"),
     )
     .expect("workspace-scoped ambient search");
     let value: serde_json::Value = serde_json::from_slice(&result.bytes).expect("JSON");
@@ -1560,67 +1563,104 @@ async fn public_wildcard_proxy_rejects_loopback_without_an_exact_origin() {
 
 #[tokio::test]
 async fn authenticated_allowlist_proxy_rejects_missing_credentials_and_strips_valid_ones() {
-    let upstream = TcpListener::bind(("127.0.0.1", 0)).await.expect("listen");
-    let address = upstream.local_addr().expect("address");
-    let origin = format!("http://{address}");
-    let credential = "a".repeat(64);
-    let proxy = AllowlistProxy::start_authenticated(vec![origin.clone()], &credential)
-        .await
+    for dual_stack in [false, true] {
+        let upstream = TcpListener::bind(("127.0.0.1", 0)).await.expect("listen");
+        let address = upstream.local_addr().expect("address");
+        let origin = format!("http://{address}");
+        let credential = "a".repeat(64);
+        let authorization = format!("Basic {}", BASE64.encode(format!("colossus:{credential}")));
+        let proxy = if dual_stack {
+            AllowlistProxy::start_with_authorization(
+                vec![origin.clone()],
+                Some(authorization.clone()),
+                true,
+            )
+            .await
+        } else {
+            AllowlistProxy::start_authenticated(vec![origin.clone()], &credential).await
+        }
         .expect("authenticated proxy");
-
-    let mut unauthorized = TcpStream::connect(("127.0.0.1", proxy.port()))
-        .await
-        .expect("unauthorized connect");
-    unauthorized
-        .write_all(format!("GET {origin}/denied HTTP/1.1\r\nHost: {address}\r\n\r\n").as_bytes())
-        .await
-        .expect("unauthorized request");
-    let mut response = Vec::new();
-    unauthorized
-        .read_to_end(&mut response)
-        .await
-        .expect("unauthorized response");
-    assert!(response.starts_with(b"HTTP/1.1 407"));
-
-    let server = tokio::spawn(async move {
-        let (mut stream, _) = upstream.accept().await.expect("authorized accept");
-        let mut request = Vec::new();
-        let mut buffer = [0_u8; 1024];
-        while !request.windows(4).any(|window| window == b"\r\n\r\n") {
-            let count = stream.read(&mut buffer).await.expect("authorized read");
-            assert!(count > 0);
-            request.extend_from_slice(&buffer[..count]);
+        let mut endpoints = vec![proxy.address];
+        if dual_stack {
+            endpoints.push(SocketAddr::new(
+                IpAddr::V6(std::net::Ipv6Addr::LOCALHOST),
+                proxy.port(),
+            ));
         }
-        assert!(
-            !String::from_utf8_lossy(&request)
-                .to_ascii_lowercase()
-                .contains("proxy-authorization:")
-        );
+        let requests = endpoints.len();
+        let server = tokio::spawn(async move {
+            for _ in 0..requests {
+                let (mut stream, _) = upstream.accept().await.expect("authorized accept");
+                let mut request = Vec::new();
+                let mut buffer = [0_u8; 1024];
+                while !request.windows(4).any(|window| window == b"\r\n\r\n") {
+                    let count = stream.read(&mut buffer).await.expect("authorized read");
+                    assert!(count > 0);
+                    request.extend_from_slice(&buffer[..count]);
+                    assert!(request.len() <= 16 * 1024);
+                }
+                assert!(
+                    !String::from_utf8_lossy(&request)
+                        .to_ascii_lowercase()
+                        .contains("proxy-authorization:")
+                );
+                stream
+                    .write_all(
+                        b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok",
+                    )
+                    .await
+                    .expect("authorized response");
+            }
+        });
+        for endpoint in &endpoints {
+            let response = proxy_test_response(
+                *endpoint,
+                format!("GET {origin}/denied HTTP/1.1\r\nHost: {address}\r\n\r\n"),
+            )
+            .await;
+            assert!(response.starts_with(b"HTTP/1.1 407"));
+            let response = proxy_test_response(*endpoint,
+                format!("GET http://127.0.0.1:1/denied HTTP/1.1\r\nHost: 127.0.0.1:1\r\nProxy-Authorization: {authorization}\r\n\r\n"),
+            ).await;
+            assert!(response.starts_with(b"HTTP/1.1 403"));
+            let response = proxy_test_response(*endpoint,
+                format!("GET {origin}/allowed HTTP/1.1\r\nHost: {address}\r\nProxy-Authorization: {authorization}\r\nConnection: close\r\n\r\n"),
+            ).await;
+            assert!(response.starts_with(b"HTTP/1.1 200"));
+            assert!(response.ends_with(b"ok"));
+        }
+        server.await.expect("server");
+        assert_eq!(proxy.observed_origins(), vec![origin]);
+        drop(proxy);
+        for endpoint in endpoints {
+            tokio::time::timeout(Duration::from_secs(5), async {
+                while let Ok(stream) = TcpStream::connect(endpoint).await {
+                    drop(stream);
+                    tokio::time::sleep(Duration::from_millis(10)).await;
+                }
+            })
+            .await
+            .expect("private proxy listener closes on drop");
+        }
+    }
+}
+
+async fn proxy_test_response(endpoint: SocketAddr, request: String) -> Vec<u8> {
+    tokio::time::timeout(Duration::from_secs(5), async {
+        let mut stream = TcpStream::connect(endpoint).await.expect("proxy connect");
         stream
-            .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok")
+            .write_all(request.as_bytes())
             .await
-            .expect("authorized response");
-    });
-    let authorization = format!("Basic {}", BASE64.encode(format!("colossus:{credential}")));
-    let mut authorized = TcpStream::connect(("127.0.0.1", proxy.port()))
-        .await
-        .expect("authorized connect");
-    authorized
-            .write_all(
-                format!(
-                    "GET {origin}/allowed HTTP/1.1\r\nHost: {address}\r\nProxy-Authorization: {authorization}\r\nConnection: close\r\n\r\n"
-                )
-                .as_bytes(),
-            )
+            .expect("proxy request");
+        let mut response = Vec::new();
+        stream
+            .read_to_end(&mut response)
             .await
-            .expect("authorized request");
-    let mut response = Vec::new();
-    authorized
-        .read_to_end(&mut response)
-        .await
-        .expect("authorized response");
-    assert!(response.starts_with(b"HTTP/1.1 200"));
-    server.await.expect("server");
+            .expect("proxy response");
+        response
+    })
+    .await
+    .expect("proxy response deadline")
 }
 
 #[tokio::test]
diff --git a/crates/colossus-sdk/Cargo.toml b/crates/colossus-sdk/Cargo.toml
index 98d6d02d1..ac124a5da 100644
--- a/crates/colossus-sdk/Cargo.toml
+++ b/crates/colossus-sdk/Cargo.toml
@@ -18,6 +18,7 @@ daemon = [
     "dep:prost",
     "dep:prost-types",
     "dep:rustls",
+    "dep:serde_json",
     "dep:sha2",
     "dep:tonic",
     "dep:tokio",
@@ -37,6 +38,7 @@ sidecar = [
     "dep:tempfile",
 ]
 embedded = []
+serialization = ["dep:serde"]
 
 [dependencies]
 async-trait.workspace = true
@@ -54,6 +56,7 @@ prost = { workspace = true, optional = true }
 prost-types = { workspace = true, optional = true }
 rustls = { workspace = true, optional = true }
 serde = { workspace = true, optional = true }
+serde_json = { workspace = true, optional = true }
 sha2 = { workspace = true, optional = true }
 sysinfo = { workspace = true, optional = true }
 thiserror.workspace = true
@@ -72,6 +75,9 @@ tempfile = { workspace = true, optional = true }
 nix = { workspace = true, features = ["fs", "process", "signal"], optional = true }
 rustix = { workspace = true, optional = true }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+rustix = { workspace = true, features = ["net"], optional = true }
+
 [target.'cfg(windows)'.dependencies]
 colossus-windows-native = { workspace = true, optional = true }
 
diff --git a/crates/colossus-sdk/src/backend.rs b/crates/colossus-sdk/src/backend.rs
index 1c8fbed77..a54bc26ba 100644
--- a/crates/colossus-sdk/src/backend.rs
+++ b/crates/colossus-sdk/src/backend.rs
@@ -34,6 +34,43 @@ pub enum BackendKind {
 /// context before exposing this interface.
 #[async_trait]
 pub trait AgentRunClient: Send + Sync {
+    /// Read metadata-only current policy posture beneath this application's authority.
+    async fn get_runtime_policy_posture(&self) -> ApiResult<crate::RuntimePolicyPosture> {
+        Err(crate::ApiError::failed_precondition(
+            crate::ApiErrorReason::InvalidRunTransition,
+            "runtime policy metadata is unavailable",
+        ))
+    }
+    /// Explicitly share only this application's sessions in the connected workspace.
+    async fn set_workspace_sharing(
+        &self,
+        _request: crate::SetWorkspaceSharingRequest,
+    ) -> ApiResult<crate::WorkspaceSharingState> {
+        Err(crate::ApiError::failed_precondition(
+            crate::ApiErrorReason::InvalidRunTransition,
+            "workspace sharing is unavailable",
+        ))
+    }
+
+    /// Discover runtime-authorized shared sessions with explicit mutation flags.
+    async fn list_visible_runs(
+        &self,
+        request: ListRunsRequest,
+    ) -> ApiResult<crate::ListVisibleRunsResponse> {
+        let page = self.list_runs(request).await?;
+        Ok(crate::ListVisibleRunsResponse {
+            runs: page
+                .runs
+                .into_iter()
+                .map(|run| crate::VisibleRun {
+                    run,
+                    controllable: false,
+                    continuable: false,
+                })
+                .collect(),
+            page: page.page,
+        })
+    }
     /// List caller-owned managed shells.
     async fn list_process_sessions(
         &self,
@@ -175,6 +212,44 @@ impl fmt::Debug for ContextBoundAgentRunClient {
 #[async_trait]
 #[cfg(feature = "embedded")]
 impl AgentRunClient for ContextBoundAgentRunClient {
+    async fn get_runtime_policy_posture(&self) -> ApiResult<crate::RuntimePolicyPosture> {
+        self.api.get_runtime_policy_posture(&self.caller).await
+    }
+    async fn set_workspace_sharing(
+        &self,
+        request: crate::SetWorkspaceSharingRequest,
+    ) -> ApiResult<crate::WorkspaceSharingState> {
+        self.api.set_workspace_sharing(&self.caller, request).await
+    }
+    async fn list_visible_runs(
+        &self,
+        request: ListRunsRequest,
+    ) -> ApiResult<crate::ListVisibleRunsResponse> {
+        let page = self
+            .api
+            .list_visible_runs(
+                &self.caller,
+                crate::embedded_projection::list_request(request),
+            )
+            .await?;
+        let runs = page
+            .runs
+            .into_iter()
+            .map(|value| {
+                Ok(crate::VisibleRun {
+                    run: crate::embedded_projection::get_response(value.run, &self.caller)?.run,
+                    controllable: value.controllable,
+                    continuable: value.continuable,
+                })
+            })
+            .collect::<ApiResult<Vec<_>>>()?;
+        Ok(crate::ListVisibleRunsResponse {
+            runs,
+            page: page
+                .next_page_token
+                .map(|next_page_token| crate::PageResponse { next_page_token }),
+        })
+    }
     async fn list_process_sessions(
         &self,
         request: crate::ListProcessSessionsRequest,
@@ -361,6 +436,16 @@ pub trait Backend: Send + Sync {
     /// Caller-bound run service.
     fn agent_runs(&self) -> Arc<dyn AgentRunClient>;
 
+    /// Authenticated runtime instance, when this backend has a native identity.
+    fn instance_id(&self) -> Option<crate::InstanceId> {
+        None
+    }
+
+    /// Independent cloud run client, present only after native cloud grant provisioning.
+    fn connector_runs(&self) -> Option<Arc<dyn AgentRunClient>> {
+        None
+    }
+
     /// Cached authenticated server capabilities.
     ///
     /// Custom and preview-era embedded backends default to no optional behaviors.
diff --git a/crates/colossus-sdk/src/client.rs b/crates/colossus-sdk/src/client.rs
index af934e5cb..bec4d4ee6 100644
--- a/crates/colossus-sdk/src/client.rs
+++ b/crates/colossus-sdk/src/client.rs
@@ -72,6 +72,16 @@ impl Colossus {
         self.backend.agent_runs()
     }
 
+    /// Return the independently verified runtime instance without descriptor access.
+    pub fn instance_id(&self) -> Option<crate::InstanceId> {
+        self.backend.instance_id()
+    }
+
+    /// Return the independently granted native cloud run client, without exposing credentials.
+    pub fn connector_runs(&self) -> Option<Arc<dyn AgentRunClient>> {
+        self.backend.connector_runs()
+    }
+
     /// Return authenticated optional behaviors cached during connection setup.
     pub fn capabilities(&self) -> ServerCapabilities {
         self.backend.capabilities()
diff --git a/crates/colossus-sdk/src/development_selector.rs b/crates/colossus-sdk/src/development_selector.rs
new file mode 100644
index 000000000..4d5f58b2c
--- /dev/null
+++ b/crates/colossus-sdk/src/development_selector.rs
@@ -0,0 +1,40 @@
+//! Nonsecret native-sidecar environment seam; never forwards wrapping material.
+use crate::{SdkError, SdkResult};
+use std::{ffi::OsString, path::Path};
+
+// Mirrors the native credentials contract; runtime validates its exact home binding.
+pub(crate) const VARIABLE: &str = "COLOSSUS_DEVELOPMENT_CREDENTIAL_AUTHORITY";
+pub(crate) fn selector() -> SdkResult<Option<OsString>> {
+    validate(std::env::var_os(VARIABLE), cfg!(debug_assertions))
+}
+fn validate(value: Option<OsString>, development: bool) -> SdkResult<Option<OsString>> {
+    if let Some(path) = value.as_ref() {
+        let text = path.to_str().ok_or(SdkError::InvalidConfiguration(
+            "invalid development authority selector",
+        ))?;
+        if !development
+            || text.len() > 4096
+            || text.chars().any(char::is_control)
+            || !Path::new(path).is_absolute()
+        {
+            return Err(SdkError::InvalidConfiguration(
+                "development authority requires an absolute path and debug native host",
+            ));
+        }
+    }
+    Ok(value)
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn selector_is_nonsecret_bounded_and_rejected_for_release() {
+        assert!(validate(None, false).unwrap().is_none());
+        assert!(validate(Some("relative".into()), true).is_err());
+        let path = std::env::temp_dir()
+            .join("explicit-development-authority")
+            .into_os_string();
+        assert!(validate(Some(path.clone()), false).is_err());
+        assert_eq!(validate(Some(path.clone()), true).unwrap(), Some(path));
+    }
+}
diff --git a/crates/colossus-sdk/src/grpc.rs b/crates/colossus-sdk/src/grpc.rs
index d6e5766a0..cd2b89a81 100644
--- a/crates/colossus-sdk/src/grpc.rs
+++ b/crates/colossus-sdk/src/grpc.rs
@@ -134,6 +134,7 @@ impl fmt::Debug for GrpcConnectOptions {
 
 /// Concrete pinned-TLS, bearer-authenticated public gRPC backend.
 pub struct GrpcBackend {
+    instance_id: crate::InstanceId,
     kind: BackendKind,
     agent_runs: Arc<GrpcAgentRunClient>,
     artifacts: Arc<GrpcArtifactClient>,
@@ -198,6 +199,7 @@ impl GrpcBackend {
             std::sync::atomic::Ordering::Release,
         );
         Ok(Self {
+            instance_id: options.expected_instance_id,
             kind: options.backend_kind,
             agent_runs,
             plugins: Arc::new(plugins::GrpcPluginClient {
@@ -253,6 +255,10 @@ impl Backend for GrpcBackend {
         self.agent_runs.clone()
     }
 
+    fn instance_id(&self) -> Option<crate::InstanceId> {
+        Some(self.instance_id)
+    }
+
     fn capabilities(&self) -> ServerCapabilities {
         self.capabilities.clone()
     }
@@ -555,6 +561,127 @@ fn cancel_watch_on_close(
 
 #[async_trait]
 impl AgentRunClient for GrpcAgentRunClient {
+    async fn get_runtime_policy_posture(&self) -> ApiResult<crate::RuntimePolicyPosture> {
+        let response = self
+            .client()
+            .get_runtime_policy_posture(
+                self.request(proto::GetRuntimePolicyPostureRequest {})
+                    .await?,
+            )
+            .await
+            .map_err(api_error_from_status)?
+            .into_inner();
+        if response.policy_json.is_empty() || response.policy_json.len() > 65536 {
+            return Err(protocol_error());
+        }
+        let posture: crate::RuntimePolicyPosture =
+            serde_json::from_slice(&response.policy_json).map_err(|_| protocol_error())?;
+        if !posture.validate() {
+            return Err(protocol_error());
+        }
+        Ok(posture)
+    }
+    async fn set_workspace_sharing(
+        &self,
+        request: crate::SetWorkspaceSharingRequest,
+    ) -> ApiResult<crate::WorkspaceSharingState> {
+        validate_identifier(&request.recipient_application_id)?;
+        let expected = request.clone();
+        let response = self
+            .client()
+            .set_workspace_sharing(
+                self.request(proto::SetWorkspaceSharingRequest {
+                    recipient_application_id: request.recipient_application_id,
+                    enabled: request.enabled,
+                    allow_continuation: request.allow_continuation,
+                })
+                .await?,
+            )
+            .await
+            .map_err(api_error_from_status)?
+            .into_inner();
+        validate_identifier(&response.recipient_application_id).map_err(|_| protocol_error())?;
+        if response.allow_continuation && !response.enabled
+            || response.recipient_application_id != expected.recipient_application_id
+            || response.enabled != expected.enabled
+            || response.allow_continuation != expected.allow_continuation
+        {
+            return Err(protocol_error());
+        }
+        Ok(crate::WorkspaceSharingState {
+            recipient_application_id: response.recipient_application_id,
+            enabled: response.enabled,
+            allow_continuation: response.allow_continuation,
+        })
+    }
+
+    async fn list_visible_runs(
+        &self,
+        request: ListRunsRequest,
+    ) -> ApiResult<crate::ListVisibleRunsResponse> {
+        let fallback = request.clone();
+        if let Some(session_id) = &request.session_id {
+            validate_identifier(session_id)?;
+        }
+        if request.statuses.len() > MAX_COLLECTION_ITEMS {
+            return Err(invalid_request("statuses", "too many status filters"));
+        }
+        let request = self
+            .request(proto::ListVisibleRunsRequest {
+                session_id: request.session_id,
+                statuses: request
+                    .statuses
+                    .into_iter()
+                    .map(proto_run_status)
+                    .map(|status| status as i32)
+                    .collect(),
+                page: request.page.map(|page| proto::PageRequest {
+                    page_size: page.page_size,
+                    page_token: page.page_token,
+                }),
+                include_archived: request.include_archived,
+            })
+            .await?;
+        let response = match self.client().list_visible_runs(request).await {
+            Ok(response) => response.into_inner(),
+            Err(status) if status.code() == tonic::Code::Unimplemented => {
+                let page = self.list_runs(fallback).await?;
+                return Ok(crate::ListVisibleRunsResponse {
+                    runs: page
+                        .runs
+                        .into_iter()
+                        .map(|run| crate::VisibleRun {
+                            run,
+                            controllable: false,
+                            continuable: false,
+                        })
+                        .collect(),
+                    page: page.page,
+                });
+            }
+            Err(status) => return Err(api_error_from_status(status)),
+        };
+        if response.runs.len() > MAX_COLLECTION_ITEMS {
+            return Err(protocol_error());
+        }
+        let runs = response
+            .runs
+            .into_iter()
+            .map(|value| {
+                Ok(crate::VisibleRun {
+                    run: run_from_proto(required(value.run)?)?,
+                    controllable: value.controllable,
+                    continuable: value.continuable,
+                })
+            })
+            .collect::<ApiResult<Vec<_>>>()?;
+        Ok(crate::ListVisibleRunsResponse {
+            runs,
+            page: response.page.map(|page| PageResponse {
+                next_page_token: page.next_page_token,
+            }),
+        })
+    }
     async fn list_process_sessions(
         &self,
         request: crate::ListProcessSessionsRequest,
diff --git a/crates/colossus-sdk/src/keyring_provider.rs b/crates/colossus-sdk/src/keyring_provider.rs
index 7cbfd1de7..0aa6373a2 100644
--- a/crates/colossus-sdk/src/keyring_provider.rs
+++ b/crates/colossus-sdk/src/keyring_provider.rs
@@ -1,8 +1,10 @@
 use crate::{CredentialProvider, SdkError, SdkResult, Secret};
 use async_trait::async_trait;
-use std::fmt;
+use std::{fmt, sync::Arc, time::Duration};
+use tokio::sync::Mutex;
 
 const MAX_KEYRING_ID_BYTES: usize = 256;
+const MAX_KEYRING_WAIT: Duration = Duration::from_secs(30);
 
 /// OS-keyring credential source for one enrolled application.
 ///
@@ -12,6 +14,7 @@ const MAX_KEYRING_ID_BYTES: usize = 256;
 pub struct KeyringCredentialProvider {
     service: String,
     account: String,
+    access: Arc<Mutex<()>>,
 }
 
 impl KeyringCredentialProvider {
@@ -21,7 +24,32 @@ impl KeyringCredentialProvider {
         let account = account.into();
         validate_keyring_id(&service)?;
         validate_keyring_id(&account)?;
-        Ok(Self { service, account })
+        Ok(Self {
+            service,
+            account,
+            access: Arc::new(Mutex::new(())),
+        })
+    }
+
+    async fn read_with(
+        &self,
+        wait: Duration,
+        reader: impl FnOnce() -> SdkResult<Secret> + Send + 'static,
+    ) -> SdkResult<Secret> {
+        let access = Arc::clone(&self.access);
+        tokio::time::timeout(wait, async move {
+            let guard = access.lock_owned().await;
+            tokio::task::spawn_blocking(move || {
+                // Cancellation cannot abort a running native read. Its guard must
+                // stay in that blocking task, not in the canceled async caller.
+                let _guard = guard;
+                reader()
+            })
+            .await
+            .map_err(|_| SdkError::Authentication)?
+        })
+        .await
+        .map_err(|_| SdkError::Authentication)?
     }
 }
 
@@ -40,14 +68,15 @@ impl CredentialProvider for KeyringCredentialProvider {
     async fn load(&self) -> SdkResult<Secret> {
         let service = self.service.clone();
         let account = self.account.clone();
-        let bytes = tokio::task::spawn_blocking(move || {
-            keyring::Entry::new(&service, &account)
+        self.read_with(MAX_KEYRING_WAIT, move || {
+            let bytes = keyring::Entry::new(&service, &account)
                 .and_then(|entry| entry.get_secret())
-                .map_err(|_| SdkError::Authentication)
+                .map_err(|_| SdkError::Authentication)?;
+            // Even if the caller has canceled, the completed task owns a
+            // zeroizing secret; no detached plaintext Vec outlives this read.
+            Secret::new(bytes)
         })
         .await
-        .map_err(|_| SdkError::Authentication)??;
-        Secret::new(bytes)
     }
 }
 
@@ -79,4 +108,67 @@ mod tests {
         assert!(KeyringCredentialProvider::new("", "account").is_err());
         assert!(KeyringCredentialProvider::new("service", " account").is_err());
     }
+
+    #[tokio::test]
+    async fn canceled_native_read_keeps_its_guard_and_next_completed_read_is_fresh() {
+        use std::sync::{
+            Condvar,
+            atomic::{AtomicUsize, Ordering},
+        };
+        let provider = Arc::new(KeyringCredentialProvider::new("test", "test").unwrap());
+        let calls = Arc::new(AtomicUsize::new(0));
+        let release = Arc::new((std::sync::Mutex::new(false), Condvar::new()));
+        let (entered_tx, entered_rx) = tokio::sync::oneshot::channel();
+        let (finished_tx, finished_rx) = tokio::sync::oneshot::channel();
+        let first = {
+            let provider = Arc::clone(&provider);
+            let calls = Arc::clone(&calls);
+            let release = Arc::clone(&release);
+            tokio::spawn(async move {
+                provider
+                    .read_with(Duration::from_secs(5), move || {
+                        calls.fetch_add(1, Ordering::SeqCst);
+                        let _ = entered_tx.send(());
+                        let (mutex, condition) = &*release;
+                        let mut guard = mutex.lock().unwrap();
+                        while !*guard {
+                            guard = condition.wait(guard).unwrap();
+                        }
+                        let _ = finished_tx.send(());
+                        Secret::new(b"first-token".to_vec())
+                    })
+                    .await
+            })
+        };
+        entered_rx.await.unwrap();
+        first.abort();
+        assert!(first.await.unwrap_err().is_cancelled());
+        let result = {
+            let calls = Arc::clone(&calls);
+            provider
+                .read_with(Duration::from_millis(30), move || {
+                    calls.fetch_add(1, Ordering::SeqCst);
+                    Secret::new(b"must-not-start".to_vec())
+                })
+                .await
+        };
+        // Release before assertions so a failure cannot strand a native thread.
+        *release.0.lock().unwrap() = true;
+        release.1.notify_one();
+        finished_rx.await.unwrap();
+        assert!(matches!(result, Err(SdkError::Authentication)));
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+        let fresh = {
+            let calls = Arc::clone(&calls);
+            provider
+                .read_with(Duration::from_secs(1), move || {
+                    calls.fetch_add(1, Ordering::SeqCst);
+                    Secret::new(b"rotated-token".to_vec())
+                })
+                .await
+                .unwrap()
+        };
+        assert_eq!(fresh.expose(), b"rotated-token");
+        assert_eq!(calls.load(Ordering::SeqCst), 2);
+    }
 }
diff --git a/crates/colossus-sdk/src/lib.rs b/crates/colossus-sdk/src/lib.rs
index 06aa2aa88..de2ba74df 100644
--- a/crates/colossus-sdk/src/lib.rs
+++ b/crates/colossus-sdk/src/lib.rs
@@ -11,6 +11,8 @@ mod client;
 mod config;
 #[cfg(feature = "daemon")]
 mod daemon;
+#[cfg(all(feature = "sidecar", any(unix, windows)))]
+mod development_selector;
 #[cfg(feature = "embedded")]
 mod embedded;
 #[cfg(feature = "embedded")]
@@ -20,6 +22,8 @@ mod error;
 mod grpc;
 #[cfg(feature = "keyring")]
 mod keyring_provider;
+#[cfg(all(feature = "sidecar", target_os = "linux"))]
+mod linux_credential_session;
 #[cfg(all(feature = "sidecar", target_os = "macos"))]
 mod macos_code_identity;
 #[cfg(all(feature = "sidecar", target_os = "macos"))]
@@ -36,12 +40,14 @@ mod native_sidecar;
 mod native_sidecar;
 mod plugins;
 mod secret;
+mod sharing;
 #[cfg(feature = "sidecar")]
 mod sidecar;
 #[cfg(all(feature = "sidecar", any(unix, windows)))]
 mod sidecar_agent_runs;
 mod stream;
 mod types;
+pub use sharing::{ListVisibleRunsResponse, VisibleRun};
 mod workflows;
 pub use plugins::*;
 pub use workflows::*;
@@ -52,7 +58,10 @@ pub use backend::{AgentRunClient, ArtifactClient, Backend, BackendKind};
 pub use client::Colossus;
 pub use colossus_api::{
     ApiError, ApiErrorCode, ApiErrorReason, ApiResult, ApiScope, FieldViolation, IdempotencyKey,
-    PLAN_CONTINUATION_CAPABILITY, SESSION_ACTIVITY_CAPABILITY, scopes,
+    PLAN_CONTINUATION_CAPABILITY, PolicyApprovalMode, PolicyFinding, PolicyFindingSeverity,
+    PolicyModelLabel, PolicyProvenance, PolicySandboxBackend, PolicyTelemetry,
+    PolicyTelemetryProvenance, RuntimePolicyPosture, SESSION_ACTIVITY_CAPABILITY,
+    SetWorkspaceSharingRequest, WorkspaceSharingState, scopes,
 };
 #[cfg(all(feature = "sidecar", target_os = "macos"))]
 pub use colossus_darwin_process::{
diff --git a/crates/colossus-sdk/src/linux_credential_session.rs b/crates/colossus-sdk/src/linux_credential_session.rs
new file mode 100644
index 000000000..c7964e52d
--- /dev/null
+++ b/crates/colossus-sdk/src/linux_credential_session.rs
@@ -0,0 +1,177 @@
+//! Narrow native authority for the Linux Secret Service session.
+//!
+//! A managed child has no ambient environment. Its one session locator comes from
+//! the native host and must resolve to a local Unix bus owned by the same OS user.
+
+use crate::{SdkError, SdkResult};
+use rustix::net::{AddressFamily, SocketAddrUnix, SocketFlags, SocketType};
+use std::{os::unix::ffi::OsStringExt as _, path::PathBuf, time::Duration};
+
+const INVALID_SESSION: SdkError = SdkError::InvalidConfiguration(
+    "Linux Managed Local requires a same-user local Unix Secret Service session",
+);
+
+pub(super) async fn verified_address() -> SdkResult<String> {
+    let uid = rustix::process::getuid();
+    let address = match std::env::var("DBUS_SESSION_BUS_ADDRESS") {
+        Ok(address) => address,
+        Err(std::env::VarError::NotPresent) => format!("unix:path=/run/user/{}/bus", uid.as_raw()),
+        Err(std::env::VarError::NotUnicode(_)) => return Err(INVALID_SESSION),
+    };
+    verify(&address, uid).await?;
+    Ok(address)
+}
+
+async fn verify(address: &str, expected_uid: rustix::process::Uid) -> SdkResult<()> {
+    let socket_address = parse(address)?;
+    let socket = rustix::net::socket_with(
+        AddressFamily::UNIX,
+        SocketType::STREAM,
+        SocketFlags::CLOEXEC | SocketFlags::NONBLOCK,
+        None,
+    )
+    .map_err(|_| INVALID_SESSION)?;
+    match rustix::net::connect(&socket, &socket_address) {
+        Ok(()) | Err(rustix::io::Errno::INPROGRESS) => {}
+        Err(_) => return Err(INVALID_SESSION),
+    }
+    let stream = tokio::net::UnixStream::from_std(socket.into()).map_err(|_| INVALID_SESSION)?;
+    tokio::time::timeout(Duration::from_secs(2), stream.writable())
+        .await
+        .map_err(|_| INVALID_SESSION)?
+        .map_err(|_| INVALID_SESSION)?;
+    if stream.take_error().map_err(|_| INVALID_SESSION)?.is_some() {
+        return Err(INVALID_SESSION);
+    }
+    let peer = rustix::net::sockopt::socket_peercred(&stream).map_err(|_| INVALID_SESSION)?;
+    if peer.uid != expected_uid {
+        return Err(INVALID_SESSION);
+    }
+    Ok(())
+}
+
+fn parse(address: &str) -> SdkResult<SocketAddrUnix> {
+    // Multiple transports, TCP, autolaunch and unfamiliar parameters cannot turn
+    // this non-secret native locator into network or process-launch authority.
+    if address.len() > 1024 || !address.is_ascii() || address.contains(';') {
+        return Err(INVALID_SESSION);
+    }
+    let parameters = address.strip_prefix("unix:").ok_or(INVALID_SESSION)?;
+    let mut endpoint = None;
+    let mut guid_seen = false;
+    for parameter in parameters.split(',') {
+        let (key, value) = parameter.split_once('=').ok_or(INVALID_SESSION)?;
+        match key {
+            "path" | "abstract" if endpoint.is_none() => {
+                endpoint = Some((key, decode(value)?));
+            }
+            "guid" if !guid_seen => {
+                if value.len() != 32 || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+                    return Err(INVALID_SESSION);
+                }
+                guid_seen = true;
+            }
+            _ => return Err(INVALID_SESSION),
+        }
+    }
+    let (kind, name) = endpoint.ok_or(INVALID_SESSION)?;
+    if kind == "abstract" {
+        return SocketAddrUnix::new_abstract_name(&name).map_err(|_| INVALID_SESSION);
+    }
+    let path = PathBuf::from(std::ffi::OsString::from_vec(name));
+    if !path.is_absolute() {
+        return Err(INVALID_SESSION);
+    }
+    // Do not let a filesystem alias select a different native credential session.
+    let canonical = std::fs::canonicalize(&path).map_err(|_| INVALID_SESSION)?;
+    if canonical != path {
+        return Err(INVALID_SESSION);
+    }
+    SocketAddrUnix::new(&path).map_err(|_| INVALID_SESSION)
+}
+
+fn decode(value: &str) -> SdkResult<Vec<u8>> {
+    let mut decoded = Vec::with_capacity(value.len());
+    let mut bytes = value.bytes();
+    while let Some(byte) = bytes.next() {
+        let byte = if byte == b'%' {
+            let high = bytes.next().and_then(hex_digit).ok_or(INVALID_SESSION)?;
+            let low = bytes.next().and_then(hex_digit).ok_or(INVALID_SESSION)?;
+            high * 16 + low
+        } else if byte.is_ascii_alphanumeric() || b"_-/.\\".contains(&byte) {
+            byte
+        } else {
+            return Err(INVALID_SESSION);
+        };
+        if byte == 0 {
+            return Err(INVALID_SESSION);
+        }
+        decoded.push(byte);
+    }
+    if decoded.is_empty() {
+        return Err(INVALID_SESSION);
+    }
+    Ok(decoded)
+}
+
+fn hex_digit(byte: u8) -> Option<u8> {
+    match byte {
+        b'0'..=b'9' => Some(byte - b'0'),
+        b'a'..=b'f' => Some(byte - b'a' + 10),
+        b'A'..=b'F' => Some(byte - b'A' + 10),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::os::unix::net::UnixListener;
+
+    #[test]
+    fn rejects_remote_ambiguous_or_malformed_session_authority() {
+        for address in [
+            "tcp:host=example.test,port=1234",
+            "autolaunch:",
+            "unix:abstract=test;tcp:host=example.test",
+            "unix:abstract=test,abstract=other",
+            "unix:abstract=test,path=/tmp/bus",
+            "unix:abstract=test,guid=bad",
+            "unix:abstract=test,guid=00000000000000000000000000000000,guid=00000000000000000000000000000000",
+            "unix:abstract=test,unknown=value",
+            "unix:abstract=",
+            "unix:abstract=%00name",
+            "unix:abstract=bad%",
+            "unix:abstract=bad%gg",
+            "unix:path=relative",
+        ] {
+            assert!(parse(address).is_err(), "accepted {address}");
+        }
+    }
+
+    #[tokio::test]
+    async fn local_path_requires_exact_peer_uid_and_rejects_aliases() {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("bus");
+        let _listener = UnixListener::bind(&path).unwrap();
+        let address = format!("unix:path={}", path.display());
+        let uid = rustix::process::getuid();
+        verify(&address, uid).await.unwrap();
+        let other_uid = rustix::process::Uid::from_raw(uid.as_raw().wrapping_add(1));
+        assert!(verify(&address, other_uid).await.is_err());
+        let alias = directory.path().join("alias");
+        std::os::unix::fs::symlink(&path, &alias).unwrap();
+        assert!(parse(&format!("unix:path={}", alias.display())).is_err());
+    }
+
+    #[tokio::test]
+    async fn local_abstract_bus_preserves_percent_encoded_names() {
+        use std::os::linux::net::SocketAddrExt as _;
+        let name = format!("colossus-session-{}+", uuid::Uuid::now_v7());
+        let socket = std::os::unix::net::SocketAddr::from_abstract_name(name.as_bytes()).unwrap();
+        let _listener = UnixListener::bind_addr(&socket).unwrap();
+        let encoded = name.replace('+', "%2b");
+        let address = format!("unix:abstract={encoded},guid=00000000000000000000000000000000");
+        verify(&address, rustix::process::getuid()).await.unwrap();
+    }
+}
diff --git a/crates/colossus-sdk/src/macos_verified_process.rs b/crates/colossus-sdk/src/macos_verified_process.rs
index a3dc1b49a..52dd4d7e9 100644
--- a/crates/colossus-sdk/src/macos_verified_process.rs
+++ b/crates/colossus-sdk/src/macos_verified_process.rs
@@ -71,7 +71,20 @@ pub(super) async fn spawn_verified(
     path: &Path,
     expected: CodeDirectoryHash,
 ) -> SdkResult<(MacosChild, BootstrapPipes)> {
-    spawn_verified_mode(path, expected, OsStr::new("__managed-sidecar-v1")).await
+    let mut environment = Vec::new();
+    if let Some(path) = crate::development_selector::selector()? {
+        let mut selector = OsString::from(crate::development_selector::VARIABLE);
+        selector.push("=");
+        selector.push(path);
+        environment.push(selector);
+    }
+    spawn_verified_mode_with_environment(
+        path,
+        expected,
+        OsStr::new("__managed-sidecar-v1"),
+        &environment,
+    )
+    .await
 }
 
 /// Spawn an exact path in one fixed private mode, validating its dynamic code identity
@@ -80,10 +93,18 @@ pub(super) async fn spawn_verified_mode(
     path: &Path,
     expected: CodeDirectoryHash,
     mode: &OsStr,
+) -> SdkResult<(MacosChild, BootstrapPipes)> {
+    spawn_verified_mode_with_environment(path, expected, mode, &[]).await
+}
+async fn spawn_verified_mode_with_environment(
+    path: &Path,
+    expected: CodeDirectoryHash,
+    mode: &OsStr,
+    environment: &[OsString],
 ) -> SdkResult<(MacosChild, BootstrapPipes)> {
     let arguments = [mode.to_os_string()];
-    let mut spawned =
-        spawn_suspended_pipes(path, &arguments, &[]).map_err(|_| SdkError::SidecarFailed)?;
+    let mut spawned = spawn_suspended_pipes(path, &arguments, environment)
+        .map_err(|_| SdkError::SidecarFailed)?;
     let validation = validate_dynamic_identity(spawned.child.pid(), expected).and_then(|()| {
         spawned
             .child
diff --git a/crates/colossus-sdk/src/native_sidecar.rs b/crates/colossus-sdk/src/native_sidecar.rs
index 63a9c599b..8094024a7 100644
--- a/crates/colossus-sdk/src/native_sidecar.rs
+++ b/crates/colossus-sdk/src/native_sidecar.rs
@@ -276,10 +276,17 @@ impl SidecarLifecycle for NativeSidecarLifecycle {
             let agent_runs = Arc::new(SwitchingAgentRunClient::new(
                 running.transports().agent_runs(),
             ));
+            let connector_runs = running.transports().connector.as_ref().map(|transport| {
+                Arc::new(SwitchingAgentRunClient::new(AgentRunTransports {
+                    primary: transport.agent_runs(),
+                    approval_broker: None,
+                }))
+            });
             let state = Arc::new(ManagedSidecarState {
                 options: options.clone(),
                 bootstrap: Arc::clone(&self.bootstrap),
                 agent_runs: Arc::clone(&agent_runs),
+                connector_runs,
                 artifacts: artifacts.clone(),
                 process: tokio::sync::Mutex::new(Some(running)),
                 close_guard: tokio::sync::Mutex::new(()),
@@ -882,6 +889,7 @@ fn validate_discovery_leaf_absent(directory: &File, name: &str) -> SdkResult<()>
 struct ConnectedTransports {
     primary: Arc<GrpcBackend>,
     approval_broker: Option<Arc<GrpcBackend>>,
+    connector: Option<Arc<GrpcBackend>>,
 }
 
 impl ConnectedTransports {
@@ -897,6 +905,9 @@ impl ConnectedTransports {
 
     async fn close(&self) {
         let _ = self.primary.close().await;
+        if let Some(connector) = &self.connector {
+            let _ = connector.close().await;
+        }
         if let Some(approval_broker) = &self.approval_broker {
             let _ = approval_broker.close().await;
         }
@@ -973,6 +984,7 @@ struct ManagedSidecarState {
     options: SidecarOptions,
     bootstrap: Arc<SidecarBootstrapConfig>,
     agent_runs: Arc<SwitchingAgentRunClient>,
+    connector_runs: Option<Arc<SwitchingAgentRunClient>>,
     artifacts: Option<Arc<SwitchingArtifactClient>>,
     process: tokio::sync::Mutex<Option<RunningChild>>,
     close_guard: tokio::sync::Mutex<()>,
@@ -1010,6 +1022,17 @@ impl Backend for ManagedSidecarBackend {
         self.agent_runs.clone()
     }
 
+    fn instance_id(&self) -> Option<crate::InstanceId> {
+        Some(self.state.options.instance_id())
+    }
+
+    fn connector_runs(&self) -> Option<Arc<dyn AgentRunClient>> {
+        self.state
+            .connector_runs
+            .as_ref()
+            .map(|client| client.clone() as Arc<dyn AgentRunClient>)
+    }
+
     fn capabilities(&self) -> ServerCapabilities {
         self.capabilities.clone()
     }
@@ -1044,8 +1067,7 @@ impl Backend for ManagedSidecarBackend {
         // managed tree even while the aborted supervisor is still being joined.
         let running = self.state.process.lock().await.take();
         self.state.closing.store(true, Ordering::Release);
-        self.agent_runs.mark_closed();
-        self.agent_runs.release().await;
+        close_run_clients(&self.agent_runs, self.state.connector_runs.as_deref()).await;
         if let Some(artifacts) = &self.artifacts {
             artifacts.release().await;
         }
@@ -1161,7 +1183,7 @@ impl Drop for ManagedSidecarBackend {
             .status
             .send_replace(NativeSidecarStatus::Stopping);
         self.state.closing.store(true, Ordering::Release);
-        self.agent_runs.mark_closed();
+        mark_run_clients_closed(&self.agent_runs, self.state.connector_runs.as_deref());
         if let Ok(mut monitor) = self.state.monitor.lock()
             && let Some(task) = monitor.take()
         {
@@ -1181,6 +1203,27 @@ struct SwitchingAgentRunClient {
     closed: watch::Sender<bool>,
 }
 
+fn mark_run_clients_closed(
+    primary: &SwitchingAgentRunClient,
+    connector: Option<&SwitchingAgentRunClient>,
+) {
+    primary.mark_closed();
+    if let Some(connector) = connector {
+        connector.mark_closed();
+    }
+}
+
+async fn close_run_clients(
+    primary: &SwitchingAgentRunClient,
+    connector: Option<&SwitchingAgentRunClient>,
+) {
+    mark_run_clients_closed(primary, connector);
+    primary.release().await;
+    if let Some(connector) = connector {
+        connector.release().await;
+    }
+}
+
 impl SwitchingAgentRunClient {
     fn new(initial: AgentRunTransports) -> Self {
         let (closed, _) = watch::channel(false);
@@ -1191,12 +1234,21 @@ impl SwitchingAgentRunClient {
     }
 
     async fn current(&self) -> ApiResult<AgentRunTransports> {
+        if self.is_closed() {
+            return Err(sidecar_closed_error());
+        }
         let current = self.current.read().await;
+        if self.is_closed() {
+            return Err(sidecar_closed_error());
+        }
         current.clone().ok_or_else(sidecar_closed_error)
     }
 
     async fn replace(&self, next: AgentRunTransports) {
-        *self.current.write().await = Some(next);
+        let mut current = self.current.write().await;
+        if !self.is_closed() {
+            *current = Some(next);
+        }
     }
 
     async fn release(&self) {
@@ -1205,6 +1257,11 @@ impl SwitchingAgentRunClient {
 
     fn mark_closed(&self) {
         self.closed.send_replace(true);
+        // Drop cannot await, but normally owns no competing transport read. If
+        // a read is in flight, the closed signal still rejects every later call.
+        if let Ok(mut current) = self.current.try_write() {
+            current.take();
+        }
     }
 }
 
@@ -1265,6 +1322,33 @@ impl ArtifactClient for SwitchingArtifactClient {
 
 #[async_trait]
 impl AgentRunClient for SwitchingAgentRunClient {
+    async fn get_runtime_policy_posture(&self) -> ApiResult<crate::RuntimePolicyPosture> {
+        self.current()
+            .await?
+            .primary
+            .get_runtime_policy_posture()
+            .await
+    }
+    async fn set_workspace_sharing(
+        &self,
+        request: crate::SetWorkspaceSharingRequest,
+    ) -> ApiResult<crate::WorkspaceSharingState> {
+        self.current()
+            .await?
+            .primary
+            .set_workspace_sharing(request)
+            .await
+    }
+    async fn list_visible_runs(
+        &self,
+        request: ListRunsRequest,
+    ) -> ApiResult<crate::ListVisibleRunsResponse> {
+        self.current()
+            .await?
+            .primary
+            .list_visible_runs(request)
+            .await
+    }
     async fn list_process_sessions(
         &self,
         request: crate::ListProcessSessionsRequest,
@@ -1388,8 +1472,7 @@ async fn supervise(state: Arc<ManagedSidecarState>) {
         exited.guardian.take();
         if exited.force_kill_and_cleanup().is_err() {
             exited.close_transports().await;
-            state.agent_runs.mark_closed();
-            state.agent_runs.release().await;
+            close_run_clients(&state.agent_runs, state.connector_runs.as_deref()).await;
             if let Some(artifacts) = &state.artifacts {
                 artifacts.release().await;
             }
@@ -1420,6 +1503,16 @@ async fn supervise(state: Arc<ManagedSidecarState>) {
                 state.status.send_replace(NativeSidecarStatus::Stopping);
                 return;
             }
+            if let (Some(client), Some(transport)) =
+                (&state.connector_runs, &restarted.transports().connector)
+            {
+                client
+                    .replace(AgentRunTransports {
+                        primary: transport.agent_runs(),
+                        approval_broker: None,
+                    })
+                    .await;
+            }
             state
                 .agent_runs
                 .replace(restarted.transports().agent_runs())
@@ -1444,8 +1537,7 @@ async fn supervise(state: Arc<ManagedSidecarState>) {
             // During a recoverable crash, the transport must fail naturally with a
             // retryable UNAVAILABLE so durable watches reopen against the replacement.
             exited.close_transports().await;
-            state.agent_runs.mark_closed();
-            state.agent_runs.release().await;
+            close_run_clients(&state.agent_runs, state.connector_runs.as_deref()).await;
             if let Some(artifacts) = &state.artifacts {
                 artifacts.release().await;
             }
@@ -1527,6 +1619,16 @@ async fn launch_child(
         };
         validate_ready(options, &ready)?;
         provisional.bind_discovery()?;
+        if ready.connector_bearer.is_some() != bootstrap.has_connector_grant() {
+            return Err(SdkError::IdentityMismatch);
+        }
+        let connector_credential: Option<Arc<dyn CredentialProvider>> =
+            ready.connector_bearer.as_ref().map(|bearer| {
+                Arc::new(MemoryCredentialProvider {
+                    bearer: Zeroizing::new(bearer.expose().as_bytes().to_vec()),
+                }) as Arc<dyn CredentialProvider>
+            });
+        let connector_credential_id = ready.connector_credential_id.clone();
         let credential_id = ready.credential_id.clone();
         let approval_broker_credential_id = ready.approval_broker_credential_id.clone();
         let exchange_id = ready.exchange_id.clone();
@@ -1565,6 +1667,7 @@ async fn launch_child(
                 exchange_id: exchange_id.clone(),
                 credential_id: credential_id.clone(),
                 approval_broker_credential_id: approval_broker_credential_id.clone(),
+                connector_credential_id: connector_credential_id.clone(),
             }),
         )
         .await?;
@@ -1573,6 +1676,9 @@ async fn launch_child(
             ChildFrame::Failed(failure) => return Err(map_child_failure(failure.code)),
             ChildFrame::Ready(_) => return Err(SdkError::IdentityMismatch),
         };
+        if activated.connector_credential_id != connector_credential_id {
+            return Err(SdkError::IdentityMismatch);
+        }
         validate_activated(
             &activated,
             &exchange_id,
@@ -1610,7 +1716,22 @@ async fn launch_child(
         } else {
             None
         };
+        let connector = match connector_credential {
+            Some(credential) => Some(
+                connect_sidecar_transport(
+                    options,
+                    &endpoint,
+                    fingerprint,
+                    &certificate_pem,
+                    credential,
+                    deadline,
+                )
+                .await?,
+            ),
+            None => None,
+        };
         Ok(ConnectedTransports {
+            connector,
             primary,
             approval_broker,
         })
@@ -1693,6 +1814,12 @@ async fn spawn_verified_sidecar(
 )> {
     use nix::fcntl::{FcntlArg, FdFlag, fcntl};
 
+    let development_selector = crate::development_selector::selector()?;
+    let credential_session = if development_selector.is_none() {
+        Some(crate::linux_credential_session::verified_address().await?)
+    } else {
+        None
+    };
     // The manifest-matching bytes live in a sealed anonymous file. Clearing only
     // FD_CLOEXEC lets the child resolve this exact kernel object through procfs;
     // replacement of the bundle path is therefore irrelevant to execution.
@@ -1708,6 +1835,12 @@ async fn spawn_verified_sidecar(
         .stdout(Stdio::piped())
         .stderr(Stdio::null())
         .kill_on_drop(true);
+    if let Some(address) = credential_session {
+        command.env("DBUS_SESSION_BUS_ADDRESS", address);
+    }
+    if let Some(path) = development_selector {
+        command.env(crate::development_selector::VARIABLE, path);
+    }
     let (mut child, process_tree) = spawn_managed_child(&mut command)?;
     let guardian = child.stdin.take().ok_or_else(|| {
         let _ = child.start_kill();
@@ -2919,6 +3052,7 @@ mod tests {
             exchange_id: exchange.clone(),
             credential_id: primary.clone(),
             approval_broker_credential_id: Some(broker.clone()),
+            connector_credential_id: None,
         };
         validate_activated(&activated, &exchange, &primary, Some(&broker))
             .expect("exact activation");
@@ -3089,6 +3223,82 @@ mod tests {
         assert!(client.is_closed());
     }
 
+    #[tokio::test]
+    async fn terminal_shutdown_closes_both_run_clients_and_rejects_late_replacement() {
+        let primary_transport = Arc::new(UnusedAgentRuns);
+        let connector_transport = Arc::new(UnusedAgentRuns);
+        let primary_weak = Arc::downgrade(&primary_transport);
+        let connector_weak = Arc::downgrade(&connector_transport);
+        let primary = SwitchingAgentRunClient::new(AgentRunTransports {
+            primary: primary_transport,
+            approval_broker: None,
+        });
+        let connector = SwitchingAgentRunClient::new(AgentRunTransports {
+            primary: connector_transport,
+            approval_broker: None,
+        });
+
+        close_run_clients(&primary, Some(&connector)).await;
+
+        assert!(primary_weak.upgrade().is_none());
+        assert!(connector_weak.upgrade().is_none());
+        for client in [&primary, &connector] {
+            timeout(Duration::from_millis(100), client.wait_closed())
+                .await
+                .expect("permanent shutdown must wake both clients");
+            let replacement = Arc::new(UnusedAgentRuns);
+            let replacement_weak = Arc::downgrade(&replacement);
+            client
+                .replace(AgentRunTransports {
+                    primary: replacement,
+                    approval_broker: None,
+                })
+                .await;
+            assert!(replacement_weak.upgrade().is_none());
+            assert!(client.is_closed());
+            assert_eq!(
+                client.current().await.err().expect("closed client").code,
+                ApiErrorCode::Unavailable
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn drop_shutdown_signals_both_clients_even_when_transports_are_in_use() {
+        let primary = SwitchingAgentRunClient::new(AgentRunTransports {
+            primary: Arc::new(UnusedAgentRuns),
+            approval_broker: None,
+        });
+        let connector = SwitchingAgentRunClient::new(AgentRunTransports {
+            primary: Arc::new(UnusedAgentRuns),
+            approval_broker: None,
+        });
+        // Drop cannot await these locks. Its closed signal must still prevent
+        // callers from acquiring a surviving transport after permanent shutdown.
+        let primary_guard = primary.current.write().await;
+        let connector_guard = connector.current.write().await;
+        mark_run_clients_closed(&primary, Some(&connector));
+
+        for client in [&primary, &connector] {
+            timeout(Duration::from_millis(100), client.wait_closed())
+                .await
+                .expect("Drop must wake both clients despite lock contention");
+            let result = timeout(Duration::from_millis(100), client.current())
+                .await
+                .expect("closed client must not wait for a transport lock");
+            assert_eq!(
+                result.err().expect("closed client").code,
+                ApiErrorCode::Unavailable
+            );
+        }
+
+        drop(primary_guard);
+        drop(connector_guard);
+        close_run_clients(&primary, Some(&connector)).await;
+        assert!(primary.current.read().await.is_none());
+        assert!(connector.current.read().await.is_none());
+    }
+
     #[tokio::test]
     async fn explicit_close_releases_switching_transport_owners() {
         let primary = Arc::new(UnusedAgentRuns);
diff --git a/crates/colossus-sdk/src/native_sidecar_windows.rs b/crates/colossus-sdk/src/native_sidecar_windows.rs
index 5582ec3a5..b6ae43c1c 100644
--- a/crates/colossus-sdk/src/native_sidecar_windows.rs
+++ b/crates/colossus-sdk/src/native_sidecar_windows.rs
@@ -325,6 +325,9 @@ async fn launch(
     command.stderr(Stdio::inherit());
     #[cfg(not(debug_assertions))]
     command.stderr(Stdio::null());
+    if let Some(path) = crate::development_selector::selector()? {
+        command.env(crate::development_selector::VARIABLE, path);
+    }
     colossus_windows_native::configure_suspended_process(command.as_std_mut());
     let mut child = command.spawn().map_err(|_| SdkError::SidecarFailed)?;
     let (job, process_id) =
@@ -360,6 +363,15 @@ async fn launch(
     let fingerprint = TlsFingerprint::from_hex(&ready.certificate_sha256)
         .map_err(|_| SdkError::IdentityMismatch)?;
     let certificate_pem = ready.certificate_pem.as_bytes().to_vec();
+    if ready.connector_bearer.is_some() != bootstrap.has_connector_grant() {
+        return Err(SdkError::IdentityMismatch);
+    }
+    let connector_credential: Option<Arc<dyn CredentialProvider>> =
+        ready.connector_bearer.as_ref().map(|bearer| {
+            Arc::new(MemoryCredentialProvider {
+                bearer: Zeroizing::new(bearer.expose().as_bytes().to_vec()),
+            }) as Arc<dyn CredentialProvider>
+        });
     let primary_credential: Arc<dyn CredentialProvider> = Arc::new(MemoryCredentialProvider {
         bearer: Zeroizing::new(ready.bearer.expose().as_bytes().to_vec()),
     });
@@ -382,6 +394,7 @@ async fn launch(
             exchange_id: ready.exchange_id.clone(),
             credential_id: ready.credential_id.clone(),
             approval_broker_credential_id: ready.approval_broker_credential_id.clone(),
+            connector_credential_id: ready.connector_credential_id.clone(),
         }),
     )
     .await?;
@@ -390,6 +403,9 @@ async fn launch(
         ChildFrame::Failed(failure) => return Err(map_child_failure(failure.code)),
         ChildFrame::Ready(_) => return Err(SdkError::IdentityMismatch),
     };
+    if activated.connector_credential_id != ready.connector_credential_id {
+        return Err(SdkError::IdentityMismatch);
+    }
     validate_activated(
         &activated,
         &ready.exchange_id,
@@ -422,7 +438,30 @@ async fn launch(
     } else {
         None
     };
+    let connector = match connector_credential {
+        Some(credential) => Some(
+            connect_sidecar(
+                options,
+                &endpoint,
+                fingerprint,
+                &certificate_pem,
+                credential,
+                deadline,
+            )
+            .await?,
+        ),
+        None => None,
+    };
     let (agent_runs_closed, _) = watch::channel(false);
+    let connector_runs = connector.as_ref().map(|transport| {
+        Arc::new(WindowsAgentRuns {
+            transports: AgentRunTransports {
+                primary: transport.agent_runs(),
+                approval_broker: None,
+            },
+            closed: agent_runs_closed.clone(),
+        })
+    });
     let agent_runs = Arc::new(WindowsAgentRuns {
         transports: AgentRunTransports {
             primary: primary.agent_runs(),
@@ -431,6 +470,8 @@ async fn launch(
         closed: agent_runs_closed,
     });
     Ok(WindowsSidecarBackend {
+        connector,
+        connector_runs,
         primary,
         approval,
         agent_runs,
@@ -506,6 +547,21 @@ struct WindowsAgentRuns {
 
 #[async_trait]
 impl AgentRunClient for WindowsAgentRuns {
+    async fn get_runtime_policy_posture(&self) -> ApiResult<crate::RuntimePolicyPosture> {
+        self.transports.primary.get_runtime_policy_posture().await
+    }
+    async fn set_workspace_sharing(
+        &self,
+        request: crate::SetWorkspaceSharingRequest,
+    ) -> ApiResult<crate::WorkspaceSharingState> {
+        self.transports.primary.set_workspace_sharing(request).await
+    }
+    async fn list_visible_runs(
+        &self,
+        request: ListRunsRequest,
+    ) -> ApiResult<crate::ListVisibleRunsResponse> {
+        self.transports.primary.list_visible_runs(request).await
+    }
     async fn list_process_sessions(
         &self,
         request: crate::ListProcessSessionsRequest,
@@ -587,6 +643,8 @@ impl AgentRunClient for WindowsAgentRuns {
 }
 
 struct WindowsSidecarBackend {
+    connector: Option<Arc<GrpcBackend>>,
+    connector_runs: Option<Arc<WindowsAgentRuns>>,
     primary: Arc<GrpcBackend>,
     approval: Option<Arc<GrpcBackend>>,
     agent_runs: Arc<WindowsAgentRuns>,
@@ -617,6 +675,15 @@ impl Backend for WindowsSidecarBackend {
         self.agent_runs.clone()
     }
 
+    fn instance_id(&self) -> Option<crate::InstanceId> {
+        self.primary.instance_id()
+    }
+
+    fn connector_runs(&self) -> Option<Arc<dyn AgentRunClient>> {
+        self.connector_runs
+            .as_ref()
+            .map(|client| client.clone() as Arc<dyn AgentRunClient>)
+    }
     fn capabilities(&self) -> ServerCapabilities {
         self.primary.capabilities()
     }
@@ -636,6 +703,9 @@ impl Backend for WindowsSidecarBackend {
         self.status.send_replace(NativeSidecarStatus::Stopping);
         self.agent_runs.closed.send_replace(true);
         let _ = self.primary.close().await;
+        if let Some(connector) = &self.connector {
+            let _ = connector.close().await;
+        }
         if let Some(approval) = &self.approval {
             let _ = approval.close().await;
         }
diff --git a/crates/colossus-sdk/src/secret.rs b/crates/colossus-sdk/src/secret.rs
index 521c26186..8522c28ff 100644
--- a/crates/colossus-sdk/src/secret.rs
+++ b/crates/colossus-sdk/src/secret.rs
@@ -24,7 +24,7 @@ pub struct Secret {
 impl Secret {
     /// Wrap non-empty credential bytes.
     pub fn new(bytes: impl Into<Vec<u8>>) -> SdkResult<Self> {
-        let bytes = bytes.into();
+        let bytes = Zeroizing::new(bytes.into());
         if bytes.is_empty()
             || bytes.len() > MAX_CREDENTIAL_BYTES
             || !bytes.iter().all(|byte| (0x21..=0x7e).contains(byte))
@@ -33,9 +33,7 @@ impl Secret {
                 "credential must be bounded visible ASCII",
             ));
         }
-        Ok(Self {
-            bytes: Zeroizing::new(bytes),
-        })
+        Ok(Self { bytes })
     }
 
     /// Borrow the secret for an authenticated transport operation.
diff --git a/crates/colossus-sdk/src/sharing.rs b/crates/colossus-sdk/src/sharing.rs
new file mode 100644
index 000000000..87a489cc1
--- /dev/null
+++ b/crates/colossus-sdk/src/sharing.rs
@@ -0,0 +1,32 @@
+//! Caller-visible runtime discovery with explicit local ownership flags.
+use crate::{PageResponse, Run};
+
+/// Runtime-derived authority for one released owned or shared run.
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
+pub struct VisibleRun {
+    /// Released projection of one durable source run.
+    pub run: Run,
+    /// The authenticated caller owns cancellation and response authority.
+    pub controllable: bool,
+    /// The caller may continue this session using its own execution grant.
+    pub continuable: bool,
+}
+
+/// One bounded source-stable discovery page.
+#[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
+pub struct ListVisibleRunsResponse {
+    /// Caller-owned or explicitly shared released runs.
+    pub runs: Vec<VisibleRun>,
+    /// Opaque authenticated continuation cursor.
+    pub page: Option<PageResponse>,
+}
diff --git a/crates/colossus-sdk/src/sidecar.rs b/crates/colossus-sdk/src/sidecar.rs
index eaca071e3..335b3fb81 100644
--- a/crates/colossus-sdk/src/sidecar.rs
+++ b/crates/colossus-sdk/src/sidecar.rs
@@ -247,6 +247,7 @@ pub struct SidecarBootstrapConfig {
     client_key_pem: Option<HostSecret>,
     codex_auth_path: Option<PathBuf>,
     approval_broker_grant: Option<SidecarApprovalBrokerGrant>,
+    connector_grant: Option<SidecarApplicationGrant>,
     host_credentials: Vec<SidecarHostCredential>,
     worker_ipc_authentication: Option<SecretString>,
 }
@@ -278,6 +279,7 @@ impl SidecarBootstrapConfig {
             client_key_pem: None,
             codex_auth_path: None,
             approval_broker_grant: None,
+            connector_grant: None,
             host_credentials: Vec::new(),
             worker_ipc_authentication: None,
         })
@@ -419,6 +421,35 @@ impl SidecarBootstrapConfig {
         Ok(self)
     }
 
+    pub(crate) fn has_connector_grant(&self) -> bool {
+        self.connector_grant.is_some()
+    }
+
+    /// Provision an independent cloud application beneath the local grant's ceilings.
+    /// Native hosts opt in before launch; enrollment is a separate explicit action.
+    pub fn with_connector_grant(mut self, grant: SidecarApplicationGrant) -> SdkResult<Self> {
+        if grant.application_id == self.grant.application_id
+            || grant
+                .allowed_roles
+                .iter()
+                .any(|role| !self.grant.allowed_roles.contains(role))
+            || grant
+                .allowed_tools
+                .iter()
+                .any(|tool| !self.grant.allowed_tools.contains(tool))
+            || grant.scopes.iter().any(|scope| {
+                !(self.grant.scopes.contains(scope)
+                    || scope == "approvals:respond" && self.approval_broker_grant.is_some())
+            })
+        {
+            return Err(SdkError::InvalidConfiguration(
+                "connector grant exceeds local authority",
+            ));
+        }
+        self.connector_grant = Some(grant);
+        Ok(self)
+    }
+
     /// Attach a bounded exact map of host-resolved provider credentials.
     pub fn with_host_credentials(
         mut self,
@@ -541,6 +572,10 @@ impl SidecarBootstrapConfig {
                 .approval_broker_grant
                 .as_ref()
                 .map(SidecarApprovalBrokerGrant::wire),
+            connector_grant: self
+                .connector_grant
+                .as_ref()
+                .map(SidecarApplicationGrant::wire),
             host_credentials: self
                 .host_credentials
                 .iter()
diff --git a/crates/colossus-sdk/src/types.rs b/crates/colossus-sdk/src/types.rs
index ffd083535..60178de1a 100644
--- a/crates/colossus-sdk/src/types.rs
+++ b/crates/colossus-sdk/src/types.rs
@@ -9,6 +9,11 @@ use std::collections::{BTreeMap, BTreeSet};
 /// Capability names are credential-free stable identifiers. Absence always means the
 /// client must keep the corresponding operation unavailable.
 #[derive(Clone, Debug, Default, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ServerCapabilities {
     enabled: BTreeSet<String>,
 }
@@ -33,6 +38,14 @@ impl ServerCapabilities {
 
 /// Requested public execution mode.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum RunMode {
     /// Permit policy-authorized effects.
     Execute,
@@ -44,6 +57,14 @@ pub enum RunMode {
 
 /// Requested breadth for a durable Research run.
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum ResearchDepth {
     /// Fast, narrow evidence pass.
     Quick,
@@ -56,6 +77,14 @@ pub enum ResearchDepth {
 
 /// Explicit evidence lane enabled for Research.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum ResearchSourceKind {
     /// Selected Workspace repository evidence.
     Repo,
@@ -67,6 +96,14 @@ pub enum ResearchSourceKind {
 
 /// Released canonical Plan lifecycle.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum PlanStatus {
     /// The exact revision remains editable.
     Draft,
@@ -80,6 +117,14 @@ pub enum PlanStatus {
 
 /// Requested handoff for one exact Plan revision.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum PlanExecutionStrategy {
     /// Consume the Plan in one normal run.
     Direct,
@@ -92,6 +137,14 @@ pub enum PlanExecutionStrategy {
 
 /// Typed continuation of a Plan released by a caller-owned source run.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum PlanRunAction {
     /// Refine one exact draft revision in Plan Mode.
     Revise {
@@ -113,6 +166,14 @@ pub enum PlanRunAction {
 
 /// Durable public run lifecycle.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum RunStatus {
     /// Durable but not yet executing.
     Queued,
@@ -136,6 +197,14 @@ pub enum RunStatus {
 
 /// Whether an effectful outcome is known.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum OutcomeCertainty {
     /// Durable evidence establishes the outcome.
     Known,
@@ -145,6 +214,14 @@ pub enum OutcomeCertainty {
 
 /// One v1alpha1 run input part.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum InputContentPart {
     /// Visible user text.
     Text(String),
@@ -154,6 +231,14 @@ pub enum InputContentPart {
 
 /// Projection used when a canonical session prefix starts a child conversation.
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum RunBranchContextMode {
     /// Preserve the exact provider transcript, including tool-call correlation.
     #[default]
@@ -167,6 +252,11 @@ pub enum RunBranchContextMode {
 
 /// Canonical session prefix used to start a separate child conversation.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RunBranch {
     /// Caller-owned run whose session supplies the canonical context.
     pub source_run_id: String,
@@ -179,6 +269,11 @@ pub struct RunBranch {
 
 /// Request to create one durable run.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct CreateRunRequest {
     /// Qualified Agent Plugin skills selected for this message; never a tool grant.
     pub plugin_skill_ids: Vec<String>,
@@ -210,6 +305,11 @@ pub struct CreateRunRequest {
 
 /// Bounded released terminal output.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RunResult {
     /// Complete visible assistant output.
     pub output: String,
@@ -235,6 +335,11 @@ pub struct RunResult {
 
 /// Bounded user-safe terminal failure.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RunFailure {
     /// Stable machine-readable reason.
     pub reason: String,
@@ -252,6 +357,11 @@ pub struct RunFailure {
 
 /// Durable cancellation evidence.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RunCancellation {
     /// Turn at which cancellation became terminal; zero means before turn one.
     pub turn: u32,
@@ -269,6 +379,14 @@ pub struct RunCancellation {
 
 /// Exactly one terminal run payload.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum RunTerminal {
     /// Successful released result.
     Result(RunResult),
@@ -280,6 +398,11 @@ pub enum RunTerminal {
 
 /// Durable bounded run summary.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct Run {
     /// Qualified Agent Plugin skills requested for this run.
     pub plugin_skill_ids: Vec<String>,
@@ -317,6 +440,11 @@ pub struct Run {
 
 /// Response from durable run creation.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct CreateRunResponse {
     /// Allocated durable run.
     pub run: Run,
@@ -324,6 +452,11 @@ pub struct CreateRunResponse {
 
 /// Request for one run.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct GetRunRequest {
     /// Exact stable run identifier.
     pub run_id: String,
@@ -331,6 +464,11 @@ pub struct GetRunRequest {
 
 /// Response containing one run and its currently pending interactions.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct GetRunResponse {
     /// Current bounded run summary.
     pub run: Run,
@@ -340,6 +478,11 @@ pub struct GetRunResponse {
 
 /// Bounded stable page request.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct PageRequest {
     /// Requested page size; zero selects the server default.
     pub page_size: u32,
@@ -349,6 +492,11 @@ pub struct PageRequest {
 
 /// Stable page continuation.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct PageResponse {
     /// Opaque next-page token, empty when the page is terminal.
     pub next_page_token: String,
@@ -356,6 +504,11 @@ pub struct PageResponse {
 
 /// Stable run listing request.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ListRunsRequest {
     /// Optional exact session filter.
     pub session_id: Option<String>,
@@ -369,6 +522,11 @@ pub struct ListRunsRequest {
 
 /// Stable page of run summaries.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ListRunsResponse {
     /// Deterministically ordered run summaries.
     pub runs: Vec<Run>,
@@ -378,6 +536,14 @@ pub struct ListRunsResponse {
 
 /// Timeline lane used by a curated session activity.
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum SessionActivityLane {
     /// User, assistant, and model-turn activity.
     Agent,
@@ -389,6 +555,14 @@ pub enum SessionActivityLane {
 
 /// Human-readable activity kind used by the event table.
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum SessionActivityKind {
     /// Released human or application input.
     User,
@@ -402,6 +576,14 @@ pub enum SessionActivityKind {
 
 /// Released lifecycle state for a curated activity.
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum SessionActivityStatus {
     /// Accepted but not started.
     Requested,
@@ -421,6 +603,11 @@ pub enum SessionActivityStatus {
 
 /// One bounded released inspector value.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct SessionActivityContent {
     /// Rendering hint: `text` or `json`.
     pub format: String,
@@ -430,6 +617,11 @@ pub struct SessionActivityContent {
 
 /// One curated logical activity for a caller-owned session.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct SessionActivity {
     /// Stable logical identifier used for live merging.
     pub activity_id: String,
@@ -471,6 +663,11 @@ pub struct SessionActivity {
 
 /// Caller-scoped session activity query addressed through an owned run.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ListSessionActivityRequest {
     /// Any caller-owned run in the requested session.
     pub source_run_id: String,
@@ -488,6 +685,11 @@ pub struct ListSessionActivityRequest {
 
 /// One eventually consistent newest-first activity page.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ListSessionActivityResponse {
     /// Curated activities matching the request.
     pub activities: Vec<SessionActivity>,
@@ -503,6 +705,11 @@ pub struct ListSessionActivityResponse {
 
 /// Replay-and-tail request.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct WatchRunRequest {
     /// Exact run identifier.
     pub run_id: String,
@@ -512,6 +719,11 @@ pub struct WatchRunRequest {
 
 /// Idempotent cooperative cancellation request.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct CancelRunRequest {
     /// Exact run identifier.
     pub run_id: String,
@@ -521,6 +733,11 @@ pub struct CancelRunRequest {
 
 /// Cancellation response.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct CancelRunResponse {
     /// Current durable run summary.
     pub run: Run,
@@ -528,6 +745,11 @@ pub struct CancelRunResponse {
 
 /// Idempotent request to archive one terminal thread.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ArchiveThreadRequest {
     /// Any exact run identifier belonging to the thread.
     pub run_id: String,
@@ -537,6 +759,11 @@ pub struct ArchiveThreadRequest {
 
 /// Idempotent request to restore one archived thread.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RestoreThreadRequest {
     /// Any exact run identifier belonging to the thread.
     pub run_id: String,
@@ -546,6 +773,11 @@ pub struct RestoreThreadRequest {
 
 /// Current archive lifecycle for one durable thread.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ThreadLifecycle {
     /// Durable session identity shared by the thread's runs.
     pub session_id: String,
@@ -555,6 +787,14 @@ pub struct ThreadLifecycle {
 
 /// Caller-visible interaction class.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum InteractionKind {
     /// Ordinary user input.
     UserPrompt,
@@ -564,6 +804,14 @@ pub enum InteractionKind {
 
 /// Durable interaction lifecycle.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum InteractionStatus {
     /// Awaiting one response.
     Pending,
@@ -577,6 +825,11 @@ pub enum InteractionStatus {
 
 /// Exact suggested prompt choice.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct PromptChoice {
     /// Opaque server-issued identifier that must be echoed unchanged.
     pub choice_id: String,
@@ -586,6 +839,11 @@ pub struct PromptChoice {
 
 /// Released ordinary prompt content.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct UserPromptInteraction {
     /// User-visible question.
     pub question: String,
@@ -597,6 +855,14 @@ pub struct UserPromptInteraction {
 
 /// Non-authoritative approval risk metadata.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum ApprovalRisk {
     /// Bounded reversible impact.
     Low,
@@ -611,6 +877,11 @@ pub use colossus_api::CommandApprovalContext;
 
 /// Released approval content.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ApprovalInteraction {
     /// Prepared command display, absent on historical and non-command interactions.
     pub command_context: Option<CommandApprovalContext>,
@@ -629,6 +900,14 @@ pub struct ApprovalInteraction {
 
 /// Exactly one released interaction representation.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum InteractionContent {
     /// Ordinary user prompt.
     UserPrompt(UserPromptInteraction),
@@ -638,6 +917,11 @@ pub enum InteractionContent {
 
 /// Durable caller-bound prompt or approval.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct Interaction {
     /// Opaque one-use identifier.
     pub interaction_id: String,
@@ -661,6 +945,14 @@ pub struct Interaction {
 
 /// Prompt answer that preserves opaque choice integrity.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum PromptAnswer {
     /// Select and echo one exact displayed choice.
     Choice(PromptChoice),
@@ -670,6 +962,14 @@ pub enum PromptAnswer {
 
 /// One-use interaction answer.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum InteractionAnswer {
     /// Ordinary prompt answer.
     Prompt(PromptAnswer),
@@ -684,6 +984,11 @@ pub enum InteractionAnswer {
 
 /// Request that consumes one interaction exactly once.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RespondInteractionRequest {
     /// Owning run.
     pub run_id: String,
@@ -699,6 +1004,11 @@ pub struct RespondInteractionRequest {
 
 /// Response after consuming one interaction.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RespondInteractionResponse {
     /// Terminal interaction with an empty response etag.
     pub interaction: Interaction,
@@ -706,6 +1016,14 @@ pub struct RespondInteractionResponse {
 
 /// Released tool activity state.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum ToolActivityState {
     /// Strict call validated.
     Requested,
@@ -725,6 +1043,11 @@ pub enum ToolActivityState {
 
 /// Bounded tool lifecycle metadata.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ToolActivity {
     /// Provider call identifier.
     pub call_id: String,
@@ -742,6 +1065,11 @@ pub struct ToolActivity {
 
 /// Normalized provider accounting.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct TokenUsage {
     /// Input token count.
     pub input_tokens: u64,
@@ -757,6 +1085,14 @@ pub struct TokenUsage {
 
 /// Released message role.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum MessageRole {
     /// Human or application input.
     User,
@@ -770,6 +1106,14 @@ pub enum MessageRole {
 
 /// Public artifact purpose.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum ArtifactPurpose {
     /// Agent run input.
     RunInput,
@@ -785,6 +1129,14 @@ pub enum ArtifactPurpose {
 
 /// Public artifact state.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum ArtifactState {
     /// Staged upload incomplete.
     Uploading,
@@ -800,6 +1152,11 @@ pub enum ArtifactState {
 
 /// Safe metadata for an opaque artifact.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct ArtifactReference {
     /// Stable opaque identifier.
     pub artifact_id: String,
@@ -821,6 +1178,11 @@ pub struct ArtifactReference {
 
 /// Complete bounded artifact upload supplied by an SDK caller.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct UploadArtifactRequest {
     /// Display name only; never interpreted as a server path.
     pub file_name: String,
@@ -836,6 +1198,11 @@ pub struct UploadArtifactRequest {
 
 /// Downloaded released artifact.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct DownloadedArtifact {
     /// Verified public metadata.
     pub artifact: ArtifactReference,
@@ -845,6 +1212,14 @@ pub struct DownloadedArtifact {
 
 /// Released message content part.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum MessageContentPart {
     /// Visible text.
     Text(String),
@@ -854,6 +1229,11 @@ pub enum MessageContentPart {
 
 /// Newly durable released session message.
 #[derive(Clone, Debug, Eq, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct SessionMessage {
     /// Owning session.
     pub session_id: String,
@@ -871,6 +1251,11 @@ pub struct SessionMessage {
 
 /// One durable replayable run update.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(feature = "serialization", serde(deny_unknown_fields))]
 pub struct RunUpdate {
     /// Owning run identifier.
     pub run_id: String,
@@ -884,6 +1269,14 @@ pub struct RunUpdate {
 
 /// Released public run-feed update.
 #[derive(Clone, Debug, PartialEq)]
+#[cfg_attr(
+    feature = "serialization",
+    derive(serde::Serialize, serde::Deserialize)
+)]
+#[cfg_attr(
+    feature = "serialization",
+    serde(rename_all = "snake_case", deny_unknown_fields)
+)]
 pub enum RunUpdateKind {
     /// Safe provider recovery progress.
     ProviderRetry(ProviderRetry),
diff --git a/crates/colossus-sidecar-protocol/src/protocol.rs b/crates/colossus-sidecar-protocol/src/protocol.rs
index 00d1f6432..c4f6c0dcb 100644
--- a/crates/colossus-sidecar-protocol/src/protocol.rs
+++ b/crates/colossus-sidecar-protocol/src/protocol.rs
@@ -21,7 +21,7 @@ use uuid::Uuid;
 use zeroize::Zeroizing;
 
 /// Exact bootstrap protocol version.
-pub const PROTOCOL_VERSION: u16 = 11;
+pub const PROTOCOL_VERSION: u16 = 12;
 /// Exact desktop-to-TUI inherited-channel protocol version.
 pub const DESKTOP_TUI_PROTOCOL_VERSION: u16 = 3;
 /// Fixed child descriptor from which the bundled TUI reads native authentication.
@@ -1459,6 +1459,8 @@ pub struct BootstrapRequest {
     pub grant: BootstrapGrant,
     /// Optional native-only credential allowed to answer effect approvals and nothing else.
     pub approval_broker_grant: Option<BootstrapGrant>,
+    /// Optional independent application grant for an explicitly enrolled cloud connector.
+    pub connector_grant: Option<BootstrapGrant>,
     /// Provider credentials referenced by opaque `host:` identifiers.
     pub host_credentials: Vec<HostCredential>,
     /// Optional worker IPC key supplied by a native host for its bundled TUI.
@@ -1498,6 +1500,26 @@ impl BootstrapRequest {
             return Err(ProtocolError::InvalidFrame);
         }
         self.grant.validate()?;
+        if let Some(connector) = &self.connector_grant {
+            connector.validate()?;
+            if connector.application_id == self.grant.application_id
+                || connector
+                    .allowed_roles
+                    .iter()
+                    .any(|role| !self.grant.allowed_roles.contains(role))
+                || connector
+                    .allowed_tools
+                    .iter()
+                    .any(|tool| !self.grant.allowed_tools.contains(tool))
+                || connector.scopes.iter().any(|scope| {
+                    !(self.grant.scopes.contains(scope)
+                        || scope == "approvals:respond" && self.approval_broker_grant.is_some())
+                })
+            {
+                return Err(ProtocolError::InvalidFrame);
+            }
+        }
+
         self.workspace_identity.validate()?;
         if let Some(grant) = &self.approval_broker_grant {
             grant.validate_approval_broker(&self.grant)?;
@@ -1756,6 +1778,8 @@ pub struct AckRequest {
     pub credential_id: String,
     /// Pending approval-broker credential identifier, when one was requested.
     pub approval_broker_credential_id: Option<String>,
+    /// Independent pending cloud connector credential identity.
+    pub connector_credential_id: Option<String>,
 }
 
 /// Child frames sent to the native host.
@@ -1796,8 +1820,12 @@ pub struct ReadyResponse {
     pub bearer: SecretString,
     /// Non-secret pending approval-broker credential identifier.
     pub approval_broker_credential_id: Option<String>,
+    /// Independent pending cloud connector credential identity.
+    pub connector_credential_id: Option<String>,
     /// Approval-broker bearer delivered once through this inherited channel.
     pub approval_broker_bearer: Option<SecretString>,
+    /// Independent connector bearer delivered only through native bootstrap IPC.
+    pub connector_bearer: Option<SecretString>,
 }
 
 impl ReadyResponse {
@@ -1819,6 +1847,10 @@ impl ReadyResponse {
                 &self.approval_broker_bearer,
             )
             || self.approval_broker_credential_id.as_deref() == Some(self.credential_id.as_str())
+            || !matching_optional_credential(&self.connector_credential_id, &self.connector_bearer)
+            || self.connector_credential_id.as_deref() == Some(self.credential_id.as_str())
+            || (self.connector_credential_id.is_some()
+                && self.connector_credential_id == self.approval_broker_credential_id)
         {
             return Err(ProtocolError::InvalidFrame);
         }
@@ -1861,6 +1893,8 @@ pub struct ActivatedResponse {
     pub credential_id: String,
     /// Activated approval-broker credential identifier, when one was requested.
     pub approval_broker_credential_id: Option<String>,
+    /// Independent pending cloud connector credential identity.
+    pub connector_credential_id: Option<String>,
 }
 
 /// Sanitized startup failure codes suitable for a native status surface.
@@ -2078,6 +2112,7 @@ mod tests {
                 allowed_roles: vec!["primary".into()],
                 allowed_tools: vec!["session.list".into()],
             },
+            connector_grant: None,
             approval_broker_grant: Some(BootstrapGrant {
                 application_id: "app:desktop".into(),
                 scopes: vec![APPROVALS_RESPOND_SCOPE.into()],
@@ -2862,7 +2897,9 @@ mod tests {
             credential_id: primary_id.clone(),
             bearer: SecretString::new("primary-secret").expect("secret"),
             approval_broker_credential_id: Some(broker_id),
+            connector_credential_id: None,
             approval_broker_bearer: Some(SecretString::new("approval-secret").expect("secret")),
+            connector_bearer: None,
         };
         ready.validate().expect("paired delivery");
         let debug = format!("{ready:?}");
@@ -2871,6 +2908,7 @@ mod tests {
 
         let duplicated = ReadyResponse {
             approval_broker_credential_id: Some(primary_id),
+            connector_credential_id: None,
             ..ready
         };
         assert_eq!(duplicated.validate(), Err(ProtocolError::InvalidFrame));
diff --git a/crates/colossus-sidecar/src/managed.rs b/crates/colossus-sidecar/src/managed.rs
index 31834b942..02d9f4741 100644
--- a/crates/colossus-sidecar/src/managed.rs
+++ b/crates/colossus-sidecar/src/managed.rs
@@ -340,6 +340,17 @@ async fn run(request: BootstrapRequest, input: &mut std::io::Stdin) -> Result<()
         .clone()
         .map(|grant| approval_broker_grant(&request.grant, grant))
         .transpose()?;
+    let connector_grant = request
+        .connector_grant
+        .clone()
+        .map(|grant| {
+            connector_application_grant(
+                &request.grant,
+                request.approval_broker_grant.is_some(),
+                grant,
+            )
+        })
+        .transpose()?;
     let public_directory = prepare_public_directory(&instance_dir)?;
     let tls =
         TlsIdentity::from_seed(TlsKeySeed::random().map_err(|_| FailureCode::PublicApiSetup)?)
@@ -365,19 +376,34 @@ async fn run(request: BootstrapRequest, input: &mut std::io::Stdin) -> Result<()
         .map_err(|_| FailureCode::PublicApiSetup)?
         .to_owned();
     let grants = std::iter::once(primary_grant)
-        .chain(approval_broker_grant)
+        .chain(approval_broker_grant.clone())
+        .chain(connector_grant)
         .collect::<Vec<_>>();
     let mut issued = credentials
         .issue_pending_batch(&grants)
         .map_err(|_| FailureCode::PublicApiSetup)?;
     let primary_issued = issued.remove(0);
-    let approval_broker_issued = issued.pop();
+    let approval_broker_issued = if approval_broker_grant.is_some() {
+        Some(issued.remove(0))
+    } else {
+        None
+    };
+    let connector_issued = issued.pop();
+    let connector_credential_id = connector_issued
+        .as_ref()
+        .map(|credential| credential.credential_id().to_owned());
+    let connector_bearer = connector_issued
+        .as_ref()
+        .map(|credential| SecretString::new(credential.expose_token().to_owned()))
+        .transpose()
+        .map_err(|_| FailureCode::PublicApiSetup)?;
     let credential_id = primary_issued.credential_id().to_owned();
     let approval_broker_credential_id = approval_broker_issued
         .as_ref()
         .map(|credential| credential.credential_id().to_owned());
     let credential_ids = std::iter::once(credential_id.clone())
         .chain(approval_broker_credential_id.clone())
+        .chain(connector_credential_id.clone())
         .collect::<Vec<_>>();
     let bearer = match SecretString::new(primary_issued.expose_token().to_owned()) {
         Ok(bearer) => bearer,
@@ -409,7 +435,9 @@ async fn run(request: BootstrapRequest, input: &mut std::io::Stdin) -> Result<()
         credential_id: credential_id.clone(),
         bearer,
         approval_broker_credential_id: approval_broker_credential_id.clone(),
+        connector_credential_id: connector_credential_id.clone(),
         approval_broker_bearer,
+        connector_bearer,
     };
     if ready.validate().is_err() {
         let _ = credentials.revoke_batch(&credential_ids);
@@ -425,6 +453,7 @@ async fn run(request: BootstrapRequest, input: &mut std::io::Stdin) -> Result<()
     }
     drop(primary_issued);
     drop(approval_broker_issued);
+    drop(connector_issued);
 
     let ack = match read_frame::<_, ParentFrame>(input) {
         Ok(ParentFrame::Ack(ack)) => ack,
@@ -433,6 +462,10 @@ async fn run(request: BootstrapRequest, input: &mut std::io::Stdin) -> Result<()
             return Err(FailureCode::CredentialActivation);
         }
     };
+    if ack.connector_credential_id != connector_credential_id {
+        let _ = credentials.revoke_batch(&credential_ids);
+        return Err(FailureCode::CredentialActivation);
+    }
     if let Err(error) = validate_ack(
         &ack,
         &request.exchange_id,
@@ -482,6 +515,7 @@ async fn run(request: BootstrapRequest, input: &mut std::io::Stdin) -> Result<()
                 exchange_id: request.exchange_id,
                 credential_id: credential_id.clone(),
                 approval_broker_credential_id: approval_broker_credential_id.clone(),
+                connector_credential_id: connector_credential_id.clone(),
             }),
         )
     };
@@ -1202,6 +1236,30 @@ fn approval_broker_grant(
     application_grant(broker)
 }
 
+fn connector_application_grant(
+    primary: &BootstrapGrant,
+    has_broker: bool,
+    connector: BootstrapGrant,
+) -> Result<ApplicationGrant, FailureCode> {
+    if connector.application_id == primary.application_id
+        || connector
+            .allowed_roles
+            .iter()
+            .any(|role| !primary.allowed_roles.contains(role))
+        || connector
+            .allowed_tools
+            .iter()
+            .any(|tool| !primary.allowed_tools.contains(tool))
+        || connector.scopes.iter().any(|scope| {
+            !(primary.scopes.contains(scope)
+                || scope == colossus_api::scopes::APPROVALS_RESPOND && has_broker)
+        })
+    {
+        return Err(FailureCode::InvalidBootstrap);
+    }
+    application_grant(connector)
+}
+
 fn validate_ack(
     ack: &AckRequest,
     exchange_id: &str,
@@ -2203,6 +2261,7 @@ mod tests {
             exchange_id: exchange.clone(),
             credential_id: credential.clone(),
             approval_broker_credential_id: Some(broker.clone()),
+            connector_credential_id: None,
         };
         assert_eq!(
             validate_ack(&ack, &exchange, &credential, Some(&broker)),
diff --git a/crates/colossus-sidecar/tests/native_lifecycle.rs b/crates/colossus-sidecar/tests/native_lifecycle.rs
index 560641509..65403ab8c 100644
--- a/crates/colossus-sidecar/tests/native_lifecycle.rs
+++ b/crates/colossus-sidecar/tests/native_lifecycle.rs
@@ -201,7 +201,20 @@ async fn verified_sidecar_bootstraps_pinned_grpc_and_closes_by_guardian_eof() {
         .with_worker_ipc_authentication(
             Secret::new(vec![0x5a; 32]).expect("bounded worker authentication"),
         )
-        .expect("worker authentication bootstrap");
+        .expect("worker authentication bootstrap")
+        .with_connector_grant(
+            SidecarApplicationGrant::new(
+                "app:cloud-connector-acceptance",
+                [
+                    ApiScope::new(scopes::RUNS_EXECUTE).unwrap(),
+                    ApiScope::new(scopes::RUNS_READ).unwrap(),
+                ],
+                ["primary".into()],
+                Vec::<String>::new(),
+            )
+            .unwrap(),
+        )
+        .expect("independent connector grant");
     let lifecycle = NativeSidecarLifecycle::new(bootstrap);
     assert_eq!(lifecycle.status(), NativeSidecarStatus::Starting);
     let options = SidecarOptions::new(
@@ -274,6 +287,51 @@ async fn verified_sidecar_bootstraps_pinned_grpc_and_closes_by_guardian_eof() {
         .expect("create run");
     let run_id = created.run.run_id;
     assert!(!run_id.is_empty());
+    let connector = client
+        .connector_runs()
+        .expect("independent native cloud client");
+    assert!(client.instance_id().is_some());
+    let rejected = connector
+        .get_run(GetRunRequest {
+            run_id: run_id.clone(),
+        })
+        .await;
+    assert!(
+        rejected.is_err(),
+        "cloud caller must not inherit primary Desktop runs"
+    );
+    let cloud_run = connector
+        .create_run(CreateRunRequest {
+            plugin_skill_ids: vec![],
+            input: vec![InputContentPart::Text("cloud caller self-test".into())],
+            session_id: None,
+            end_user_id: None,
+            role: "primary".into(),
+            mode: RunMode::Execute,
+            research_depth: None,
+            research_sources: vec![],
+            plan_action: None,
+            branch: None,
+            max_turns: 1,
+            idempotency_key: IdempotencyKey::new("independent-cloud-run").unwrap(),
+        })
+        .await
+        .expect("cloud application executes beneath its native grant");
+    assert!(
+        client
+            .get_run(GetRunRequest {
+                run_id: cloud_run.run.run_id.clone()
+            })
+            .await
+            .is_err(),
+        "primary caller must not inherit cloud runs"
+    );
+    connector
+        .get_run(GetRunRequest {
+            run_id: cloud_run.run.run_id,
+        })
+        .await
+        .expect("cloud caller reads its own run");
     assert_eq!(
         wait_for_terminal_run(&client, &run_id).await,
         RunStatus::Completed
diff --git a/crates/colossus-sidecar/tests/windows_lifecycle.rs b/crates/colossus-sidecar/tests/windows_lifecycle.rs
index 7edfc80bd..3fe738d07 100644
--- a/crates/colossus-sidecar/tests/windows_lifecycle.rs
+++ b/crates/colossus-sidecar/tests/windows_lifecycle.rs
@@ -10,8 +10,8 @@ use colossus_sdk::{
     ApiMajor, AppPrivateInstanceDir, BackendKind, Colossus, CreateRunRequest, GetRunRequest,
     InputContentPart, InstanceId, ManagedAccessProfile, ManagedExecutionBoundary,
     ManagedRuntimeConfig, NativeSidecarLifecycle, NativeSidecarStatus, RunMode, RunStatus,
-    Sha256Digest, SidecarApplicationGrant, SidecarBootstrapConfig, SidecarOptions,
-    VerifiedExecutable, WorkspaceIdentity,
+    Sha256Digest, SidecarApplicationGrant, SidecarApprovalBrokerGrant, SidecarBootstrapConfig,
+    SidecarOptions, VerifiedExecutable, WorkspaceIdentity,
 };
 use colossus_windows_native::{BoundPath, create_private_directory};
 use colossus_worker_protocol::{WorkerApprovalMode, WorkerControlClient, worker_ipc_endpoint};
@@ -144,6 +144,27 @@ async fn verified_sidecar_bootstraps_pinned_grpc_runs_echo_and_closes() {
     .expect("bootstrap")
     .with_expected_workspace_identity(workspace_identity(&workspace))
     .expect("expected workspace identity")
+    .with_approval_broker_grant(
+        SidecarApprovalBrokerGrant::new(
+            "app:native-sidecar-windows-acceptance",
+            ["primary".into()],
+        )
+        .unwrap(),
+    )
+    .expect("approval broker")
+    .with_connector_grant(
+        SidecarApplicationGrant::new(
+            "app:cloud-windows-acceptance",
+            [
+                ApiScope::new(scopes::RUNS_EXECUTE).unwrap(),
+                ApiScope::new(scopes::RUNS_READ).unwrap(),
+            ],
+            ["primary".into()],
+            Vec::<String>::new(),
+        )
+        .unwrap(),
+    )
+    .expect("independent cloud grant")
     .with_risk_auto_approvals()
     .with_worker_ipc_authentication(colossus_sdk::Secret::new(vec![0x5a; 32]).expect("worker key"))
     .expect("worker authentication");
@@ -224,6 +245,53 @@ async fn verified_sidecar_bootstraps_pinned_grpc_runs_echo_and_closes() {
         .expect("create run");
     let run_id = created.run.run_id;
     assert!(!run_id.is_empty());
+    let connector = client
+        .connector_runs()
+        .expect("dedicated Windows cloud client");
+    assert!(client.instance_id().is_some());
+    assert!(
+        connector
+            .get_run(GetRunRequest {
+                run_id: run_id.clone()
+            })
+            .await
+            .is_err(),
+        "cloud cannot inherit Desktop runs"
+    );
+    let cloud_run = connector
+        .create_run(CreateRunRequest {
+            plugin_skill_ids: vec![],
+            input: vec![InputContentPart::Text(
+                "Windows cloud grant self-test".into(),
+            )],
+            session_id: None,
+            end_user_id: None,
+            role: "primary".into(),
+            mode: RunMode::Execute,
+            research_depth: None,
+            research_sources: vec![],
+            plan_action: None,
+            branch: None,
+            max_turns: 1,
+            idempotency_key: IdempotencyKey::new("windows-cloud-once").unwrap(),
+        })
+        .await
+        .expect("cloud grant executes");
+    assert!(
+        client
+            .get_run(GetRunRequest {
+                run_id: cloud_run.run.run_id.clone()
+            })
+            .await
+            .is_err(),
+        "Desktop cannot inherit cloud runs"
+    );
+    connector
+        .get_run(GetRunRequest {
+            run_id: cloud_run.run.run_id,
+        })
+        .await
+        .expect("cloud reads its own run");
     assert_eq!(
         wait_for_terminal_run(&client, &run_id).await,
         RunStatus::Completed
diff --git a/crates/colossus-windows-native/Cargo.toml b/crates/colossus-windows-native/Cargo.toml
index f64f8e727..cb4f49913 100644
--- a/crates/colossus-windows-native/Cargo.toml
+++ b/crates/colossus-windows-native/Cargo.toml
@@ -12,6 +12,7 @@ thiserror.workspace = true
 [target.'cfg(windows)'.dependencies]
 tokio.workspace = true
 windows-sys = { workspace = true, features = [
+    "Wdk_Storage_FileSystem",
     "Win32_Foundation",
     "Win32_Graphics_Gdi",
     "Win32_Security",
@@ -19,6 +20,7 @@ windows-sys = { workspace = true, features = [
     "Win32_Storage_FileSystem",
     "Win32_System_Console",
     "Win32_System_Diagnostics_ToolHelp",
+    "Win32_System_IO",
     "Win32_System_JobObjects",
     "Win32_System_Pipes",
     "Win32_System_SystemServices",
diff --git a/crates/colossus-windows-native/src/tests.rs b/crates/colossus-windows-native/src/tests.rs
index 7ef1c2d65..14f28e57e 100644
--- a/crates/colossus-windows-native/src/tests.rs
+++ b/crates/colossus-windows-native/src/tests.rs
@@ -325,13 +325,25 @@ fn private_file_creation_is_exclusive_and_owner_private() {
 #[cfg(windows)]
 #[test]
 fn private_file_replacement_is_atomic_and_preserves_private_access() {
+    use std::io::Read as _;
+
     let parent = local_app_data_tempdir("colossus-native-private-replace-");
     let directory = parent.path().join("private");
     create_private_directory(&directory).expect("create private directory");
     let destination = directory.join("settings.json");
     let source = directory.join(".settings.next");
-    std::fs::write(&destination, b"old").expect("write original");
+    create_private_file(&source, b"old").expect("stage initial private file");
+    replace_private_file(&source, &destination).expect("commit initially absent private file");
+    assert!(!source.exists());
+    assert_eq!(
+        std::fs::read(&destination).expect("read initial file"),
+        b"old"
+    );
     std::fs::write(&source, b"new").expect("write replacement");
+    let old = BoundPath::open_file_read_write(&destination).expect("retain original writer");
+    let staged = BoundPath::open_file_read_write(&source).expect("retain replacement writer");
+    let mut old_reader = old.try_clone_file().expect("retain original reader");
+    let mut staged_reader = staged.try_clone_file().expect("retain replacement reader");
 
     replace_private_file(&source, &destination).expect("replace private file");
 
@@ -340,8 +352,28 @@ fn private_file_replacement_is_atomic_and_preserves_private_access() {
         std::fs::read(&destination).expect("read replacement"),
         b"new"
     );
-    BoundPath::open_file(&destination)
-        .expect("bind replacement")
+    let committed = BoundPath::open_file(&destination).expect("bind replacement");
+    assert_eq!(committed.identity(), staged.identity());
+    assert_ne!(committed.identity(), old.identity());
+    let mut original = Vec::new();
+    old_reader
+        .read_to_end(&mut original)
+        .expect("read displaced file");
+    assert_eq!(original, b"old");
+    let mut replacement = Vec::new();
+    staged_reader
+        .read_to_end(&mut replacement)
+        .expect("read retained replacement");
+    assert_eq!(replacement, b"new");
+    assert!(
+        old.revalidate().is_err(),
+        "the old name now identifies a different object"
+    );
+    assert!(staged.revalidate().is_err(), "the staged name was removed");
+    committed
+        .revalidate()
+        .expect("committed identity remains bound");
+    committed
         .validate_private_owner_dacl()
         .expect("replacement remains private");
 }
diff --git a/crates/colossus-windows-native/src/windows.rs b/crates/colossus-windows-native/src/windows.rs
index 4ae30afb4..92501d2ee 100644
--- a/crates/colossus-windows-native/src/windows.rs
+++ b/crates/colossus-windows-native/src/windows.rs
@@ -1,7 +1,7 @@
 use crate::{FileIdentity, WindowsNativeError};
 use std::{
     fs::{self, File, OpenOptions},
-    mem::{size_of, zeroed},
+    mem::{offset_of, size_of, zeroed},
     os::windows::{
         ffi::{OsStrExt as _, OsStringExt as _},
         fs::OpenOptionsExt as _,
@@ -11,8 +11,12 @@ use std::{
     path::{Path, PathBuf},
     ptr::{null, null_mut},
 };
+use windows_sys::Wdk::Storage::FileSystem::{
+    FILE_RENAME_INFORMATION, FILE_RENAME_POSIX_SEMANTICS, FILE_RENAME_REPLACE_IF_EXISTS,
+    FileRenameInformationEx, NtSetInformationFile,
+};
 use windows_sys::Win32::{
-    Foundation::{GENERIC_READ, INVALID_HANDLE_VALUE, LocalFree, NO_ERROR},
+    Foundation::{GENERIC_READ, INVALID_HANDLE_VALUE, LocalFree, NO_ERROR, RtlNtStatusToDosError},
     Security::{
         ACCESS_ALLOWED_ACE, ACE_FLAGS, ACE_HEADER,
         Authorization::{
@@ -27,18 +31,19 @@ use windows_sys::Win32::{
         WinBuiltinAdministratorsSid, WinLocalSystemSid,
     },
     Storage::FileSystem::{
-        BY_HANDLE_FILE_INFORMATION, CREATE_NEW, CreateDirectoryW, CreateFileW, FILE_ALL_ACCESS,
-        FILE_ATTRIBUTE_DIRECTORY, FILE_ATTRIBUTE_NORMAL, FILE_ATTRIBUTE_REPARSE_POINT,
-        FILE_FLAG_BACKUP_SEMANTICS, FILE_FLAG_OPEN_REPARSE_POINT, FILE_GENERIC_WRITE, FILE_ID_INFO,
-        FILE_READ_ATTRIBUTES, FILE_SHARE_DELETE, FILE_SHARE_READ, FILE_SHARE_WRITE, FileIdInfo,
-        GetFileInformationByHandle, GetFileInformationByHandleEx, MOVEFILE_REPLACE_EXISTING,
-        MOVEFILE_WRITE_THROUGH, MoveFileExW, READ_CONTROL,
+        BY_HANDLE_FILE_INFORMATION, CREATE_NEW, CreateDirectoryW, CreateFileW, DELETE,
+        FILE_ALL_ACCESS, FILE_ATTRIBUTE_DIRECTORY, FILE_ATTRIBUTE_NORMAL,
+        FILE_ATTRIBUTE_REPARSE_POINT, FILE_FLAG_BACKUP_SEMANTICS, FILE_FLAG_OPEN_REPARSE_POINT,
+        FILE_GENERIC_WRITE, FILE_ID_INFO, FILE_READ_ATTRIBUTES, FILE_SHARE_DELETE, FILE_SHARE_READ,
+        FILE_SHARE_WRITE, FileIdInfo, GetFileInformationByHandle, GetFileInformationByHandleEx,
+        READ_CONTROL,
     },
     System::{
         Console::{STD_INPUT_HANDLE, STD_OUTPUT_HANDLE, SetStdHandle},
         Diagnostics::ToolHelp::{
             CreateToolhelp32Snapshot, TH32CS_SNAPTHREAD, THREADENTRY32, Thread32First, Thread32Next,
         },
+        IO::IO_STATUS_BLOCK,
         JobObjects::{
             AssignProcessToJobObject, CreateJobObjectW, JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE,
             JOBOBJECT_EXTENDED_LIMIT_INFORMATION, JobObjectExtendedLimitInformation,
@@ -248,7 +253,11 @@ pub(super) fn replace_private_file(
     parent.validate_ancestor_namespace_authority()?;
     parent.validate_private_owner_dacl()?;
     parent.revalidate()?;
-    let source = open_bound(source_path, BoundKind::File)?;
+    let source = open_bound_with_access(
+        source_path,
+        BoundKind::File,
+        GENERIC_READ | FILE_GENERIC_WRITE | DELETE,
+    )?;
     source.validate_ancestor_namespace_authority()?;
     source.validate_private_owner_dacl()?;
     source.revalidate()?;
@@ -259,19 +268,75 @@ pub(super) fn replace_private_file(
         destination.revalidate()?;
     }
 
-    let source_encoded = nul_terminated_path(source_path)?;
-    let destination_encoded = nul_terminated_path(destination_path)?;
-    // SAFETY: both paths are NUL-terminated and remain live for the call. The retained
-    // private parent and source handles make the post-operation identity check meaningful.
-    if unsafe {
-        MoveFileExW(
-            source_encoded.as_ptr(),
-            destination_encoded.as_ptr(),
-            MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH,
+    let destination_leaf = destination_path
+        .file_name()
+        .ok_or(WindowsNativeError::InvalidInput)?;
+    let mut encoded = destination_leaf.encode_wide().collect::<Vec<_>>();
+    if encoded.is_empty() || encoded.contains(&0) {
+        return Err(WindowsNativeError::InvalidInput);
+    }
+    let name_bytes = encoded
+        .len()
+        .checked_mul(size_of::<u16>())
+        .and_then(|size| u32::try_from(size).ok())
+        .ok_or(WindowsNativeError::InvalidInput)?;
+    encoded.push(0);
+    let buffer_bytes = offset_of!(FILE_RENAME_INFORMATION, FileName)
+        .checked_add(encoded.len() * size_of::<u16>())
+        .and_then(|size| u32::try_from(size).ok())
+        .ok_or(WindowsNativeError::InvalidInput)?;
+    // Struct storage preserves alignment while reserving the variable-length name tail.
+    let mut buffer = vec![
+        FILE_RENAME_INFORMATION::default();
+        (buffer_bytes as usize).div_ceil(size_of::<FILE_RENAME_INFORMATION>())
+    ];
+    buffer[0].Anonymous.Flags = FILE_RENAME_REPLACE_IF_EXISTS | FILE_RENAME_POSIX_SEMANTICS;
+    buffer[0].RootDirectory = parent.file.as_raw_handle().cast();
+    buffer[0].FileNameLength = name_bytes;
+    // SAFETY: the aligned allocation covers the header and entire UTF-16 name tail;
+    // its destination range does not overlap the separate encoded-name allocation.
+    unsafe {
+        std::ptr::copy_nonoverlapping(
+            encoded.as_ptr(),
+            buffer
+                .as_mut_ptr()
+                .cast::<u8>()
+                .add(offset_of!(FILE_RENAME_INFORMATION, FileName))
+                .cast::<u16>(),
+            encoded.len(),
+        );
+    }
+    source
+        .file
+        .sync_all()
+        .map_err(|source| WindowsNativeError::Io {
+            operation: "flush private replacement file",
+            source,
+        })?;
+    source.revalidate()?;
+    parent.revalidate()?;
+    let mut io_status = IO_STATUS_BLOCK::default();
+    // Use the native operation for a leaf relative to the retained directory handle;
+    // the Win32 wrapper performs DOS path conversion before calling this operation.
+    // SAFETY: both handles remain live, the output status is writable, and the aligned
+    // buffer contains exactly the initialized rename header and name bytes. POSIX
+    // replacement keeps existing readers attached to the displaced file object.
+    let status = unsafe {
+        NtSetInformationFile(
+            source.file.as_raw_handle().cast(),
+            &mut io_status,
+            buffer.as_ptr().cast(),
+            buffer_bytes,
+            FileRenameInformationEx,
         )
-    } == 0
-    {
-        return Err(last_error("replace private file"));
+    };
+    if status < 0 {
+        // SAFETY: translating an NTSTATUS does not dereference caller-owned memory.
+        let error = unsafe { RtlNtStatusToDosError(status) };
+        return Err(WindowsNativeError::Io {
+            operation: "replace private file",
+            source: std::io::Error::from_raw_os_error(error as i32),
+        });
     }
 
     let committed = open_bound(destination_path, BoundKind::File)?;
@@ -566,19 +631,19 @@ pub(super) fn open_bound(
     path: &Path,
     kind: BoundKind,
 ) -> Result<BoundPathInner, WindowsNativeError> {
-    open_bound_with_access(path, kind, false)
+    open_bound_with_access(path, kind, GENERIC_READ)
 }
 
 pub(super) fn open_bound_file_read_write(
     path: &Path,
 ) -> Result<BoundPathInner, WindowsNativeError> {
-    open_bound_with_access(path, BoundKind::File, true)
+    open_bound_with_access(path, BoundKind::File, GENERIC_READ | FILE_GENERIC_WRITE)
 }
 
 fn open_bound_with_access(
     path: &Path,
     kind: BoundKind,
-    writable_file: bool,
+    file_access: u32,
 ) -> Result<BoundPathInner, WindowsNativeError> {
     if !path.is_absolute()
         || path.parent().is_none()
@@ -604,7 +669,11 @@ fn open_bound_with_access(
         }
         let leaf = index + 1 == components.len();
         let component_kind = if leaf { kind } else { BoundKind::Directory };
-        let opened = open_exact(&candidate, component_kind, leaf && writable_file)?;
+        let opened = open_exact(
+            &candidate,
+            component_kind,
+            if leaf { file_access } else { 0 },
+        )?;
         if leaf {
             let canonical_path =
                 fs::canonicalize(path).map_err(|source| WindowsNativeError::Io {
@@ -625,14 +694,10 @@ fn open_bound_with_access(
     Err(WindowsNativeError::InvalidInput)
 }
 
-fn open_exact(
-    path: &Path,
-    kind: BoundKind,
-    writable_file: bool,
-) -> Result<File, WindowsNativeError> {
+fn open_exact(path: &Path, kind: BoundKind, file_access: u32) -> Result<File, WindowsNativeError> {
     let mut options = OpenOptions::new();
     let data_access = if matches!(kind, BoundKind::File) {
-        GENERIC_READ | if writable_file { FILE_GENERIC_WRITE } else { 0 }
+        file_access
     } else {
         0
     };
diff --git a/deny.toml b/deny.toml
index 12b1f6a38..8856a1c23 100644
--- a/deny.toml
+++ b/deny.toml
@@ -10,7 +10,12 @@ targets = [
 all-features = true
 
 [advisories]
-ignore = []
+ignore = [
+    # OIDC verifies signatures with public keys only; certificate issuance is
+    # Ed25519. No application path performs RSA private-key operations.
+    # See ADR 0006. Remove when OpenID Connect drops the affected dependency.
+    { id = "RUSTSEC-2023-0071", reason = "OIDC public-key verification is outside the private-key timing attack; no application RSA private-key operations" },
+]
 
 [licenses]
 allow = [
diff --git a/deploy/cloud/Dockerfile b/deploy/cloud/Dockerfile
new file mode 100644
index 000000000..28123c1d6
--- /dev/null
+++ b/deploy/cloud/Dockerfile
@@ -0,0 +1,34 @@
+# syntax=docker/dockerfile:1
+FROM node:22.18.0-bookworm-slim@sha256:752ea8a2f758c34002a0461bd9f1cee4f9a3c36d48494586f60ffce1fc708e0e AS web
+WORKDIR /source
+COPY apps/ui apps/ui
+COPY apps/web apps/web
+ARG VITE_COLOSSUS_DOCUMENTATION_URL=/docs/
+RUN cd apps/web && npm ci --ignore-scripts --legacy-peer-deps --install-links && \
+    VITE_COLOSSUS_DOCUMENTATION_URL="$VITE_COLOSSUS_DOCUMENTATION_URL" npm run build
+
+FROM rust:1.96.0-bookworm@sha256:5e2214abe154fe26e39f64488952e5c991eeed1d6d6da7cc8381ae83927f0cfc AS build
+WORKDIR /source
+COPY . .
+ARG PROFILE=release
+ENV CARGO_BUILD_JOBS=2
+ENV CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_DEV_INCREMENTAL=false
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/source/target \
+    cargo build --locked --profile ${PROFILE} -p colossus-cloud-server -p colossus-connector -p colossus-cli --bins && \
+    if [ "$PROFILE" = dev ]; then output=debug; else output="$PROFILE"; fi && \
+    mkdir /artifacts && cp target/${output}/colossus-control-plane target/${output}/colossus-cloud-server target/${output}/colossus-connector target/${output}/colossus /artifacts/ && \
+    strip /artifacts/*
+
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251 AS runtime
+RUN apt-get update && apt-get install --yes --no-install-recommends ca-certificates libdbus-1-3 libsecret-1-0 && rm -rf /var/lib/apt/lists/* && \
+    groupadd --gid 10001 colossus && useradd --uid 10001 --gid colossus --home-dir /var/lib/colossus --create-home colossus && \
+    chmod 0700 /var/lib/colossus
+COPY --from=build /artifacts/ /usr/local/bin/
+COPY --from=web /source/apps/web/dist/ /opt/colossus/web/
+USER 10001:10001
+ENV COLOSSUS_HOME=/var/lib/colossus
+EXPOSE 8080 8443
+ENTRYPOINT ["colossus-control-plane"]
+CMD ["/etc/colossus/cloud.json"]
diff --git a/deploy/cloud/kubernetes/cloud.json b/deploy/cloud/kubernetes/cloud.json
new file mode 100644
index 000000000..f86f317ff
--- /dev/null
+++ b/deploy/cloud/kubernetes/cloud.json
@@ -0,0 +1,39 @@
+{
+  "http_bind": "0.0.0.0:8080",
+  "grpc_bind": "0.0.0.0:8443",
+  "public_origin": "https://colossus.example.com",
+  "grpc_endpoint": "https://runtimes.colossus.example.com",
+  "ca_certificate": "/etc/colossus/tls/ca.pem",
+  "ca_key": "/etc/colossus/tls/ca-key.pem",
+  "server_certificate": "/etc/colossus/tls/server.pem",
+  "server_key": "/etc/colossus/tls/server-key.pem",
+  "oidc": {
+    "issuer": "https://identity.example.com/realms/colossus",
+    "client_id": "colossus-cloud",
+    "client_secret_file": "/etc/colossus/oidc/client-secret"
+  },
+  "memberships": [
+    {
+      "subject": "replace-with-oidc-subject",
+      "project_id": "engineering",
+      "permissions": ["read", "execute", "control", "approve", "administer"]
+    }
+  ],
+  "web_root": "/opt/colossus/web",
+  "database": {
+    "connectionVariable": "COLOSSUS_CLOUD_DATABASE",
+    "schema": "colossus_cloud",
+    "tls": {
+      "kind": "webpki_roots"
+    },
+    "maxConnections": 16,
+    "connectionTimeoutMs": 5000,
+    "statementTimeoutMs": 15000
+  },
+  "auth_key_variable": "COLOSSUS_CLOUD_AUTH_KEY",
+  "maintenance": {
+    "batchLimit": 256,
+    "deliveredOutboxRetentionSeconds": 86400
+  },
+  "local_development": false
+}
diff --git a/deploy/cloud/kubernetes/control-plane.yaml b/deploy/cloud/kubernetes/control-plane.yaml
new file mode 100644
index 000000000..0c2e9070c
--- /dev/null
+++ b/deploy/cloud/kubernetes/control-plane.yaml
@@ -0,0 +1,91 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: colossus-cloud
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: colossus-cloud
+  template:
+    metadata:
+      labels:
+        app: colossus-cloud
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 45
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: control-plane
+          image: colossus-cloud
+          imagePullPolicy: IfNotPresent
+          ports:
+            - {name: http, containerPort: 8080}
+            - {name: connector, containerPort: 8443}
+          env:
+            - name: COLOSSUS_CLOUD_DATABASE
+              valueFrom: {secretKeyRef: {name: colossus-cloud-state, key: database}}
+            - name: COLOSSUS_CLOUD_AUTH_KEY
+              valueFrom: {secretKeyRef: {name: colossus-cloud-state, key: auth-key}}
+          resources:
+            requests: {cpu: 250m, memory: 256Mi}
+            limits: {cpu: "2", memory: 1Gi}
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+          startupProbe:
+            httpGet: {path: /health/ready, port: http}
+            periodSeconds: 2
+            failureThreshold: 60
+          readinessProbe:
+            httpGet: {path: /health/ready, port: http}
+            periodSeconds: 5
+          livenessProbe:
+            httpGet: {path: /health/live, port: http}
+            periodSeconds: 10
+          volumeMounts:
+            - {name: config, mountPath: /etc/colossus/cloud.json, subPath: cloud.json, readOnly: true}
+            - {name: tls, mountPath: /etc/colossus/tls, readOnly: true}
+            - {name: oidc, mountPath: /etc/colossus/oidc, readOnly: true}
+            - {name: temporary, mountPath: /tmp}
+      volumes:
+        - name: config
+          configMap: {name: colossus-cloud-config}
+        - name: tls
+          secret: {secretName: colossus-cloud-tls, defaultMode: 288}
+        - name: oidc
+          secret: {secretName: colossus-cloud-oidc, defaultMode: 288}
+        - name: temporary
+          emptyDir: {sizeLimit: 64Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: colossus-cloud
+spec:
+  selector: {app: colossus-cloud}
+  ports:
+    - {name: http, port: 8080, targetPort: http}
+    - {name: connector, port: 8443, targetPort: connector}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: colossus-cloud
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: colossus-cloud
diff --git a/deploy/cloud/kubernetes/ingress.yaml b/deploy/cloud/kubernetes/ingress.yaml
new file mode 100644
index 000000000..0567e7f99
--- /dev/null
+++ b/deploy/cloud/kubernetes/ingress.yaml
@@ -0,0 +1,40 @@
+# Example for ingress-nginx. Its controller must enable --enable-ssl-passthrough.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: colossus-browser
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts: [colossus.example.com]
+      secretName: colossus-browser-tls
+  rules:
+    - host: colossus.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: {name: colossus-cloud, port: {name: http}}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: colossus-runtime
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: runtimes.colossus.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: {name: colossus-cloud, port: {name: connector}}
diff --git a/deploy/cloud/kubernetes/kustomization.yaml b/deploy/cloud/kubernetes/kustomization.yaml
new file mode 100644
index 000000000..e0fa3a2c0
--- /dev/null
+++ b/deploy/cloud/kubernetes/kustomization.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: colossus
+resources:
+  - namespace.yaml
+  - control-plane.yaml
+  - ingress.yaml
+configMapGenerator:
+  - name: colossus-cloud-config
+    files:
+      - cloud.json
+# Pin this image tag to a tested immutable release or replace it with a digest.
+images:
+  - name: colossus-cloud
+    newName: registry.example.com/colossus/cloud
+    newTag: replace-with-your-built-image
diff --git a/deploy/cloud/kubernetes/namespace.yaml b/deploy/cloud/kubernetes/namespace.yaml
new file mode 100644
index 000000000..7b2e483c7
--- /dev/null
+++ b/deploy/cloud/kubernetes/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: colossus
diff --git a/deploy/cloud/linux-desktop.Dockerfile b/deploy/cloud/linux-desktop.Dockerfile
new file mode 100644
index 000000000..fe8960d28
--- /dev/null
+++ b/deploy/cloud/linux-desktop.Dockerfile
@@ -0,0 +1,30 @@
+# Reproducible Linux Desktop package/acceptance builder, without host credentials.
+FROM node:22.18.0-bookworm-slim@sha256:752ea8a2f758c34002a0461bd9f1cee4f9a3c36d48494586f60ffce1fc708e0e AS node
+FROM rust:1.96.0-bookworm@sha256:5e2214abe154fe26e39f64488952e5c991eeed1d6d6da7cc8381ae83927f0cfc AS build-base
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
+COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    clang cmake pkg-config libssl-dev libsecret-1-dev libwebkit2gtk-4.1-dev libasound2-dev \
+    libayatana-appindicator3-dev librsvg2-dev libxdo-dev patchelf \
+    dbus-x11 gnome-keyring xvfb xauth xdotool python3 \
+    && rm -rf /var/lib/apt/lists/*
+ENV CARGO_BUILD_JOBS=4
+WORKDIR /build
+
+FROM build-base AS package
+COPY . .
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/build/target \
+    --mount=type=cache,target=/build/apps/desktop/src-tauri/target \
+    npm ci --prefix apps/desktop --ignore-scripts --legacy-peer-deps --install-links \
+    && git init --quiet \
+    && COLOSSUS_DESKTOP_RELEASE_CHANNEL=developer_preview COLOSSUS_DESKTOP_TEAM_ID=UNSIGNED sh scripts/package-desktop-linux
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/build/target \
+    --mount=type=cache,target=/build/apps/desktop/src-tauri/target \
+    xvfb-run -a dbus-run-session -- sh scripts/test-desktop-linux-native
+FROM scratch AS artifacts
+COPY --from=package /build/dist/desktop-linux/ /
diff --git a/deploy/cloud/local/compose.yml b/deploy/cloud/local/compose.yml
new file mode 100644
index 000000000..c6429cfb3
--- /dev/null
+++ b/deploy/cloud/local/compose.yml
@@ -0,0 +1,24 @@
+services:
+  oidc:
+    image: quay.io/keycloak/keycloak:26.8.0@sha256:b0f60d489d51c5d113390bdf5461d4c06e6051be026c05549f2e1e10ec352bcc
+    command: [start-dev, --import-realm]
+    ports: ["127.0.0.1:8180:8080"]
+    environment:
+      KC_BOOTSTRAP_ADMIN_USERNAME: local-admin
+      KC_BOOTSTRAP_ADMIN_PASSWORD: local-only-admin
+      KC_HOSTNAME: http://127.0.0.1:8180
+    volumes: ["./realm.json:/opt/keycloak/data/import/colossus.json:ro"]
+    mem_limit: 1g
+  postgres:
+    image: postgres:17.9@sha256:2a0d0fe14825b0939f78a8cad5cd4e6aa68bf94d0e5dd96e24b6d23af4315545
+    ports: ["127.0.0.1:5433:5432"]
+    environment:
+      POSTGRES_USER: colossus
+      POSTGRES_PASSWORD: local-only-database
+      POSTGRES_DB: colossus_cloud
+    healthcheck:
+      test: [CMD-SHELL, "pg_isready -U colossus -d colossus_cloud"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+    mem_limit: 512m
diff --git a/deploy/cloud/local/realm.json b/deploy/cloud/local/realm.json
new file mode 100644
index 000000000..e64a8aea3
--- /dev/null
+++ b/deploy/cloud/local/realm.json
@@ -0,0 +1,45 @@
+{
+  "realm": "colossus",
+  "enabled": true,
+  "sslRequired": "none",
+  "registrationAllowed": false,
+  "accessTokenLifespan": 1800,
+  "clients": [
+    {
+      "clientId": "colossus-cloud",
+      "enabled": true,
+      "publicClient": true,
+      "standardFlowEnabled": true,
+      "directAccessGrantsEnabled": false,
+      "redirectUris": [
+        "http://127.0.0.1:5180/auth/callback",
+        "http://127.0.0.1:8090/auth/callback"
+      ],
+      "webOrigins": [
+        "http://127.0.0.1:5180",
+        "http://127.0.0.1:8090"
+      ],
+      "attributes": {
+        "pkce.code.challenge.method": "S256"
+      }
+    }
+  ],
+  "users": [
+    {
+      "id": "11111111-1111-4111-8111-111111111111",
+      "username": "alice",
+      "enabled": true,
+      "emailVerified": true,
+      "firstName": "Alice",
+      "lastName": "Local",
+      "email": "alice@local.test",
+      "credentials": [
+        {
+          "type": "password",
+          "value": "local-only-password",
+          "temporary": false
+        }
+      ]
+    }
+  ]
+}
diff --git a/deploy/control-plane/Dockerfile b/deploy/control-plane/Dockerfile
new file mode 100644
index 000000000..0fb91a98f
--- /dev/null
+++ b/deploy/control-plane/Dockerfile
@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1
+FROM node:22.18.0-bookworm-slim@sha256:752ea8a2f758c34002a0461bd9f1cee4f9a3c36d48494586f60ffce1fc708e0e AS web
+WORKDIR /source
+COPY apps/ui apps/ui
+COPY apps/web apps/web
+ARG VITE_COLOSSUS_DOCUMENTATION_URL=/docs/
+RUN cd apps/web && npm ci --ignore-scripts --legacy-peer-deps --install-links && \
+    VITE_COLOSSUS_DOCUMENTATION_URL="$VITE_COLOSSUS_DOCUMENTATION_URL" npm run build
+
+FROM rust:1.96.0-bookworm@sha256:5e2214abe154fe26e39f64488952e5c991eeed1d6d6da7cc8381ae83927f0cfc AS build
+WORKDIR /source
+COPY . .
+ARG PROFILE=release
+ARG BUILD_JOBS=2
+ENV CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_DEV_INCREMENTAL=false
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
+    --mount=type=cache,target=/source/target \
+    CARGO_BUILD_JOBS=${BUILD_JOBS} cargo build --locked --profile ${PROFILE} -p colossus-cloud-server --bin colossus-control-plane && \
+    if [ "$PROFILE" = dev ]; then output=debug; else output="$PROFILE"; fi && \
+    install -D target/${output}/colossus-control-plane /artifacts/colossus-control-plane && strip /artifacts/colossus-control-plane
+
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251 AS runtime
+RUN apt-get update && apt-get install --yes --no-install-recommends ca-certificates libdbus-1-3 libsecret-1-0 && rm -rf /var/lib/apt/lists/* && \
+    groupadd --gid 10001 colossus && useradd --uid 10001 --gid colossus --home-dir /var/lib/colossus --create-home colossus && chmod 0700 /var/lib/colossus
+COPY --from=build /artifacts/colossus-control-plane /usr/local/bin/
+COPY --from=web /source/apps/web/dist/ /opt/colossus/web/
+USER 10001:10001
+ENV COLOSSUS_HOME=/var/lib/colossus
+EXPOSE 8080 8443
+ENTRYPOINT ["colossus-control-plane"]
+CMD ["/etc/colossus/control-plane.json"]
diff --git a/deploy/control-plane/kubernetes/control-plane.json b/deploy/control-plane/kubernetes/control-plane.json
new file mode 100644
index 000000000..3b74e3312
--- /dev/null
+++ b/deploy/control-plane/kubernetes/control-plane.json
@@ -0,0 +1,45 @@
+{
+  "http_bind": "0.0.0.0:8080",
+  "grpc_bind": "0.0.0.0:8443",
+  "public_origin": "https://colossus.example.com",
+  "grpc_endpoint": "https://runtimes.colossus.example.com",
+  "ca_certificate": "/etc/colossus/tls/ca.pem",
+  "ca_key": "/etc/colossus/tls/ca-key.pem",
+  "server_certificate": "/etc/colossus/tls/server.pem",
+  "server_key": "/etc/colossus/tls/server-key.pem",
+  "oidc": null,
+  "memberships": [],
+  "web_root": "/opt/colossus/web",
+  "database": {
+    "connectionVariable": "COLOSSUS_CONTROL_PLANE_DATABASE",
+    "schema": "colossus_control_plane",
+    "tls": {
+      "kind": "webpki_roots"
+    },
+    "maxConnections": 16,
+    "connectionTimeoutMs": 5000,
+    "statementTimeoutMs": 15000
+  },
+  "auth_key_variable": "COLOSSUS_CONTROL_PLANE_AUTH_KEY",
+  "maintenance": {
+    "batchLimit": 256,
+    "deliveredOutboxRetentionSeconds": 86400
+  },
+  "local_development": false,
+  "local_auth": {
+    "session_seconds": 28800
+  },
+  "bootstrap_admin": {
+    "display_name": "Administrator",
+    "email": null,
+    "oidc_subject": null,
+    "username": "admin",
+    "password_variable": "COLOSSUS_CONTROL_PLANE_BOOTSTRAP_PASSWORD"
+  },
+  "classification": {
+    "enabled": false,
+    "text": "",
+    "tone": "neutral",
+    "position": "top_and_bottom"
+  }
+}
diff --git a/deploy/control-plane/kubernetes/control-plane.yaml b/deploy/control-plane/kubernetes/control-plane.yaml
new file mode 100644
index 000000000..5a263f138
--- /dev/null
+++ b/deploy/control-plane/kubernetes/control-plane.yaml
@@ -0,0 +1,93 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: colossus-control-plane
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app: colossus-control-plane
+  template:
+    metadata:
+      labels:
+        app: colossus-control-plane
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 45
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: control-plane
+          image: colossus-control-plane
+          imagePullPolicy: IfNotPresent
+          ports:
+            - {name: http, containerPort: 8080}
+            - {name: connector, containerPort: 8443}
+          env:
+            - name: COLOSSUS_CONTROL_PLANE_DATABASE
+              valueFrom: {secretKeyRef: {name: colossus-control-plane-state, key: database}}
+            - name: COLOSSUS_CONTROL_PLANE_AUTH_KEY
+              valueFrom: {secretKeyRef: {name: colossus-control-plane-state, key: auth-key}}
+            - name: COLOSSUS_CONTROL_PLANE_BOOTSTRAP_PASSWORD
+              valueFrom: {secretKeyRef: {name: colossus-control-plane-state, key: bootstrap-password, optional: true}}
+          resources:
+            requests: {cpu: 250m, memory: 256Mi}
+            limits: {cpu: "2", memory: 1Gi}
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+          startupProbe:
+            httpGet: {path: /health/ready, port: http}
+            periodSeconds: 2
+            failureThreshold: 60
+          readinessProbe:
+            httpGet: {path: /health/ready, port: http}
+            periodSeconds: 5
+          livenessProbe:
+            httpGet: {path: /health/live, port: http}
+            periodSeconds: 10
+          volumeMounts:
+            - {name: config, mountPath: /etc/colossus/control-plane.json, subPath: control-plane.json, readOnly: true}
+            - {name: tls, mountPath: /etc/colossus/tls, readOnly: true}
+            - {name: oidc, mountPath: /etc/colossus/oidc, readOnly: true}
+            - {name: temporary, mountPath: /tmp}
+      volumes:
+        - name: config
+          configMap: {name: colossus-control-plane-config}
+        - name: tls
+          secret: {secretName: colossus-control-plane-tls, defaultMode: 288}
+        - name: oidc
+          secret: {secretName: colossus-control-plane-oidc, optional: true, defaultMode: 288}
+        - name: temporary
+          emptyDir: {sizeLimit: 64Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: colossus-control-plane
+spec:
+  selector: {app: colossus-control-plane}
+  ports:
+    - {name: http, port: 8080, targetPort: http}
+    - {name: connector, port: 8443, targetPort: connector}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: colossus-control-plane
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: colossus-control-plane
diff --git a/deploy/control-plane/kubernetes/documentation.yaml b/deploy/control-plane/kubernetes/documentation.yaml
new file mode 100644
index 000000000..e6e4b7f25
--- /dev/null
+++ b/deploy/control-plane/kubernetes/documentation.yaml
@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: colossus-documentation
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate: { maxUnavailable: 0, maxSurge: 1 }
+  selector:
+    matchLabels: { app: colossus-documentation }
+  template:
+    metadata:
+      labels: { app: colossus-documentation }
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile: { type: RuntimeDefault }
+      containers:
+        - name: documentation
+          image: colossus-documentation
+          imagePullPolicy: IfNotPresent
+          ports: [{ name: http, containerPort: 8080 }]
+          resources:
+            requests: { cpu: 25m, memory: 32Mi }
+            limits: { cpu: 250m, memory: 128Mi }
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: { drop: [ALL] }
+          readinessProbe:
+            httpGet: { path: /docs/, port: http }
+            periodSeconds: 5
+          livenessProbe:
+            httpGet: { path: /health/live, port: http }
+            periodSeconds: 10
+          volumeMounts:
+            - { name: temporary, mountPath: /tmp }
+      volumes:
+        - name: temporary
+          emptyDir: { sizeLimit: 16Mi }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: colossus-documentation
+spec:
+  selector: { app: colossus-documentation }
+  ports: [{ name: http, port: 8080, targetPort: http }]
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: colossus-documentation
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: { app: colossus-documentation }
diff --git a/deploy/control-plane/kubernetes/ingress.yaml b/deploy/control-plane/kubernetes/ingress.yaml
new file mode 100644
index 000000000..a801800d4
--- /dev/null
+++ b/deploy/control-plane/kubernetes/ingress.yaml
@@ -0,0 +1,46 @@
+# Example for ingress-nginx. Its controller must enable --enable-ssl-passthrough.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: colossus-browser
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts: [colossus.example.com]
+      secretName: colossus-browser-tls
+  rules:
+    - host: colossus.example.com
+      http:
+        paths:
+          # Static public documentation; no authentication or path rewrite.
+          - path: /docs
+            pathType: Prefix
+            backend:
+              service: { name: colossus-documentation, port: { name: http } }
+          - path: /
+            pathType: Prefix
+            backend:
+              service: { name: colossus-control-plane, port: { name: http } }
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: colossus-runtime
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: runtimes.colossus.example.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                { name: colossus-control-plane, port: { name: connector } }
diff --git a/deploy/control-plane/kubernetes/kustomization.yaml b/deploy/control-plane/kubernetes/kustomization.yaml
new file mode 100644
index 000000000..0f34c86d0
--- /dev/null
+++ b/deploy/control-plane/kubernetes/kustomization.yaml
@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: colossus
+resources:
+  - namespace.yaml
+  - control-plane.yaml
+  - documentation.yaml
+  - ingress.yaml
+configMapGenerator:
+  - name: colossus-control-plane-config
+    files:
+      - control-plane.json
+# Pin this image tag to a tested immutable release or replace it with a digest.
+images:
+  - name: colossus-control-plane
+    newName: ghcr.io/obscuritylabs/colossus-control-plane
+    newTag: replace-with-your-built-image
+  - name: colossus-documentation
+    newName: ghcr.io/obscuritylabs/colossus-documentation
+    newTag: replace-with-your-built-image
diff --git a/deploy/control-plane/kubernetes/namespace.yaml b/deploy/control-plane/kubernetes/namespace.yaml
new file mode 100644
index 000000000..7b2e483c7
--- /dev/null
+++ b/deploy/control-plane/kubernetes/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: colossus
diff --git a/deploy/documentation/.gitignore b/deploy/documentation/.gitignore
new file mode 100644
index 000000000..43ae0e2a6
--- /dev/null
+++ b/deploy/documentation/.gitignore
@@ -0,0 +1,2 @@
+__pycache__/
+*.py[cod]
diff --git a/deploy/documentation/Dockerfile b/deploy/documentation/Dockerfile
new file mode 100644
index 000000000..740c4c353
--- /dev/null
+++ b/deploy/documentation/Dockerfile
@@ -0,0 +1,38 @@
+# syntax=docker/dockerfile:1
+# Keep the canonical Zensical pin aligned with scripts/docs-site.
+FROM zensical/zensical:0.0.50@sha256:a67f689607908b47b9979ff8213906477f78826e9f8565f012e06071f883e973 AS build
+WORKDIR /source
+ARG SOURCE_DATE_EPOCH=0
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
+# Bash runs the repository's canonical compatibility redirect generator.
+RUN apk add --no-cache bash
+COPY docs docs
+COPY zensical.toml /source/zensical.source.toml
+COPY documentation/legacy-routes.tsv /source/documentation/legacy-routes.tsv
+COPY scripts/generate-doc-redirects /source/scripts/generate-doc-redirects
+COPY deploy/documentation/build-config.py /source/deploy/documentation/build-config.py
+RUN python deploy/documentation/build-config.py zensical.source.toml zensical.toml && \
+    zensical build --clean --strict && \
+    bash scripts/generate-doc-redirects documentation/legacy-routes.tsv site /docs && \
+    python deploy/documentation/build-config.py --timestamps site && \
+    test -s site/index.html && test -s site/search.json && \
+    test -s site/assets/vendor/mermaid-11.15.0.min.js
+
+FROM nginx:1.30.5-alpine@sha256:0985e772fb9f729e6fa0980da05fca5d9c468e870eed43071545afa9d2e27d94
+ARG COLOSSUS_VERSION=development
+ARG COLOSSUS_REVISION=unknown
+ARG SOURCE_DATE_EPOCH=0
+LABEL org.opencontainers.image.title="Colossus documentation" \
+      org.opencontainers.image.description="Public Colossus documentation and local search" \
+      org.opencontainers.image.source="https://github.com/obscuritylabs/Colossus" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="${COLOSSUS_VERSION}" \
+      org.opencontainers.image.revision="${COLOSSUS_REVISION}"
+COPY --from=build /source/site/ /opt/colossus/documentation/docs/
+COPY LICENSE /usr/share/licenses/colossus/LICENSE
+COPY deploy/documentation/nginx.conf /etc/nginx/nginx.conf
+USER 10001:10001
+EXPOSE 8080
+STOPSIGNAL SIGQUIT
+# Skip the official entrypoint's runtime configuration writes.
+ENTRYPOINT ["nginx", "-g", "daemon off;"]
diff --git a/deploy/documentation/build-config.py b/deploy/documentation/build-config.py
new file mode 100644
index 000000000..74b3fb0a3
--- /dev/null
+++ b/deploy/documentation/build-config.py
@@ -0,0 +1,60 @@
+"""Select portable documentation URLs without changing the GitHub Pages source."""
+
+from pathlib import Path
+import os
+import re
+import sys
+import tomllib
+
+
+def normalize_timestamps(root: Path) -> None:
+    epoch = int(os.environ.get("SOURCE_DATE_EPOCH", "0"))
+    if epoch < 0 or epoch > 253402300799:
+        raise ValueError("SOURCE_DATE_EPOCH is outside the supported UTC range")
+    if epoch:
+        for path in [root, *root.rglob("*")]:
+            if not path.is_symlink():
+                os.utime(path, (epoch, epoch))
+
+
+def configure(source: Path, target: Path) -> None:
+    if source.resolve() == target.resolve():
+        raise ValueError("the canonical documentation source must not be overwritten")
+    text = source.read_text(encoding="utf-8")
+    project = tomllib.loads(text)["project"]
+    if project["docs_dir"] != "docs" or project["site_dir"] != "site":
+        raise ValueError("documentation paths must retain the canonical build contract")
+    text, replaced = re.subn(
+        r'^site_url\s*=\s*"[^"\r\n]*"\s*$',
+        'site_url = "/docs/"',
+        text,
+        count=1,
+        flags=re.MULTILINE,
+    )
+    if replaced != 1 or tomllib.loads(text)["project"]["site_url"] != "/docs/":
+        raise ValueError("canonical documentation site URL could not be selected")
+    # Zensical 0.0.50's instant-navigation sitemap reader requires absolute URLs.
+    # Portable root-relative pages retain ordinary navigation and local search.
+    text = re.sub(
+        r'^[ \t]*"navigation\.instant(?:\.progress)?",[ \t]*\r?\n',
+        "",
+        text,
+        flags=re.MULTILINE,
+    )
+    features = tomllib.loads(text)["project"]["theme"]["features"]
+    if any(
+        name in features
+        for name in ("navigation.instant", "navigation.instant.progress")
+    ):
+        raise ValueError("portable documentation must use full-page navigation")
+    target.write_text(text, encoding="utf-8")
+    normalize_timestamps(target.parent / "docs")
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        raise SystemExit("usage: build-config.py SOURCE.toml TARGET.toml")
+    if sys.argv[1] == "--timestamps":
+        normalize_timestamps(Path(sys.argv[2]))
+    else:
+        configure(Path(sys.argv[1]), Path(sys.argv[2]))
diff --git a/deploy/documentation/nginx.conf b/deploy/documentation/nginx.conf
new file mode 100644
index 000000000..099f2b9df
--- /dev/null
+++ b/deploy/documentation/nginx.conf
@@ -0,0 +1,59 @@
+worker_processes 1;
+pid /tmp/nginx.pid;
+error_log /dev/stderr warn;
+
+events {
+    worker_connections 512;
+}
+
+http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+    access_log /dev/stdout;
+    server_tokens off;
+    sendfile on;
+    client_max_body_size 1k;
+    client_body_temp_path /tmp/client_body;
+    proxy_temp_path /tmp/proxy;
+    fastcgi_temp_path /tmp/fastcgi;
+    uwsgi_temp_path /tmp/uwsgi;
+    scgi_temp_path /tmp/scgi;
+
+    server {
+        listen 8080;
+        server_name _;
+        absolute_redirect off;
+        root /opt/colossus/documentation;
+        index index.html;
+        autoindex off;
+
+        add_header X-Content-Type-Options nosniff always;
+        add_header Referrer-Policy strict-origin-when-cross-origin always;
+        add_header X-Frame-Options DENY always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+        add_header Cache-Control "public, max-age=300" always;
+        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'" always;
+
+        if ($request_method !~ ^(GET|HEAD)$) {
+            return 405;
+        }
+
+        location = / {
+            return 308 /docs/;
+        }
+        location = /docs {
+            return 308 /docs/;
+        }
+        location = /health/live {
+            default_type text/plain;
+            return 200 "ok\n";
+        }
+        location /docs/ {
+            try_files $uri $uri/ =404;
+            error_page 404 /docs/404/index.html;
+        }
+        location / {
+            return 404;
+        }
+    }
+}
diff --git a/deploy/documentation/smoke.mjs b/deploy/documentation/smoke.mjs
new file mode 100644
index 000000000..aed222c38
--- /dev/null
+++ b/deploy/documentation/smoke.mjs
@@ -0,0 +1,218 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+
+const image = process.argv[2];
+if (
+  process.argv.length !== 3 ||
+  !/^[a-zA-Z0-9][a-zA-Z0-9._:/@-]{0,511}$/.test(image ?? "")
+) {
+  throw new Error("usage: node deploy/documentation/smoke.mjs IMAGE");
+}
+const name = `colossus-documentation-smoke-${randomUUID().slice(0, 12)}`;
+const origin = "http://documentation.test";
+const base = `${origin}/docs/`;
+
+function docker(args, input) {
+  const result = spawnSync("docker", args, {
+    input,
+    maxBuffer: 16 * 1024 * 1024,
+    timeout: 30_000,
+  });
+  if (result.error || result.status !== 0) {
+    throw new Error(
+      `Docker ${args[0]} failed: ${result.error?.message ?? result.stderr?.toString()}`,
+    );
+  }
+  return result.stdout;
+}
+
+function request(path, method = "GET") {
+  assert.match(path, /^\/[\x21-\x7e]*$/);
+  const raw = docker(
+    ["exec", "-i", name, "/bin/busybox", "nc", "-w", "2", "127.0.0.1", "8080"],
+    `${method} ${path} HTTP/1.0\r\nHost: documentation.test\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`,
+  );
+  const end = raw.indexOf("\r\n\r\n");
+  assert.ok(end > 0, "static server must return an HTTP response");
+  const lines = raw.subarray(0, end).toString().split("\r\n");
+  const status = Number(lines.shift().split(" ")[1]);
+  const headers = Object.fromEntries(
+    lines.map((line) => {
+      const at = line.indexOf(":");
+      return [line.slice(0, at).toLowerCase(), line.slice(at + 1).trim()];
+    }),
+  );
+  return { status, headers, body: raw.subarray(end + 4) };
+}
+
+function successful(path) {
+  const response = request(path);
+  assert.equal(response.status, 200, path);
+  assert.ok(response.body.length > 0, path);
+  assert.equal(response.headers["x-content-type-options"], "nosniff");
+  assert.equal(response.headers["x-frame-options"], "DENY");
+  assert.match(
+    response.headers["content-security-policy"],
+    /connect-src 'self'/,
+  );
+  assert.equal(response.headers["set-cookie"], undefined);
+  return response;
+}
+
+const verified = [];
+let started = false;
+try {
+  docker([
+    "run",
+    "--detach",
+    "--name",
+    name,
+    "--network",
+    "none",
+    "--read-only",
+    "--user",
+    "10001:10001",
+    "--cap-drop",
+    "ALL",
+    "--security-opt",
+    "no-new-privileges",
+    "--memory",
+    "128m",
+    "--cpus",
+    "0.25",
+    "--pids-limit",
+    "32",
+    "--tmpfs",
+    "/tmp:rw,noexec,nosuid,size=16m,mode=1777",
+    image,
+  ]);
+  started = true;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      successful("/health/live");
+      break;
+    } catch (error) {
+      if (attempt === 19) throw error;
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+  }
+  const [container] = JSON.parse(docker(["inspect", name]).toString());
+  assert.equal(container.Config.User, "10001:10001");
+  assert.equal(container.HostConfig.ReadonlyRootfs, true);
+  assert.equal(container.HostConfig.NetworkMode, "none");
+  assert.deepEqual(container.HostConfig.CapDrop, ["ALL"]);
+  assert.ok(container.HostConfig.SecurityOpt.includes("no-new-privileges"));
+  verified.push("non-root/read-only/no-network/capability boundary");
+
+  for (const path of ["/", "/docs"]) {
+    const response = request(path);
+    assert.equal(response.status, 308);
+    assert.equal(response.headers.location, "/docs/");
+  }
+  verified.push("relative mount redirects");
+
+  for (const path of [
+    "/docs/",
+    "/docs/admin/cloud-control-plane/",
+    "/docs/admin/documentation-hosting/",
+    "/docs/develop/application-sdk/",
+  ]) {
+    const response = successful(path);
+    assert.match(response.headers["content-type"], /^text\/html/);
+    const html = response.body.toString();
+    assert.match(html, /<meta name="generator" content="zensical-0\.0\.50">/);
+    assert.doesNotMatch(html, /https:\/\/obscuritylabs\.github\.io\/Colossus/);
+    const config = /<script[^>]*id="__config"[^>]*>([\s\S]*?)<\/script>/.exec(
+      html,
+    );
+    assert.ok(config, "generated page configuration");
+    const features = JSON.parse(config[1]).features;
+    assert.ok(Array.isArray(features));
+    assert.ok(!features.includes("navigation.instant"));
+    assert.ok(!features.includes("navigation.instant.progress"));
+    const canonical = /<link rel="canonical" href="([^"]+)"/.exec(html);
+    assert.ok(
+      canonical && new URL(canonical[1], base).pathname.startsWith("/docs/"),
+      "portable canonical URL",
+    );
+  }
+  verified.push("homepage/direct pages/local canonical URLs");
+
+  const home = successful("/docs/");
+  const assets = [...home.body.toString().matchAll(/(?:src|href)="([^"]+)"/g)]
+    .map((match) => new URL(match[1], base))
+    .filter(
+      (url) => url.origin === origin && /\.(?:css|js|svg)$/.test(url.pathname),
+    );
+  assert.ok(assets.length >= 3);
+  for (const url of assets) {
+    assert.ok(url.pathname.startsWith("/docs/"));
+    successful(url.pathname);
+  }
+  successful("/docs/assets/vendor/mermaid-11.15.0.min.js");
+  verified.push("referenced local assets and pinned diagrams");
+
+  const searchResponse = successful("/docs/search.json");
+  assert.match(searchResponse.headers["content-type"], /application\/json/);
+  const search = JSON.parse(searchResponse.body.toString());
+  assert.ok(Array.isArray(search.items) && search.items.length > 100);
+  const locations = search.items.map((item) => {
+    assert.equal(typeof item.location, "string");
+    assert.equal(typeof item.title, "string");
+    assert.equal(typeof item.text, "string");
+    const url = new URL(item.location, base);
+    assert.equal(url.origin, origin);
+    assert.ok(url.pathname.startsWith("/docs/"));
+    return url.pathname;
+  });
+  for (const path of [
+    "/docs/admin/cloud-control-plane/",
+    "/docs/admin/documentation-hosting/",
+    "/docs/develop/application-sdk/",
+  ]) {
+    assert.ok(locations.includes(path), `search includes ${path}`);
+    successful(path);
+  }
+  verified.push("browser/agent search index and direct result URLs");
+
+  const legacy = successful("/docs/GETTING_STARTED.html").body.toString();
+  assert.match(legacy, /\/docs\/get-started\/quickstart\//);
+  assert.doesNotMatch(legacy, /obscuritylabs\.github\.io|\/Colossus\//);
+  successful("/docs/get-started/quickstart/");
+  verified.push("portable legacy compatibility redirect");
+
+  const head = request("/docs/", "HEAD");
+  assert.equal(head.status, 200);
+  assert.equal(head.body.length, 0);
+  assert.ok(Number(head.headers["content-length"]) > 0);
+  for (const path of [
+    "/docs/missing-documentation-page/",
+    "/docs/assets/missing.js",
+    "/api/me",
+    "/auth/login",
+    "/etc/nginx/nginx.conf",
+  ]) {
+    assert.equal(request(path).status, 404, path);
+  }
+  assert.ok([400, 404].includes(request("/docs/%2e%2e/etc/passwd").status));
+  assert.equal(request("/docs/", "POST").status, 405);
+  verified.push("HEAD/missing pages/assets/reserved paths/traversal/non-GET");
+
+  console.log(
+    JSON.stringify(
+      {
+        image,
+        image_id: container.Image,
+        labels: container.Config.Labels,
+        search_items: search.items.length,
+        local_assets: assets.length,
+        verified,
+      },
+      null,
+      2,
+    ),
+  );
+} finally {
+  if (started) docker(["rm", "--force", name]);
+}
diff --git a/docs/admin/cloud-control-plane.md b/docs/admin/cloud-control-plane.md
new file mode 100644
index 000000000..d2b7d7e4e
--- /dev/null
+++ b/docs/admin/cloud-control-plane.md
@@ -0,0 +1,537 @@
+---
+title: Operate Colossus Control Plane
+description: Deploy the PostgreSQL-backed Kubernetes control plane, enroll runtimes, and operate shared conversations.
+audience: operator
+type: how-to
+---
+
+# Operate Colossus Control Plane
+
+Colossus Control Plane connects explicitly enrolled agents, retains their released conversation
+history, and queues human work on a fixed runtime. Each agent opens an outbound
+connection; its workspace and daemon need no inbound public port. The control plane
+owns project membership, placement and its PostgreSQL schema. Local runtimes retain
+their own journals, provider credentials, tools, policy, approvals and sandboxing.
+
+## Deploy on Kubernetes
+
+Provision PostgreSQL with a dedicated database role and cloud schema. The role must
+own the schema and its tables so startup can apply versioned migrations; it does not
+need access to runtime journals or other application schemas. Configure verified
+TLS and keep database credentials in your normal secret manager.
+Released conversation records are readable by the database role; configure database,
+disk and backup encryption through your deployment platform.
+
+Use `deploy/control-plane/kubernetes`. Pin the server image to an exact published
+release or digest, replace both example hostnames, and configure `control-plane.json`.
+The template also deploys release-matched public documentation at `/docs/`; pin the
+documentation image and retain the Ingress prefix as described in
+[documentation hosting](documentation-hosting.md).
+The server binary is `colossus-control-plane`; `colossus-cloud-server` remains a
+compatibility entry point for existing deployments.
+
+The default template supports on-prem installations without an identity provider.
+Set `local_auth` to configure local sessions and provision the first administrator
+with `bootstrap_admin.username`, `display_name`, and a `password_variable` secret
+reference. No default password or public registration exists. The initial password
+must contain at least 15 characters. Include a `bootstrap-password` key in the state
+Secret for initial provisioning; after an administrator exists, bootstrap does not
+replace that account or its credential. Administrators create, suspend, reactivate,
+and reset accounts in **Administration → Users**. Password resets and suspension
+invalidate existing sessions. Password hashes use Argon2id; login throttling is shared
+across replicas.
+
+To use an identity provider, configure `oidc` with its exact issuer, client, and
+human-readable `label`, such as `Keycloak`. Register the exact browser
+`/auth/callback` URL. Sign-in uses authorization code, S256 PKCE, state, and nonce.
+The login button displays the configured provider label. Set the explicit
+`bootstrap_admin.oidc_subject` for the first global administrator. OIDC users are bound
+to the verified issuer and subject; email does not automatically link accounts.
+Local and OIDC sign-in can be enabled together, or either can be used independently.
+
+Users, project memberships, and project hierarchy live in PostgreSQL. The legacy
+`memberships` configuration is a one-time migration seed; subsequent configuration
+restarts do not overwrite administrator-managed database roles. A global administrator
+can inspect all projects and manage users, but receives no implicit execution or effect
+approval grant. Project roles explicitly bundle permissions: Viewer reads; Operator
+reads, executes, and controls; Approver reads, controls, and answers effect approvals;
+Project administrator reads, executes, controls, and administers that project. Every
+remote operation still intersects the enrolled runtime's independent local grant.
+
+Projects can contain child projects. Membership remains explicit at each project;
+parent membership does not silently grant access to children. Archived projects retain
+readable history and administration while execution and control are disabled. Manage
+hierarchy in **Administration → Projects** and membership in the project's **Access**
+view. **Home** summarizes visible projects; **Fleet** opens the agent table, then an
+agent's workspace/thread sidebar. **Analytics** reports retained run outcomes and
+provider usage. Missing usage and unconfigured prices remain unknown.
+
+Major pages and resources have stable browser URLs. Copy the address bar to share a
+project view, agent overview or policy, conversation, or task. For example,
+`/projects/example/analytics` opens project analytics, and
+`/projects/example/threads/<thread-id>` opens one conversation. Browser Back and
+Forward follow navigation history; a page's Back control uses the previous in-app
+page or its parent when opened directly. Ordinary links also support opening a new
+tab.
+
+Shared links require sign-in and the recipient's existing project permissions. A
+link does not grant access, select a different account, or enroll a runtime. Sign-in
+preserves the requested page, including an OIDC round trip in the same browser tab.
+Route browser requests through to the Control Plane server so direct resource links
+can load the application; keep `/api`, `/auth`, and health requests on their existing
+server handlers.
+
+Browser-session and PKCE-flow identities are bound to the configured issuer and client
+ID. Changing either invalidates existing browser cookies and in-progress sign-ins;
+users must authenticate again under the new identity configuration.
+
+The database block uses camel-case keys; server-level keys use snake case:
+
+```json
+{
+  "database": {
+    "connectionVariable": "COLOSSUS_CONTROL_PLANE_DATABASE",
+    "schema": "colossus_control_plane",
+    "tls": { "kind": "webpki_roots" },
+    "maxConnections": 16,
+    "connectionTimeoutMs": 5000,
+    "statementTimeoutMs": 15000
+  },
+  "auth_key_variable": "COLOSSUS_CONTROL_PLANE_AUTH_KEY",
+  "maintenance": {
+    "batchLimit": 256,
+    "deliveredOutboxRetentionSeconds": 86400
+  }
+}
+```
+
+Supply a PostgreSQL connection URL in `COLOSSUS_CONTROL_PLANE_DATABASE`; the configuration
+contains only its environment-variable name. `webpki_roots` verifies the database
+hostname and certificate chain. For a private CA, use
+`{"kind":"custom_ca","caPemPath":"/etc/colossus/tls/database-ca.pem"}` and add that
+PEM file to the mounted TLS Secret. Production rejects disabled database TLS.
+
+Generate a separate random 32-byte hex OIDC-flow encryption key and store it in a
+protected file for Secret creation. All replicas must receive the same key. This key
+protects the PKCE/nonce sign-in flow stored in PostgreSQL; it is independent of runtime
+journal encryption and machine certificate keys.
+
+```sh
+kubectl create namespace colossus
+kubectl -n colossus create secret generic colossus-control-plane-state \
+  --from-file=database=/secure/cloud/database-url \
+  --from-file=auth-key=/secure/cloud/auth-key \
+  --from-file=bootstrap-password=/secure/cloud/bootstrap-password
+kubectl -n colossus create secret generic colossus-control-plane-oidc \
+  --from-file=client-secret=/secure/cloud/oidc-client-secret
+kubectl -n colossus create secret generic colossus-control-plane-tls \
+  --from-file=ca.pem=/secure/cloud/ca.pem \
+  --from-file=ca-key.pem=/secure/cloud/ca-key.pem \
+  --from-file=server.pem=/secure/cloud/server.pem \
+  --from-file=server-key.pem=/secure/cloud/server-key.pem
+kubectl -n colossus create secret tls colossus-browser-tls \
+  --cert=/secure/cloud/browser.pem --key=/secure/cloud/browser-key.pem
+kubectl apply -k deploy/control-plane/kubernetes
+kubectl -n colossus rollout status deployment/colossus-control-plane
+```
+
+The deployment has two replicas, rolling updates and a disruption budget. Each
+replica uses a bounded asynchronous database pool plus one notification-listener
+connection: with the default pool, allow up to 34 database connections for two
+steady-state replicas and 51 while a third pod rolls in. Reserve capacity for backup,
+monitoring and administration. Change the pool or replica count only with measured
+connection and event-rate budgets.
+
+Browser sessions, encrypted OIDC flows, durable commands and runtime ownership leases
+are shared in PostgreSQL. Connection fencing prevents a previous replica from committing
+runtime updates after a replacement obtains ownership. The service applies checksummed
+SQL migrations under a schema-specific advisory lock; independent replicas can start
+together. Changed migration SQL fails startup instead of silently changing the schema.
+The cloud deployment needs no journal anchor PVC. Its history and operational state
+live in PostgreSQL; runtime journals remain local to their runtimes.
+
+Browser HTTPS terminates at the trusted ingress. The separate runtime hostname on
+port 443 passes TCP/TLS through to port 8443, preserving HTTP/2 and client certificates.
+The runtime server leaf must cover that hostname and chain to the configured connector
+CA. The ingress example uses ingress-nginx's
+[SSL passthrough](https://kubernetes.github.io/ingress-nginx/user-guide/tls/#ssl-passthrough);
+enable its controller flag or use your environment's equivalent TCP forwarding.
+Keep browser SSE buffering disabled. `/health/live` reports the server process;
+`/health/ready` probes the database. SIGTERM closes streams and drains the server so
+connectors can reconnect and resume from committed cursors.
+
+Coordinate auth-key rotation across all replicas. An in-progress sign-in encrypted
+with an old key must restart after rotation; existing browser sessions use independent
+hashed identities in PostgreSQL. Preserve the configured connector CA and enrollment
+records when rolling the control plane. Pooling and replicas provide concurrency
+mechanisms; deployment fleet capacity still needs a representative load measurement.
+
+Home and project analytics show daily run activity for the last 7, 30, or 90 days.
+The line chart and its accessible data table use the same retained UTC daily buckets;
+tooltips show actual counts. Active runs and queued work show current state regardless
+of the selected period. Failed runs describe execution outcomes, not policy violations.
+
+## Configure deployment markings and monitor policy
+
+A global administrator can configure a plain-text classification banner in
+**Administration → Settings**, including tone and top or top-and-bottom placement.
+The optional `classification` server configuration seeds the marking only when no
+saved display setting exists; subsequent administrator edits survive restarts. The
+marking is visible on sign-in and authenticated screens and does not enforce data
+classification or change native permissions.
+
+An agent's **Policy** view shows bounded configuration released by that authenticated
+runtime: access profile, sandbox, approval mode, grant roles/tools, configured model
+labels, and a metadata fingerprint. Fresh observations are runtime-reported, not
+independent attestation. Older or disconnected observations are marked stale.
+Project administrators can set a monitoring baseline for sandbox profile, approval
+modes, and tool ceiling; differences are shown as drift without changing the runtime's
+local enforcement. Missing canonical denial/approval counters are unavailable, and
+failed runs are not treated as policy violations.
+
+Desktop's global **Control Plane** settings manage named endpoint profiles and show
+workspace connections. Selecting a profile only pre-fills its endpoint. Enrollment,
+local sharing, and grant confirmation remain explicit per workspace.
+
+## Migrate an existing cloud journal
+
+Use the explicit offline importer when upgrading a control plane that used the old
+cloud journal adapter. Ordinary server startup accepts the new database configuration;
+it does not reinterpret an old `storage` or `signing_key_variable` block. Runtime
+journals are outside this migration and remain untouched.
+
+1. Stop every old and new cloud-server replica. Connectors can disconnect while
+   accepted work continues locally. Freeze the legacy cloud source for the entire
+   import; do not run the old server against it during migration.
+2. Take an independently restorable source backup. For protected journal storage,
+   preserve its encryption/signing references and secure anchor with its database or
+   files. Keep the old configuration and image available for reconciliation.
+3. Prepare `CONFIG.json` with the new `database` block and independent
+   `auth_key_variable`. Preserve projects, memberships, browser origin, runtime endpoint
+   and certificate authority. The destination must be an empty cloud store. When the
+   legacy source uses PostgreSQL, use a different destination schema, such as
+   `colossus_cloud_v2`; never import into the legacy journal schema.
+4. Supply both configurations' credential references through the protected environment
+   and run the installed server's migration command:
+
+   ```sh
+   colossus-cloud-server migrate-journal /secure/cloud/LEGACY_CONFIG.json \
+     /secure/cloud/CONFIG.json
+   ```
+
+5. Wait for successful completion before starting any cloud replica. If interrupted,
+   rerun the same command against the same frozen source and destination. Import progress
+   is bound to the verified source head/hash and resumes with the same entity revisions,
+   task/run IDs, command identities, receipts and event cursors. A changed source is not
+   a valid retry. Normal startup fails closed while an import marker is incomplete;
+   do not remove the marker manually to bypass recovery.
+6. Update the deployment's configuration and Secrets, then apply the new manifests and
+   verify readiness. Sign in again, reconnect the original agents and compare original
+   task/run IDs, receipts, retained event sequences and thread history. New metadata and
+   thread projections can advance record revisions; they preserve accepted native run
+   identities and the imported canonical events.
+
+Keep the legacy backup and anchor after verification. The new deployment removes the
+anchor volume from its pod specification; applying it does not delete an existing PVC.
+Retire the old PVC and journal/signing Secrets only under your backup-retention policy.
+Rollback is straightforward before new cloud mutations are accepted. After cutover,
+reconcile newly accepted work on its original runtime before returning to an older cloud
+snapshot; the legacy source cannot contain those later commands.
+
+## Enroll a CLI daemon
+
+Start an existing configured worker with an owner-private public API directory.
+Stop it briefly to enroll a dedicated application using the same directory and
+configuration, then restart it. Offline enrollment refuses another active owner.
+
+```sh
+colossus --workspace /work/project --config /secure/runtime.yaml worker \
+  --public-api-dir /secure/runtime-api \
+  --enroll-application app:colossus-cloud-cli \
+  --scope runs:execute --scope runs:read --scope runs:control \
+  --scope prompts:respond --scope approvals:respond \
+  --role primary --tool user.ask --tool filesystem.read \
+  --credential-keyring-service dev.colossus.cloud \
+  --credential-keyring-account engineering
+colossus --workspace /work/project --config /secure/runtime.yaml worker \
+  --public-api-dir /secure/runtime-api
+```
+
+Choose tools and roles explicitly beneath the runtime's existing ceilings. The native
+credential store receives the bearer directly; enrollment output contains public metadata
+only. Public API administration is supported on Windows, macOS and Linux with their
+native owner-private directory checks.
+
+Create an owner-private `connector.json` containing only public paths, pins and native
+credential references. Use the exact values returned by local application enrollment:
+
+```json
+{
+  "descriptor": "/secure/runtime-api/endpoint.json",
+  "certificate": "/secure/runtime-api/certificate.pem",
+  "instance_id": "replace-with-enrolled-local-instance",
+  "certificate_sha256": "replace-with-exact-64-character-local-pin",
+  "keyring_service": "dev.colossus.cloud",
+  "keyring_account": "engineering"
+}
+```
+
+Sign into the web app, select the project, open **Fleet**, and create an
+invitation with the reviewed label and role ceiling. On the runtime machine, run:
+
+```sh
+colossus control-plane enroll --local-config /secure/connector.json \
+  --enrollment-url https://colossus.example.com/api/enroll --name engineering
+colossus control-plane run --local-config /secure/connector.json --name engineering
+```
+
+In another terminal, inspect or stop that exact named CLI connection:
+
+```sh
+colossus control-plane status --name engineering
+colossus control-plane disconnect --name engineering
+colossus control-plane revoke --name engineering
+```
+
+Status reports a bounded, owner-private, non-secret heartbeat independently of the
+encrypted credential vault. A stale running heartbeat is reported as `unknown`.
+Disconnect requests are bound to one connector process generation; an old request
+cannot stop a later connection. Revocation disconnects first, then uses the native
+client certificate to revoke only its own enrolled node. Retry a failed revocation
+with the same enrollment; forgetting credentials alone does not revoke cloud authority.
+
+Paste the invitation into the stdin prompt. It expires after ten minutes and is consumed
+once. The connector generates and retains its private key locally. Enrollment binds the
+cloud node to the independently verified local instance. The separate `colossus-connector`
+binary accepts the same commands without the `control-plane` prefix. The former
+`colossus cloud` command remains an alias for existing scripts.
+
+## Enroll Desktop
+
+Select a Managed Local workspace and open its **Control Plane** settings. Paste the web
+invitation and enrollment URL, then review the native confirmation showing the cloud
+origin and execution/approval authority. Desktop uses a separate native-held application
+credential; the renderer receives connection status and public identities only.
+External daemon targets use their separately enrolled CLI connector.
+
+Desktop can disconnect, reconnect, revoke, and forget its enrollment. Closing the cloud
+connection leaves accepted tasks running locally. Removing a local enrollment does
+not revoke it remotely. Use **Revoke enrollment** in Desktop or **Revoke agent** in
+the web fleet to remove cloud authority. Desktop revocation requires native confirmation.
+
+## Operate hosts, threads and tasks
+
+**Fleet** groups hosts, their independently enrolled agents, and workspace identities.
+A host is an opaque native-installation identity retained under `COLOSSUS_HOME`; it is
+not derived from a machine identifier or a filesystem path. Desktop workspaces using
+the same home share a host group. CLI deployments with separate homes remain separate
+host groups even when they run on the same computer. Grouping grants no additional
+access: every agent keeps its own application grant and project enrollment.
+
+Open a host, then an agent to see its **Threads**. Start a cloud conversation or open
+saved history. A thread stays assigned to its agent and workspace. Each submitted
+human message creates an ordered task/run; **Tasks** shows execution requests across
+the project's agents and opens their associated conversations. Queue acceptance is
+separate from the runtime's receipt. The first turn must establish its native session
+before a follow-up can be submitted.
+
+Thread output streams through durable ingestion and browser SSE. Reconnection resumes
+from committed cursors. Saved messages remain readable when the agent is offline; new
+messages in an established conversation queue for that agent to reconnect. The UI marks
+incomplete history and output limits explicitly and offers older history pages. Rename
+and archive require `control`; message submission requires `execute`. Archive changes
+conversation visibility and does not cancel accepted work.
+
+Released session-activity excerpts can be bounded by the runtime, including its 64 KiB
+text limit. The UI marks bounded history; it does not promise that every omitted byte
+will backfill. Continuation uses the agent's canonical native session context rather
+than rebuilding context from the cloud's excerpts.
+
+Local sessions stay private by default. In Desktop's **Control Plane** settings, choose
+**Share Desktop history for viewing** or **Share history and allow continuation** and
+save **Desktop conversation sharing**. Enabling sharing requires native confirmation.
+Sharing includes the source application's existing and future sessions in that
+workspace. Disabling sharing stops future synchronization and continuation; already
+synchronized cloud history remains retained.
+
+For a CLI deployment, use the source application's protected connection configuration,
+not the cloud recipient's bearer. The source caller must have `runs:read` and
+`runs:control`, and `runs:execute` when allowing continuation. The recipient must be a
+separately enrolled application on that runtime:
+
+```sh
+colossus control-plane share-workspace --local-config /secure/source-application.json \
+  --recipient-application-id app:colossus-cloud-cli
+colossus control-plane share-workspace --local-config /secure/source-application.json \
+  --recipient-application-id app:colossus-cloud-cli --allow-continuation
+colossus control-plane share-workspace --local-config /secure/source-application.json \
+  --recipient-application-id app:colossus-cloud-cli --disable
+```
+
+The first command shares history for viewing; the second also allows new recipient-owned
+runs to continue the source conversation under the recipient's own grant. Imported
+source runs remain read-only: they cannot inherit approval or cancellation authority.
+The cloud cannot inspect arbitrary local applications or grant itself sharing access.
+
+## Install and supervise runtime connections
+
+CLI and standalone connectors use the same outbound protocol on Windows, macOS and
+Linux. Use the platform's native credential authority for interactive installations:
+Windows Credential Manager, macOS Keychain, or Linux Secret Service. A graphical
+credential authority must be unlocked for enrollment, connection and rotation. Use
+the explicit sealed headless authority below for unattended hosts that lack one.
+
+Run the daemon and connector as the same selected operating-system user, with distinct
+process lifetimes. On Linux, supervise both with systemd; on macOS, use launchd;
+on Windows, use your service supervisor or Task Scheduler. Preserve the configured
+owner-private runtime and Colossus home directories across restarts. Select the exact
+enrollment name and local configuration in the connector's supervised command. Inject
+headless wrapping keys through the supervisor's protected secret environment.
+
+For concurrent CLI connectors, give each daemon/connector pair its own owner-private
+`COLOSSUS_HOME`. A native vault retains one process's exclusive lease while the
+connector is running; named enrollments in one home are selected serially. Desktop
+shares its native vault within the application and can connect multiple workspaces.
+
+Use `cloud disconnect` or Ctrl-C for graceful connector shutdown. This leaves the
+daemon and accepted runs alive. Stop the worker separately with its normal graceful
+shutdown when ending local execution. Revoke before uninstalling a enrolled connector,
+then use `cloud forget` to delete its native enrollment. Desktop's embedded connector
+and Managed Local runtime end when Desktop exits; persistent execution requires a
+separately supervised CLI daemon.
+
+Linux Desktop is distributed as an unsigned Developer Preview `.deb` for Debian 12
+compatible systems, in native x86-64 and ARM64 builds. Verify the accompanying SHA-256
+checksum and install the package with your distribution's package manager. It includes
+sealed sidecar, CLI and search executables and requires GTK 3, WebKitGTK 4.1, Secret
+Service and ALSA. A running unlocked Secret Service is required for native credentials.
+Launch `colossus-desktop` or the desktop menu entry. Revoke enrolled workspaces before
+removing the package. User workspace state remains in the configured Colossus home.
+
+## Use an explicit headless authority
+
+Linux servers without Secret Service can inject an operator-owned random 32-byte hex
+wrapping key through a secret manager. Set the worker's
+`--public-api-vault-key-variable COLOSSUS_HEADLESS_KEY` for both offline enrollment and
+normal hosting. Its public API credentials are sealed beneath the public API directory's
+`headless-credentials` child. Add the non-secret selector to `connector.json`:
+
+```json
+{
+  "headless_authority": {
+    "directory": "/secure/runtime-api/headless-credentials",
+    "key_variable": "COLOSSUS_HEADLESS_KEY"
+  }
+}
+```
+
+Retain all the earlier connector fields. Supply
+`--vault-key-variable COLOSSUS_HEADLESS_KEY` to connector enrollment and lifecycle
+commands. The injected key protects the vault's small key envelope; the daemon bearer
+and connector TLS private key remain sealed on disk. There is no fallback to plaintext
+or another credential store when that authority is missing or changed.
+
+## Back up and restore the cloud database
+
+Use your PostgreSQL platform's encrypted backups and point-in-time recovery. Retain
+cloud certificate CA material, server keys, the OIDC configuration and flow key in your
+secret-management backup; database snapshots alone do not restore these credentials.
+Runtime journals and native connector vaults need their own existing backup policy.
+
+For a portable logical backup, configure a protected libpq service and password file
+with verified TLS. The commands below use the example `colossus_cloud` schema and keep
+connection passwords out of command arguments:
+
+```sh
+umask 077
+pg_dump --dbname='service=colossus-cloud-backup' --format=custom \
+  --schema=colossus_cloud --file=/secure/backups/colossus-cloud.dump
+pg_restore --list /secure/backups/colossus-cloud.dump
+```
+
+Protect exported dumps with your backup system's encryption and access controls.
+
+Retained entities and events have per-resource audit hashes. These detect changed
+retained content, but an administrator can replace the database and its hashes together.
+They do not reproduce the runtime journal's independent secure-anchor rollback protection.
+Retain audit head checkpoints in an independently protected archive. For an exact
+checkpoint alongside a logical backup, pause cloud writers by scaling its deployment to
+zero, take the dump, and export the retained audit heads before restarting:
+
+```sh
+kubectl -n colossus scale deployment/colossus-control-plane --replicas=0
+pg_dump --dbname='service=colossus-cloud-backup' --format=custom \
+  --schema=colossus_cloud --file=/secure/backups/colossus-cloud.dump
+psql --dbname='service=colossus-cloud-backup' --set=ON_ERROR_STOP=1 \
+  --command='COPY (SELECT DISTINCT ON (project_id,entity_kind,parent_id,id) project_id,entity_kind,parent_id,id,revision,chain_hash FROM colossus_cloud.cloud_audit ORDER BY project_id,entity_kind,parent_id,id,revision DESC) TO STDOUT WITH CSV HEADER' \
+  > /secure/backups/colossus-cloud-audit-heads.csv
+kubectl -n colossus scale deployment/colossus-control-plane --replicas=2
+kubectl -n colossus rollout status deployment/colossus-control-plane
+```
+
+Accepted runtime work continues while cloud writers are paused. Protect or sign the
+export with your independent archive process; keeping it in the same mutable database
+is not an independent checkpoint.
+
+Restore first into an empty isolated database owned by the cloud role. Use a separate
+protected service reference and the same schema name:
+
+```sh
+pg_restore --dbname='service=colossus-cloud-restore' --single-transaction \
+  --exit-on-error --no-owner /secure/backups/colossus-cloud.dump
+```
+
+Verify migration checksums, enrollment/revocation records, task/run identities, receipts,
+sync cursors and audit heads against the archived checkpoint. Before production cutover,
+stop all cloud replicas, update their database Secret and restore the matching secret
+material. Reconcile certificate renewals and revocations newer than the backup, then
+restart and verify original-agent replay. A database restored to an earlier point may
+not contain later accepted commands; inspect the original runtime outcomes before
+resubmission. Keep an independently restorable pre-cutover backup.
+
+Operational maintenance runs each minute in bounded batches of 256 records per
+collection. It republishes pending project wakeup hints and marks them delivered,
+retains published outbox metadata for one day, and removes expired browser sessions
+and consumed expired OIDC flows. These hints carry project identities only; duplicate
+notifications are safe because readers reload durable state from their cursors.
+Pending hints are coalesced per project. Import and maintenance markers have no expiry
+and remain retained. The optional `maintenance` block accepts `batchLimit` from 1 to
+1024 and `deliveredOutboxRetentionSeconds` from 60 to 2592000 seconds. These settings
+change operational metadata cleanup, while conversation retention remains explicit.
+
+Archiving a thread retains its messages and runs. Maintenance leaves canonical events,
+messages, tasks, receipts, cursors and audit records intact. Establish project retention
+periods and independently retained audit checkpoints before adding a schema-aware cleanup procedure. Do not prune
+`released_events`, sync cursors, receipts, audit heads or pending outbox rows independently;
+they jointly establish replay and reconciliation. Database access and backup retention
+must reflect the sensitivity of released conversation content.
+
+## Verify and recover
+
+The fleet shows host/workspace inventory and a ready agent after its authenticated
+heartbeat. Start a short thread, verify live output and its terminal state, send a
+follow-up, then reopen saved history with the agent offline. Verify pending prompts,
+approvals and cancellation with their exact runtime receipts.
+Approval requires the independent project `approve` permission plus the native local
+grant. Cancellation and ordinary prompt responses require `control`.
+
+Connector certificates last thirty days and renew with a new key at seven days
+remaining. `colossus control-plane renew --name engineering` explicitly rotates a certificate;
+use the same native vault selector for headless deployments. Interrupted enrollment and
+renewal retain their exact pending exchange for retry. Expired or revoked enrollment
+requires operator reconciliation or a new reviewed invitation.
+
+Cloud and connector restarts replay the same task/run allocation and exclusive durable
+output cursor. Disconnection never moves accepted work to another machine. An unknown
+outcome stays explicit; inspect the original local run before deciding whether to submit
+new work. Never automatically retry it with a fresh task identity.
+
+Each node admits sixteen active tasks. Each task retains at most 1,000,000 output events and
+256 MiB of released output. Reaching that bound marks the web task explicitly and switches
+to snapshot/control updates; full runtime output remains local. Sessions are bounded by
+the verified ID-token expiry and eight hours; sign in again to resume observation.
+
+Cloud sandbox provisioning, artifact/context transfer and scheduled cloud workflows
+require separate ownership contracts. Existing local sandbox and policy behavior still
+applies to every task. Source and acceptance commands are in
+[cloud development](../develop/cloud-control-plane.md).
diff --git a/docs/admin/documentation-hosting.md b/docs/admin/documentation-hosting.md
new file mode 100644
index 000000000..a1b0ef56e
--- /dev/null
+++ b/docs/admin/documentation-hosting.md
@@ -0,0 +1,90 @@
+---
+title: Host public documentation
+description: Serve the release-matched Colossus documentation and search beside an on-prem Control Plane.
+audience: operator
+type: how-to
+---
+
+# Host public documentation
+
+The Control Plane Kubernetes template serves public documentation at
+`https://colossus.example.com/docs/`. The documentation image contains the same
+canonical Zensical pages, local search index, diagrams, and compatibility redirects
+as its source release. It runs separately from the Control Plane and needs no
+database, account, credentials, or persistent volume.
+
+## Deploy with the Control Plane
+
+Follow [Control Plane deployment](cloud-control-plane.md#deploy-on-kubernetes) and
+select both images in `deploy/control-plane/kubernetes/kustomization.yaml`:
+
+- `ghcr.io/obscuritylabs/colossus-control-plane:TAG`
+- `ghcr.io/obscuritylabs/colossus-documentation:TAG`
+
+Use the same reviewed stable or preview source tag for both, or pin their published
+digests. Wait for the documentation candidate and publication workflows to succeed;
+the source checkout alone does not establish that a registry image exists. On first
+GHCR publication, verify public package visibility and an anonymous pull of its
+published digest before advertising the image. Replace the example browser hostname
+and supply its TLS Secret. The browser
+Ingress routes `/docs` to the documentation Service and `/` to the Control Plane;
+keep `/docs/` intact and do not add a path rewrite. The same browser certificate covers
+both applications. A separate hostname can route its `/docs` prefix to the same
+documentation Service.
+
+```sh
+kubectl kustomize deploy/control-plane/kubernetes
+kubectl apply -k deploy/control-plane/kubernetes
+kubectl -n colossus rollout status deployment/colossus-documentation
+curl --fail https://colossus.example.com/docs/
+curl --fail https://colossus.example.com/docs/admin/cloud-control-plane/
+curl --fail https://colossus.example.com/docs/search.json
+```
+
+The documentation deployment has two replicas and a disruption budget. It runs as
+UID/GID 10001, drops all capabilities, disables privilege escalation and service-account
+tokens, uses a read-only root filesystem, and mounts only a bounded temporary directory.
+Readiness reads the actual generated homepage; liveness checks the static server.
+GET and HEAD are supported. Missing pages retain HTTP 404 responses.
+
+## Browse and search
+
+The Control Plane rail's **Documentation** link opens `/docs/` in a new tab. Sign-in
+is not required for these published pages. The site's search runs in the reader's
+browser and uses the local `/docs/search.json` index; fonts, scripts and diagrams
+are bundled rather than loaded from a public CDN.
+
+Agents with independently authorized HTTP access can read the same page URLs and
+search index. Each index item contains a title, relative `location`, and searchable
+page text. Resolve locations against the `/docs/` base, retaining any fragment.
+For example, `admin/cloud-control-plane/#deploy-on-kubernetes` resolves under
+`https://colossus.example.com/docs/`. This is public static documentation, not a new
+runtime tool or a permission grant. Native runtime network policy still applies.
+
+An installation that serves documentation elsewhere can select the rail destination
+when building the web image with `VITE_COLOSSUS_DOCUMENTATION_URL`. HTTP(S) URLs and
+same-origin root-relative paths are supported; invalid values fall back to `/docs/`.
+See the [source build commands](../develop/documentation.md#build-the-on-prem-documentation-image).
+
+## Verify and update
+
+Open a direct page URL, search for a documented command, and follow a result. Verify
+that navigation stays on your documentation origin beneath `/docs/`, and inspect
+the browser for missing assets. Legacy routes such as `/docs/GETTING_STARTED.html`
+redirect to the corresponding local page, preserving supported anchors.
+
+To inspect an image before Kubernetes deployment:
+
+```sh
+docker run --rm --read-only --user 10001:10001 --cap-drop ALL \
+  --security-opt no-new-privileges \
+  --tmpfs /tmp:rw,noexec,nosuid,size=16m,mode=1777 \
+  --publish 127.0.0.1:8081:8080 \
+  ghcr.io/obscuritylabs/colossus-documentation:TAG
+```
+
+Open `http://127.0.0.1:8081/docs/`. Update the documentation image together with its
+Control Plane release; the static service can roll independently. If a page fails,
+check the selected image, `/docs` Ingress backend and unmodified prefix first. Restore
+the previous known image digest to roll back. Public documentation does not require
+access to application authentication, runtime enrollments, or database backups.
diff --git a/docs/develop/adr/0006-cloud-control-plane.md b/docs/develop/adr/0006-cloud-control-plane.md
new file mode 100644
index 000000000..7f168b125
--- /dev/null
+++ b/docs/develop/adr/0006-cloud-control-plane.md
@@ -0,0 +1,142 @@
+---
+title: "ADR 0006: Cloud control plane and outbound connections"
+description: Cloud protocol, project authority, enrollment trust, native grants, lifecycle and durable recovery decisions.
+audience: developer
+type: concept
+---
+
+# ADR 0006: Cloud control plane and outbound connections
+
+- Status: accepted
+- Date: 2026-10-05
+
+## Context
+
+Workstations and independently supervised daemons must accept cloud work behind NAT
+without exposing the runtime's loopback API. A browser cannot hold runtime credentials
+or inherit the Desktop caller's authority. Stream reconnection alone does not establish
+whether a mutation was accepted or whether output was retained durably.
+
+Fleet inventories and long-lived conversations need indexed project, host, workspace
+and history queries. Independent agents must commit their events concurrently without
+a cloud-wide journal head. Cloud metadata, connection ownership and browser sessions
+need their own lifecycle, while native execution journals retain their separate
+recovery boundary. Host grouping must not disclose unrelated applications' sessions.
+
+## Decision
+
+Use a separate cloud application and a reusable native connector. `colossus-cloud`
+owns project/host/agent/workspace/thread operations and a cloud-owned asynchronous
+storage port. `colossus-cloud-postgres` implements that port with Diesel/diesel-async,
+a bounded pool and an independent relational PostgreSQL schema. `colossus-cloud-server`
+composes OIDC, HTTP/JSON, SSE and certificate issuance. Cloud storage does not implement
+the runtime journal port; local runtime journals retain their existing protections.
+`colossus-cloud-protocol` owns a separate major-versioned Protobuf bidirectional stream
+with closed typed SDK operations. `colossus-connector` implements enrollment and the
+outbound stream for CLI, standalone and native Desktop hosts.
+
+Browser authentication uses OIDC authorization code with PKCE, verified issuer,
+audience, signature, nonce, expiry and access-token hash. Explicit subject/project
+memberships grant independent read, execution, control, approval and administration
+permissions. Opaque browser sessions use protected cookies and same-origin CSRF checks.
+Configured memberships form an authority ceiling and reconcile changed/removed persisted
+grants at startup. Every request intersects local configuration with database permissions;
+replicas share one configuration. Browser-session and PKCE-flow identities bind the issuer
+and client namespace so an identity-provider/client change cannot reuse old cookies.
+Browser code receives released views and one-use invitations, never native bearers,
+provider keys or machine private keys.
+
+Machine connections use mutual TLS 1.3 over HTTP/2, normally on port 443. Kubernetes
+connector ingress preserves end-to-end TLS. One-use, expiring invitation redemption
+binds a node to one project, independently verified local runtime instance and signed
+CSR. Certificate renewal persists its identity and CSR before exchange, reconciles a
+lost reply and atomically replaces the host fingerprint. Revocation is durable and
+rechecked during active connections. Certificate authority and connector keys are
+Ed25519 and remain native/operator-held.
+
+Each connector authenticates the pinned local public API as a dedicated enrolled
+application. Native Desktop bootstrap provisions separate primary, approval-broker and
+connector grants, delivered and activated atomically. Cloud roles intersect immutable
+local roles, scopes and tool ceilings. Runtime policy, audit, approvals, sandboxing,
+effect recovery and output release remain runtime-owned. No private worker RPC,
+arbitrary filesystem/network tunnel or generic renderer capability crosses this boundary.
+
+Allocate each task to one node and one local run, with caller/project-scoped stable
+idempotency keys and durable command receipts. Persist allocation, receipt and event
+cursor changes atomically with per-resource audit and delivery-outbox records before
+acknowledging them. Entity revisions and per-feed ordering allow independent resources
+to progress without a cloud-wide journal-head lock.
+Exact retries reconcile existing state; changed duplicates and cursor gaps fail.
+Unknown outcomes stay explicit and retain their admission slot. They never cause
+automatic execution on another node.
+
+Group native-installation hosts, independently enrolled runtime agents and workspace
+identities without changing authority. A durable thread maps to one runtime and native
+session. Human turns allocate ordered immutable tasks/runs; cloud owns thread metadata
+and the queue while the runtime owns execution and released content. Default discovery
+contains only the connector application's own runs. Existing local sessions require
+explicit source-application workspace sharing. Imported source runs remain read-only;
+shared continuation creates recipient-owned runs beneath that recipient's native grant.
+Disabling sharing stops future release and continuation while retained cloud history
+remains available for authorized offline reads.
+
+Store browser sessions and encrypted OIDC sign-in flows in PostgreSQL so callback and
+browser requests may reach different replicas. All replicas share an independent
+OIDC-flow envelope key. Bind each runtime connection to an expiring database lease and
+monotonic fencing generation; validate that lease within runtime-output transactions.
+A replaced replica cannot commit under its earlier generation. PostgreSQL notifications
+wake consumers, while durable outbox/state reads and cursors establish recovery.
+
+Apply checksummed schema migrations transactionally under a schema-specific advisory
+lock. Ordinary cloud writes do not acquire that migration lock. Retained entity/event
+audit chains detect changed retained content, but do not protect against replacement,
+deletion or rollback of the database and its hashes together. Independent audit-head
+checkpoints, restricted database roles, encrypted backups and tested restore procedures
+are operator requirements; the cloud deployment does not retain a journal-anchor PVC.
+
+Output resumes after the highest contiguous acknowledged sequence. Bound frames,
+queued messages, active tasks, retained events and bytes, and connection/request
+timeouts. Reaching retention limits is explicit; the exact run's snapshots and controls
+continue. HTTP mutations acknowledge durable queuing; the UI checks runtime receipts
+before confirming an approval response or cancellation. Shutdown drains for a bounded
+period. Disconnecting a connector does not cancel accepted work.
+
+Channel startup has a ten-second deadline across TCP, TLS and HTTP/2, including
+certificate renewal and revocation. Opening stream response headers and receiving its
+first welcome have separate ten-second deadlines; an established stream remains live
+under heartbeat and backpressure bounds. An authenticated peer withholding HTTP/2
+progress must return the same connector to bounded retry without changing run identity.
+
+Before connecting and every five-second heartbeat, the connector probes the local
+runtime's authenticated caller-scoped read API with a three-second deadline and a
+one-item page. It discards the page locally. An open SDK client alone does not establish
+daemon readiness: unavailable or stalled local service closes the cloud stream and
+returns to bounded reconnect, retaining the same enrollment and accepted work.
+
+Desktop-managed sidecars stop with Desktop. Persistent work uses an independently
+supervised daemon and connector under one explicitly chosen OS-user identity. Windows
+uses protected discovery and native credentials; macOS uses Keychain; graphical Linux
+uses Secret Service and native GTK credential entry. Headless Linux explicitly injects
+a wrapping-key authority and stores only authenticated encrypted envelopes. Missing,
+changed or unavailable authority fails closed.
+
+## Consequences
+
+The web frontend reuses React/TypeScript and shared shadcn-based Colossus UI. Kubernetes manifests and
+portable container images avoid a cloud-provider dependency. Linux Desktop preview
+packages bind the sealed executable manifest into the running ELF and verify every
+bundled executable digest. They report unsigned distribution accurately and do not
+advertise a stable automatic update channel.
+
+The OpenID Connect dependency brings `rsa`, affected by
+[RUSTSEC-2023-0071](https://rustsec.org/advisories/RUSTSEC-2023-0071.html). The advisory
+concerns private-key timing leakage. Colossus uses this dependency only to verify
+provider signatures with public keys; it has no RSA private-key signing or decryption
+path. Keep the exact documented supply-chain exception limited to that use and remove
+it when the dependency no longer contains the affected version. Adding any RSA
+private-key operation requires revisiting this decision and exception.
+
+Sandbox provisioning, scheduling and cloud artifact/context transfer remain separate
+extensions. Registered fleet size and replica count are not capacity evidence;
+representative concurrent stream, history-query and failover measurements are required. See [cloud development](../cloud-control-plane.md)
+and [operations](../../admin/cloud-control-plane.md) for current setup and acceptance.
diff --git a/docs/develop/adr/index.md b/docs/develop/adr/index.md
index 20b4ebff7..6063844e0 100644
--- a/docs/develop/adr/index.md
+++ b/docs/develop/adr/index.md
@@ -15,6 +15,7 @@ not duplicate current configuration or operator procedures.
 - [ADR 0003: Desktop browser boundary](0003-desktop-browser-boundary.md)
 - [ADR 0004: Desktop Git inspection](0004-desktop-git-inspection.md)
 - [ADR 0005: Desktop file search and diffs](0005-desktop-file-diffs.md)
+- [ADR 0006: Cloud control plane and outbound connections](0006-cloud-control-plane.md)
 
 Use the next sequential number. Record context, decision, consequences, status, and the
 date; link to canonical current documentation rather than copying it.
diff --git a/docs/develop/application-sdk.md b/docs/develop/application-sdk.md
index d673eca09..9b5504284 100644
--- a/docs/develop/application-sdk.md
+++ b/docs/develop/application-sdk.md
@@ -167,6 +167,30 @@ and enforce resource scope again inside each command. Do not add generic “run
 “read path,” “call URL,” or “invoke SDK method” commands; those would turn the WebView
 into a capability-confused deputy.
 
+## Explicit workspace conversation sharing
+
+Cloud enrollment creates an independent application grant. It does not make existing
+Desktop or CLI application conversations visible. `SetWorkspaceSharing` lets the
+authenticated source application explicitly release its own sessions in that runtime
+workspace to a named recipient application. It requires `runs:read` and `runs:control`;
+enabling continuation also requires `runs:execute`. The source owner is derived from
+authentication and cannot be selected in the request.
+
+`ListVisibleRuns` provides bounded, source-stable discovery of owned and explicitly
+shared runs. Each item carries runtime-derived `controllable` and `continuable` flags.
+Shared source runs remain read-only: their cancellation and interaction responses still
+require the original owner. Reads and live watches use only released public projections;
+revocation closes ongoing shared watches and invalidates discovery cursors. Cloud
+continuations create new recipient-owned runs using that recipient's captured scopes,
+roles, and tools. They never borrow the source application's execution grant.
+
+Managed Local exposes this opt-in in Desktop's Cloud settings with native confirmation.
+For an installed daemon, the source application can use `colossus cloud share-workspace`
+with its protected local connection configuration and the exact recipient application
+ID. `--allow-continuation` permits new recipient-owned runs; `--disable` revokes future
+disclosure. Previously synchronized cloud history is retained under cloud project
+access and retention policy.
+
 ## Managed shell inspection
 
 `AgentRunService` also exposes `ListProcessSessions`, `ReadProcessSession`, and
@@ -238,6 +262,18 @@ CodeDirectory identity to match before `SIGCONT`. On Linux, it executes the veri
 bytes from a sealed, non-writable `memfd`. Platforms without an equivalent mechanism
 fail Managed Local startup closed.
 
+Linux native startup retains only the host's local Unix D-Bus session locator after
+clearing the child's environment. The SDK accepts one filesystem or abstract Unix
+socket and verifies the bus peer's OS user before launch; it rejects remote transports,
+autolaunch, aliases, and ambiguous addresses. Without an explicit session locator it
+uses `/run/user/<uid>/bus`. This locator carries no secret. The native Secret Service
+remains required by default; missing session authority fails startup without a credential
+fallback. The explicit debug-only
+[development credential authority](security-architecture.md#development-credential-authority)
+instead forwards one validated nonsecret path to the verified child and uses its
+encrypted file custody. It does not require a Secret Service session, discover an
+alternative backend or change application grants. Release builds reject this opt-in.
+
 The selected macOS workspace is also persistent object authority rather than a saved
 path. Desktop hashes the device, inode, and birth timestamp obtained from a securely
 opened directory descriptor and includes that versioned identity in its private state
diff --git a/docs/develop/architecture.md b/docs/develop/architecture.md
index 1fd9e59ee..bdf6065b0 100644
--- a/docs/develop/architecture.md
+++ b/docs/develop/architecture.md
@@ -75,10 +75,21 @@ infrastructure adapters implement ports and are assembled only by the runtime.
 | Security and catalog | `colossus-access`, `colossus-policy`, `colossus-tools` | Capability metadata, decisions, permits, and strict tool schemas |
 | Infrastructure | `colossus-provider`, `colossus-codex-auth`, `colossus-credentials`, journal/projection crates, `colossus-sandbox`, `colossus-integrations`, `colossus-mcp`, `colossus-plugins`, `colossus-bundles`, `colossus-search` | External systems, authentication, plugin OCI/lifecycle, release bundles, and storage adapters |
 | Public API and SDK | `colossus-api-proto`, `colossus-api`, `colossus-api-runtime`, `colossus-grpc`, `colossus-sdk` | Version public resources, authenticate applications, host durable runs, and provide transport-neutral clients |
+| Control Plane application | `colossus-cloud`, `colossus-cloud-protocol`, `colossus-cloud-server`, `colossus-connector` | Project authority, durable fixed-node placement, OIDC browser access, and native outbound connections through the public SDK |
 | Composition and interfaces | `colossus-runtime`, `colossus-worker-protocol`, `colossus-worker`, `colossus-cli`, `colossus-tui`, `colossus-presentation` | Narrow private transport contracts, wire services, host application contracts, and released-data rendering |
 
 ## Boundary rules
 
+The [cloud control plane](cloud-control-plane.md) is a separate application composition.
+Its Diesel/diesel-async PostgreSQL schema and database-backed user and project authority are independent
+of runtime journals and policy. `colossus-cloud-postgres` owns pooled relational storage,
+transactional outbox/audit records, shared browser sessions and fenced connection leases.
+Host/agent/workspace grouping and thread history do not grant local execution authority.
+Each connector uses a dedicated native application grant; it cannot borrow the Desktop
+primary or approval-broker credential. Cloud roles intersect that grant and never
+expand local tool, policy, or sandbox authority. The closed remote operation set does
+not expose private worker RPC, arbitrary network forwarding, or renderer credentials.
+
 Manual Desktop credentials and platform-backed MCP OAuth share the
 `colossus-credentials` adapter. `HostSecret` (64 KiB) and `VaultRecord` (1 MiB) are
 non-serializable, zeroizing contracts. `CredentialVault` and its opaque record
@@ -198,7 +209,7 @@ commands dispatch it without receiving secret values from the renderer.
   caller-bound embedded SDK backend; they never depend on agent internals.
 - Crate roots expose a focused API or composition surface; nontrivial logic belongs in
   named modules.
-- Canonical writes append journal events. Read models and indexes are replaceable.
+- Runtime canonical writes append journal events. Runtime read models and indexes are replaceable. Cloud domain state uses independent relational transactions with audit, outbox, and source cursors.
 - Event-sourced repositories discover aggregate streams through bounded pages of the
   journal-maintained stream identifier index. Listing integrations, plugin installations, sessions,
   work, research, memory, or workflows must not rescan the global event history.
diff --git a/docs/develop/ci-cd.md b/docs/develop/ci-cd.md
index 05d5bc7fc..df5568b38 100644
--- a/docs/develop/ci-cd.md
+++ b/docs/develop/ci-cd.md
@@ -59,11 +59,11 @@ flowchart LR
 
 ## Tiers and cost ceilings
 
-| Tier | Trigger | Hosted coverage | Stable gate | Runner cost |
-|---|---|---|---|---|
-| PR validation | Open, edit, reopen, synchronize, or mark ready | Parallel standard Linux formatting, lint, unit, SDK, Desktop, documentation, and dependency jobs selected by changed paths | `Colossus PR gate` | Free standard public runners |
-| Pre-merge acceptance | Apply `ci:full` | macOS 14 ARM, Windows 2025 x64, Linux integration, bounded fuzzing, supply chain, Chroma, PostgreSQL, OCI, OPA, and mTLS | `Colossus pre-merge gate` | Larger Linux and Windows Desktop runners are billed; standard public runners are free |
-| Release | Push an annotated stable or approved prerelease tag | Six CLI targets; signed Windows CLI and Desktop; stable SDK or macOS Developer Preview | `Colossus release gate` | Larger runners are billed |
+| Tier                 | Trigger                                             | Hosted coverage                                                                                                            | Stable gate               | Runner cost                                                                           |
+| -------------------- | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------- |
+| PR validation        | Open, edit, reopen, synchronize, or mark ready      | Parallel standard Linux formatting, lint, unit, SDK, Desktop, documentation, and dependency jobs selected by changed paths | `Colossus PR gate`        | Free standard public runners                                                          |
+| Pre-merge acceptance | Apply `ci:full`                                     | macOS 14 ARM, Windows 2025 x64, Linux integration, bounded fuzzing, supply chain, Chroma, PostgreSQL, OCI, OPA, and mTLS   | `Colossus pre-merge gate` | Larger Linux and Windows Desktop runners are billed; standard public runners are free |
+| Release              | Push an annotated stable or approved prerelease tag | Six CLI targets; signed Windows CLI and Desktop; stable SDK or macOS Developer Preview                                     | `Colossus release gate`   | Larger runners are billed                                                             |
 
 A job timeout remains mandatory for every hosted job.
 The four-core `ubuntu-latest-m` larger runner is reserved for final Linux integration,
@@ -212,9 +212,9 @@ Apply `ci:full` only after the PR is ready to merge:
 3. Mark the PR ready for review if it is still a draft.
 4. As a repository writer, apply the label:
 
-    ```bash
-    gh pr edit PR_NUMBER --add-label ci:full
-    ```
+   ```bash
+   gh pr edit PR_NUMBER --add-label ci:full
+   ```
 
 Eligibility is checked on a cheap Linux runner before macOS or Windows is allocated. It
 rejects draft PRs, actors below write permission, and a missing or failed current-head PR
@@ -426,3 +426,32 @@ For a normal contribution, resolve review and follow
 [Request pre-merge acceptance](#request-pre-merge-acceptance). For repository rollout,
 follow [Bootstrap repository enforcement](#bootstrap-repository-enforcement) without
 skipping the evaluation run.
+
+## Control Plane and VSIX release artifacts
+
+The coordinated release gate also requires native Linux x64/arm64 Control Plane
+server/web and offline container bundles, plus six platform-targeted VSIX packages.
+`control-plane-image.yml` publishes the exact tested release images after release
+publication and verifies the two-platform index. It compares release assets against
+successful exact-tag Actions candidates before loading images; a conflicting immutable
+tag fails. See [release operations](releasing.md#control-plane-containers-and-vs-code-packages)
+for recovery and anonymous distribution verification.
+
+## Documentation container publication
+
+`documentation-candidate.yml` builds and smoke-tests the public documentation image
+on native Linux amd64 and arm64 runners. Documentation and container pull requests
+exercise the same build and HTTP smoke with their proposed source. Release candidates
+require an annotated stable or preview tag on `main`; only successful tag pushes retain
+the tested offline images and source-bound candidate manifests for 30 days. The
+candidate jobs have no registry write credentials.
+
+`documentation-image.yml` publishes after the reviewed GitHub Release is published,
+or retries an exact tag from `main`. Its contracts and publishing job use the same
+resolved protected-main publisher revision. Before any registry write, it requires
+successful exact-tag release and documentation candidate runs, verifies both retained
+image archives and source identities, and checks the published release channel. It
+refuses conflicting existing version tags and verifies the two-platform executable
+index by digest. Documentation publication is separate from the CLI release inventory;
+it adds no CLI assets. See [documentation image operations](releasing.md#documentation-container)
+for recovery and public-distribution verification.
diff --git a/docs/develop/cloud-control-plane.md b/docs/develop/cloud-control-plane.md
new file mode 100644
index 000000000..c398d232c
--- /dev/null
+++ b/docs/develop/cloud-control-plane.md
@@ -0,0 +1,299 @@
+---
+title: Develop and test Colossus Control Plane
+description: Run the real local OIDC, browser, host and runtime connection stack and its acceptance checks.
+audience: developer
+type: how-to
+---
+
+# Develop and test Colossus Control Plane
+
+The stack uses Rust/Tokio for the server and connector, React/TypeScript with shared
+shadcn-based Colossus UI for the browser, Diesel/diesel-async for the dedicated
+PostgreSQL schema, and optional named OIDC or local Argon2id authentication. `colossus-cloud` owns project authority,
+host/agent/workspace inventory, conversations, fixed-runtime tasks and the asynchronous
+`CloudStore` port. `colossus-cloud-postgres` owns SQL, pooling, migrations, indexed
+queries, transactions and replica coordination; it does not implement `EventJournal`.
+Runtime journals and their recovery adapters remain runtime-owned.
+
+Persisted users and issuer/subject identities own project membership. Optional local
+login uses bounded Argon2id work, shared database attempt limits, and session revocation
+epochs; the explicit bootstrap configuration provisions the first administrator.
+Hierarchy membership is not inherited. Global administrator read access does not
+create a runtime grant. See [operator setup](../admin/cloud-control-plane.md) for the
+production configuration and administration flow.
+
+`colossus-cloud-protocol` owns the closed versioned connection contract.
+`colossus-cloud-server` hosts HTTP/OIDC, browser SSE and end-to-end TLS 1.3 mutual-TLS
+gRPC. `colossus-connector` uses only the public SDK under a dedicated native application
+grant. Desktop embeds that connector; CLI exposes it through `control-plane` (`cloud` remains an alias), and the standalone
+binary owns the same lifecycle commands.
+
+## Run the local stack
+
+Start the disposable identity provider and PostgreSQL fixtures:
+
+```sh
+docker compose -f deploy/cloud/local/compose.yml up -d
+cargo run -p colossus-cloud-server --example init_local -- /private/tmp/colossus-cloud
+source /private/tmp/colossus-cloud/local.env
+cargo run -p colossus-cloud-server -- /private/tmp/colossus-cloud/cloud.json
+```
+
+On Linux, select an absolute owner-private path such as `/tmp/colossus-cloud`.
+The example generates a private local CA/server key, a protected `local.env` with the
+disposable database URL and a random OIDC-flow key, loopback HTTP on 8090 and mutual-TLS
+gRPC on 8443. Source that environment in the server terminal without printing its
+contents. PostgreSQL is also used locally; only deterministic unit fixtures use
+`MemoryCloudStore`. The generator refuses to overwrite an existing configuration.
+Development HTTP and disabled database TLS require explicit loopback-only configuration
+and are rejected for production endpoints.
+
+In another terminal:
+
+```sh
+npm ci --prefix apps/web --ignore-scripts --legacy-peer-deps --install-links
+npm run dev --prefix apps/web
+```
+
+Open `http://127.0.0.1:5180` and sign in as `alice` with `local-only-password`. The fixture
+realm/client and explicit subject membership match the generated local configuration.
+Those checked-in credentials exist only for this disposable loopback fixture.
+
+Generate an isolated credential-free Echo runtime:
+
+```sh
+cargo run -p colossus-cloud-server --example init_runtime -- /private/tmp/colossus-runtime
+cargo build --locked -p colossus-cli -p colossus-connector --bins
+```
+
+Follow [runtime enrollment](../admin/cloud-control-plane.md#enroll-a-cli-daemon) with
+the generated runtime config and API directory. Use `--tool echo` for the Echo fixture.
+Cloud enrollment to the loopback host additionally requires `--allow-loopback-http`.
+Start the worker and connector in separate terminals. The browser should show the
+agent and host/workspace inventory ready. Start an Echo thread, verify released output,
+and send a second turn in the same conversation. Disconnect the connector and reopen
+saved history, then reconnect and reconcile queued work on that same agent.
+
+For Desktop, prepare current verified binaries before launching the native app:
+
+```sh
+cargo xtask desktop prepare --profile debug
+npm run tauri --prefix apps/desktop -- dev -- --locked
+```
+
+Select an isolated Managed Local workspace and use its global **Control Plane** settings. Native
+confirmation, keyboard/focus behavior, and actual platform credential storage require
+an unlocked graphical desktop. Renderer fixtures do not establish those properties.
+
+Build the standalone Control Plane image from the repository root:
+
+```sh
+docker build -f deploy/control-plane/Dockerfile -t colossus-control-plane:local .
+kubectl kustomize deploy/control-plane/kubernetes
+```
+
+The default image uses the release profile. `--build-arg PROFILE=dev` builds a stripped
+debug image for local Linux acceptance. Builder/runtime images and local fixtures are
+digest pinned. Production deployment and Secret configuration belong to the
+[operator guide](../admin/cloud-control-plane.md).
+
+Run the [local documentation image](documentation.md#build-the-on-prem-documentation-image)
+on loopback port 8081 alongside the web development server. Vite forwards the default
+`/docs/` Documentation link there without a path rewrite; it serves public static
+pages and local search independently of Control Plane sign-in.
+
+Build and validate Linux Desktop in its disposable native builder:
+
+```sh
+docker build -f deploy/cloud/linux-desktop.Dockerfile --target artifacts \
+  --output type=local,dest=/tmp/colossus-linux-desktop .
+```
+
+The host architecture selects x86-64 or ARM64. This exports an unsigned Developer
+Preview Debian package and its checksum. The builder verifies the native masked
+credential dialog under an isolated Xvfb display, including validation, clipboard
+preservation and cancellation. The package seals its sidecar/CLI/search digests into
+the main ELF executable. Linux packaging also runs in the full pre-merge acceptance
+gate. A native Linux checkout with the builder's listed dependencies can use
+`COLOSSUS_DESKTOP_RELEASE_CHANNEL=developer_preview COLOSSUS_DESKTOP_TEAM_ID=UNSIGNED
+sh scripts/package-desktop-linux` after installing Desktop npm dependencies.
+
+## Work on cloud storage and synchronization
+
+The relational tables are separated by domain: project membership, host/agent/workspace
+inventory, conversation threads/messages, tasks, commands/receipts, session/run mappings,
+enrollment and certificate rotation. Indexed domain columns accompany versioned JSONB
+SDK snapshots. The cloud store commits related entity revisions, command delivery,
+released events and sync cursors with audit and outbox records in the same transaction.
+Entity compare-and-swap and per-feed ordering replace the old global journal-head lock.
+
+Lists use bounded project-scoped queries and timestamp/identifier cursors. Thread detail
+returns the latest messages in chronological order and the latest runs, with separate
+cursors for earlier pages. Source discovery remains caller-authorized through the SDK;
+cloud membership cannot disclose an unrelated local application's history.
+
+The connector advertises an opaque native-installation host identity and its workspace.
+Desktop can expose multiple independently granted workspace agents under that host.
+A cloud thread maps to a fixed node and native session; every human turn remains a
+separate immutable task/run allocation. The runtime owns execution, policy and released
+content. The cloud owns metadata, membership and the ordered submission queue. Concurrent
+human submissions and metadata changes reconcile exact revisions and idempotency keys.
+
+Local source sessions require explicit workspace sharing. Imported runs stay read-only.
+When continuation is shared, a new cloud-owned run can continue that native session under
+the connector's independent scopes, roles and tools. Disabling sharing stops future
+synchronization; it does not delete already retained cloud history.
+
+Each production replica has a bounded asynchronous pool and a dedicated PostgreSQL
+notification listener. Notifications contain project identities only and wake readers;
+all browser/event consumers reread durable records from their cursors. Notification loss
+or reconnect cannot stand in for durable acknowledgement. Browser sessions and encrypted
+OIDC flows are shared. Connection leases carry fencing generations checked within runtime
+transactions so a stale replica cannot commit output after replacement ownership.
+
+Configured legacy memberships seed audited database identities and memberships once,
+preserving their exact existing permission ceilings. Database roles are authoritative
+after migration; restart does not overwrite administrator edits. Explicitly assigning a
+built-in role replaces a legacy customized permission set with that role's exact bundle.
+Every request and SSE revalidation checks the active user, session security epoch and
+current project membership. All replicas share authentication configuration and keys.
+Session and PKCE-flow hashes bind the issuer/client namespace; changing identity
+configuration requires new browser sign-ins. Upgrade the former configuration-only
+authentication deployment with all old replicas stopped before admitting users under
+the new identity schema; do not depend on revocation enforcement across mixed versions.
+
+`CloudStore::maintain` drains coalesced project wakeup hints with `FOR UPDATE SKIP LOCKED`,
+marks publication and prunes delivered hints older than one day. Minute maintenance
+passes also remove expired browser sessions and consumed expired OIDC flows in bounded
+batches of 256 records per collection. Import/maintenance markers remain unexpired.
+The maintenance contract never deletes canonical thread/run events, messages, tasks,
+cursors or audit chains; their archive boundary requires an explicit retention design.
+
+Numbered SQL migrations under `crates/colossus-cloud-postgres/migrations` run transactionally
+at store startup under a schema-specific advisory lock. Applied checksums are persisted.
+Add a new migration for a deployed schema; do not change already applied SQL. Schema
+rollback files are destructive operator tools and are never executed by ordinary startup.
+The database and independently archived audit heads require tested restore procedures;
+[cloud operations](../admin/cloud-control-plane.md#back-up-and-restore-the-cloud-database)
+owns those steps and the credential references.
+
+The offline `migrate-journal` entry point imports the prior cloud journal into an empty
+SQL store, preserving stable task/run/command identities and source event/cursor state.
+It records a verified source marker and resumable progress; ordinary startup refuses an
+incomplete import. Keep the source frozen and target server stopped during import.
+[Operator migration](../admin/cloud-control-plane.md#migrate-an-existing-cloud-journal)
+owns the installed-binary command, source backup and production cutover sequence. This
+conversion never migrates or opens local runtime journals.
+
+## Export and verify an independent audit checkpoint
+
+The source helper under `colossus-cloud-postgres` signs metadata-only audit heads with
+a separate 32-byte Ed25519 seed. Supply a protected database-reference JSON file using
+`CloudDatabaseConfig`'s camel-case fields and an environment-variable reference for the
+connection URL. Keep `COLOSSUS_CLOUD_AUDIT_SIGNING_SEED` in your secret manager; it must
+be independent of the OIDC-flow key and runtime journal keys.
+
+```sh
+cargo run --locked -p colossus-cloud-postgres --example audit_checkpoint -- \
+  export --config /secure/cloud/database-reference.json --project engineering \
+  --audit-key-variable COLOSSUS_CLOUD_AUDIT_SIGNING_SEED \
+  --output /secure/backups/engineering-checkpoint.json
+cargo run --locked -p colossus-cloud-postgres --example audit_checkpoint -- \
+  verify-file --anchor /secure/backups/engineering-checkpoint.json \
+  --public-key INDEPENDENTLY_PINNED_PUBLIC_KEY_HEX
+cargo run --locked -p colossus-cloud-postgres --example audit_checkpoint -- \
+  verify-db --config /secure/cloud/database-reference.json \
+  --anchor /secure/backups/engineering-checkpoint.json \
+  --public-key INDEPENDENTLY_PINNED_PUBLIC_KEY_HEX
+```
+
+Export creates a new owner-private file and reports its public key, checkpoint digest
+and head count. Pin that public key through an independent trusted channel; accepting
+an arbitrary key carried by the exported file defeats the trust boundary. Archive the
+checkpoint independently of the mutable database. Offline verification rejects changed
+signed metadata or a wrong key; database verification checks retained audit chains and
+rejects revisions below the anchored heads. Checkpoints contain resource metadata and
+hashes rather than released conversation plaintext. They complement encrypted database
+backups and restore tests.
+
+The adapter's
+[source README](https://github.com/obscuritylabs/Colossus/tree/main/crates/colossus-cloud-postgres)
+owns the helper's exact configuration, maintenance and reproducible load-measurement
+commands. The running service already performs bounded operational maintenance;
+`audit_checkpoint maintain` is an explicit developer/operator diagnostic using the same
+policy and does not prune canonical history.
+
+## Acceptance and completion checks
+
+```sh
+cargo test --locked -p colossus-cloud -p colossus-cloud-protocol -p colossus-cloud-postgres
+cargo test --locked -p colossus-cloud-server --lib
+cargo test --locked -p colossus-credentials --test headless
+cargo test --locked -p colossus-sidecar --test native_lifecycle -- --ignored
+cargo xtask check web
+cargo xtask check rust
+cargo xtask check desktop
+cargo xtask check docs
+cargo xtask pr --base origin/main
+```
+
+The server acceptance owns a signed local OIDC issuer, real browser HTTP/SSE, encrypted
+native enrollment records, the production mutual-TLS transport and connector, and a
+real runtime using a deterministic credential-free model endpoint. It verifies prompt
+responses, policy-bound file-write approval, cancellation, certificate rotation, durable
+host restart, and revocation. No external model key or provider service is required.
+The native sidecar acceptance requires a usable OS credential store and loopback sockets;
+it proves independently granted cloud and Desktop callers cannot read each other's runs.
+
+The ignored `managed_sidecar_cloud_run_isolated_and_application_exit_disconnects`
+server acceptance uses `COLOSSUS_ACCEPTANCE_SIDECAR` to select a prepared native sidecar.
+It signs in through OIDC, enrolls its independently bootstrapped cloud grant, submits
+a browser HTTP task through the mutual-TLS connection, receives released native output,
+and verifies application exit disconnects cloud readiness without changing the durable
+run identity. The Linux package builder and native macOS/Windows pre-merge jobs run
+this check with the platform credential store.
+
+The operator-owned PostgreSQL variant runs the same transport/runtime/restart flow
+against the local fixture. Inject `COLOSSUS_CLOUD_TEST_DATABASE` with its connection
+URL, then run:
+
+```sh
+cargo test --locked -p colossus-cloud-server --lib postgres_oidc_to_runtime_and_recover -- --ignored
+```
+
+Each invocation owns a uniquely named `cloud_e2e_` schema in the disposable fixture
+database. Never point this acceptance command at an operator's production database.
+The lower-level database conformance uses a separate explicit reference:
+
+```sh
+cargo test --locked -p colossus-cloud-postgres --lib \
+  postgres_atomic_recovery_and_replica_conformance -- --ignored
+```
+
+Inject `COLOSSUS_CLOUD_TEST_DATABASE_URL` with the disposable fixture connection URL.
+That test owns a generated `cloud_acceptance_` schema. It verifies atomic state/event/cursor
+commits, optimistic contention, chronological pages, notification fanout, shared browser
+sessions, one-use consumption, lease fencing and changed retained-record detection.
+
+Repository tests additionally cover thread continuation and read-only session sharing,
+exact idempotent receipts, project isolation,
+contiguous output and changed-duplicate rejection, role ceilings, admission bounds,
+certificate renewal ACK reconciliation, OIDC signature/issuer/audience/nonce/expiry
+validation and CSRF. The headless acceptance runs isolated processes to prove sealed
+authority survives restart and fails closed when its wrapping key changes.
+
+Use the actual web app for desktop/mobile, light/dark, keyboard/dialog and browser
+console acceptance. Test native enrollment confirmation separately on the supported
+platform. The Desktop gate includes the cloud web gate, and changes under `apps/web`
+select that gate through the existing CI classification contract.
+
+Correctness checks do not establish a fleet-capacity claim. Measure concurrent streaming
+agents separately from registered idle agents. Record released events/second and size,
+command acknowledgement and launch latency, history-query concurrency, database pool wait,
+transaction latency and connection count. Repeat with reconnect backfill, simultaneous human
+submissions and replica replacement. Use representative workspace/thread histories and the
+same TLS/database topology as deployment before selecting replica and pool budgets.
+
+Keep local invitations, private keys, screenshots, logs and task plans in ignored
+development output or owner-private temporary directories. Remove disposable fixtures
+with `docker compose -f deploy/cloud/local/compose.yml down` after acceptance.
diff --git a/docs/develop/documentation.md b/docs/develop/documentation.md
index 6e89febb6..ed49b94f4 100644
--- a/docs/develop/documentation.md
+++ b/docs/develop/documentation.md
@@ -22,27 +22,27 @@ Zensical route.
 
 1. Choose one audience:
 
-    - `user` for completing work with Colossus;
-    - `operator` for configuring, securing, and recovering deployments;
-    - `developer` for schemas, internals, and contributing.
+   - `user` for completing work with Colossus;
+   - `operator` for configuring, securing, and recovering deployments;
+   - `developer` for schemas, internals, and contributing.
 
 2. Choose one page type:
 
-    - `tutorial` for a guided learning journey;
-    - `how-to` for a specific outcome;
-    - `concept` for a mental model;
-    - `reference` for exact contracts.
+   - `tutorial` for a guided learning journey;
+   - `how-to` for a specific outcome;
+   - `concept` for a mental model;
+   - `reference` for exact contracts.
 
 3. Add required frontmatter:
 
-    ```yaml
-    ---
-    title: Short page title
-    description: One sentence describing the reader outcome.
-    audience: user
-    type: how-to
-    ---
-    ```
+   ```yaml
+   ---
+   title: Short page title
+   description: One sentence describing the reader outcome.
+   audience: user
+   type: how-to
+   ---
+   ```
 
 4. Structure tutorials and how-tos around the reader's task. Put the first useful
    action near the top, and use headings that name the work or decision. Include
@@ -56,11 +56,11 @@ Zensical route.
 
 6. Link to the canonical owner instead of copying:
 
-    - installation in Get started;
-    - field names in Configuration reference;
-    - access semantics in Administer;
-    - tool definitions and schemas in Reference;
-    - release history in the root changelog.
+   - installation in Get started;
+   - field names in Configuration reference;
+   - access semantics in Administer;
+   - tool definitions and schemas in Reference;
+   - release history in the root changelog.
 
 7. Use Mermaid only when relationships are clearer than prose. Add adjacent prose that
    explains the same sequence or structure without relying on color. Zensical's native
@@ -75,15 +75,15 @@ Zensical route.
 
 9. Validate the site and its executable examples with the repository gate:
 
-    ```bash
-    cargo xtask check docs
-    ```
+   ```bash
+   cargo xtask check docs
+   ```
 
-    Preview locally with:
+   Preview locally with:
 
-    ```bash
-    ./scripts/docs-site serve
-    ```
+   ```bash
+   ./scripts/docs-site serve
+   ```
 
 ## Expected result
 
@@ -110,3 +110,72 @@ overrides, custom JavaScript, analytics, external fonts, or CDN diagram loaders.
 
 Request review from the owner of the documented contract and from a reader in the
 declared audience.
+
+## Build the on-prem documentation image
+
+The public documentation container uses the canonical source and pinned Zensical
+generator. Its build selects `/docs/` URLs in a copied configuration and passes that
+mount root to the shared compatibility redirect generator. It does not modify
+`zensical.toml` or the GitHub Pages publication. The digest-pinned Nginx runtime serves
+static files as a non-root user. No generator, application backend or database runs
+inside the final image.
+
+The portable copy uses full-page navigation and local search. Zensical 0.0.50's
+instant-navigation sitemap reader requires absolute URLs, so only
+`navigation.instant` and `navigation.instant.progress` are disabled in that copy.
+The canonical GitHub Pages configuration retains those features.
+
+From the repository root:
+
+```sh
+docker build -f deploy/documentation/Dockerfile \
+  --build-arg COLOSSUS_VERSION=development \
+  --build-arg COLOSSUS_REVISION="$(git rev-parse HEAD)" \
+  --build-arg SOURCE_DATE_EPOCH="$(git show -s --format=%ct HEAD)" \
+  -t colossus-documentation:local .
+node deploy/documentation/smoke.mjs colossus-documentation:local
+kubectl kustomize deploy/control-plane/kubernetes
+```
+
+The smoke runs the actual image with its non-root identity, read-only root filesystem,
+dropped capabilities, a bounded temporary mount and no network. It verifies HTTP from
+inside that isolated container: pages, local assets, search-index routes, compatibility
+redirects, HEAD, missing resources and unsupported methods. It removes its own
+container when finished. Release builds set exact tag/revision labels and the source
+commit timestamp; timestamp normalization keeps generated input and output metadata
+consistent across candidate builds.
+
+The Control Plane defaults to this same-origin `/docs/` destination. To link a separate
+documentation deployment, build the web image with an explicit destination:
+
+```sh
+docker build -f deploy/control-plane/Dockerfile \
+  --build-arg VITE_COLOSSUS_DOCUMENTATION_URL=https://docs.example.com/docs/ \
+  -t colossus-control-plane:local .
+```
+
+For a renderer-only build:
+
+```sh
+VITE_COLOSSUS_DOCUMENTATION_URL=https://docs.example.com/docs/ \
+  npm run build --prefix apps/web
+```
+
+The destination is compile-time presentation configuration, not a new browser or
+runtime permission. See [operator deployment](../admin/documentation-hosting.md) for
+TLS, Ingress and release-image selection.
+
+For the local Control Plane web development server, run the documentation image
+on loopback port 8081 in a separate terminal:
+
+```sh
+docker run --rm --read-only --user 10001:10001 --cap-drop ALL \
+  --security-opt no-new-privileges \
+  --tmpfs /tmp:rw,noexec,nosuid,size=16m,mode=1777 \
+  --publish 127.0.0.1:8081:8080 colossus-documentation:local
+```
+
+Vite forwards `/docs` to that listener without rewriting the path. The default
+Documentation link therefore works through the same web development origin on
+port 5180. Stop this container with Ctrl+C in its terminal when finished. The
+static documentation listener needs no Control Plane session, API or credentials.
diff --git a/docs/develop/releasing.md b/docs/develop/releasing.md
index 273aff142..673161726 100644
--- a/docs/develop/releasing.md
+++ b/docs/develop/releasing.md
@@ -10,7 +10,8 @@ type: how-to
 ## Goal
 
 Publish one stable Colossus version as six GitHub CLI archives, a signed Windows x64
-Desktop installer, two reviewed bootstrap installers,
+Desktop installer, Linux Control Plane bundles and images, six VS Code packages,
+two reviewed bootstrap installers,
 `@obscuritylabs/colossus-sdk` on npm, `obscuritylabs-colossus-sdk` on PyPI, and
 `sdk/go/vX.Y.Z` from the same immutable source commit. Stable releases require Azure
 Artifact Signing for the Windows executables and installer. They do not include a
@@ -42,6 +43,7 @@ Complete these account-owned steps before publishing the first stable draft:
    After a trusted publication succeeds, disallow token-based publication and revoke
    any bootstrap automation token. The public repository allows npm to attach a
    provenance statement to each trusted OIDC publication; keep `--provenance` enabled.
+
 5. The normalized PyPI name `colossus-sdk` belongs to an unrelated project. Create a
    **pending trusted publisher** for the unclaimed project
    `obscuritylabs-colossus-sdk` with owner `obscuritylabs`, repository `Colossus`,
@@ -75,8 +77,9 @@ setuptools does not apply `SOURCE_DATE_EPOCH` to all sdist metadata itself.
 All internal Rust packages must retain `publish = false`.
 
 Set `workspace.metadata.release.publish-sdks` in `Cargo.toml` for each release:
-`true` allows coordinated SDK registry publication; `false` selects Core/Desktop-only
-publication. Both modes build and verify SDK candidate archives with aligned versions.
+`true` allows coordinated SDK registry publication; `false` publishes the application
+artifacts without SDK registry publication. Both modes build and verify SDK candidate
+archives with aligned versions.
 The publisher reads this required boolean from the immutable release tag and blocks
 its privileged publication job when false, including manual recovery requests. Missing
 or malformed policy fails validation. Check the release tag's `Cargo.toml` for the
@@ -131,6 +134,17 @@ candidate pass. Before publishing the draft, verify that it contains exactly:
 - `colossus-sdk-vX.Y.Z-SHA256SUMS`;
 - a signed `Colossus-Desktop-STABLE-vX.Y.Z-x86_64-pc-windows-msvc-setup.exe`,
   its `.sha256`, sealed bundle manifest, and provenance JSON.
+- two `Colossus-Control-Plane-TAG-TARGET.tar.gz` server/web/deployment bundles and
+  their checksums, for Linux x64 and arm64;
+- two matching `.docker.tar.gz` offline image archives and their checksums; and
+- six `Colossus-VSCode-TAG-PLATFORM.vsix` packages with checksums, for Linux,
+  macOS, and Windows x64/arm64.
+
+The complete stable release has 45 assets. Ordinary previews have 42; previews built
+from an unchanged stable source version have 38 because they omit bootstrap installers.
+Control Plane and VSIX jobs are required by the release gate for every channel. The
+extension retains its independently versioned package metadata; release filenames
+identify the shared source tag.
 
 Publishing the stable draft triggers `publish-sdk.yml`. For a release whose policy
 allows SDK publication, approve its one
@@ -147,11 +161,13 @@ the core tag's commit.
 
 The stable GitHub Release contains the six CLI archives and checksums, the two
 repository-owned bootstrap installers and checksums, the five immutable SDK candidate
-files, and four signed Windows Desktop assets. The Windows CLI archives contain signed
-executables. When `publish-sdks` is true, the protected publisher releases the same
+files, four signed Windows Desktop assets, Linux Control Plane bundles and offline
+images, and six platform-specific VSIX packages with checksums. The Windows CLI
+archives contain signed executables. Publishing also starts the separate Control
+Plane image publisher. When `publish-sdks` is true, the protected publisher releases the same
 version to npm and PyPI and creates the Go module tag at the identical source commit.
-For Core/Desktop-only releases, candidate validation passes and the publication job
-is skipped; no registry packages or Go module tag are created.
+When `publish-sdks` is false, SDK candidate validation passes and the SDK publication
+job is skipped; no SDK registry packages or Go module tag are created.
 
 ## Verification
 
@@ -262,6 +278,97 @@ omit the four bootstrap installer assets because bootstrap installation requires
 tag and binary versions to match. Stable tags and already-versioned preview sources
 still require an exact version match.
 
+### Control Plane containers and VS Code packages
+
+The native Linux release jobs build the pinned `deploy/control-plane/Dockerfile`,
+smoke its actual non-root image with a read-only filesystem and no network, and package
+matching server/web bytes plus an offline `docker load` archive. Both architectures
+are retained in the successful tag run's Actions artifacts and attached to the release.
+
+Publishing the reviewed release starts `Publish Control Plane image`. It uses the
+protected-main publisher, verifies the annotated tag's ancestry and successful tag
+build, and compares every server/image release asset against the independently retained
+Actions candidate. Recomputed mutable release checksums alone cannot authorize
+substituted bytes. It publishes only those tested images at
+`ghcr.io/obscuritylabs/colossus-control-plane:TAG`, then verifies the Linux amd64/arm64
+manifest index by digest. Conflicting existing version tags are refused; matching
+reruns reuse existing bytes. No moving `latest` alias is published.
+
+The publisher requires Docker API 1.46 or later and explicitly pushes each executable
+platform manifest before assembling the index from immutable manifest digests. It
+verifies the remote manifest's config digest against the trusted offline archive,
+then pulls the immutable executable digest so Docker validates the actual layers and
+root filesystem before advertising the index. This supports both classic and
+containerd image stores. Containerd's parent index and
+default build attestations remain in the offline archive; they are omitted from the
+published executable image index.
+
+Verify both the publication evidence and an anonymous digest pull before advertising
+the image. The first GHCR package must be public for anonymous on-prem installation.
+For an interrupted publication, rerun the publisher from `main` with the exact tag:
+
+```sh
+gh workflow run control-plane-image.yml --ref main -f tag=TAG
+```
+
+Trusted server candidates are retained for 30 days; if they have expired, the publisher
+fails rather than trusting release sidecars. Restore a successful exact-tag build
+before retrying. Offline installs can instead verify and load the attached
+`Colossus-Control-Plane-TAG-TARGET.docker.tar.gz` archive.
+
+The release builds platform-specific VSIX packages using the locked native keyring
+archive and verifies its registry integrity before packaging. Install the matching
+asset with `code --install-extension PATH_TO_VSIX`. This does not publish to the VS Code
+Marketplace. Source/browser and native worker acceptance remain distinct checks; a
+cross-packaged native binding is not a claim of native acceptance on that platform.
+
+### Documentation container
+
+The separate `documentation-candidate.yml` tag workflow builds and HTTP smoke-tests
+the canonical documentation image on native Linux amd64 and arm64. It retains the
+actual tested offline images and candidate manifests binding the annotated tag, source
+commit, archive hashes, and non-root image config digests. Candidate artifacts expire
+after 30 days; mutable Release sidecars cannot substitute for this source evidence.
+
+Publishing the reviewed stable or preview Release starts `documentation-image.yml`.
+The publisher runs from one resolved protected-main revision and requires successful
+exact-tag `release.yml` and documentation candidate runs before publishing
+`ghcr.io/obscuritylabs/colossus-documentation:TAG`. It publishes only the tested
+executables and verifies their immutable config/layers and final amd64/arm64 index.
+It refuses conflicting existing version tags; matching reruns reuse existing images.
+No moving `latest` alias or extra CLI Release assets are produced.
+
+To recover an interrupted publication:
+
+```sh
+gh workflow run documentation-image.yml --ref main -f tag=TAG
+```
+
+If the candidate artifacts expired, first rerun the original successful exact-tag
+Documentation image candidate workflow run, then retry publication:
+
+```sh
+gh run rerun DOCUMENTATION_CANDIDATE_RUN_ID
+gh run watch DOCUMENTATION_CANDIDATE_RUN_ID --exit-status
+gh workflow run documentation-image.yml --ref main -f tag=TAG
+```
+
+Inspect the retained publication evidence, confirm the first GHCR package is public,
+and verify an anonymous pull by its recorded index digest before advertising the
+image. Package visibility and a successful authenticated push do not prove anonymous
+availability. For example, use a temporary empty Docker configuration for the pull:
+
+```sh
+documentation_auth=$(mktemp -d)
+docker --config "$documentation_auth" pull \
+  ghcr.io/obscuritylabs/colossus-documentation@sha256:RECORDED_INDEX_DIGEST
+rm -r "$documentation_auth"
+```
+
+See [documentation hosting](../admin/documentation-hosting.md) for the portable `/docs/`
+mount, Kubernetes deployment, and browser/agent search. The canonical GitHub Pages
+publication continues independently.
+
 ### Windows Artifact Signing authority
 
 The tag-scoped `release-signing` GitHub environment is federated to the Azure app
diff --git a/docs/develop/security-architecture.md b/docs/develop/security-architecture.md
index 669c95faf..b913cef54 100644
--- a/docs/develop/security-architecture.md
+++ b/docs/develop/security-architecture.md
@@ -450,6 +450,51 @@ existing IDs or sign in to MCP OAuth again. Old OS entries are left untouched.
 Automatic master-key rotation, portable export, and backup recovery are outside
 this version. Copying a database alone does not produce a portable credential vault.
 
+### Development credential authority
+
+The optional debug-only development authority is bound to the exact canonical
+`COLOSSUS_HOME/development-credentials` directory, outside the workspace. Its
+owner-private, single-link wrapping-key file protects the existing encrypted envelopes
+and vault records with the same authenticated encryption as the headless key store.
+Unix key mode must remain `0600`. This is explicit filesystem custody, with less
+same-user application isolation than an OS-protected store. Production composition
+continues to use the platform store and release builds reject the selector.
+
+Preparation creates an inactive marker. Metadata-only planning never opens a wrapping
+key or OS credential. Explicit offline apply binds the reviewed source fingerprints
+and selectors, holds source leases that exclude writers, copies and verifies only selected
+material, then atomically commits activation. Whole-vault rewrap preserves its original
+vault/key/owner identities; named enrollment copy decrypts only the selected record and
+creates an independent destination vault. Both retain the original platform entries
+and source ciphertext. Neither rotates an application bearer, expands a grant or
+re-enrolls a runtime. Incomplete, missing or mismatched sources fail without activation;
+runtime use has no platform fallback or regeneration.
+
+Vault planning and apply open the original database read-only and revalidate its
+confined identity and ciphertext hash. If redb requires allocator recovery, they recover
+only an encrypted in-memory snapshot, bounded to 64 MiB with bounded storage growth.
+No source lock file is created, no original database repair is performed, and no sibling
+record is decrypted during named copy. Corrupt, oversized, busy or owner-mismatched
+sources fail closed. Destination writes use the ordinary encrypted vault transaction.
+
+Native composition alone reads the wrapping key. Build processes receive no raw key;
+the renderer receives no selector or credential. The verified managed sidecar may
+inherit only the nonsecret authority path so its runtime can validate custody before
+storage acquisition. Ordinary tools strip or reject reserved authority/key variables.
+Supported isolated runtimes deny filesystem and search access to the authority root,
+including linked aliases. Startup rejects `danger_full_access`, external/broker and
+unsupported sandbox backends, and broker fallback, before storage-key or runtime
+acquisition. Approval modes do not rewrite that sandbox boundary or its grants.
+The protected process adapter separately rejects ambient resource authority and sandbox
+downgrade permits before launching a helper. These controls do not protect against
+compromised native code, arbitrary same-user applications or the OS.
+
+The SDK's platform-keyring provider permits one outstanding native read per provider.
+The guard stays with the blocking OS call after async timeout or cancellation, preventing
+repeated calls from opening concurrent consent dialogs. Subsequent completed reads are
+fresh; the SDK does not cache application bearers or relax authentication. See
+[isolated development setup](setup-testing.md#use-isolated-development-credential-custody).
+
 Codex/ChatGPT authentication is also operator-only. `colossus codex login` delegates the
 OAuth ceremony to the official Codex CLI and forces its supported file credential store;
 Colossus never handles the authorization code. The `open_ai_codex` adapter accepts only
diff --git a/docs/develop/setup-testing.md b/docs/develop/setup-testing.md
index 7cba83b80..6e66c0a59 100644
--- a/docs/develop/setup-testing.md
+++ b/docs/develop/setup-testing.md
@@ -190,6 +190,93 @@ chain but has no payload confidentiality, signed checkpoints, or external rollba
 anchor. Release builds continue to use platform-protected journals and never reuse the
 debug partition.
 
+### Use isolated development credential custody
+
+Unsigned development rebuilds can change their macOS code identity and require renewed
+Keychain consent. The ordinary launchers keep the platform credential store. An explicit
+debug-only alternative stores encrypted credentials under a private, isolated
+`COLOSSUS_HOME`, with its wrapping key in that same private home. This provides less
+protection from other applications running as your OS user than the platform store;
+use it only for a deliberately selected development home outside every workspace.
+Release binaries reject the development selector.
+
+Build the debug CLI with the pinned toolchain first. Stop the selected app, worker and
+connector before preparing custody; the offline commands refuse busy vaults and
+journals. `dev-credentials init --home /absolute/private/home --workspace
+/absolute/workspace` creates an **inactive** authority. `dev-credentials status` with
+the same arguments inspects its public marker without reading a key. Neither command
+migrates platform entries or activates an existing home.
+
+Use `colossus dev-credentials plan --help` to select exact existing sources, then review
+the generated owner-private plan and its SHA-256 before applying it with
+`dev-credentials rewrap --plan-file FILE --expected-plan-sha256 SHA256 --apply`.
+Planning reads only nonsecret metadata. Applying may require one final platform-store
+consent to read the selected original entries, seals and verifies them, and activates
+the authority only after all selected sources pass. Old platform entries remain intact;
+credentials and grants are not reissued. A named connector enrollment can be copied
+from a shared source home into a new isolated home without exporting that source
+vault's master or sibling enrollments. Platform-backed redb journals preserve their
+historical key IDs, checkpoint seed and anchor; environment/headless and PostgreSQL
+journal source migration is not supported by this command and fails explicitly.
+
+Vault inspection and apply retain the original database bytes. An unclean redb vault
+can be inspected through a bounded encrypted snapshot recovered only in memory; the
+original file is not repaired. Vault sources larger than 64 MiB or held by a writer
+are refused. This does not recover a missing platform key or authorize a different
+source selection.
+
+For an empty home, an explicit `plan --fresh-empty` followed by the same reviewed
+rewrap boundary activates fresh development custody. It refuses existing runtime or
+credential state. Never use a fresh-home plan to recover missing keys.
+
+After activation, run the canonical launcher with its explicit opt-in:
+
+```sh
+COLOSSUS_HOME=/absolute/private/home ./scripts/desktop-dev --dev-credentials
+COLOSSUS_HOME=/absolute/private/home COLOSSUS_DEV_CONFIG=/absolute/config.yaml \
+  ./scripts/colossus-dev --dev-credentials tui
+```
+
+On Windows, set the same explicit private `COLOSSUS_HOME` and run
+`./scripts/desktop-dev.ps1 -DevCredentials`. These launchers require Node.js, inspect
+only the authority marker, and pass one nonsecret path selector to trusted native
+composition. They remove raw development/journal key variables from build processes;
+tools cannot inherit the selector or raw wrapping material. The CLI opt-in uses the
+reviewed existing configuration and does not regenerate development journal IDs.
+
+An inactive, malformed, missing, linked, moved or overly permissive wrapping-key file
+fails closed. There is no automatic platform fallback or key regeneration. Restore the
+original private custody from a protected backup or stop and review a new offline plan;
+do not delete a key to make startup succeed. See the
+[credential boundary](security-architecture.md#development-credential-authority).
+
+### Select a private Codex account for a worker
+
+A serving CLI worker can select one existing owner-private Codex auth file without
+changing the default account store or setting `CODEX_HOME`:
+
+```sh
+target/debug/colossus --workspace /absolute/workspace --config /absolute/config.yaml \
+  --approval-mode ask worker --public-api-dir /absolute/private/api \
+  --codex-auth-path /absolute/private/account/auth.json --no-model-network-tools
+```
+
+The file and its directory must already exist, be private and have no linked aliases;
+keep the selected account file outside the tool workspace.
+The path must be absolute and canonical; credential contents remain late-bound behind
+the provider permit. The selected private directory stays bound for every load and
+refresh; parent aliases and added hard links are refused, while legitimate atomic
+credential replacement remains supported. Invalid selection fails before worker
+acquisition without falling
+back to another account. This option is unavailable with `worker --once`, status,
+shutdown or enrollment administration; ordinary `codex login/status/logout` behavior
+is unchanged. Configure the `open_ai_codex` primary route and exact service/refresh
+origins using the [provider guide](../use/providers/codex-chatgpt.md).
+The optional serve-only `--no-model-network-tools` host control hides generic model
+fetch tools while retaining the configured provider's HTTP and refresh transport. It
+does not change access policy, runtime grants, approval handling or provider credentials;
+omitting it preserves the ordinary CLI tool surface.
+
 The pruned release compilation path requires an explicit non-runnable validation
 channel and sentinel:
 
diff --git a/docs/develop/testing.md b/docs/develop/testing.md
index 85166ce70..eb86f68f9 100644
--- a/docs/develop/testing.md
+++ b/docs/develop/testing.md
@@ -37,6 +37,7 @@ protects a current boundary; it does not mean every future assertion is permanen
 | `colossus-api` | Keep server composition and public API lifecycle tests. |
 | `colossus-audit` | Keep journal export, retry, recovery, and live WORM acceptance tests. |
 | `colossus-cli` | Keep command-level smoke suites because they exercise public parsing and embedded/worker boundaries; remove a suite only when its command or contract is removed. |
+| `colossus-cloud`, `colossus-cloud-protocol`, `colossus-cloud-server`, `colossus-connector` | Keep project/placement/receipt/cursor/renewal invariants and the signed OIDC-to-runtime transport acceptance; run the operator-owned PostgreSQL variant described in [cloud development](cloud-control-plane.md). |
 | `colossus-codex-auth` | Keep OAuth/device-flow parsing, storage, and redaction tests. |
 | `colossus-context` | Keep compaction budgets, snapshots, and deterministic fallback unit tests. |
 | `colossus-contracts` | Keep serialization, validation, and stable contract-shape tests. |
diff --git a/docs/develop/toolchain-inventory.md b/docs/develop/toolchain-inventory.md
index 32fdf9725..a9fd47a00 100644
--- a/docs/develop/toolchain-inventory.md
+++ b/docs/develop/toolchain-inventory.md
@@ -27,7 +27,7 @@ use their own declarations.
 | Rust protobuf compiler | Root Cargo manifest/lock own `protoc-bin-vendored`. | Cargo integrity/locked resolution; Rust API build and tests. |
 | Language linters and tests | Desktop/SDK npm manifests and locks, Python development requirements, and Go module files own tools. | Desktop TypeScript/Vitest/Prettier checks; SDK Ruff/mypy/Python tests, Go tests/vet/gofmt and TypeScript checks. |
 | Browser acceptance | Desktop npm lock owns Playwright; `test:browser:install` installs its browser payloads in premerge. | Native browser acceptance jobs and Desktop tests. |
-| Documentation | `scripts/docs-site` owns the Zensical image version/digest; docs jobs and developers invoke it through Docker. | Digest-pinned build, strict site checks and Rust documentation examples via `cargo xtask check docs`. |
+| Documentation | `scripts/docs-site` owns the Zensical image version/digest; `deploy/documentation/Dockerfile` mirrors that generator and pins the Nginx static runtime. Docs jobs and developers invoke Docker. | Digest-pinned build, strict site checks and Rust documentation examples via `cargo xtask check docs`; on-prem image HTTP checks use `deploy/documentation/smoke.mjs`. |
 | ORAS and OPA | `release-image.yml` owns ORAS downloads; `premerge.yml` owns OPA download. | Explicit checksums; OCI roundtrip and live OPA acceptance. |
 | Containers and devcontainer features | Workflow service/acceptance images, devcontainer Docker stages and `devcontainer-lock.json` own immutable references. `oci-proxy.Dockerfile` uses `scratch`. | Preserve image digests and feature lock; live PostgreSQL, Chroma, OCI and OPA suites. |
 | Native build tools and container engines | Runner images and OS package installation supply Clang, CMake, pkg-config, Tauri libraries, Docker/Podman and platform packaging/signing tools. | Native CI/release acceptance; these are not supplied by `mise install`. |
diff --git a/release/verify-release-readiness.sh b/release/verify-release-readiness.sh
index 7c10637f5..0c222574c 100755
--- a/release/verify-release-readiness.sh
+++ b/release/verify-release-readiness.sh
@@ -77,10 +77,12 @@ run cargo deny --locked check -D warnings advisories
 # registry release in quickwit-oss/tantivy#3034. Remove this exact exception
 # with that upgrade. cargo-deny does not report this informational advisory, so
 # its advisory policy remains unmodified.
-run cargo audit -D warnings --ignore RUSTSEC-2026-0253 --file Cargo.lock
+# OpenID Connect verifies public signatures only; no RSA private-key operations.
+# Keep this exact exception aligned with deny.toml and ADR 0006.
+run cargo audit -D warnings --ignore RUSTSEC-2026-0253 --ignore RUSTSEC-2023-0071 --file Cargo.lock
 
 run cargo deny --manifest-path fuzz/Cargo.toml --config deny.toml --locked check -A license-not-encountered licenses sources bans
-run cargo deny --manifest-path fuzz/Cargo.toml --config deny.toml --locked check -D warnings advisories
+run cargo deny --manifest-path fuzz/Cargo.toml --config deny.toml --locked check -D warnings -A advisory-not-detected advisories
 run cargo audit -D warnings --file fuzz/Cargo.lock
 
 printf 'local release-readiness verification passed\n'
diff --git a/scripts/check-desktop-renderer-bundle.mjs b/scripts/check-desktop-renderer-bundle.mjs
index d944d05ed..d2d1535b6 100644
--- a/scripts/check-desktop-renderer-bundle.mjs
+++ b/scripts/check-desktop-renderer-bundle.mjs
@@ -4,9 +4,10 @@ import { join, relative, resolve } from "node:path";
 const desktop = resolve(process.argv[2] ?? "apps/desktop");
 const dist = join(desktop, "dist");
 const maximumJavaScriptChunkBytes = 700_000;
-// Regular dictation adds its native controls, meter, and lazy Settings page (~27 KB).
-// Keep a bounded 50 KB allowance; model weights remain outside the renderer.
-const maximumRendererBytes = 4_050_000;
+// Regular dictation includes a bounded 50 KB allowance; weights stay native.
+// Desktop's shared shadcn thread menu adds ~81 KB of Radix menu/focus/positioning
+// code in a lazy chunk. Allow 100 KB total growth while retaining the chunk limit.
+const maximumRendererBytes = 4_150_000;
 const forbiddenFixtureStrings = [
   "Offline dictation preview",
   "fixture-run-desktop-release",
diff --git a/scripts/ci/classify-changes.sh b/scripts/ci/classify-changes.sh
index 208b90a84..2b9e66845 100755
--- a/scripts/ci/classify-changes.sh
+++ b/scripts/ci/classify-changes.sh
@@ -41,7 +41,7 @@ for changed_path in "$@"; do
     esac
 
     case "$changed_path" in
-        apps/desktop/* | apps/ui/* | crates/colossus-native-dictation/* | crates/colossus-tui/* | release/dictation/* | scripts/stage-dictation-model.mjs | release/ripgrep.json | scripts/desktop-dev | scripts/package-desktop-macos | scripts/package-desktop-windows.ps1 | scripts/stage-ripgrep.mjs | scripts/patch-desktop-manifest-binding.mjs | scripts/prepare-desktop-binaries | scripts/write-desktop-bundle-manifest.mjs | scripts/verify-desktop-bundle.mjs | scripts/verify-desktop-unsigned-archive.mjs | crates/colossus-cli/* | crates/colossus-darwin-process/* | crates/colossus-sdk/* | crates/colossus-sidecar/* | crates/colossus-sidecar-protocol/*)
+        apps/desktop/* | apps/web/* | apps/ui/* | crates/colossus-native-dictation/* | crates/colossus-tui/* | release/dictation/* | scripts/stage-dictation-model.mjs | release/ripgrep.json | scripts/desktop-dev | scripts/package-desktop-macos | scripts/package-desktop-windows.ps1 | scripts/stage-ripgrep.mjs | scripts/patch-desktop-manifest-binding.mjs | scripts/prepare-desktop-binaries | scripts/write-desktop-bundle-manifest.mjs | scripts/verify-desktop-bundle.mjs | scripts/verify-desktop-unsigned-archive.mjs | crates/colossus-cli/* | crates/colossus-darwin-process/* | crates/colossus-sdk/* | crates/colossus-sidecar/* | crates/colossus-sidecar-protocol/*)
             desktop_required=true
             ;;
     esac
diff --git a/scripts/ci/control-plane-assets.test.mjs b/scripts/ci/control-plane-assets.test.mjs
new file mode 100644
index 000000000..4fdd04783
--- /dev/null
+++ b/scripts/ci/control-plane-assets.test.mjs
@@ -0,0 +1,110 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { mkdtemp, mkdir, writeFile, rm, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { test } from "node:test";
+import { serverTargets, validateRequest, verifyControlPlaneAssets, savedImageConfigPath,
+  verifySavedImageConfig, verifyExecutableManifest, executableDescriptorDigest } from "./verify-control-plane-assets.mjs";
+import { readSavedImageConfig } from "./verify-control-plane-assets.mjs";
+
+test("privileged publication uses the protected publisher revision that passed contracts", async () => {
+  const workflow = await readFile(new URL("../../.github/workflows/control-plane-image.yml", import.meta.url), "utf8");
+  const resolver = workflow.split("  publisher-revision:\n")[1]?.split("  contracts:\n")[0];
+  assert.ok(resolver, "Publication must resolve its trusted publisher before either consumer runs");
+  assert.match(resolver, /if \[\[ "\$EVENT_NAME" == pull_request \]\]; then\s+revision="\$GITHUB_SHA"\s+else\s+revision=\$\(gh api repos\/obscuritylabs\/Colossus\/git\/ref\/heads\/main --jq \.object\.sha\)/u);
+  assert.match(resolver, /\[\[ "\$revision" =~ \^\[0-9a-f\]\{40\}\$ \]\]/u);
+  assert.equal(workflow.split("ref: ${{ needs.publisher-revision.outputs.revision }}").length - 1, 2,
+    "Contracts and credentialed publication must check out the same resolved immutable SHA");
+  assert.doesNotMatch(workflow, /ref: main\b/u, "A moving main ref can bypass the checked publisher revision");
+  const contracts = workflow.split("  contracts:\n")[1]?.split("  publish:\n")[0];
+  assert.match(contracts, /needs: publisher-revision/u);
+  const publish = workflow.split("  publish:\n")[1];
+  assert.match(publish, /needs: \[publisher-revision, contracts\]/u);
+});
+
+test("publication rejects path/tag injection and mutable release substitutions", async () => {
+  assert.throws(() => validateRequest("../../secret"));
+  assert.throws(() => validateRequest("v0.11.7-preview.0"));
+  assert.throws(() => validateRequest("v0.11.7\n"));
+  assert.throws(() => validateRequest("v0.11.7", "main"));
+  const root = await mkdtemp(join(tmpdir(), "colossus-image-candidate-"));
+  const tag = "v0.11.7-preview.3";
+  const trusted = join(root, "trusted");
+  const published = join(root, "published");
+  try {
+    await mkdir(trusted); await mkdir(published);
+    async function asset(directory, filename, bytes) {
+      await writeFile(join(directory, filename), bytes);
+      await writeFile(join(directory, `${filename}.sha256`), `${createHash("sha256").update(bytes).digest("hex")}  ${filename}\n`);
+    }
+    for (const target of serverTargets) for (const suffix of ["tar.gz", "docker.tar.gz"]) {
+      const filename = `Colossus-Control-Plane-${tag}-${target}.${suffix}`;
+      await asset(trusted, filename, "trusted tested candidate");
+      await asset(published, filename, "trusted tested candidate");
+    }
+    assert.equal((await verifyControlPlaneAssets(trusted, published, tag)).length, 4);
+    const filename = `Colossus-Control-Plane-${tag}-${serverTargets[0]}.docker.tar.gz`;
+    // An attacker can replace a release asset and recompute its sidecar, but cannot
+    // replace the independently retained successful tag build in this trust model.
+    await asset(published, filename, "substituted image with a valid recomputed sidecar");
+    await assert.rejects(verifyControlPlaneAssets(trusted, published, tag), /trusted tag build/u);
+    await asset(published, filename, "trusted tested candidate");
+    await writeFile(join(published, `${filename}.sha256`), `${"0".repeat(64)}  another-file\n`);
+    await assert.rejects(verifyControlPlaneAssets(trusted, published, tag), /checksum or filename/u);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+test("classic and containerd archives identify the executable config independently of an index", async () => {
+  const identity = { arch: "arm64", tag: "v0.11.7-preview.3", commit: "a".repeat(40) };
+  const config = Buffer.from(JSON.stringify({
+    architecture: identity.arch, os: "linux", config: { User: "10001:10001", Labels: {
+      "org.opencontainers.image.revision": identity.commit,
+      "org.opencontainers.image.version": identity.tag,
+    } },
+  }));
+  const hash = createHash("sha256").update(config).digest("hex");
+  const root = await mkdtemp(join(tmpdir(), "colossus-image-config-"));
+  try { for (const [position, path] of [`${hash}.json`, `blobs/sha256/${hash}`].entries()) {
+    const manifest = [{ Config: path, RepoTags: ["colossus-control-plane:release"], Layers: [] }];
+    assert.equal(savedImageConfigPath(manifest), path);
+    assert.deepEqual(verifySavedImageConfig(manifest, config, identity), {
+      architecture: identity.arch, config_digest: `sha256:${hash}`,
+    });
+    assert.throws(() => verifySavedImageConfig(manifest, Buffer.from("substitution"), identity), /config digest/u);
+    assert.throws(() => verifySavedImageConfig(manifest, config, { ...identity, arch: "amd64" }), /release identity/u);
+    assert.throws(() => verifySavedImageConfig(manifest, config, { ...identity, commit: undefined }), /source commit/u);
+    const stage = join(root, `stage-${position}`);
+    await mkdir(dirname(join(stage, path)), { recursive: true });
+    await writeFile(join(stage, "manifest.json"), JSON.stringify(manifest));
+    await writeFile(join(stage, path), config);
+    const archive = join(root, `image-${position}.tar.gz`);
+    execFileSync("tar", ["-czf", archive, "-C", stage, "manifest.json", path]);
+    assert.deepEqual(readSavedImageConfig(archive, identity), {
+      architecture: identity.arch, config_digest: `sha256:${hash}`,
+    });
+  } } finally { await rm(root, { recursive: true, force: true }); }
+  assert.throws(() => savedImageConfigPath([{ Config: "../../config", RepoTags: ["colossus-control-plane:release"] }]));
+  assert.throws(() => savedImageConfigPath([{ Config: `${hash}.json`, RepoTags: ["other:release"] }]));
+});
+
+test("publication accepts executable manifests and refuses conflicting configs or attestation indexes", () => {
+  const configDigest = `sha256:${"c".repeat(64)}`;
+  const executableDigest = `sha256:${"e".repeat(64)}`;
+  for (const mediaType of ["application/vnd.oci.image.manifest.v1+json", "application/vnd.docker.distribution.manifest.v2+json"]) {
+    const manifest = { schemaVersion: 2, mediaType, config: { digest: configDigest },
+      layers: [{ digest: `sha256:${"d".repeat(64)}` }] };
+    assert.doesNotThrow(() => verifyExecutableManifest(manifest, configDigest));
+    assert.throws(() => verifyExecutableManifest(manifest, `sha256:${"f".repeat(64)}`), /conflicting config/u);
+    assert.equal(executableDescriptorDigest({ mediaType, digest: executableDigest }), executableDigest);
+  }
+  const index = { schemaVersion: 2, mediaType: "application/vnd.oci.image.index.v1+json", digest: `sha256:${"a".repeat(64)}`,
+    manifests: [
+      { digest: executableDigest, platform: { os: "linux", architecture: "arm64" } },
+      { digest: `sha256:${"b".repeat(64)}`, platform: { os: "unknown", architecture: "unknown" },
+        annotations: { "vnd.docker.reference.type": "attestation-manifest", "vnd.docker.reference.digest": executableDigest } },
+    ] };
+  assert.throws(() => verifyExecutableManifest(index, configDigest), /non-executable/u);
+  assert.throws(() => executableDescriptorDigest(index), /single-platform/u);
+});
diff --git a/scripts/ci/desktop-contract.test.mjs b/scripts/ci/desktop-contract.test.mjs
index 1d92591d9..7fe37eb5c 100644
--- a/scripts/ci/desktop-contract.test.mjs
+++ b/scripts/ci/desktop-contract.test.mjs
@@ -1508,6 +1508,8 @@ test("release manifest writer emits exact final binary digests", () => {
     mkdirSync(notices, { mode: 0o755 });
     for (const name of ["COPYING", "LICENSE-MIT", "UNLICENSE"]) {
       writeFileSync(join(notices, name), "test license\n", { mode: 0o644 });
+      // Match staging's public notice permissions even with a private umask.
+      chmodSync(join(notices, name), 0o644);
     }
     const sidecar = join(macos, "colossus-sidecar");
     const cli = join(macos, "colossus");
diff --git a/scripts/ci/desktop-manifest-binding.test.mjs b/scripts/ci/desktop-manifest-binding.test.mjs
index 7f3afc93f..878eb9fb0 100644
--- a/scripts/ci/desktop-manifest-binding.test.mjs
+++ b/scripts/ci/desktop-manifest-binding.test.mjs
@@ -25,7 +25,7 @@ const placeholder = `${prefix}${"0".repeat(64)}${suffix}`;
 function manifest({
   targetTriple = "aarch64-apple-darwin",
   sidecar = "colossus-sidecar",
-    cli = "colossus",
+  cli = "colossus",
   ripgrep = "rg",
 } = {}) {
   return `${JSON.stringify({
@@ -199,7 +199,7 @@ test("rejects non-Mach-O executables and noncanonical manifests", () => {
     chmodSync(executablePath, 0o755);
     let result = run(executablePath, manifestPath);
     assert.notEqual(result.status, 0);
-    assert.match(result.stderr, /not a supported Mach-O or PE image/u);
+    assert.match(result.stderr, /not a supported Mach-O, PE, or ELF image/u);
 
     writeFileSync(executablePath, executable([placeholder]), { mode: 0o755 });
     chmodSync(executablePath, 0o755);
@@ -211,3 +211,29 @@ test("rejects non-Mach-O executables and noncanonical manifests", () => {
     rmSync(root, { recursive: true, force: true });
   }
 });
+
+test("binds a Linux ELF preview and rejects a non-executable ELF type", () => {
+  const { root, executablePath, manifestPath } = fixture();
+  try {
+    writeFileSync(
+      manifestPath,
+      manifest({ targetTriple: "aarch64-unknown-linux-gnu" }),
+      { mode: 0o644 },
+    );
+    const header = Buffer.alloc(64);
+    header.set([0x7f, 0x45, 0x4c, 0x46, 2, 1]);
+    header.writeUInt16LE(3, 16);
+    const image = Buffer.concat([header, Buffer.from(placeholder)]);
+    writeFileSync(executablePath, image, { mode: 0o755 });
+    chmodSync(executablePath, 0o755);
+    assert.equal(run(executablePath, manifestPath).status, 0);
+    header.writeUInt16LE(1, 16);
+    writeFileSync(
+      executablePath,
+      Buffer.concat([header, Buffer.from(placeholder)]),
+    );
+    assert.notEqual(run(executablePath, manifestPath).status, 0);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
diff --git a/scripts/ci/documentation-candidate.mjs b/scripts/ci/documentation-candidate.mjs
new file mode 100644
index 000000000..00a3c4419
--- /dev/null
+++ b/scripts/ci/documentation-candidate.mjs
@@ -0,0 +1,240 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { lstat, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  readSavedImageConfig,
+  validateRequest,
+} from "./verify-control-plane-assets.mjs";
+
+export const documentationImage = "colossus-documentation:candidate";
+export const documentationArchitectures = ["amd64", "arm64"];
+const digestPattern = /^sha256:[a-f0-9]{64}$/u;
+const indexMediaTypes = new Set([
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json",
+]);
+
+export function candidateNames(tag, architecture) {
+  validateRequest(tag);
+  if (!documentationArchitectures.includes(architecture))
+    throw new Error("Unsupported documentation architecture.");
+  const name = `Colossus-Documentation-${tag}-linux-${architecture}`;
+  return { archive: `${name}.docker.tar.gz`, manifest: `${name}.json` };
+}
+
+export function verifyPublishedDocumentationRelease(release, tag) {
+  validateRequest(tag);
+  if (
+    release?.tag_name !== tag ||
+    release.draft !== false ||
+    release.prerelease !== tag.includes("-preview.") ||
+    !Number.isSafeInteger(release.id) ||
+    release.id < 1 ||
+    typeof release.published_at !== "string" ||
+    !Number.isFinite(Date.parse(release.published_at))
+  )
+    throw new Error(
+      "A published exact-tag stable or preview release is required.",
+    );
+  return { release_id: release.id, tag, published_at: release.published_at };
+}
+
+export function verifyDocumentationSourceRun(run, workflow, tag, commit) {
+  validateRequest(tag, commit);
+  if (!["release.yml", "documentation-candidate.yml"].includes(workflow))
+    throw new Error("Unsupported source proof workflow.");
+  if (
+    !Number.isSafeInteger(run?.id) ||
+    run.id < 1 ||
+    run.event !== "push" ||
+    run.status !== "completed" ||
+    run.conclusion !== "success" ||
+    run.head_sha !== commit ||
+    run.head_branch !== tag ||
+    run.path !== `.github/workflows/${workflow}` ||
+    run.repository?.full_name !== "obscuritylabs/Colossus" ||
+    run.head_repository?.full_name !== "obscuritylabs/Colossus"
+  )
+    throw new Error(
+      "Successful exact-tag repository source proof is required.",
+    );
+  return {
+    run_id: run.id,
+    workflow,
+    event: run.event,
+    tag,
+    source_commit: commit,
+  };
+}
+
+export function matchingDocumentationSourceRun(runs, workflow, tag, commit) {
+  if (!Array.isArray(runs) || runs.length > 100)
+    throw new Error("Source proof results are unavailable or unbounded.");
+  for (const run of runs) {
+    try {
+      return verifyDocumentationSourceRun(run, workflow, tag, commit);
+    } catch {
+      // Other completed tag builds are not proof for this exact source request.
+    }
+  }
+  throw new Error("No successful exact-tag source build is available.");
+}
+
+async function archiveDigest(path) {
+  const file = await lstat(path);
+  if (!file.isFile() || file.size < 1 || file.size > 512 * 1024 * 1024)
+    throw new Error("Documentation image must be a bounded regular archive.");
+  const hash = createHash("sha256");
+  for await (const block of createReadStream(path)) hash.update(block);
+  return { sha256: hash.digest("hex"), size: file.size };
+}
+
+export async function createDocumentationCandidate(
+  directory,
+  tag,
+  commit,
+  architecture,
+) {
+  validateRequest(tag, commit);
+  const names = candidateNames(tag, architecture);
+  const archive = join(directory, names.archive);
+  const digest = await archiveDigest(archive);
+  const saved = readSavedImageConfig(archive, {
+    tag,
+    commit,
+    arch: architecture,
+    imageName: documentationImage,
+  });
+  const candidate = {
+    schema_version: 1,
+    tag,
+    source_commit: commit,
+    architecture,
+    image_name: documentationImage,
+    config_digest: saved.config_digest,
+    archive: { filename: names.archive, ...digest },
+    smoke_suite: "documentation-container-v1",
+  };
+  await writeFile(
+    join(directory, names.manifest),
+    JSON.stringify(candidate, null, 2) + "\n",
+    {
+      flag: "wx",
+      mode: 0o600,
+    },
+  );
+  return candidate;
+}
+
+export async function verifyDocumentationCandidate(
+  directory,
+  tag,
+  commit,
+  architecture,
+) {
+  validateRequest(tag, commit);
+  const names = candidateNames(tag, architecture);
+  const manifestPath = join(directory, names.manifest);
+  const file = await lstat(manifestPath);
+  if (!file.isFile() || file.size > 16 * 1024)
+    throw new Error(
+      "Documentation candidate metadata must be bounded and regular.",
+    );
+  const candidate = JSON.parse(
+    new TextDecoder("utf-8", { fatal: true }).decode(
+      await readFile(manifestPath),
+    ),
+  );
+  if (
+    candidate?.schema_version !== 1 ||
+    candidate.tag !== tag ||
+    candidate.source_commit !== commit ||
+    candidate.architecture !== architecture ||
+    candidate.image_name !== documentationImage ||
+    candidate.smoke_suite !== "documentation-container-v1" ||
+    !digestPattern.test(candidate.config_digest) ||
+    candidate.archive?.filename !== names.archive
+  )
+    throw new Error(
+      "Documentation candidate differs from the verified tag source.",
+    );
+  const archive = join(directory, names.archive);
+  const actual = await archiveDigest(archive);
+  if (
+    candidate.archive.sha256 !== actual.sha256 ||
+    candidate.archive.size !== actual.size
+  )
+    throw new Error(
+      "Documentation image differs from its tested candidate bytes.",
+    );
+  const saved = readSavedImageConfig(archive, {
+    tag,
+    commit,
+    arch: architecture,
+    imageName: documentationImage,
+  });
+  if (candidate.config_digest !== saved.config_digest)
+    throw new Error(
+      "Documentation candidate config digest disagrees with the image.",
+    );
+  return candidate;
+}
+
+export function verifyDocumentationIndex(index, variants) {
+  if (
+    !digestPattern.test(index?.digest) ||
+    !indexMediaTypes.has(index.mediaType) ||
+    index.schemaVersion !== 2 ||
+    !Array.isArray(index.manifests) ||
+    index.manifests.length !== 2
+  )
+    throw new Error(
+      "Documentation index must contain exactly the tested platforms.",
+    );
+  for (const architecture of documentationArchitectures) {
+    const digest = variants[architecture];
+    if (
+      !digestPattern.test(digest) ||
+      index.manifests.filter(
+        (item) =>
+          item.digest === digest &&
+          item.platform?.os === "linux" &&
+          item.platform?.architecture === architecture &&
+          (item.platform.variant === undefined ||
+            (architecture === "arm64" && item.platform.variant === "v8")),
+      ).length !== 1
+    )
+      throw new Error("Refusing a conflicting documentation image version.");
+  }
+  return index.digest;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  const [operation, directory, tag, commit, architecture] =
+    process.argv.slice(2);
+  if (
+    !directory ||
+    !tag ||
+    !commit ||
+    !architecture ||
+    process.argv.length !== 7 ||
+    !["create", "verify"].includes(operation)
+  )
+    throw new Error(
+      "usage: documentation-candidate.mjs create|verify DIRECTORY TAG COMMIT ARCH",
+    );
+  console.log(
+    JSON.stringify(
+      await (
+        operation === "create"
+          ? createDocumentationCandidate
+          : verifyDocumentationCandidate
+      )(directory, tag, commit, architecture),
+    ),
+  );
+}
diff --git a/scripts/ci/documentation-candidate.test.mjs b/scripts/ci/documentation-candidate.test.mjs
new file mode 100644
index 000000000..9cc543cfa
--- /dev/null
+++ b/scripts/ci/documentation-candidate.test.mjs
@@ -0,0 +1,302 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import {
+  mkdtemp,
+  mkdir,
+  readFile,
+  writeFile,
+  rm,
+  symlink,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import {
+  candidateNames,
+  createDocumentationCandidate,
+  documentationImage,
+  matchingDocumentationSourceRun,
+  verifyDocumentationCandidate,
+  verifyDocumentationIndex,
+  verifyDocumentationSourceRun,
+  verifyPublishedDocumentationRelease,
+} from "./documentation-candidate.mjs";
+
+const tag = "v0.11.7-preview.3";
+const commit = "a".repeat(40);
+const digest = (letter) => `sha256:${letter.repeat(64)}`;
+
+async function imageArchive(directory, architecture, user = "10001:10001") {
+  const names = candidateNames(tag, architecture);
+  const stage = join(directory, `stage-${architecture}`);
+  await mkdir(stage, { recursive: true });
+  const config = Buffer.from(
+    JSON.stringify({
+      os: "linux",
+      architecture,
+      config: {
+        User: user,
+        Labels: {
+          "org.opencontainers.image.version": tag,
+          "org.opencontainers.image.revision": commit,
+        },
+      },
+    }),
+  );
+  const filename = createHash("sha256").update(config).digest("hex") + ".json";
+  await writeFile(join(stage, filename), config);
+  await writeFile(
+    join(stage, "manifest.json"),
+    JSON.stringify([
+      { Config: filename, RepoTags: [documentationImage], Layers: [] },
+    ]),
+  );
+  execFileSync("tar", [
+    "-czf",
+    join(directory, names.archive),
+    "-C",
+    stage,
+    "manifest.json",
+    filename,
+  ]);
+  return names;
+}
+
+test("tested image bytes and exact source identity survive the retained candidate round trip", async () => {
+  const directory = await mkdtemp(
+    join(tmpdir(), "colossus-documentation-candidate-"),
+  );
+  try {
+    for (const architecture of ["amd64", "arm64"]) {
+      const names = await imageArchive(directory, architecture);
+      const original = await createDocumentationCandidate(
+        directory,
+        tag,
+        commit,
+        architecture,
+      );
+      assert.deepEqual(
+        await verifyDocumentationCandidate(
+          directory,
+          tag,
+          commit,
+          architecture,
+        ),
+        original,
+      );
+      await assert.rejects(
+        createDocumentationCandidate(directory, tag, commit, architecture),
+        { code: "EEXIST" },
+      );
+      await assert.rejects(
+        verifyDocumentationCandidate(
+          directory,
+          tag,
+          "b".repeat(40),
+          architecture,
+        ),
+        /tag source/u,
+      );
+      const bytes = await readFile(join(directory, names.archive));
+      await writeFile(
+        join(directory, names.archive),
+        Buffer.concat([bytes, Buffer.from("substitution")]),
+      );
+      await assert.rejects(
+        verifyDocumentationCandidate(directory, tag, commit, architecture),
+        /tested candidate bytes/u,
+      );
+      await writeFile(join(directory, names.archive), bytes);
+      await writeFile(
+        join(directory, names.manifest),
+        JSON.stringify({ ...original, config_digest: digest("d") }),
+      );
+      await assert.rejects(
+        verifyDocumentationCandidate(directory, tag, commit, architecture),
+        /config digest/u,
+      );
+      await writeFile(
+        join(directory, names.manifest),
+        JSON.stringify({
+          ...original,
+          archive: { ...original.archive, filename: "../../image.tar.gz" },
+        }),
+      );
+      await assert.rejects(
+        verifyDocumentationCandidate(directory, tag, commit, architecture),
+        /tag source/u,
+      );
+    }
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("root images, aliases, symlinks and malformed candidate requests cannot reach publication", async () => {
+  assert.throws(() => candidateNames("../../secret", "amd64"));
+  assert.throws(() => candidateNames("v0.11.7-preview.0", "amd64"));
+  assert.throws(() => candidateNames(tag, "unknown"));
+  const directory = await mkdtemp(
+    join(tmpdir(), "colossus-documentation-invalid-"),
+  );
+  try {
+    const names = await imageArchive(directory, "amd64", "0:0");
+    await assert.rejects(
+      createDocumentationCandidate(directory, tag, commit, "amd64"),
+      /release identity/u,
+    );
+    await rm(join(directory, names.archive));
+    await writeFile(join(directory, "elsewhere"), "not an archive");
+    await symlink(join(directory, "elsewhere"), join(directory, names.archive));
+    await assert.rejects(
+      createDocumentationCandidate(directory, tag, commit, "amd64"),
+      /regular archive/u,
+    );
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("source proof requires successful exact tag runs from this repository and a published release", () => {
+  const release = {
+    id: 42,
+    tag_name: tag,
+    draft: false,
+    prerelease: true,
+    published_at: "2026-10-06T12:00:00Z",
+  };
+  assert.equal(
+    verifyPublishedDocumentationRelease(release, tag).release_id,
+    42,
+  );
+  for (const overrides of [
+    { draft: true },
+    { prerelease: false },
+    { published_at: null },
+    { tag_name: "v0.11.7" },
+  ])
+    assert.throws(
+      () =>
+        verifyPublishedDocumentationRelease({ ...release, ...overrides }, tag),
+      /published exact-tag/u,
+    );
+  for (const workflow of ["release.yml", "documentation-candidate.yml"]) {
+    const run = {
+      id: 43,
+      event: "push",
+      status: "completed",
+      conclusion: "success",
+      head_sha: commit,
+      head_branch: tag,
+      path: `.github/workflows/${workflow}`,
+      repository: { full_name: "obscuritylabs/Colossus" },
+      head_repository: { full_name: "obscuritylabs/Colossus" },
+    };
+    assert.equal(
+      matchingDocumentationSourceRun([run], workflow, tag, commit).run_id,
+      43,
+    );
+    for (const overrides of [
+      { event: "workflow_dispatch" },
+      { head_sha: "b".repeat(40) },
+      { conclusion: "failure" },
+      { head_branch: "main" },
+      { path: ".github/workflows/arbitrary.yml" },
+      { head_repository: { full_name: "someone/fork" } },
+    ])
+      assert.throws(
+        () =>
+          verifyDocumentationSourceRun(
+            { ...run, ...overrides },
+            workflow,
+            tag,
+            commit,
+          ),
+        /exact-tag repository source/u,
+      );
+    assert.throws(
+      () => matchingDocumentationSourceRun([], workflow, tag, commit),
+      /No successful/u,
+    );
+  }
+});
+
+test("an existing documentation index is reusable only for the two exact tested executables", () => {
+  const variants = { amd64: digest("c"), arm64: digest("d") };
+  const index = {
+    schemaVersion: 2,
+    mediaType: "application/vnd.oci.image.index.v1+json",
+    digest: digest("a"),
+    manifests: [
+      {
+        digest: variants.amd64,
+        platform: { os: "linux", architecture: "amd64" },
+      },
+      {
+        digest: variants.arm64,
+        platform: { os: "linux", architecture: "arm64", variant: "v8" },
+      },
+    ],
+  };
+  assert.equal(verifyDocumentationIndex(index, variants), index.digest);
+  assert.throws(
+    () => verifyDocumentationIndex(index, { ...variants, arm64: digest("e") }),
+    /conflicting/u,
+  );
+  assert.throws(
+    () =>
+      verifyDocumentationIndex(
+        { ...index, manifests: [index.manifests[0], index.manifests[0]] },
+        variants,
+      ),
+    /conflicting/u,
+  );
+  assert.throws(
+    () =>
+      verifyDocumentationIndex(
+        {
+          ...index,
+          manifests: [
+            ...index.manifests,
+            {
+              digest: digest("e"),
+              platform: { os: "unknown", architecture: "unknown" },
+            },
+          ],
+        },
+        variants,
+      ),
+    /exactly/u,
+  );
+});
+
+test("publication contracts and write authority stay separate from tag and PR candidate code", async () => {
+  const candidate = await readFile(
+    new URL(
+      "../../.github/workflows/documentation-candidate.yml",
+      import.meta.url,
+    ),
+    "utf8",
+  );
+  const publisher = await readFile(
+    new URL("../../.github/workflows/documentation-image.yml", import.meta.url),
+    "utf8",
+  );
+  assert.doesNotMatch(candidate, /packages:\s*write|docker login|secrets\./u);
+  assert.match(
+    candidate,
+    /node deploy\/documentation\/smoke\.mjs colossus-documentation:candidate/u,
+  );
+  assert.match(candidate, /if: github\.event_name == 'push'/u);
+  assert.match(candidate, /if \[\[ "\$EVENT_NAME" == push \]\]; then/u);
+  assert.equal(
+    publisher.match(
+      /ref: \$\{\{ needs\.publisher-revision\.outputs\.revision \}\}/gu,
+    )?.length,
+    2,
+  );
+  assert.equal(publisher.match(/packages: write/gu)?.length, 1);
+  assert.match(publisher, /github\.ref == 'refs\/heads\/main'/u);
+  assert.match(publisher, /needs: \[publisher-revision, contracts\]/u);
+});
diff --git a/scripts/ci/publish-control-plane-image.sh b/scripts/ci/publish-control-plane-image.sh
new file mode 100644
index 000000000..bc78b9f8c
--- /dev/null
+++ b/scripts/ci/publish-control-plane-image.sh
@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+set -euo pipefail
+umask 077
+
+tag=${RELEASE_TAG:?Release tag is required}
+image=ghcr.io/obscuritylabs/colossus-control-plane
+node --input-type=module - "$tag" <<'JS'
+import { validateRequest } from './scripts/ci/verify-control-plane-assets.mjs';
+validateRequest(process.argv[2]);
+JS
+node --input-type=module - "$(docker version --format '{{.Server.APIVersion}}')" <<'JS'
+const version = process.argv[2];
+if (!/^\d+\.\d+$/u.test(version)) throw new Error('Docker server API version is unavailable.');
+const [major, minor] = version.split('.').map(Number);
+if (major < 1 || (major === 1 && minor < 46)) throw new Error('Docker API 1.46 or later is required for explicit platform publication.');
+JS
+test "$(gh release view "$tag" --json isDraft --jq .isDraft)" = false
+git fetch origin main "refs/tags/$tag:refs/tags/$tag"
+test "$(git cat-file -t "$tag")" = tag
+commit=$(git rev-list -n 1 "$tag")
+git merge-base --is-ancestor "$commit" origin/main
+
+run=$(gh run list --workflow release.yml --branch "$tag" --event push --status success \
+  --json databaseId,headSha --jq ".[] | select(.headSha == \"$commit\") | .databaseId" | head -n 1)
+test -n "$run"
+test "$(gh api "repos/obscuritylabs/Colossus/actions/runs/$run" --jq .head_sha)" = "$commit"
+test "$(gh api "repos/obscuritylabs/Colossus/actions/runs/$run" --jq .event)" = push
+test "$(gh api "repos/obscuritylabs/Colossus/actions/runs/$run" --jq .conclusion)" = success
+
+output=${RUNNER_TEMP:?Runner temporary directory is required}/control-plane-image
+mkdir -p "$output/trusted" "$output/published"
+for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
+  gh run download "$run" --name "colossus-control-plane-$target" --dir "$output/trusted"
+done
+gh release download "$tag" --pattern 'Colossus-Control-Plane-*' --dir "$output/published"
+node scripts/ci/verify-control-plane-assets.mjs "$output/trusted" "$output/published" "$tag" > "$output/assets.json"
+
+# Only explicit not-found responses permit creation. Authorization, rate-limit and
+# transport failures do not become permission to overwrite an existing immutable tag.
+inspect() {
+  local ref=$1 destination=$2
+  if docker buildx imagetools inspect "$ref" --format '{{json .Manifest}}' > "$destination" 2> "$output/inspect-error"; then
+    return 0
+  fi
+  local error
+  error=$(<"$output/inspect-error")
+  if [[ "$error" == *'manifest unknown'* || "$error" == *'MANIFEST_UNKNOWN'* || "$error" == *'404 Not Found'* || "$error" == *"$ref: not found"* ]]; then return 1; fi
+  cat "$output/inspect-error" >&2
+  return 2
+}
+
+for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu; do
+  if [[ "$target" == x86_64-* ]]; then arch=amd64; else arch=arm64; fi
+  archive="$output/trusted/Colossus-Control-Plane-${tag}-${target}.docker.tar.gz"
+  expected=$(node --input-type=module - "$archive" "$arch" "$tag" "$commit" <<'JS'
+import { readSavedImageConfig } from './scripts/ci/verify-control-plane-assets.mjs';
+const [archive, arch, tag, commit] = process.argv.slice(2);
+console.log(readSavedImageConfig(archive, {arch, tag, commit}).config_digest);
+JS
+  )
+  docker load --input "$archive"
+  test "$(docker image inspect colossus-control-plane:release --format '{{.Architecture}}')" = "$arch"
+  test "$(docker image inspect colossus-control-plane:release --format '{{.Config.User}}')" = 10001:10001
+  test "$(docker image inspect colossus-control-plane:release --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$commit"
+  test "$(docker image inspect colossus-control-plane:release --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = "$tag"
+  ref="$image:$tag-$arch"
+  if inspect "$ref" "$output/$arch.json"; then
+    : # Verify the existing immutable executable below; never overwrite it.
+  else
+    status=$?
+    test "$status" = 1
+    docker tag colossus-control-plane:release "$ref"
+    # Publish the executable manifest explicitly. Containerd archives can contain a
+    # parent index and default provenance; those are not executable platform digests.
+    docker push --platform "linux/$arch" "$ref"
+    inspect "$ref" "$output/$arch.json"
+  fi
+  executable=$(node --input-type=module - "$output/$arch.json" <<'JS'
+import { readFile } from 'node:fs/promises';
+import { executableDescriptorDigest } from './scripts/ci/verify-control-plane-assets.mjs';
+console.log(executableDescriptorDigest(JSON.parse(await readFile(process.argv[2], 'utf8'))));
+JS
+  )
+  # Resolve metadata by the captured digest, not a mutable architecture tag.
+  docker buildx imagetools inspect "$image@$executable" --raw > "$output/$arch-manifest.json"
+  node --input-type=module - "$output/$arch-manifest.json" "$expected" <<'JS'
+import { readFile } from 'node:fs/promises';
+import { verifyExecutableManifest } from './scripts/ci/verify-control-plane-assets.mjs';
+verifyExecutableManifest(JSON.parse(await readFile(process.argv[2], 'utf8')), process.argv[3]);
+JS
+  # The config binds uncompressed rootfs digests, but a manifest can claim that config
+  # with conflicting layer descriptors. Pull the immutable executable so the engine
+  # verifies the actual layer downloads and rootfs before the final index advertises it.
+  docker pull --platform "linux/$arch" "$image@$executable"
+  printf '%s\n' "$executable" > "$output/$arch.digest"
+done
+
+if inspect "$image:$tag" "$output/index.json"; then
+  : # Verify the existing exact-platform index below; never overwrite it.
+else
+  status=$?
+  test "$status" = 1
+  docker buildx imagetools create --tag "$image:$tag" "$image@$(<"$output/amd64.digest")" "$image@$(<"$output/arm64.digest")"
+  inspect "$image:$tag" "$output/index.json"
+fi
+node --input-type=module - "$output" "$image:$tag" "$commit" <<'JS'
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const [directory, image, commit] = process.argv.slice(2);
+const load = async name => JSON.parse(await readFile(join(directory,name),'utf8'));
+const index = await load('index.json');
+const variants = await Promise.all(['amd64.json','arm64.json'].map(load));
+const manifests = index.manifests ?? [];
+if (manifests.length !== 2 || !/^sha256:[a-f0-9]{64}$/u.test(index.digest)) throw new Error('Published index is invalid.');
+for (const [position, arch] of ['amd64','arm64'].entries()) {
+  if (!manifests.some(item => item.digest === variants[position].digest && item.platform?.os === 'linux' && item.platform?.architecture === arch))
+    throw new Error('Published image differs from the verified release platforms.');
+}
+const evidence = {image,digest:index.digest,source_commit:commit,platforms:manifests.map(item=>({digest:item.digest,platform:item.platform}))};
+await writeFile(join(directory,'publication.json'),JSON.stringify(evidence,null,2)+'\n');
+console.log(JSON.stringify(evidence));
+JS
diff --git a/scripts/ci/publish-documentation-image.sh b/scripts/ci/publish-documentation-image.sh
new file mode 100644
index 000000000..14927cb4a
--- /dev/null
+++ b/scripts/ci/publish-documentation-image.sh
@@ -0,0 +1,141 @@
+#!/usr/bin/env bash
+set -euo pipefail
+umask 077
+
+tag=${RELEASE_TAG:?Release tag is required}
+image=ghcr.io/obscuritylabs/colossus-documentation
+node --input-type=module - "$tag" <<'JS'
+import { validateRequest } from './scripts/ci/verify-control-plane-assets.mjs';
+validateRequest(process.argv[2]);
+JS
+node --input-type=module - "$(docker version --format '{{.Server.APIVersion}}')" <<'JS'
+const version = process.argv[2];
+if (!/^\d+\.\d+$/u.test(version)) throw new Error('Docker server API version is unavailable.');
+const [major, minor] = version.split('.').map(Number);
+if (major < 1 || (major === 1 && minor < 46)) throw new Error('Docker API 1.46 or later is required for explicit platform publication.');
+JS
+
+git fetch origin refs/heads/main:refs/remotes/origin/main "refs/tags/$tag:refs/tags/$tag"
+test "$(git cat-file -t "$tag")" = tag
+commit=$(git rev-parse "$tag^{commit}")
+git merge-base --is-ancestor "$commit" origin/main
+output=${RUNNER_TEMP:?Runner temporary directory is required}/documentation-image
+mkdir -p "$output/trusted"
+gh api "repos/obscuritylabs/Colossus/releases/tags/$tag" > "$output/release.json"
+
+for workflow in release.yml documentation-candidate.yml; do
+  gh api "repos/obscuritylabs/Colossus/actions/workflows/$workflow/runs?event=push&status=success&head_sha=$commit&per_page=100" > "$output/$workflow-runs.json"
+  run=$(node --input-type=module - "$output/$workflow-runs.json" "$workflow" "$tag" "$commit" <<'JS'
+import { readFile } from 'node:fs/promises';
+import { matchingDocumentationSourceRun } from './scripts/ci/documentation-candidate.mjs';
+const [path, workflow, tag, commit] = process.argv.slice(2);
+const response = JSON.parse(await readFile(path, 'utf8'));
+console.log(matchingDocumentationSourceRun(response.workflow_runs, workflow, tag, commit).run_id);
+JS
+  )
+  gh api "repos/obscuritylabs/Colossus/actions/runs/$run" > "$output/$workflow-run.json"
+  if [[ "$workflow" == documentation-candidate.yml ]]; then
+    for arch in amd64 arm64; do
+      gh run download "$run" --repo obscuritylabs/Colossus --name "colossus-documentation-$arch" --dir "$output/trusted"
+    done
+  fi
+done
+
+# Validate both complete source-bound candidates before the first registry write.
+node --input-type=module - "$output" "$tag" "$commit" "$(git rev-parse HEAD)" <<'JS'
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { verifyPublishedDocumentationRelease, verifyDocumentationSourceRun, verifyDocumentationCandidate } from './scripts/ci/documentation-candidate.mjs';
+const [directory, tag, commit, publisher] = process.argv.slice(2);
+const load = async name => JSON.parse(await readFile(join(directory, name), 'utf8'));
+const release = verifyPublishedDocumentationRelease(await load('release.json'), tag);
+const releaseBuild = verifyDocumentationSourceRun(await load('release.yml-run.json'), 'release.yml', tag, commit);
+const candidateBuild = verifyDocumentationSourceRun(await load('documentation-candidate.yml-run.json'), 'documentation-candidate.yml', tag, commit);
+const candidates = await Promise.all(['amd64', 'arm64'].map(arch => verifyDocumentationCandidate(join(directory, 'trusted'), tag, commit, arch)));
+const evidence = { ...release, source_commit: commit, publisher_commit: publisher, release_build: releaseBuild, candidate_build: candidateBuild, candidates };
+await writeFile(join(directory, 'provenance.json'), JSON.stringify(evidence, null, 2) + '\n');
+JS
+
+# Only an explicit registry not-found response allows creation. Authentication,
+# rate-limit, transport, and conflicting immutable versions all fail closed.
+inspect() {
+  local ref=$1 destination=$2 error
+  if docker buildx imagetools inspect "$ref" --format '{{json .Manifest}}' > "$destination" 2> "$output/inspect-error"; then return 0; fi
+  error=$(<"$output/inspect-error")
+  if [[ "$error" == *'manifest unknown'* || "$error" == *'MANIFEST_UNKNOWN'* || "$error" == *'404 Not Found'* || "$error" == *"$ref: not found"* ]]; then return 1; fi
+  cat "$output/inspect-error" >&2
+  return 2
+}
+
+for arch in amd64 arm64; do
+  archive="$output/trusted/Colossus-Documentation-${tag}-linux-${arch}.docker.tar.gz"
+  expected=$(node --input-type=module - "$output/trusted" "$tag" "$commit" "$arch" <<'JS'
+import { verifyDocumentationCandidate } from './scripts/ci/documentation-candidate.mjs';
+const [directory, tag, commit, arch] = process.argv.slice(2);
+console.log((await verifyDocumentationCandidate(directory, tag, commit, arch)).config_digest);
+JS
+  )
+  docker load --input "$archive"
+  test "$(docker image inspect colossus-documentation:candidate --format '{{.Architecture}}')" = "$arch"
+  test "$(docker image inspect colossus-documentation:candidate --format '{{.Config.User}}')" = 10001:10001
+  test "$(docker image inspect colossus-documentation:candidate --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$commit"
+  test "$(docker image inspect colossus-documentation:candidate --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = "$tag"
+  ref="$image:$tag-$arch"
+  if inspect "$ref" "$output/$arch.json"; then
+    : # Existing version tags are verified below and never overwritten.
+  else
+    status=$?
+    test "$status" = 1
+    docker tag colossus-documentation:candidate "$ref"
+    docker push --platform "linux/$arch" "$ref"
+    inspect "$ref" "$output/$arch.json"
+  fi
+  executable=$(node --input-type=module - "$output/$arch.json" <<'JS'
+import { readFile } from 'node:fs/promises';
+import { executableDescriptorDigest } from './scripts/ci/verify-control-plane-assets.mjs';
+console.log(executableDescriptorDigest(JSON.parse(await readFile(process.argv[2], 'utf8'))));
+JS
+  )
+  docker buildx imagetools inspect "$image@$executable" --raw > "$output/$arch-manifest.json"
+  node --input-type=module - "$output/$arch-manifest.json" "$expected" <<'JS'
+import { readFile } from 'node:fs/promises';
+import { verifyExecutableManifest } from './scripts/ci/verify-control-plane-assets.mjs';
+verifyExecutableManifest(JSON.parse(await readFile(process.argv[2], 'utf8')), process.argv[3]);
+JS
+  docker pull --platform "linux/$arch" "$image@$executable"
+  printf '%s\n' "$executable" > "$output/$arch.digest"
+done
+
+# Recheck release publication before advertising either platform at the exact tag.
+gh api "repos/obscuritylabs/Colossus/releases/tags/$tag" > "$output/release-current.json"
+node --input-type=module - "$output" "$tag" <<'JS'
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { verifyPublishedDocumentationRelease } from './scripts/ci/documentation-candidate.mjs';
+const [directory, tag] = process.argv.slice(2);
+const previous = JSON.parse(await readFile(join(directory, 'provenance.json'), 'utf8'));
+const current = verifyPublishedDocumentationRelease(JSON.parse(await readFile(join(directory, 'release-current.json'), 'utf8')), tag);
+if (current.release_id !== previous.release_id || current.published_at !== previous.published_at) throw new Error('The reviewed release changed during publication.');
+JS
+if inspect "$image:$tag" "$output/index.json"; then
+  : # The exact existing index must match both verified platform digests.
+else
+  status=$?
+  test "$status" = 1
+  docker buildx imagetools create --tag "$image:$tag" "$image@$(<"$output/amd64.digest")" "$image@$(<"$output/arm64.digest")"
+  inspect "$image:$tag" "$output/index.json"
+fi
+node --input-type=module - "$output" "$image:$tag" <<'JS'
+import { readFile, writeFile, appendFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { verifyDocumentationIndex } from './scripts/ci/documentation-candidate.mjs';
+const [directory, image] = process.argv.slice(2);
+const index = JSON.parse(await readFile(join(directory, 'index.json'), 'utf8'));
+const variants = Object.fromEntries(await Promise.all(['amd64', 'arm64'].map(async arch => [arch, (await readFile(join(directory, arch + '.digest'), 'utf8')).trim()])));
+const digest = verifyDocumentationIndex(index, variants);
+const provenance = JSON.parse(await readFile(join(directory, 'provenance.json'), 'utf8'));
+const evidence = { image, digest, source_commit: provenance.source_commit, publisher_commit: provenance.publisher_commit, release_id: provenance.release_id, candidate_build: provenance.candidate_build, platforms: index.manifests.map(item => ({digest: item.digest, platform: item.platform})) };
+await writeFile(join(directory, 'publication.json'), JSON.stringify(evidence, null, 2) + '\n');
+if (process.env.GITHUB_STEP_SUMMARY) await appendFile(process.env.GITHUB_STEP_SUMMARY, `Documentation image: \`${image}\`\n\nVerified digest: \`${digest}\`\n\nAnonymous digest pull must pass before advertising public availability.\n`);
+console.log(JSON.stringify(evidence));
+JS
diff --git a/scripts/ci/release-source-version.test.mjs b/scripts/ci/release-source-version.test.mjs
index 5579b204e..161f97168 100644
--- a/scripts/ci/release-source-version.test.mjs
+++ b/scripts/ci/release-source-version.test.mjs
@@ -53,7 +53,11 @@ test("test releases keep signing and omit incompatible bootstrap installers", ()
   assert.ok(gate.includes('windows_cli_sign="$WINDOWS_CLI_SIGN_RESULT"'));
   assert.ok(gate.includes('desktop_windows_signed="$WINDOWS_SIGNED_DESKTOP_RESULT"'));
   const draft = workflow.slice(workflow.indexOf("  draft-release:"));
-  assert.ok(draft.includes('expected_assets=18'));
+  assert.ok(draft.includes('expected_assets=38'));
+  assert.ok(gate.includes('control_plane=${{ needs.control_plane.result }}'));
+  assert.ok(gate.includes('vscode=${{ needs.vscode.result }}'));
+  assert.ok(draft.includes('Colossus-Control-Plane-${RELEASE_TAG}-${target}.docker.tar.gz'));
+  assert.ok(draft.includes('Colossus-VSCode-${RELEASE_TAG}-${target}.vsix'));
   assert.ok(draft.includes('if [ "$TEST_RELEASE" != true ]; then'));
   assert.ok(draft.includes("CLI archives retain the source version"));
 });
diff --git a/scripts/ci/test-contracts.sh b/scripts/ci/test-contracts.sh
index a48e51ebd..ab09e1a24 100755
--- a/scripts/ci/test-contracts.sh
+++ b/scripts/ci/test-contracts.sh
@@ -90,6 +90,11 @@ expect_classification 'rust_required=true
 docs_required=false
 dependency_required=false
 sdk_required=false
+desktop_required=true' apps/web/src/App.tsx
+expect_classification 'rust_required=true
+docs_required=false
+dependency_required=false
+sdk_required=false
 desktop_required=true' crates/colossus-darwin-process/src/lib.rs
 expect_classification 'rust_required=true
 docs_required=false
@@ -214,4 +219,7 @@ trap - EXIT HUP INT TERM
 "${NODE:-node}" --test "$script_dir/homebrew-formula.test.mjs"
 "${NODE:-node}" --test "$script_dir/ripgrep-pin.test.mjs"
 "${NODE:-node}" --test "$script_dir/release-oci.test.mjs"
+"${NODE:-node}" --test "$script_dir/control-plane-assets.test.mjs"
+"${NODE:-node}" --test "$script_dir/documentation-candidate.test.mjs"
 "${NODE:-node}" --test "$script_dir/release-source-version.test.mjs"
+"${NODE:-node}" --test "$script_dir/../development-launch.test.mjs"
diff --git a/scripts/ci/verify-control-plane-assets.mjs b/scripts/ci/verify-control-plane-assets.mjs
new file mode 100644
index 000000000..97c0ceb03
--- /dev/null
+++ b/scripts/ci/verify-control-plane-assets.mjs
@@ -0,0 +1,110 @@
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { createReadStream } from "node:fs";
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+export const serverTargets = ["x86_64-unknown-linux-gnu", "aarch64-unknown-linux-gnu"];
+const sha256 = /^sha256:[a-f0-9]{64}$/u;
+const imageMediaTypes = new Set([
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.docker.distribution.manifest.v2+json",
+]);
+export function validateRequest(tag, commit) {
+  if (typeof tag !== "string" || tag.trim() !== tag || tag.length > 128 || !/^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-preview\.[1-9]\d*)?$/u.test(tag))
+    throw new Error("A stable or preview release tag is required.");
+  if (commit !== undefined && (typeof commit !== "string" || commit.trim() !== commit || !/^[a-f0-9]{40}$/u.test(commit)))
+    throw new Error("An exact source commit is required.");
+}
+async function digest(path) {
+  const file = await lstat(path);
+  if (!file.isFile()) throw new Error("Release assets must be regular files.");
+  const hash = createHash("sha256");
+  for await (const block of createReadStream(path)) hash.update(block);
+  return { hash: hash.digest("hex"), size: file.size };
+}
+async function verify(directory, filename) {
+  const checksumPath = join(directory, `${filename}.sha256`);
+  const checksumFile = await lstat(checksumPath);
+  if (!checksumFile.isFile() || checksumFile.size > 1024)
+    throw new Error("Checksum sidecar is invalid.");
+  const checksum = (await readFile(checksumPath, "utf8")).trimEnd();
+  const actual = await digest(join(directory, filename));
+  if (checksum !== `${actual.hash}  ${filename}`)
+    throw new Error("Release asset checksum or filename disagrees.");
+  return actual;
+}
+// Mutable release sidecars alone are insufficient: compare every byte to the successful
+// protected tag build's Actions artifact before Docker loads or publishes an image.
+export async function verifyControlPlaneAssets(trusted, published, tag) {
+  validateRequest(tag);
+  const inventory = [];
+  for (const target of serverTargets) {
+    for (const suffix of ["tar.gz", "docker.tar.gz"]) {
+      const filename = `Colossus-Control-Plane-${tag}-${target}.${suffix}`;
+      const expected = await verify(trusted, filename);
+      const actual = await verify(published, filename);
+      if (actual.hash !== expected.hash || actual.size !== expected.size)
+        throw new Error("Release asset differs from the trusted tag build.");
+      inventory.push({ filename, sha256: actual.hash, size: actual.size });
+    }
+  }
+  return inventory;
+}
+
+export function savedImageConfigPath(manifest, imageName = "colossus-control-plane:release") {
+  if (!Array.isArray(manifest) || manifest.length !== 1 ||
+      !Array.isArray(manifest[0].RepoTags) || manifest[0].RepoTags.length !== 1 ||
+      manifest[0].RepoTags[0] !== imageName ||
+      typeof manifest[0].Config !== "string" ||
+      !/^(?:blobs\/sha256\/[a-f0-9]{64}|[a-f0-9]{64}\.json)$/u.test(manifest[0].Config))
+    throw new Error("Saved image must contain exactly the trusted release image.");
+  return manifest[0].Config;
+}
+
+export function verifySavedImageConfig(manifest, configBytes, { arch, tag, commit, imageName }) {
+  if (typeof commit !== "string") throw new Error("An exact source commit is required.");
+  validateRequest(tag, commit);
+  if (!["amd64", "arm64"].includes(arch)) throw new Error("Unsupported image architecture.");
+  const path = savedImageConfigPath(manifest, imageName);
+  const expected = path.startsWith("blobs/") ? path.slice("blobs/sha256/".length) : path.slice(0, -5);
+  if (createHash("sha256").update(configBytes).digest("hex") !== expected)
+    throw new Error("Saved image config digest disagrees with its bytes.");
+  const config = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(configBytes));
+  if (config.os !== "linux" || config.architecture !== arch || config.config?.User !== "10001:10001" ||
+      config.config?.Labels?.["org.opencontainers.image.revision"] !== commit ||
+      config.config?.Labels?.["org.opencontainers.image.version"] !== tag)
+    throw new Error("Saved image config differs from the trusted release identity.");
+  return { architecture: arch, config_digest: `sha256:${expected}` };
+}
+
+// Docker save includes manifest.json in both classic and containerd archives. Read only
+// its bounded config member, never extract archive paths or assume Docker .Id is a config
+// digest: containerd can report the parent index (including attestations) instead.
+export function readSavedImageConfig(archive, options) {
+  const member = path => execFileSync("tar", ["-xOf", archive, path], { maxBuffer: 1024 * 1024 });
+  const manifest = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(member("manifest.json")));
+  const path = savedImageConfigPath(manifest, options.imageName);
+  return verifySavedImageConfig(manifest, member(path), options);
+}
+
+export function verifyExecutableManifest(manifest, configDigest) {
+  if (!sha256.test(configDigest) || manifest?.schemaVersion !== 2 ||
+      !imageMediaTypes.has(manifest.mediaType) || manifest.manifests !== undefined ||
+      manifest.config?.digest !== configDigest || !Array.isArray(manifest.layers) ||
+      manifest.layers.length === 0 || !manifest.layers.every(layer => sha256.test(layer.digest)))
+    throw new Error("Refusing a conflicting config or non-executable platform manifest.");
+}
+
+export function executableDescriptorDigest(descriptor) {
+  if (!sha256.test(descriptor?.digest) || !imageMediaTypes.has(descriptor.mediaType) || descriptor.manifests !== undefined)
+    throw new Error("An immutable single-platform executable manifest is required.");
+  return descriptor.digest;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const [trusted, published, tag] = process.argv.slice(2);
+  if (!trusted || !published || !tag || process.argv.length !== 5)
+    throw new Error("usage: verify-control-plane-assets.mjs TRUSTED PUBLISHED TAG");
+  console.log(JSON.stringify(await verifyControlPlaneAssets(trusted, published, tag)));
+}
diff --git a/scripts/colossus-dev b/scripts/colossus-dev
index 95aef7568..b447ae690 100755
--- a/scripts/colossus-dev
+++ b/scripts/colossus-dev
@@ -8,6 +8,13 @@ fail() {
 
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
 repository=$(CDPATH= cd -- "$script_dir/.." && pwd -P)
+development_custody=false
+if [ "${1:-}" = --dev-credentials ]; then
+    development_custody=true
+    shift
+    [ -n "${COLOSSUS_HOME:-}" ] || fail "--dev-credentials requires an explicit private COLOSSUS_HOME outside the workspace"
+    case "$COLOSSUS_HOME" in /*) ;; *) fail "COLOSSUS_HOME must be absolute" ;; esac
+fi
 config=${COLOSSUS_DEV_CONFIG:-"$repository/.colossus/config.dev.yaml"}
 source_config=${COLOSSUS_DEV_SOURCE_CONFIG:-"$repository/.colossus/config.yaml"}
 keys_file=${COLOSSUS_DEV_KEYS_FILE:-"$repository/.colossus/dev-keys.env"}
@@ -24,10 +31,15 @@ mkdir -p -- "$config_dir" "$keys_dir"
 
 cd -- "$repository"
 unset COLOSSUS_DEV_JOURNAL_KEY COLOSSUS_DEV_SIGNING_KEY
-cargo build --offline -q --target-dir "$repository/target" -p colossus-cli --bin colossus
+node "$script_dir/development-launch.mjs" -- cargo build --offline -q --target-dir "$repository/target" -p colossus-cli --bin colossus
 colossus="$repository/target/debug/colossus"
 [ -x "$colossus" ] || fail "development binary was not created: $colossus"
 
+if [ "$development_custody" = true ]; then
+    [ -f "$config" ] || fail "--dev-credentials requires a reviewed existing configuration; prepare dev-credentials plan/rewrap before launch"
+    exec node "$script_dir/development-launch.mjs" --authority-home "$COLOSSUS_HOME" --workspace "$repository" --cli "$colossus" -- "$colossus" --config "$config" "$@"
+fi
+
 if [ ! -e "$config" ]; then
     if [ -e "$source_config" ]; then
         "$colossus" --config "$config" config init --development --from "$source_config"
diff --git a/scripts/desktop-dev b/scripts/desktop-dev
index d35543c9d..8cdada0b7 100755
--- a/scripts/desktop-dev
+++ b/scripts/desktop-dev
@@ -9,6 +9,19 @@ fail() {
 script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
 repository=$(CDPATH= cd -- "$script_dir/.." && pwd -P)
 desktop="$repository/apps/desktop"
+development_custody=false
+dictation=false
+for argument in "$@"; do
+    case "$argument" in
+        --dev-credentials) [ "$development_custody" = false ] || fail "duplicate --dev-credentials"; development_custody=true ;;
+        --dictation) [ "$dictation" = false ] || fail "duplicate --dictation"; dictation=true ;;
+        *) fail "usage: scripts/desktop-dev [--dev-credentials] [--dictation]" ;;
+    esac
+done
+if [ "$development_custody" = true ]; then
+    [ -n "${COLOSSUS_HOME:-}" ] || fail "--dev-credentials requires an explicit private COLOSSUS_HOME outside the workspace"
+    case "$COLOSSUS_HOME" in /*) ;; *) fail "COLOSSUS_HOME must be absolute" ;; esac
+fi
 
 command -v npm >/dev/null 2>&1 || fail "npm is not installed or not on PATH"
 command -v cargo >/dev/null 2>&1 || fail "cargo is not installed or not on PATH"
@@ -33,11 +46,17 @@ try {
 fi
 
 cd "$desktop"
-npm ci --ignore-scripts
+node "$script_dir/development-launch.mjs" -- npm ci --ignore-scripts
+
+if [ "$development_custody" = true ]; then
+    cd "$repository"
+    node "$script_dir/development-launch.mjs" -- cargo xtask desktop prepare --profile debug
+    target=$(rustc -vV | sed -n 's/^host: //p')
+    cli="$desktop/src-tauri/binaries/colossus-$target"
+    [ -x "$cli" ] || fail "prepared development CLI is unavailable"
+    cd "$desktop"
+    exec node "$script_dir/development-launch.mjs" --authority-home "$COLOSSUS_HOME" --workspace "$repository" --cli "$cli" -- npm run tauri -- dev -- --locked
+fi
 
-case "${1:-}" in
-    "") exec npm run tauri:dev ;;
-    --dictation) [ "$#" -eq 1 ] || fail "usage: scripts/desktop-dev [--dictation]"
-        exec npm run tauri:dev:dictation ;;
-    *) fail "usage: scripts/desktop-dev [--dictation]" ;;
-esac
+if [ "$dictation" = true ]; then command=tauri:dev:dictation; else command=tauri:dev; fi
+exec node "$script_dir/development-launch.mjs" -- npm run "$command"
diff --git a/scripts/desktop-dev.ps1 b/scripts/desktop-dev.ps1
index 525a3e351..a1175644d 100644
--- a/scripts/desktop-dev.ps1
+++ b/scripts/desktop-dev.ps1
@@ -1,7 +1,12 @@
+param([Alias("DevCredentials")][switch] $DevelopmentCredentials)
 $ErrorActionPreference = "Stop"
 $Repository = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
 $Desktop = Join-Path $Repository "apps/desktop"
 $Connection = Join-Path $Desktop "src-tauri/connection.local.json"
+$DevelopmentLauncher = Join-Path $PSScriptRoot "development-launch.mjs"
+if ($DevelopmentCredentials -and [string]::IsNullOrWhiteSpace($env:COLOSSUS_HOME)) {
+    throw "-DevCredentials requires an explicit private COLOSSUS_HOME outside the workspace"
+}
 
 function Test-AbsoluteDevPath {
     param(
@@ -145,7 +150,7 @@ if (Test-Path $Connection) {
 
 Push-Location $Repository
 try {
-    cargo xtask desktop prepare --profile debug
+    node $DevelopmentLauncher -- cargo xtask desktop prepare --profile debug
     if ($LASTEXITCODE -ne 0) {
         throw "desktop managed runtime preparation failed"
     }
@@ -156,11 +161,18 @@ finally {
 
 Push-Location $Desktop
 try {
-    npm ci --ignore-scripts
+    node $DevelopmentLauncher -- npm ci --ignore-scripts
     if ($LASTEXITCODE -ne 0) {
         throw "desktop dependency installation failed"
     }
-    npm run tauri:dev
+    if ($DevelopmentCredentials) {
+        $HostTarget = (& rustc -vV | Select-String '^host: ').ToString().Substring(6)
+        $PreparedCli = Join-Path $Desktop "src-tauri/binaries/colossus-$HostTarget.exe"
+        node $DevelopmentLauncher --authority-home $env:COLOSSUS_HOME --workspace $Repository --cli $PreparedCli -- npm run tauri -- dev -- --locked
+    }
+    else {
+        node $DevelopmentLauncher -- npm run tauri:dev
+    }
     if ($LASTEXITCODE -ne 0) {
         throw "desktop development application failed"
     }
diff --git a/scripts/development-launch.mjs b/scripts/development-launch.mjs
new file mode 100644
index 000000000..f5cbbb0a8
--- /dev/null
+++ b/scripts/development-launch.mjs
@@ -0,0 +1,108 @@
+// Trusted launcher environment seam. This module never reads wrapping key bytes.
+import { spawn, spawnSync } from "node:child_process";
+import { isAbsolute } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const selectorName = "COLOSSUS_DEVELOPMENT_CREDENTIAL_AUTHORITY";
+const legacyKeys = new Set([
+  "COLOSSUS_DEV_JOURNAL_KEY",
+  "COLOSSUS_DEV_SIGNING_KEY",
+  "COLOSSUS_JOURNAL_KEY",
+  "COLOSSUS_SIGNING_KEY",
+]);
+export function developmentEnvironment(input, selector) {
+  const output = {};
+  for (const [name, value] of Object.entries(input)) {
+    const normalized = name.toUpperCase();
+    if (
+      normalized.startsWith("COLOSSUS_DEVELOPMENT_") ||
+      legacyKeys.has(normalized)
+    )
+      continue;
+    if (value !== undefined) output[name] = value;
+  }
+  if (selector !== undefined) {
+    if (
+      !isAbsolute(selector) ||
+      selector.length > 4096 ||
+      /[\u0000-\u001f\u007f]/u.test(selector)
+    )
+      throw new Error("development authority must be an absolute bounded path");
+    output[selectorName] = selector;
+  }
+  return output;
+}
+function main(argv) {
+  const options = {};
+  while (argv.length && argv[0] !== "--") {
+    const flag = argv.shift();
+    if (
+      !["--authority-home", "--workspace", "--cli"].includes(flag) ||
+      !argv.length ||
+      options[flag] !== undefined
+    )
+      throw new Error(
+        "usage: development-launch.mjs [--authority-home HOME --workspace ROOT --cli CLI] -- COMMAND [ARG...]",
+      );
+    options[flag] = argv.shift();
+  }
+  if (argv.shift() !== "--" || !argv.length)
+    throw new Error("a development command is required");
+  let selector;
+  if (Object.keys(options).length) {
+    for (const flag of ["--authority-home", "--workspace", "--cli"])
+      if (!isAbsolute(options[flag] ?? ""))
+        throw new Error("development custody paths must be absolute");
+    const status = spawnSync(
+      options["--cli"],
+      [
+        "--output",
+        "json",
+        "dev-credentials",
+        "status",
+        "--home",
+        options["--authority-home"],
+        "--workspace",
+        options["--workspace"],
+      ],
+      {
+        env: developmentEnvironment(process.env),
+        encoding: "utf8",
+        maxBuffer: 32768,
+        timeout: 10000,
+      },
+    );
+    if (status.error || status.status !== 0)
+      throw new Error(
+        "development authority is not prepared and active; use the reviewed dev-credentials plan/rewrap flow before launching",
+      );
+    const metadata = JSON.parse(status.stdout);
+    if (metadata.active !== true || typeof metadata.authorityPath !== "string")
+      throw new Error(
+        "development authority is inactive; explicit reviewed activation is required",
+      );
+    selector = metadata.authorityPath;
+  }
+  const command = argv.shift();
+  const child = spawn(command, argv, {
+    env: developmentEnvironment(process.env, selector),
+    stdio: "inherit",
+  });
+  for (const signal of ["SIGINT", "SIGTERM"])
+    process.on(signal, () => child.kill(signal));
+  child.on("error", () => {
+    console.error("development command could not start");
+    process.exitCode = 1;
+  });
+  child.on("exit", (code, signal) => {
+    process.exitCode = code ?? (signal === "SIGINT" ? 130 : 1);
+  });
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  try {
+    main(process.argv.slice(2));
+  } catch (error) {
+    console.error(`development launch: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/development-launch.test.mjs b/scripts/development-launch.test.mjs
new file mode 100644
index 000000000..80ef7e731
--- /dev/null
+++ b/scripts/development-launch.test.mjs
@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { developmentEnvironment, selectorName } from "./development-launch.mjs";
+
+test("development build/tool environments never contain wrapping controls or legacy journal keys", () => {
+  const input = {
+    PATH: "/trusted/bin",
+    COLOSSUS_DEVELOPMENT_CREDENTIAL_AUTHORITY: "/old",
+    COLOSSUS_DEVELOPMENT_CREDENTIAL_KEY: "synthetic",
+    COLOSSUS_DEVELOPMENT_OTHER_KEY: "synthetic",
+    COLOSSUS_DEV_JOURNAL_KEY: "synthetic",
+    COLOSSUS_DEV_SIGNING_KEY: "synthetic",
+    COLOSSUS_JOURNAL_KEY: "synthetic",
+    COLOSSUS_SIGNING_KEY: "synthetic",
+  };
+  assert.deepEqual(developmentEnvironment(input), { PATH: "/trusted/bin" });
+  assert.deepEqual(
+    developmentEnvironment(input, "/private/development-credentials"),
+    {
+      PATH: "/trusted/bin",
+      [selectorName]: "/private/development-credentials",
+    },
+  );
+  assert.equal(input.COLOSSUS_DEVELOPMENT_CREDENTIAL_KEY, "synthetic");
+});
+test("nonsecret selector rejects relative paths and control data", () => {
+  assert.throws(() => developmentEnvironment({}, "relative"));
+  assert.throws(() =>
+    developmentEnvironment({}, "/private/authority\ninvalid"),
+  );
+});
+test("case-insensitive Windows controls are removed while allowed spelling is preserved", () => {
+  assert.deepEqual(
+    developmentEnvironment({
+      Path: "/trusted",
+      colossus_development_credential_key: "synthetic",
+      CoLoSsUs_DeVeLoPmEnT_CrEdEnTiAl_AuThOrItY: "/old",
+      colossus_dev_journal_key: "synthetic",
+      Colossus_Signing_Key: "synthetic",
+    }),
+    { Path: "/trusted" },
+  );
+});
diff --git a/scripts/generate-doc-redirects b/scripts/generate-doc-redirects
index 92924da39..bb25c4dd3 100755
--- a/scripts/generate-doc-redirects
+++ b/scripts/generate-doc-redirects
@@ -4,8 +4,23 @@ set -euo pipefail
 readonly repository_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 readonly manifest="${1:-"${repository_root}/documentation/legacy-routes.tsv"}"
 readonly site_dir="${2:-"${repository_root}/site"}"
-readonly canonical_root="https://obscuritylabs.github.io/Colossus"
-readonly published_root="/Colossus"
+canonical_root="https://obscuritylabs.github.io/Colossus"
+published_root="/Colossus"
+# An optional mount root selects portable URLs for the on-prem container only.
+# Default builds retain the canonical GitHub Pages publication unchanged.
+if (( $# > 3 )); then
+  echo "usage: generate-doc-redirects [MANIFEST [SITE_DIR [MOUNT_ROOT]]]" >&2
+  exit 2
+fi
+if (( $# == 3 )); then
+  if [[ ! "$3" =~ ^(/([a-zA-Z0-9_-]+/)*[a-zA-Z0-9_-]+/?|/)$ ]]; then
+    echo "documentation mount root must be a clean root-relative path" >&2
+    exit 2
+  fi
+  published_root="${3%/}"
+  canonical_root="${published_root}"
+fi
+readonly canonical_root published_root
 
 if [[ ! -f "${manifest}" ]]; then
   echo "legacy route manifest not found: ${manifest}" >&2
diff --git a/scripts/package-desktop-linux b/scripts/package-desktop-linux
new file mode 100644
index 000000000..aac2dbaaf
--- /dev/null
+++ b/scripts/package-desktop-linux
@@ -0,0 +1,83 @@
+#!/bin/sh
+set -eu
+umask 077
+fail() { printf 'package-desktop-linux: %s\n' "$*" >&2; exit 1; }
+[ "$(uname -s)" = Linux ] || fail "Linux packaging requires a native Linux builder"
+[ "$#" -eq 0 ] || fail "usage: scripts/package-desktop-linux"
+case "${COLOSSUS_DESKTOP_RELEASE_CHANNEL:-}" in
+    developer_preview|validation_only) ;;
+    *) fail "select developer_preview or validation_only explicitly" ;;
+esac
+[ "${COLOSSUS_DESKTOP_TEAM_ID:-}" = UNSIGNED ] || fail "set COLOSSUS_DESKTOP_TEAM_ID=UNSIGNED"
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+repository=$(CDPATH= cd -- "$script_dir/.." && pwd -P)
+target=$(rustc --print host-tuple)
+case "$target" in
+    x86_64-unknown-linux-gnu) architecture=amd64 ;;
+    aarch64-unknown-linux-gnu) architecture=arm64 ;;
+    *) fail "unsupported native Linux target: $target" ;;
+esac
+desktop="$repository/apps/desktop"
+[ -x "$desktop/node_modules/.bin/tauri" ] || fail "install the Desktop npm dependencies first"
+version=$(node -p "JSON.parse(require('fs').readFileSync('$desktop/src-tauri/tauri.conf.json','utf8')).version")
+cd "$repository"
+cargo xtask desktop prepare --profile release --target "$target"
+search_target=$(printf '%s' "$target" | sed 's/-gnu$/-musl/')
+node scripts/stage-ripgrep.mjs --target "$search_target" --output "$desktop/src-tauri/binaries" --binary-name "rg-$target"
+cd "$desktop"
+"$desktop/node_modules/.bin/tauri" build --no-bundle -- --locked
+cd "$repository"
+native_target=${CARGO_TARGET_DIR:-$desktop/src-tauri/target}
+case "$native_target" in /*) ;; *) native_target="$repository/$native_target" ;; esac
+mkdir -p "$repository/dist/desktop-linux"
+output=$(CDPATH= cd -- "$repository/dist/desktop-linux" && pwd -P)
+stage=$(mktemp -d "$output/.package.XXXXXXXX")
+trap 'rm -rf -- "$stage"' EXIT HUP INT TERM
+bundle="$stage/usr/lib/colossus-desktop"
+mkdir -p "$bundle" "$stage/DEBIAN" "$stage/usr/bin" "$stage/usr/share/applications" "$stage/usr/share/icons/hicolor/scalable/apps"
+install -m 0755 "$native_target/release/colossus-desktop" "$bundle/colossus-desktop"
+for name in colossus-sidecar colossus rg; do
+    install -m 0755 "$desktop/src-tauri/binaries/$name-$target" "$bundle/$name"
+    strip "$bundle/$name"
+done
+strip "$bundle/colossus-desktop"
+mkdir -p "$bundle/dictation" "$bundle/ripgrep"
+install -m 0644 "$desktop/src-tauri/dictation-assets/ggml-tiny.en.bin" "$desktop/src-tauri/dictation-assets/models.json" "$desktop/src-tauri/dictation-assets/LICENSE-MIT" "$bundle/dictation/"
+install -m 0644 "$desktop/src-tauri/binaries/COPYING" "$desktop/src-tauri/binaries/LICENSE-MIT" "$desktop/src-tauri/binaries/UNLICENSE" "$bundle/ripgrep/"
+install -m 0644 "$repository/LICENSE" "$bundle/LICENSE"
+node scripts/write-desktop-bundle-manifest.mjs --target "$target" --release-channel "$COLOSSUS_DESKTOP_RELEASE_CHANNEL" --sidecar "$bundle/colossus-sidecar" --cli "$bundle/colossus" --ripgrep "$bundle/rg" --output "$bundle/colossus-bundle-manifest.json"
+node scripts/patch-desktop-manifest-binding.mjs --executable "$bundle/colossus-desktop" --manifest "$bundle/colossus-bundle-manifest.json"
+cat > "$stage/usr/bin/colossus-desktop" <<'LAUNCHER'
+#!/bin/sh
+exec /usr/lib/colossus-desktop/colossus-desktop "$@"
+LAUNCHER
+chmod 0755 "$stage/usr/bin/colossus-desktop"
+cat > "$stage/usr/share/applications/colossus-desktop.desktop" <<'DESKTOP'
+[Desktop Entry]
+Type=Application
+Name=Colossus Desktop
+Comment=Colossus agent workspaces
+Exec=colossus-desktop
+Icon=colossus-desktop
+Terminal=false
+Categories=Development;
+DESKTOP
+install -m 0644 "$repository/apps/ui/assets/colossus-mark.svg" "$stage/usr/share/icons/hicolor/scalable/apps/colossus-desktop.svg"
+cat > "$stage/DEBIAN/control" <<CONTROL
+Package: colossus-desktop
+Version: $version
+Architecture: $architecture
+Maintainer: Obscurity Labs <engineering@obscuritylabs.com>
+Section: devel
+Priority: optional
+Depends: libwebkit2gtk-4.1-0, libgtk-3-0, libayatana-appindicator3-1, libsecret-1-0, libxdo3, libssl3, libasound2
+Recommends: gnome-keyring
+Description: Colossus Desktop Developer Preview
+ Native workspaces and explicitly enrolled cloud runtime connections.
+CONTROL
+find "$stage" -type d -exec chmod 0755 {} +
+find "$stage" -type f ! -perm /111 -exec chmod 0644 {} +
+package="$output/colossus-desktop-$version-$target.deb"
+dpkg-deb --build --root-owner-group "$stage" "$package"
+(cd "$output" && sha256sum "${package##*/}" > "${package##*/}.sha256")
+printf 'Built Linux Desktop package: %s\n' "$package"
diff --git a/scripts/patch-desktop-manifest-binding.mjs b/scripts/patch-desktop-manifest-binding.mjs
index 6ef5df22d..866a27c06 100755
--- a/scripts/patch-desktop-manifest-binding.mjs
+++ b/scripts/patch-desktop-manifest-binding.mjs
@@ -44,13 +44,28 @@ const MACH_O_MAGICS = new Set([
 ]);
 
 function isPortableExecutable(executable) {
-  if (executable.length < 64 || executable[0] !== 0x4d || executable[1] !== 0x5a) {
+  if (
+    executable.length < 64 ||
+    executable[0] !== 0x4d ||
+    executable[1] !== 0x5a
+  ) {
     return false;
   }
   const headerOffset = executable.readUInt32LE(0x3c);
   return (
     headerOffset <= executable.length - 4 &&
-    executable.subarray(headerOffset, headerOffset + 4).equals(Buffer.from("PE\0\0"))
+    executable
+      .subarray(headerOffset, headerOffset + 4)
+      .equals(Buffer.from("PE\0\0"))
+  );
+}
+function isElfExecutable(executable) {
+  return (
+    executable.length >= 64 &&
+    executable.subarray(0, 4).equals(Buffer.from([0x7f, 0x45, 0x4c, 0x46])) &&
+    executable[4] === 2 &&
+    executable[5] === 1 &&
+    [2, 3].includes(executable.readUInt16LE(16))
   );
 }
 
@@ -175,9 +190,7 @@ function validateManifest(bytes) {
     ) ||
     !validExecutableEntry(
       manifest.cli,
-      manifest.targetTriple.includes("-windows-")
-        ? "colossus.exe"
-        : "colossus",
+      manifest.targetTriple.includes("-windows-") ? "colossus.exe" : "colossus",
     ) ||
     !validExecutableEntry(
       manifest.ripgrep,
@@ -209,9 +222,10 @@ try {
   if (
     executable.length < 4 ||
     (!MACH_O_MAGICS.has(executable.readUInt32BE(0)) &&
-      !isPortableExecutable(executable))
+      !isPortableExecutable(executable) &&
+      !isElfExecutable(executable))
   ) {
-    fail("executable is not a supported Mach-O or PE image");
+    fail("executable is not a supported Mach-O, PE, or ELF image");
   }
 
   const bindingOffset = executable.indexOf(PLACEHOLDER_BINDING);
diff --git a/scripts/test-desktop-linux-native b/scripts/test-desktop-linux-native
new file mode 100644
index 000000000..d648234a2
--- /dev/null
+++ b/scripts/test-desktop-linux-native
@@ -0,0 +1,25 @@
+#!/bin/sh
+# Run only inside the disposable Linux Desktop builder, never a user session.
+set -eu
+umask 077
+[ "$(uname -s)" = Linux ]
+[ -n "${DBUS_SESSION_BUS_ADDRESS:-}" ]
+native_fixture=$(mktemp -d)
+trap 'rm -rf -- "$native_fixture"' EXIT HUP INT TERM
+export XDG_DATA_HOME="$native_fixture/data"
+mkdir -p "$XDG_DATA_HOME"
+# This is a synthetic password for a new disposable keyring collection.
+printf 'colossus-local-native-acceptance' | gnome-keyring-daemon --unlock --components=secrets
+cargo test --locked --release -p colossus-credentials --test native_linux \
+    native_secret_service_survives_process_restart -- --ignored --exact --test-threads=1
+cargo test --locked --release -p colossus-sdk --features sidecar --lib linux_credential_session
+cargo test --locked --release -p colossus-sdk --features sidecar --lib native_sidecar::tests::
+cargo test --locked --release -p colossus-sidecar --test native_lifecycle \
+    verified_sidecar_bootstraps_pinned_grpc_and_closes_by_guardian_eof -- --ignored --exact
+COLOSSUS_ACCEPTANCE_SIDECAR=/build/target/release/colossus-sidecar \
+    cargo test --locked --release -p colossus-cloud-server --lib \
+    managed_sidecar_cloud_run_isolated_and_application_exit_disconnects -- --ignored
+cargo clippy --locked --release -p colossus-sdk --features sidecar --all-targets -- -D warnings
+cargo test --locked --release --manifest-path apps/desktop/src-tauri/Cargo.toml \
+    -p colossus-native-credential-ui --lib linux::tests::native_linux_password_entry_and_cancel \
+    -- --ignored --exact --test-threads=1
diff --git a/sdk/generated-inputs.sha256 b/sdk/generated-inputs.sha256
index 43723e82b..40d80efb9 100644
--- a/sdk/generated-inputs.sha256
+++ b/sdk/generated-inputs.sha256
@@ -1 +1 @@
-c1109da6fa4ae87ce59b97cc8fe3748a22c59e85351f1074221cf6940a880c9f
+e05323d40846e298f37979d0881346fd6c34930d84d2d85ddfc7e69acdd5e1ef
diff --git a/sdk/go/README.md b/sdk/go/README.md
index 07414b2d1..f17751467 100644
--- a/sdk/go/README.md
+++ b/sdk/go/README.md
@@ -73,3 +73,14 @@ sequence gaps. For a generated run-update watcher, set `RunWatchOptions.IsTermin
 `colossus.IsTerminalRunUpdate[*v1alpha1.RunUpdate]`. Only exact `result`, `failure`,
 and `cancellation` variants stop the feed; a lifecycle `state` notification does not.
 No effectful RPC is automatically retried.
+
+### Runtime policy metadata
+
+`colossus.GetRuntimePolicyPosture(ctx, agentRunClient)` reads validated, typed
+`RuntimePolicyPosture` metadata once through the authenticated generated client.
+`DecodeRuntimePolicyPosture` validates a released response independently. Closed
+enums and bounded identifier lists omit private configuration, and the nullable
+`*uint64` configuration revision preserves the full Rust integer range. Malformed,
+unknown, duplicate, or oversized metadata fails with `ErrRuntimePolicyPosture`
+without including payload text. Nil counters mean unknown. This runtime-reported
+configuration neither changes native policy nor independently attests enforcement.
diff --git a/sdk/go/gen/colossus/api/v1alpha1/agent_run.pb.go b/sdk/go/gen/colossus/api/v1alpha1/agent_run.pb.go
index 3e74e7f14..ffb4f9fad 100644
--- a/sdk/go/gen/colossus/api/v1alpha1/agent_run.pb.go
+++ b/sdk/go/gen/colossus/api/v1alpha1/agent_run.pb.go
@@ -5343,6 +5343,409 @@ func (x *StopProcessSessionResponse) GetSnapshot() *ProcessSessionSnapshot {
 	return nil
 }
 
+// Change the authenticated application's local workspace disclosure relationship.
+type SetWorkspaceSharingRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Exact independently enrolled recipient application identity.
+	RecipientApplicationId string `protobuf:"bytes,1,opt,name=recipient_application_id,json=recipientApplicationId,proto3" json:"recipient_application_id,omitempty"`
+	// Release source-owned sessions, or revoke future reads.
+	Enabled bool `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// Permit recipient-owned runs to continue source sessions under its own grant.
+	AllowContinuation bool `protobuf:"varint,3,opt,name=allow_continuation,json=allowContinuation,proto3" json:"allow_continuation,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *SetWorkspaceSharingRequest) Reset() {
+	*x = SetWorkspaceSharingRequest{}
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[56]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SetWorkspaceSharingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetWorkspaceSharingRequest) ProtoMessage() {}
+
+func (x *SetWorkspaceSharingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[56]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetWorkspaceSharingRequest.ProtoReflect.Descriptor instead.
+func (*SetWorkspaceSharingRequest) Descriptor() ([]byte, []int) {
+	return file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP(), []int{56}
+}
+
+func (x *SetWorkspaceSharingRequest) GetRecipientApplicationId() string {
+	if x != nil {
+		return x.RecipientApplicationId
+	}
+	return ""
+}
+
+func (x *SetWorkspaceSharingRequest) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *SetWorkspaceSharingRequest) GetAllowContinuation() bool {
+	if x != nil {
+		return x.AllowContinuation
+	}
+	return false
+}
+
+// Durable local sharing posture. Enrollment alone does not enable sharing.
+type SetWorkspaceSharingResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Exact recipient application identity.
+	RecipientApplicationId string `protobuf:"bytes,1,opt,name=recipient_application_id,json=recipientApplicationId,proto3" json:"recipient_application_id,omitempty"`
+	// Whether released source sessions are visible to the recipient.
+	Enabled bool `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// Whether recipient-owned runs may continue shared sessions.
+	AllowContinuation bool `protobuf:"varint,3,opt,name=allow_continuation,json=allowContinuation,proto3" json:"allow_continuation,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *SetWorkspaceSharingResponse) Reset() {
+	*x = SetWorkspaceSharingResponse{}
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[57]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SetWorkspaceSharingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SetWorkspaceSharingResponse) ProtoMessage() {}
+
+func (x *SetWorkspaceSharingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[57]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SetWorkspaceSharingResponse.ProtoReflect.Descriptor instead.
+func (*SetWorkspaceSharingResponse) Descriptor() ([]byte, []int) {
+	return file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP(), []int{57}
+}
+
+func (x *SetWorkspaceSharingResponse) GetRecipientApplicationId() string {
+	if x != nil {
+		return x.RecipientApplicationId
+	}
+	return ""
+}
+
+func (x *SetWorkspaceSharingResponse) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *SetWorkspaceSharingResponse) GetAllowContinuation() bool {
+	if x != nil {
+		return x.AllowContinuation
+	}
+	return false
+}
+
+// Bounded discovery filters for caller-owned and explicitly shared runs.
+type ListVisibleRunsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Optional exact session identity within the released source scope.
+	SessionId *string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3,oneof" json:"session_id,omitempty"`
+	// Distinct optional lifecycle states; empty includes all states.
+	Statuses []RunStatus `protobuf:"varint,2,rep,packed,name=statuses,proto3,enum=colossus.api.v1alpha1.RunStatus" json:"statuses,omitempty"`
+	// Bounded page size and opaque source-stable continuation cursor.
+	Page *PageRequest `protobuf:"bytes,3,opt,name=page,proto3" json:"page,omitempty"`
+	// Include shared and owned archived threads.
+	IncludeArchived bool `protobuf:"varint,4,opt,name=include_archived,json=includeArchived,proto3" json:"include_archived,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *ListVisibleRunsRequest) Reset() {
+	*x = ListVisibleRunsRequest{}
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[58]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListVisibleRunsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListVisibleRunsRequest) ProtoMessage() {}
+
+func (x *ListVisibleRunsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[58]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListVisibleRunsRequest.ProtoReflect.Descriptor instead.
+func (*ListVisibleRunsRequest) Descriptor() ([]byte, []int) {
+	return file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP(), []int{58}
+}
+
+func (x *ListVisibleRunsRequest) GetSessionId() string {
+	if x != nil && x.SessionId != nil {
+		return *x.SessionId
+	}
+	return ""
+}
+
+func (x *ListVisibleRunsRequest) GetStatuses() []RunStatus {
+	if x != nil {
+		return x.Statuses
+	}
+	return nil
+}
+
+func (x *ListVisibleRunsRequest) GetPage() *PageRequest {
+	if x != nil {
+		return x.Page
+	}
+	return nil
+}
+
+func (x *ListVisibleRunsRequest) GetIncludeArchived() bool {
+	if x != nil {
+		return x.IncludeArchived
+	}
+	return false
+}
+
+// Released run and authority derived by the authenticated runtime.
+type VisibleRun struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Public run projection; never private worker data.
+	Run *Run `protobuf:"bytes,1,opt,name=run,proto3" json:"run,omitempty"`
+	// Whether this caller owns cancellation and interaction response authority.
+	Controllable bool `protobuf:"varint,2,opt,name=controllable,proto3" json:"controllable,omitempty"`
+	// Whether the caller may continue this session using its own grant.
+	Continuable   bool `protobuf:"varint,3,opt,name=continuable,proto3" json:"continuable,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VisibleRun) Reset() {
+	*x = VisibleRun{}
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[59]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VisibleRun) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VisibleRun) ProtoMessage() {}
+
+func (x *VisibleRun) ProtoReflect() protoreflect.Message {
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[59]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VisibleRun.ProtoReflect.Descriptor instead.
+func (*VisibleRun) Descriptor() ([]byte, []int) {
+	return file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP(), []int{59}
+}
+
+func (x *VisibleRun) GetRun() *Run {
+	if x != nil {
+		return x.Run
+	}
+	return nil
+}
+
+func (x *VisibleRun) GetControllable() bool {
+	if x != nil {
+		return x.Controllable
+	}
+	return false
+}
+
+func (x *VisibleRun) GetContinuable() bool {
+	if x != nil {
+		return x.Continuable
+	}
+	return false
+}
+
+// Bounded source-stable page of owned and explicitly shared runs.
+type ListVisibleRunsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Runtime-authorized released run projections.
+	Runs []*VisibleRun `protobuf:"bytes,1,rep,name=runs,proto3" json:"runs,omitempty"`
+	// Opaque continuation cursor bound to current sharing relationships.
+	Page          *PageResponse `protobuf:"bytes,2,opt,name=page,proto3" json:"page,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListVisibleRunsResponse) Reset() {
+	*x = ListVisibleRunsResponse{}
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[60]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListVisibleRunsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListVisibleRunsResponse) ProtoMessage() {}
+
+func (x *ListVisibleRunsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[60]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListVisibleRunsResponse.ProtoReflect.Descriptor instead.
+func (*ListVisibleRunsResponse) Descriptor() ([]byte, []int) {
+	return file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP(), []int{60}
+}
+
+func (x *ListVisibleRunsResponse) GetRuns() []*VisibleRun {
+	if x != nil {
+		return x.Runs
+	}
+	return nil
+}
+
+func (x *ListVisibleRunsResponse) GetPage() *PageResponse {
+	if x != nil {
+		return x.Page
+	}
+	return nil
+}
+
+// Requests current metadata beneath the authenticated application ceiling.
+type GetRuntimePolicyPostureRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRuntimePolicyPostureRequest) Reset() {
+	*x = GetRuntimePolicyPostureRequest{}
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[61]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRuntimePolicyPostureRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRuntimePolicyPostureRequest) ProtoMessage() {}
+
+func (x *GetRuntimePolicyPostureRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[61]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRuntimePolicyPostureRequest.ProtoReflect.Descriptor instead.
+func (*GetRuntimePolicyPostureRequest) Descriptor() ([]byte, []int) {
+	return file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP(), []int{61}
+}
+
+// Contains one closed, validated metadata-only RuntimePolicyPosture contract.
+type GetRuntimePolicyPostureResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Strict RuntimePolicyPosture JSON, at most64KiB; unknown fields are rejected by SDKs.
+	PolicyJson    []byte `protobuf:"bytes,1,opt,name=policy_json,json=policyJson,proto3" json:"policy_json,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRuntimePolicyPostureResponse) Reset() {
+	*x = GetRuntimePolicyPostureResponse{}
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[62]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRuntimePolicyPostureResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRuntimePolicyPostureResponse) ProtoMessage() {}
+
+func (x *GetRuntimePolicyPostureResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_colossus_api_v1alpha1_agent_run_proto_msgTypes[62]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRuntimePolicyPostureResponse.ProtoReflect.Descriptor instead.
+func (*GetRuntimePolicyPostureResponse) Descriptor() ([]byte, []int) {
+	return file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP(), []int{62}
+}
+
+func (x *GetRuntimePolicyPostureResponse) GetPolicyJson() []byte {
+	if x != nil {
+		return x.PolicyJson
+	}
+	return nil
+}
+
 var File_colossus_api_v1alpha1_agent_run_proto protoreflect.FileDescriptor
 
 const file_colossus_api_v1alpha1_agent_run_proto_rawDesc = "" +
@@ -5715,7 +6118,34 @@ const file_colossus_api_v1alpha1_agent_run_proto_rawDesc = "" +
 	"\n" +
 	"session_id\x18\x01 \x01(\tR\tsessionId\"g\n" +
 	"\x1aStopProcessSessionResponse\x12I\n" +
-	"\bsnapshot\x18\x01 \x01(\v2-.colossus.api.v1alpha1.ProcessSessionSnapshotR\bsnapshot*c\n" +
+	"\bsnapshot\x18\x01 \x01(\v2-.colossus.api.v1alpha1.ProcessSessionSnapshotR\bsnapshot\"\x9f\x01\n" +
+	"\x1aSetWorkspaceSharingRequest\x128\n" +
+	"\x18recipient_application_id\x18\x01 \x01(\tR\x16recipientApplicationId\x12\x18\n" +
+	"\aenabled\x18\x02 \x01(\bR\aenabled\x12-\n" +
+	"\x12allow_continuation\x18\x03 \x01(\bR\x11allowContinuation\"\xa0\x01\n" +
+	"\x1bSetWorkspaceSharingResponse\x128\n" +
+	"\x18recipient_application_id\x18\x01 \x01(\tR\x16recipientApplicationId\x12\x18\n" +
+	"\aenabled\x18\x02 \x01(\bR\aenabled\x12-\n" +
+	"\x12allow_continuation\x18\x03 \x01(\bR\x11allowContinuation\"\xec\x01\n" +
+	"\x16ListVisibleRunsRequest\x12\"\n" +
+	"\n" +
+	"session_id\x18\x01 \x01(\tH\x00R\tsessionId\x88\x01\x01\x12<\n" +
+	"\bstatuses\x18\x02 \x03(\x0e2 .colossus.api.v1alpha1.RunStatusR\bstatuses\x126\n" +
+	"\x04page\x18\x03 \x01(\v2\".colossus.api.v1alpha1.PageRequestR\x04page\x12)\n" +
+	"\x10include_archived\x18\x04 \x01(\bR\x0fincludeArchivedB\r\n" +
+	"\v_session_id\"\x80\x01\n" +
+	"\n" +
+	"VisibleRun\x12,\n" +
+	"\x03run\x18\x01 \x01(\v2\x1a.colossus.api.v1alpha1.RunR\x03run\x12\"\n" +
+	"\fcontrollable\x18\x02 \x01(\bR\fcontrollable\x12 \n" +
+	"\vcontinuable\x18\x03 \x01(\bR\vcontinuable\"\x89\x01\n" +
+	"\x17ListVisibleRunsResponse\x125\n" +
+	"\x04runs\x18\x01 \x03(\v2!.colossus.api.v1alpha1.VisibleRunR\x04runs\x127\n" +
+	"\x04page\x18\x02 \x01(\v2#.colossus.api.v1alpha1.PageResponseR\x04page\" \n" +
+	"\x1eGetRuntimePolicyPostureRequest\"B\n" +
+	"\x1fGetRuntimePolicyPostureResponse\x12\x1f\n" +
+	"\vpolicy_json\x18\x01 \x01(\fR\n" +
+	"policyJson*c\n" +
 	"\aRunMode\x12\x18\n" +
 	"\x14RUN_MODE_UNSPECIFIED\x10\x00\x12\x14\n" +
 	"\x10RUN_MODE_EXECUTE\x10\x01\x12\x11\n" +
@@ -5806,8 +6236,7 @@ const file_colossus_api_v1alpha1_agent_run_proto_rawDesc = "" +
 	" PROVIDER_RETRY_STATE_UNSPECIFIED\x10\x00\x12 \n" +
 	"\x1cPROVIDER_RETRY_STATE_BACKOFF\x10\x01\x12!\n" +
 	"\x1dPROVIDER_RETRY_STATE_RETRYING\x10\x02\x12\"\n" +
-	"\x1ePROVIDER_RETRY_STATE_RECOVERED\x10\x032\xa9\n" +
-	"\n" +
+	"\x1ePROVIDER_RETRY_STATE_RECOVERED\x10\x032\xa4\r\n" +
 	"\x0fAgentRunService\x12|\n" +
 	"\x13ListProcessSessions\x121.colossus.api.v1alpha1.ListProcessSessionsRequest\x1a2.colossus.api.v1alpha1.ListProcessSessionsResponse\x12y\n" +
 	"\x12ReadProcessSession\x120.colossus.api.v1alpha1.ReadProcessSessionRequest\x1a1.colossus.api.v1alpha1.ReadProcessSessionResponse\x12y\n" +
@@ -5820,7 +6249,10 @@ const file_colossus_api_v1alpha1_agent_run_proto_rawDesc = "" +
 	"\tCancelRun\x12'.colossus.api.v1alpha1.CancelRunRequest\x1a(.colossus.api.v1alpha1.CancelRunResponse\x12j\n" +
 	"\rArchiveThread\x12+.colossus.api.v1alpha1.ArchiveThreadRequest\x1a,.colossus.api.v1alpha1.ArchiveThreadResponse\x12j\n" +
 	"\rRestoreThread\x12+.colossus.api.v1alpha1.RestoreThreadRequest\x1a,.colossus.api.v1alpha1.RestoreThreadResponse\x12y\n" +
-	"\x12RespondInteraction\x120.colossus.api.v1alpha1.RespondInteractionRequest\x1a1.colossus.api.v1alpha1.RespondInteractionResponseB\xf0\x01\n" +
+	"\x12RespondInteraction\x120.colossus.api.v1alpha1.RespondInteractionRequest\x1a1.colossus.api.v1alpha1.RespondInteractionResponse\x12|\n" +
+	"\x13SetWorkspaceSharing\x121.colossus.api.v1alpha1.SetWorkspaceSharingRequest\x1a2.colossus.api.v1alpha1.SetWorkspaceSharingResponse\x12p\n" +
+	"\x0fListVisibleRuns\x12-.colossus.api.v1alpha1.ListVisibleRunsRequest\x1a..colossus.api.v1alpha1.ListVisibleRunsResponse\x12\x88\x01\n" +
+	"\x17GetRuntimePolicyPosture\x125.colossus.api.v1alpha1.GetRuntimePolicyPostureRequest\x1a6.colossus.api.v1alpha1.GetRuntimePolicyPostureResponseB\xf0\x01\n" +
 	"\x19com.colossus.api.v1alpha1B\rAgentRunProtoP\x01ZNgithub.com/obscuritylabs/colossus/sdk/go/gen/colossus/api/v1alpha1;apiv1alpha1\xa2\x02\x03CAX\xaa\x02\x15Colossus.Api.V1alpha1\xca\x02\x15Colossus\\Api\\V1alpha1\xe2\x02!Colossus\\Api\\V1alpha1\\GPBMetadata\xea\x02\x17Colossus::Api::V1alpha1b\x06proto3"
 
 var (
@@ -5836,200 +6268,218 @@ func file_colossus_api_v1alpha1_agent_run_proto_rawDescGZIP() []byte {
 }
 
 var file_colossus_api_v1alpha1_agent_run_proto_enumTypes = make([]protoimpl.EnumInfo, 15)
-var file_colossus_api_v1alpha1_agent_run_proto_msgTypes = make([]protoimpl.MessageInfo, 57)
+var file_colossus_api_v1alpha1_agent_run_proto_msgTypes = make([]protoimpl.MessageInfo, 64)
 var file_colossus_api_v1alpha1_agent_run_proto_goTypes = []any{
-	(RunMode)(0),                        // 0: colossus.api.v1alpha1.RunMode
-	(ResearchDepth)(0),                  // 1: colossus.api.v1alpha1.ResearchDepth
-	(ResearchSourceKind)(0),             // 2: colossus.api.v1alpha1.ResearchSourceKind
-	(PlanStatus)(0),                     // 3: colossus.api.v1alpha1.PlanStatus
-	(PlanExecutionStrategy)(0),          // 4: colossus.api.v1alpha1.PlanExecutionStrategy
-	(RunStatus)(0),                      // 5: colossus.api.v1alpha1.RunStatus
-	(RunBranchContextMode)(0),           // 6: colossus.api.v1alpha1.RunBranchContextMode
-	(SessionActivityLane)(0),            // 7: colossus.api.v1alpha1.SessionActivityLane
-	(SessionActivityKind)(0),            // 8: colossus.api.v1alpha1.SessionActivityKind
-	(SessionActivityStatus)(0),          // 9: colossus.api.v1alpha1.SessionActivityStatus
-	(InteractionKind)(0),                // 10: colossus.api.v1alpha1.InteractionKind
-	(InteractionStatus)(0),              // 11: colossus.api.v1alpha1.InteractionStatus
-	(ApprovalRisk)(0),                   // 12: colossus.api.v1alpha1.ApprovalRisk
-	(ToolActivityState)(0),              // 13: colossus.api.v1alpha1.ToolActivityState
-	(ProviderRetryState)(0),             // 14: colossus.api.v1alpha1.ProviderRetryState
-	(*RunResult)(nil),                   // 15: colossus.api.v1alpha1.RunResult
-	(*RunFailure)(nil),                  // 16: colossus.api.v1alpha1.RunFailure
-	(*RunCancellation)(nil),             // 17: colossus.api.v1alpha1.RunCancellation
-	(*Run)(nil),                         // 18: colossus.api.v1alpha1.Run
-	(*CreateRunRequest)(nil),            // 19: colossus.api.v1alpha1.CreateRunRequest
-	(*RunBranch)(nil),                   // 20: colossus.api.v1alpha1.RunBranch
-	(*PlanRunAction)(nil),               // 21: colossus.api.v1alpha1.PlanRunAction
-	(*RevisePlanAction)(nil),            // 22: colossus.api.v1alpha1.RevisePlanAction
-	(*ExecutePlanAction)(nil),           // 23: colossus.api.v1alpha1.ExecutePlanAction
-	(*CreateRunResponse)(nil),           // 24: colossus.api.v1alpha1.CreateRunResponse
-	(*GetRunRequest)(nil),               // 25: colossus.api.v1alpha1.GetRunRequest
-	(*GetRunResponse)(nil),              // 26: colossus.api.v1alpha1.GetRunResponse
-	(*ListRunsRequest)(nil),             // 27: colossus.api.v1alpha1.ListRunsRequest
-	(*ListRunsResponse)(nil),            // 28: colossus.api.v1alpha1.ListRunsResponse
-	(*SessionActivityContent)(nil),      // 29: colossus.api.v1alpha1.SessionActivityContent
-	(*SessionActivity)(nil),             // 30: colossus.api.v1alpha1.SessionActivity
-	(*ListSessionActivityRequest)(nil),  // 31: colossus.api.v1alpha1.ListSessionActivityRequest
-	(*ListSessionActivityResponse)(nil), // 32: colossus.api.v1alpha1.ListSessionActivityResponse
-	(*WatchRunRequest)(nil),             // 33: colossus.api.v1alpha1.WatchRunRequest
-	(*WatchRunResponse)(nil),            // 34: colossus.api.v1alpha1.WatchRunResponse
-	(*CancelRunRequest)(nil),            // 35: colossus.api.v1alpha1.CancelRunRequest
-	(*CancelRunResponse)(nil),           // 36: colossus.api.v1alpha1.CancelRunResponse
-	(*ThreadLifecycle)(nil),             // 37: colossus.api.v1alpha1.ThreadLifecycle
-	(*ArchiveThreadRequest)(nil),        // 38: colossus.api.v1alpha1.ArchiveThreadRequest
-	(*ArchiveThreadResponse)(nil),       // 39: colossus.api.v1alpha1.ArchiveThreadResponse
-	(*RestoreThreadRequest)(nil),        // 40: colossus.api.v1alpha1.RestoreThreadRequest
-	(*RestoreThreadResponse)(nil),       // 41: colossus.api.v1alpha1.RestoreThreadResponse
-	(*PromptChoice)(nil),                // 42: colossus.api.v1alpha1.PromptChoice
-	(*UserPromptInteraction)(nil),       // 43: colossus.api.v1alpha1.UserPromptInteraction
-	(*ReleasedDetail)(nil),              // 44: colossus.api.v1alpha1.ReleasedDetail
-	(*ApprovalInteraction)(nil),         // 45: colossus.api.v1alpha1.ApprovalInteraction
-	(*CommandApprovalContext)(nil),      // 46: colossus.api.v1alpha1.CommandApprovalContext
-	(*Interaction)(nil),                 // 47: colossus.api.v1alpha1.Interaction
-	(*PromptChoiceAnswer)(nil),          // 48: colossus.api.v1alpha1.PromptChoiceAnswer
-	(*PromptAnswer)(nil),                // 49: colossus.api.v1alpha1.PromptAnswer
-	(*ApprovalAnswer)(nil),              // 50: colossus.api.v1alpha1.ApprovalAnswer
-	(*RespondInteractionRequest)(nil),   // 51: colossus.api.v1alpha1.RespondInteractionRequest
-	(*RespondInteractionResponse)(nil),  // 52: colossus.api.v1alpha1.RespondInteractionResponse
-	(*VisibleOutputDelta)(nil),          // 53: colossus.api.v1alpha1.VisibleOutputDelta
-	(*ReasoningSummary)(nil),            // 54: colossus.api.v1alpha1.ReasoningSummary
-	(*ToolActivity)(nil),                // 55: colossus.api.v1alpha1.ToolActivity
-	(*TokenUsage)(nil),                  // 56: colossus.api.v1alpha1.TokenUsage
-	(*ProviderRetry)(nil),               // 57: colossus.api.v1alpha1.ProviderRetry
-	(*RunNotice)(nil),                   // 58: colossus.api.v1alpha1.RunNotice
-	(*RunStateChanged)(nil),             // 59: colossus.api.v1alpha1.RunStateChanged
-	(*RunFailed)(nil),                   // 60: colossus.api.v1alpha1.RunFailed
-	(*RunUpdate)(nil),                   // 61: colossus.api.v1alpha1.RunUpdate
-	(*ProcessSession)(nil),              // 62: colossus.api.v1alpha1.ProcessSession
-	(*ProcessOutputChunk)(nil),          // 63: colossus.api.v1alpha1.ProcessOutputChunk
-	(*ProcessSessionSnapshot)(nil),      // 64: colossus.api.v1alpha1.ProcessSessionSnapshot
-	(*ListProcessSessionsRequest)(nil),  // 65: colossus.api.v1alpha1.ListProcessSessionsRequest
-	(*ListProcessSessionsResponse)(nil), // 66: colossus.api.v1alpha1.ListProcessSessionsResponse
-	(*ReadProcessSessionRequest)(nil),   // 67: colossus.api.v1alpha1.ReadProcessSessionRequest
-	(*ReadProcessSessionResponse)(nil),  // 68: colossus.api.v1alpha1.ReadProcessSessionResponse
-	(*StopProcessSessionRequest)(nil),   // 69: colossus.api.v1alpha1.StopProcessSessionRequest
-	(*StopProcessSessionResponse)(nil),  // 70: colossus.api.v1alpha1.StopProcessSessionResponse
-	nil,                                 // 71: colossus.api.v1alpha1.SessionActivity.AttributesEntry
-	(OutcomeCertainty)(0),               // 72: colossus.api.v1alpha1.OutcomeCertainty
-	(*timestamppb.Timestamp)(nil),       // 73: google.protobuf.Timestamp
-	(*ContentPart)(nil),                 // 74: colossus.api.v1alpha1.ContentPart
-	(*PageRequest)(nil),                 // 75: colossus.api.v1alpha1.PageRequest
-	(*PageResponse)(nil),                // 76: colossus.api.v1alpha1.PageResponse
-	(*SessionMessage)(nil),              // 77: colossus.api.v1alpha1.SessionMessage
+	(RunMode)(0),                            // 0: colossus.api.v1alpha1.RunMode
+	(ResearchDepth)(0),                      // 1: colossus.api.v1alpha1.ResearchDepth
+	(ResearchSourceKind)(0),                 // 2: colossus.api.v1alpha1.ResearchSourceKind
+	(PlanStatus)(0),                         // 3: colossus.api.v1alpha1.PlanStatus
+	(PlanExecutionStrategy)(0),              // 4: colossus.api.v1alpha1.PlanExecutionStrategy
+	(RunStatus)(0),                          // 5: colossus.api.v1alpha1.RunStatus
+	(RunBranchContextMode)(0),               // 6: colossus.api.v1alpha1.RunBranchContextMode
+	(SessionActivityLane)(0),                // 7: colossus.api.v1alpha1.SessionActivityLane
+	(SessionActivityKind)(0),                // 8: colossus.api.v1alpha1.SessionActivityKind
+	(SessionActivityStatus)(0),              // 9: colossus.api.v1alpha1.SessionActivityStatus
+	(InteractionKind)(0),                    // 10: colossus.api.v1alpha1.InteractionKind
+	(InteractionStatus)(0),                  // 11: colossus.api.v1alpha1.InteractionStatus
+	(ApprovalRisk)(0),                       // 12: colossus.api.v1alpha1.ApprovalRisk
+	(ToolActivityState)(0),                  // 13: colossus.api.v1alpha1.ToolActivityState
+	(ProviderRetryState)(0),                 // 14: colossus.api.v1alpha1.ProviderRetryState
+	(*RunResult)(nil),                       // 15: colossus.api.v1alpha1.RunResult
+	(*RunFailure)(nil),                      // 16: colossus.api.v1alpha1.RunFailure
+	(*RunCancellation)(nil),                 // 17: colossus.api.v1alpha1.RunCancellation
+	(*Run)(nil),                             // 18: colossus.api.v1alpha1.Run
+	(*CreateRunRequest)(nil),                // 19: colossus.api.v1alpha1.CreateRunRequest
+	(*RunBranch)(nil),                       // 20: colossus.api.v1alpha1.RunBranch
+	(*PlanRunAction)(nil),                   // 21: colossus.api.v1alpha1.PlanRunAction
+	(*RevisePlanAction)(nil),                // 22: colossus.api.v1alpha1.RevisePlanAction
+	(*ExecutePlanAction)(nil),               // 23: colossus.api.v1alpha1.ExecutePlanAction
+	(*CreateRunResponse)(nil),               // 24: colossus.api.v1alpha1.CreateRunResponse
+	(*GetRunRequest)(nil),                   // 25: colossus.api.v1alpha1.GetRunRequest
+	(*GetRunResponse)(nil),                  // 26: colossus.api.v1alpha1.GetRunResponse
+	(*ListRunsRequest)(nil),                 // 27: colossus.api.v1alpha1.ListRunsRequest
+	(*ListRunsResponse)(nil),                // 28: colossus.api.v1alpha1.ListRunsResponse
+	(*SessionActivityContent)(nil),          // 29: colossus.api.v1alpha1.SessionActivityContent
+	(*SessionActivity)(nil),                 // 30: colossus.api.v1alpha1.SessionActivity
+	(*ListSessionActivityRequest)(nil),      // 31: colossus.api.v1alpha1.ListSessionActivityRequest
+	(*ListSessionActivityResponse)(nil),     // 32: colossus.api.v1alpha1.ListSessionActivityResponse
+	(*WatchRunRequest)(nil),                 // 33: colossus.api.v1alpha1.WatchRunRequest
+	(*WatchRunResponse)(nil),                // 34: colossus.api.v1alpha1.WatchRunResponse
+	(*CancelRunRequest)(nil),                // 35: colossus.api.v1alpha1.CancelRunRequest
+	(*CancelRunResponse)(nil),               // 36: colossus.api.v1alpha1.CancelRunResponse
+	(*ThreadLifecycle)(nil),                 // 37: colossus.api.v1alpha1.ThreadLifecycle
+	(*ArchiveThreadRequest)(nil),            // 38: colossus.api.v1alpha1.ArchiveThreadRequest
+	(*ArchiveThreadResponse)(nil),           // 39: colossus.api.v1alpha1.ArchiveThreadResponse
+	(*RestoreThreadRequest)(nil),            // 40: colossus.api.v1alpha1.RestoreThreadRequest
+	(*RestoreThreadResponse)(nil),           // 41: colossus.api.v1alpha1.RestoreThreadResponse
+	(*PromptChoice)(nil),                    // 42: colossus.api.v1alpha1.PromptChoice
+	(*UserPromptInteraction)(nil),           // 43: colossus.api.v1alpha1.UserPromptInteraction
+	(*ReleasedDetail)(nil),                  // 44: colossus.api.v1alpha1.ReleasedDetail
+	(*ApprovalInteraction)(nil),             // 45: colossus.api.v1alpha1.ApprovalInteraction
+	(*CommandApprovalContext)(nil),          // 46: colossus.api.v1alpha1.CommandApprovalContext
+	(*Interaction)(nil),                     // 47: colossus.api.v1alpha1.Interaction
+	(*PromptChoiceAnswer)(nil),              // 48: colossus.api.v1alpha1.PromptChoiceAnswer
+	(*PromptAnswer)(nil),                    // 49: colossus.api.v1alpha1.PromptAnswer
+	(*ApprovalAnswer)(nil),                  // 50: colossus.api.v1alpha1.ApprovalAnswer
+	(*RespondInteractionRequest)(nil),       // 51: colossus.api.v1alpha1.RespondInteractionRequest
+	(*RespondInteractionResponse)(nil),      // 52: colossus.api.v1alpha1.RespondInteractionResponse
+	(*VisibleOutputDelta)(nil),              // 53: colossus.api.v1alpha1.VisibleOutputDelta
+	(*ReasoningSummary)(nil),                // 54: colossus.api.v1alpha1.ReasoningSummary
+	(*ToolActivity)(nil),                    // 55: colossus.api.v1alpha1.ToolActivity
+	(*TokenUsage)(nil),                      // 56: colossus.api.v1alpha1.TokenUsage
+	(*ProviderRetry)(nil),                   // 57: colossus.api.v1alpha1.ProviderRetry
+	(*RunNotice)(nil),                       // 58: colossus.api.v1alpha1.RunNotice
+	(*RunStateChanged)(nil),                 // 59: colossus.api.v1alpha1.RunStateChanged
+	(*RunFailed)(nil),                       // 60: colossus.api.v1alpha1.RunFailed
+	(*RunUpdate)(nil),                       // 61: colossus.api.v1alpha1.RunUpdate
+	(*ProcessSession)(nil),                  // 62: colossus.api.v1alpha1.ProcessSession
+	(*ProcessOutputChunk)(nil),              // 63: colossus.api.v1alpha1.ProcessOutputChunk
+	(*ProcessSessionSnapshot)(nil),          // 64: colossus.api.v1alpha1.ProcessSessionSnapshot
+	(*ListProcessSessionsRequest)(nil),      // 65: colossus.api.v1alpha1.ListProcessSessionsRequest
+	(*ListProcessSessionsResponse)(nil),     // 66: colossus.api.v1alpha1.ListProcessSessionsResponse
+	(*ReadProcessSessionRequest)(nil),       // 67: colossus.api.v1alpha1.ReadProcessSessionRequest
+	(*ReadProcessSessionResponse)(nil),      // 68: colossus.api.v1alpha1.ReadProcessSessionResponse
+	(*StopProcessSessionRequest)(nil),       // 69: colossus.api.v1alpha1.StopProcessSessionRequest
+	(*StopProcessSessionResponse)(nil),      // 70: colossus.api.v1alpha1.StopProcessSessionResponse
+	(*SetWorkspaceSharingRequest)(nil),      // 71: colossus.api.v1alpha1.SetWorkspaceSharingRequest
+	(*SetWorkspaceSharingResponse)(nil),     // 72: colossus.api.v1alpha1.SetWorkspaceSharingResponse
+	(*ListVisibleRunsRequest)(nil),          // 73: colossus.api.v1alpha1.ListVisibleRunsRequest
+	(*VisibleRun)(nil),                      // 74: colossus.api.v1alpha1.VisibleRun
+	(*ListVisibleRunsResponse)(nil),         // 75: colossus.api.v1alpha1.ListVisibleRunsResponse
+	(*GetRuntimePolicyPostureRequest)(nil),  // 76: colossus.api.v1alpha1.GetRuntimePolicyPostureRequest
+	(*GetRuntimePolicyPostureResponse)(nil), // 77: colossus.api.v1alpha1.GetRuntimePolicyPostureResponse
+	nil,                                     // 78: colossus.api.v1alpha1.SessionActivity.AttributesEntry
+	(OutcomeCertainty)(0),                   // 79: colossus.api.v1alpha1.OutcomeCertainty
+	(*timestamppb.Timestamp)(nil),           // 80: google.protobuf.Timestamp
+	(*ContentPart)(nil),                     // 81: colossus.api.v1alpha1.ContentPart
+	(*PageRequest)(nil),                     // 82: colossus.api.v1alpha1.PageRequest
+	(*PageResponse)(nil),                    // 83: colossus.api.v1alpha1.PageResponse
+	(*SessionMessage)(nil),                  // 84: colossus.api.v1alpha1.SessionMessage
 }
 var file_colossus_api_v1alpha1_agent_run_proto_depIdxs = []int32{
-	3,  // 0: colossus.api.v1alpha1.RunResult.plan_status:type_name -> colossus.api.v1alpha1.PlanStatus
-	72, // 1: colossus.api.v1alpha1.RunFailure.outcome_certainty:type_name -> colossus.api.v1alpha1.OutcomeCertainty
-	3,  // 2: colossus.api.v1alpha1.RunCancellation.plan_status:type_name -> colossus.api.v1alpha1.PlanStatus
-	0,  // 3: colossus.api.v1alpha1.Run.mode:type_name -> colossus.api.v1alpha1.RunMode
-	5,  // 4: colossus.api.v1alpha1.Run.status:type_name -> colossus.api.v1alpha1.RunStatus
-	73, // 5: colossus.api.v1alpha1.Run.created_at:type_name -> google.protobuf.Timestamp
-	73, // 6: colossus.api.v1alpha1.Run.updated_at:type_name -> google.protobuf.Timestamp
-	73, // 7: colossus.api.v1alpha1.Run.started_at:type_name -> google.protobuf.Timestamp
-	73, // 8: colossus.api.v1alpha1.Run.finished_at:type_name -> google.protobuf.Timestamp
-	15, // 9: colossus.api.v1alpha1.Run.result:type_name -> colossus.api.v1alpha1.RunResult
-	16, // 10: colossus.api.v1alpha1.Run.failure:type_name -> colossus.api.v1alpha1.RunFailure
-	17, // 11: colossus.api.v1alpha1.Run.cancellation:type_name -> colossus.api.v1alpha1.RunCancellation
-	74, // 12: colossus.api.v1alpha1.CreateRunRequest.input:type_name -> colossus.api.v1alpha1.ContentPart
-	0,  // 13: colossus.api.v1alpha1.CreateRunRequest.mode:type_name -> colossus.api.v1alpha1.RunMode
-	21, // 14: colossus.api.v1alpha1.CreateRunRequest.plan_action:type_name -> colossus.api.v1alpha1.PlanRunAction
-	20, // 15: colossus.api.v1alpha1.CreateRunRequest.branch:type_name -> colossus.api.v1alpha1.RunBranch
-	1,  // 16: colossus.api.v1alpha1.CreateRunRequest.research_depth:type_name -> colossus.api.v1alpha1.ResearchDepth
-	2,  // 17: colossus.api.v1alpha1.CreateRunRequest.research_sources:type_name -> colossus.api.v1alpha1.ResearchSourceKind
-	6,  // 18: colossus.api.v1alpha1.RunBranch.context_mode:type_name -> colossus.api.v1alpha1.RunBranchContextMode
-	22, // 19: colossus.api.v1alpha1.PlanRunAction.revise:type_name -> colossus.api.v1alpha1.RevisePlanAction
-	23, // 20: colossus.api.v1alpha1.PlanRunAction.execute:type_name -> colossus.api.v1alpha1.ExecutePlanAction
-	4,  // 21: colossus.api.v1alpha1.ExecutePlanAction.strategy:type_name -> colossus.api.v1alpha1.PlanExecutionStrategy
-	18, // 22: colossus.api.v1alpha1.CreateRunResponse.run:type_name -> colossus.api.v1alpha1.Run
-	18, // 23: colossus.api.v1alpha1.GetRunResponse.run:type_name -> colossus.api.v1alpha1.Run
-	47, // 24: colossus.api.v1alpha1.GetRunResponse.pending_interactions:type_name -> colossus.api.v1alpha1.Interaction
-	5,  // 25: colossus.api.v1alpha1.ListRunsRequest.statuses:type_name -> colossus.api.v1alpha1.RunStatus
-	75, // 26: colossus.api.v1alpha1.ListRunsRequest.page:type_name -> colossus.api.v1alpha1.PageRequest
-	18, // 27: colossus.api.v1alpha1.ListRunsResponse.runs:type_name -> colossus.api.v1alpha1.Run
-	76, // 28: colossus.api.v1alpha1.ListRunsResponse.page:type_name -> colossus.api.v1alpha1.PageResponse
-	7,  // 29: colossus.api.v1alpha1.SessionActivity.lane:type_name -> colossus.api.v1alpha1.SessionActivityLane
-	8,  // 30: colossus.api.v1alpha1.SessionActivity.kind:type_name -> colossus.api.v1alpha1.SessionActivityKind
-	9,  // 31: colossus.api.v1alpha1.SessionActivity.status:type_name -> colossus.api.v1alpha1.SessionActivityStatus
-	73, // 32: colossus.api.v1alpha1.SessionActivity.started_at:type_name -> google.protobuf.Timestamp
-	73, // 33: colossus.api.v1alpha1.SessionActivity.completed_at:type_name -> google.protobuf.Timestamp
-	29, // 34: colossus.api.v1alpha1.SessionActivity.input:type_name -> colossus.api.v1alpha1.SessionActivityContent
-	29, // 35: colossus.api.v1alpha1.SessionActivity.result:type_name -> colossus.api.v1alpha1.SessionActivityContent
-	71, // 36: colossus.api.v1alpha1.SessionActivity.attributes:type_name -> colossus.api.v1alpha1.SessionActivity.AttributesEntry
-	7,  // 37: colossus.api.v1alpha1.ListSessionActivityRequest.lanes:type_name -> colossus.api.v1alpha1.SessionActivityLane
-	8,  // 38: colossus.api.v1alpha1.ListSessionActivityRequest.kinds:type_name -> colossus.api.v1alpha1.SessionActivityKind
-	9,  // 39: colossus.api.v1alpha1.ListSessionActivityRequest.statuses:type_name -> colossus.api.v1alpha1.SessionActivityStatus
-	75, // 40: colossus.api.v1alpha1.ListSessionActivityRequest.page:type_name -> colossus.api.v1alpha1.PageRequest
-	30, // 41: colossus.api.v1alpha1.ListSessionActivityResponse.activities:type_name -> colossus.api.v1alpha1.SessionActivity
-	76, // 42: colossus.api.v1alpha1.ListSessionActivityResponse.page:type_name -> colossus.api.v1alpha1.PageResponse
-	61, // 43: colossus.api.v1alpha1.WatchRunResponse.update:type_name -> colossus.api.v1alpha1.RunUpdate
-	18, // 44: colossus.api.v1alpha1.CancelRunResponse.run:type_name -> colossus.api.v1alpha1.Run
-	37, // 45: colossus.api.v1alpha1.ArchiveThreadResponse.thread:type_name -> colossus.api.v1alpha1.ThreadLifecycle
-	37, // 46: colossus.api.v1alpha1.RestoreThreadResponse.thread:type_name -> colossus.api.v1alpha1.ThreadLifecycle
-	42, // 47: colossus.api.v1alpha1.UserPromptInteraction.choices:type_name -> colossus.api.v1alpha1.PromptChoice
-	12, // 48: colossus.api.v1alpha1.ApprovalInteraction.risk:type_name -> colossus.api.v1alpha1.ApprovalRisk
-	46, // 49: colossus.api.v1alpha1.ApprovalInteraction.command_context:type_name -> colossus.api.v1alpha1.CommandApprovalContext
-	10, // 50: colossus.api.v1alpha1.Interaction.kind:type_name -> colossus.api.v1alpha1.InteractionKind
-	11, // 51: colossus.api.v1alpha1.Interaction.status:type_name -> colossus.api.v1alpha1.InteractionStatus
-	73, // 52: colossus.api.v1alpha1.Interaction.created_at:type_name -> google.protobuf.Timestamp
-	73, // 53: colossus.api.v1alpha1.Interaction.expires_at:type_name -> google.protobuf.Timestamp
-	43, // 54: colossus.api.v1alpha1.Interaction.user_prompt:type_name -> colossus.api.v1alpha1.UserPromptInteraction
-	45, // 55: colossus.api.v1alpha1.Interaction.approval:type_name -> colossus.api.v1alpha1.ApprovalInteraction
-	48, // 56: colossus.api.v1alpha1.PromptAnswer.choice:type_name -> colossus.api.v1alpha1.PromptChoiceAnswer
-	49, // 57: colossus.api.v1alpha1.RespondInteractionRequest.prompt_answer:type_name -> colossus.api.v1alpha1.PromptAnswer
-	50, // 58: colossus.api.v1alpha1.RespondInteractionRequest.approval_answer:type_name -> colossus.api.v1alpha1.ApprovalAnswer
-	47, // 59: colossus.api.v1alpha1.RespondInteractionResponse.interaction:type_name -> colossus.api.v1alpha1.Interaction
-	13, // 60: colossus.api.v1alpha1.ToolActivity.state:type_name -> colossus.api.v1alpha1.ToolActivityState
-	14, // 61: colossus.api.v1alpha1.ProviderRetry.state:type_name -> colossus.api.v1alpha1.ProviderRetryState
-	5,  // 62: colossus.api.v1alpha1.RunStateChanged.status:type_name -> colossus.api.v1alpha1.RunStatus
-	5,  // 63: colossus.api.v1alpha1.RunFailed.status:type_name -> colossus.api.v1alpha1.RunStatus
-	16, // 64: colossus.api.v1alpha1.RunFailed.failure:type_name -> colossus.api.v1alpha1.RunFailure
-	73, // 65: colossus.api.v1alpha1.RunUpdate.created_at:type_name -> google.protobuf.Timestamp
-	59, // 66: colossus.api.v1alpha1.RunUpdate.state:type_name -> colossus.api.v1alpha1.RunStateChanged
-	53, // 67: colossus.api.v1alpha1.RunUpdate.output_delta:type_name -> colossus.api.v1alpha1.VisibleOutputDelta
-	54, // 68: colossus.api.v1alpha1.RunUpdate.reasoning_summary:type_name -> colossus.api.v1alpha1.ReasoningSummary
-	55, // 69: colossus.api.v1alpha1.RunUpdate.tool_activity:type_name -> colossus.api.v1alpha1.ToolActivity
-	56, // 70: colossus.api.v1alpha1.RunUpdate.usage:type_name -> colossus.api.v1alpha1.TokenUsage
-	47, // 71: colossus.api.v1alpha1.RunUpdate.interaction:type_name -> colossus.api.v1alpha1.Interaction
-	77, // 72: colossus.api.v1alpha1.RunUpdate.message:type_name -> colossus.api.v1alpha1.SessionMessage
-	58, // 73: colossus.api.v1alpha1.RunUpdate.notice:type_name -> colossus.api.v1alpha1.RunNotice
-	15, // 74: colossus.api.v1alpha1.RunUpdate.result:type_name -> colossus.api.v1alpha1.RunResult
-	60, // 75: colossus.api.v1alpha1.RunUpdate.failure:type_name -> colossus.api.v1alpha1.RunFailed
-	17, // 76: colossus.api.v1alpha1.RunUpdate.cancellation:type_name -> colossus.api.v1alpha1.RunCancellation
-	57, // 77: colossus.api.v1alpha1.RunUpdate.provider_retry:type_name -> colossus.api.v1alpha1.ProviderRetry
-	62, // 78: colossus.api.v1alpha1.ProcessSessionSnapshot.session:type_name -> colossus.api.v1alpha1.ProcessSession
-	63, // 79: colossus.api.v1alpha1.ProcessSessionSnapshot.chunks:type_name -> colossus.api.v1alpha1.ProcessOutputChunk
-	62, // 80: colossus.api.v1alpha1.ListProcessSessionsResponse.sessions:type_name -> colossus.api.v1alpha1.ProcessSession
-	64, // 81: colossus.api.v1alpha1.ReadProcessSessionResponse.snapshot:type_name -> colossus.api.v1alpha1.ProcessSessionSnapshot
-	64, // 82: colossus.api.v1alpha1.StopProcessSessionResponse.snapshot:type_name -> colossus.api.v1alpha1.ProcessSessionSnapshot
-	65, // 83: colossus.api.v1alpha1.AgentRunService.ListProcessSessions:input_type -> colossus.api.v1alpha1.ListProcessSessionsRequest
-	67, // 84: colossus.api.v1alpha1.AgentRunService.ReadProcessSession:input_type -> colossus.api.v1alpha1.ReadProcessSessionRequest
-	69, // 85: colossus.api.v1alpha1.AgentRunService.StopProcessSession:input_type -> colossus.api.v1alpha1.StopProcessSessionRequest
-	19, // 86: colossus.api.v1alpha1.AgentRunService.CreateRun:input_type -> colossus.api.v1alpha1.CreateRunRequest
-	25, // 87: colossus.api.v1alpha1.AgentRunService.GetRun:input_type -> colossus.api.v1alpha1.GetRunRequest
-	27, // 88: colossus.api.v1alpha1.AgentRunService.ListRuns:input_type -> colossus.api.v1alpha1.ListRunsRequest
-	31, // 89: colossus.api.v1alpha1.AgentRunService.ListSessionActivity:input_type -> colossus.api.v1alpha1.ListSessionActivityRequest
-	33, // 90: colossus.api.v1alpha1.AgentRunService.WatchRun:input_type -> colossus.api.v1alpha1.WatchRunRequest
-	35, // 91: colossus.api.v1alpha1.AgentRunService.CancelRun:input_type -> colossus.api.v1alpha1.CancelRunRequest
-	38, // 92: colossus.api.v1alpha1.AgentRunService.ArchiveThread:input_type -> colossus.api.v1alpha1.ArchiveThreadRequest
-	40, // 93: colossus.api.v1alpha1.AgentRunService.RestoreThread:input_type -> colossus.api.v1alpha1.RestoreThreadRequest
-	51, // 94: colossus.api.v1alpha1.AgentRunService.RespondInteraction:input_type -> colossus.api.v1alpha1.RespondInteractionRequest
-	66, // 95: colossus.api.v1alpha1.AgentRunService.ListProcessSessions:output_type -> colossus.api.v1alpha1.ListProcessSessionsResponse
-	68, // 96: colossus.api.v1alpha1.AgentRunService.ReadProcessSession:output_type -> colossus.api.v1alpha1.ReadProcessSessionResponse
-	70, // 97: colossus.api.v1alpha1.AgentRunService.StopProcessSession:output_type -> colossus.api.v1alpha1.StopProcessSessionResponse
-	24, // 98: colossus.api.v1alpha1.AgentRunService.CreateRun:output_type -> colossus.api.v1alpha1.CreateRunResponse
-	26, // 99: colossus.api.v1alpha1.AgentRunService.GetRun:output_type -> colossus.api.v1alpha1.GetRunResponse
-	28, // 100: colossus.api.v1alpha1.AgentRunService.ListRuns:output_type -> colossus.api.v1alpha1.ListRunsResponse
-	32, // 101: colossus.api.v1alpha1.AgentRunService.ListSessionActivity:output_type -> colossus.api.v1alpha1.ListSessionActivityResponse
-	34, // 102: colossus.api.v1alpha1.AgentRunService.WatchRun:output_type -> colossus.api.v1alpha1.WatchRunResponse
-	36, // 103: colossus.api.v1alpha1.AgentRunService.CancelRun:output_type -> colossus.api.v1alpha1.CancelRunResponse
-	39, // 104: colossus.api.v1alpha1.AgentRunService.ArchiveThread:output_type -> colossus.api.v1alpha1.ArchiveThreadResponse
-	41, // 105: colossus.api.v1alpha1.AgentRunService.RestoreThread:output_type -> colossus.api.v1alpha1.RestoreThreadResponse
-	52, // 106: colossus.api.v1alpha1.AgentRunService.RespondInteraction:output_type -> colossus.api.v1alpha1.RespondInteractionResponse
-	95, // [95:107] is the sub-list for method output_type
-	83, // [83:95] is the sub-list for method input_type
-	83, // [83:83] is the sub-list for extension type_name
-	83, // [83:83] is the sub-list for extension extendee
-	0,  // [0:83] is the sub-list for field type_name
+	3,   // 0: colossus.api.v1alpha1.RunResult.plan_status:type_name -> colossus.api.v1alpha1.PlanStatus
+	79,  // 1: colossus.api.v1alpha1.RunFailure.outcome_certainty:type_name -> colossus.api.v1alpha1.OutcomeCertainty
+	3,   // 2: colossus.api.v1alpha1.RunCancellation.plan_status:type_name -> colossus.api.v1alpha1.PlanStatus
+	0,   // 3: colossus.api.v1alpha1.Run.mode:type_name -> colossus.api.v1alpha1.RunMode
+	5,   // 4: colossus.api.v1alpha1.Run.status:type_name -> colossus.api.v1alpha1.RunStatus
+	80,  // 5: colossus.api.v1alpha1.Run.created_at:type_name -> google.protobuf.Timestamp
+	80,  // 6: colossus.api.v1alpha1.Run.updated_at:type_name -> google.protobuf.Timestamp
+	80,  // 7: colossus.api.v1alpha1.Run.started_at:type_name -> google.protobuf.Timestamp
+	80,  // 8: colossus.api.v1alpha1.Run.finished_at:type_name -> google.protobuf.Timestamp
+	15,  // 9: colossus.api.v1alpha1.Run.result:type_name -> colossus.api.v1alpha1.RunResult
+	16,  // 10: colossus.api.v1alpha1.Run.failure:type_name -> colossus.api.v1alpha1.RunFailure
+	17,  // 11: colossus.api.v1alpha1.Run.cancellation:type_name -> colossus.api.v1alpha1.RunCancellation
+	81,  // 12: colossus.api.v1alpha1.CreateRunRequest.input:type_name -> colossus.api.v1alpha1.ContentPart
+	0,   // 13: colossus.api.v1alpha1.CreateRunRequest.mode:type_name -> colossus.api.v1alpha1.RunMode
+	21,  // 14: colossus.api.v1alpha1.CreateRunRequest.plan_action:type_name -> colossus.api.v1alpha1.PlanRunAction
+	20,  // 15: colossus.api.v1alpha1.CreateRunRequest.branch:type_name -> colossus.api.v1alpha1.RunBranch
+	1,   // 16: colossus.api.v1alpha1.CreateRunRequest.research_depth:type_name -> colossus.api.v1alpha1.ResearchDepth
+	2,   // 17: colossus.api.v1alpha1.CreateRunRequest.research_sources:type_name -> colossus.api.v1alpha1.ResearchSourceKind
+	6,   // 18: colossus.api.v1alpha1.RunBranch.context_mode:type_name -> colossus.api.v1alpha1.RunBranchContextMode
+	22,  // 19: colossus.api.v1alpha1.PlanRunAction.revise:type_name -> colossus.api.v1alpha1.RevisePlanAction
+	23,  // 20: colossus.api.v1alpha1.PlanRunAction.execute:type_name -> colossus.api.v1alpha1.ExecutePlanAction
+	4,   // 21: colossus.api.v1alpha1.ExecutePlanAction.strategy:type_name -> colossus.api.v1alpha1.PlanExecutionStrategy
+	18,  // 22: colossus.api.v1alpha1.CreateRunResponse.run:type_name -> colossus.api.v1alpha1.Run
+	18,  // 23: colossus.api.v1alpha1.GetRunResponse.run:type_name -> colossus.api.v1alpha1.Run
+	47,  // 24: colossus.api.v1alpha1.GetRunResponse.pending_interactions:type_name -> colossus.api.v1alpha1.Interaction
+	5,   // 25: colossus.api.v1alpha1.ListRunsRequest.statuses:type_name -> colossus.api.v1alpha1.RunStatus
+	82,  // 26: colossus.api.v1alpha1.ListRunsRequest.page:type_name -> colossus.api.v1alpha1.PageRequest
+	18,  // 27: colossus.api.v1alpha1.ListRunsResponse.runs:type_name -> colossus.api.v1alpha1.Run
+	83,  // 28: colossus.api.v1alpha1.ListRunsResponse.page:type_name -> colossus.api.v1alpha1.PageResponse
+	7,   // 29: colossus.api.v1alpha1.SessionActivity.lane:type_name -> colossus.api.v1alpha1.SessionActivityLane
+	8,   // 30: colossus.api.v1alpha1.SessionActivity.kind:type_name -> colossus.api.v1alpha1.SessionActivityKind
+	9,   // 31: colossus.api.v1alpha1.SessionActivity.status:type_name -> colossus.api.v1alpha1.SessionActivityStatus
+	80,  // 32: colossus.api.v1alpha1.SessionActivity.started_at:type_name -> google.protobuf.Timestamp
+	80,  // 33: colossus.api.v1alpha1.SessionActivity.completed_at:type_name -> google.protobuf.Timestamp
+	29,  // 34: colossus.api.v1alpha1.SessionActivity.input:type_name -> colossus.api.v1alpha1.SessionActivityContent
+	29,  // 35: colossus.api.v1alpha1.SessionActivity.result:type_name -> colossus.api.v1alpha1.SessionActivityContent
+	78,  // 36: colossus.api.v1alpha1.SessionActivity.attributes:type_name -> colossus.api.v1alpha1.SessionActivity.AttributesEntry
+	7,   // 37: colossus.api.v1alpha1.ListSessionActivityRequest.lanes:type_name -> colossus.api.v1alpha1.SessionActivityLane
+	8,   // 38: colossus.api.v1alpha1.ListSessionActivityRequest.kinds:type_name -> colossus.api.v1alpha1.SessionActivityKind
+	9,   // 39: colossus.api.v1alpha1.ListSessionActivityRequest.statuses:type_name -> colossus.api.v1alpha1.SessionActivityStatus
+	82,  // 40: colossus.api.v1alpha1.ListSessionActivityRequest.page:type_name -> colossus.api.v1alpha1.PageRequest
+	30,  // 41: colossus.api.v1alpha1.ListSessionActivityResponse.activities:type_name -> colossus.api.v1alpha1.SessionActivity
+	83,  // 42: colossus.api.v1alpha1.ListSessionActivityResponse.page:type_name -> colossus.api.v1alpha1.PageResponse
+	61,  // 43: colossus.api.v1alpha1.WatchRunResponse.update:type_name -> colossus.api.v1alpha1.RunUpdate
+	18,  // 44: colossus.api.v1alpha1.CancelRunResponse.run:type_name -> colossus.api.v1alpha1.Run
+	37,  // 45: colossus.api.v1alpha1.ArchiveThreadResponse.thread:type_name -> colossus.api.v1alpha1.ThreadLifecycle
+	37,  // 46: colossus.api.v1alpha1.RestoreThreadResponse.thread:type_name -> colossus.api.v1alpha1.ThreadLifecycle
+	42,  // 47: colossus.api.v1alpha1.UserPromptInteraction.choices:type_name -> colossus.api.v1alpha1.PromptChoice
+	12,  // 48: colossus.api.v1alpha1.ApprovalInteraction.risk:type_name -> colossus.api.v1alpha1.ApprovalRisk
+	46,  // 49: colossus.api.v1alpha1.ApprovalInteraction.command_context:type_name -> colossus.api.v1alpha1.CommandApprovalContext
+	10,  // 50: colossus.api.v1alpha1.Interaction.kind:type_name -> colossus.api.v1alpha1.InteractionKind
+	11,  // 51: colossus.api.v1alpha1.Interaction.status:type_name -> colossus.api.v1alpha1.InteractionStatus
+	80,  // 52: colossus.api.v1alpha1.Interaction.created_at:type_name -> google.protobuf.Timestamp
+	80,  // 53: colossus.api.v1alpha1.Interaction.expires_at:type_name -> google.protobuf.Timestamp
+	43,  // 54: colossus.api.v1alpha1.Interaction.user_prompt:type_name -> colossus.api.v1alpha1.UserPromptInteraction
+	45,  // 55: colossus.api.v1alpha1.Interaction.approval:type_name -> colossus.api.v1alpha1.ApprovalInteraction
+	48,  // 56: colossus.api.v1alpha1.PromptAnswer.choice:type_name -> colossus.api.v1alpha1.PromptChoiceAnswer
+	49,  // 57: colossus.api.v1alpha1.RespondInteractionRequest.prompt_answer:type_name -> colossus.api.v1alpha1.PromptAnswer
+	50,  // 58: colossus.api.v1alpha1.RespondInteractionRequest.approval_answer:type_name -> colossus.api.v1alpha1.ApprovalAnswer
+	47,  // 59: colossus.api.v1alpha1.RespondInteractionResponse.interaction:type_name -> colossus.api.v1alpha1.Interaction
+	13,  // 60: colossus.api.v1alpha1.ToolActivity.state:type_name -> colossus.api.v1alpha1.ToolActivityState
+	14,  // 61: colossus.api.v1alpha1.ProviderRetry.state:type_name -> colossus.api.v1alpha1.ProviderRetryState
+	5,   // 62: colossus.api.v1alpha1.RunStateChanged.status:type_name -> colossus.api.v1alpha1.RunStatus
+	5,   // 63: colossus.api.v1alpha1.RunFailed.status:type_name -> colossus.api.v1alpha1.RunStatus
+	16,  // 64: colossus.api.v1alpha1.RunFailed.failure:type_name -> colossus.api.v1alpha1.RunFailure
+	80,  // 65: colossus.api.v1alpha1.RunUpdate.created_at:type_name -> google.protobuf.Timestamp
+	59,  // 66: colossus.api.v1alpha1.RunUpdate.state:type_name -> colossus.api.v1alpha1.RunStateChanged
+	53,  // 67: colossus.api.v1alpha1.RunUpdate.output_delta:type_name -> colossus.api.v1alpha1.VisibleOutputDelta
+	54,  // 68: colossus.api.v1alpha1.RunUpdate.reasoning_summary:type_name -> colossus.api.v1alpha1.ReasoningSummary
+	55,  // 69: colossus.api.v1alpha1.RunUpdate.tool_activity:type_name -> colossus.api.v1alpha1.ToolActivity
+	56,  // 70: colossus.api.v1alpha1.RunUpdate.usage:type_name -> colossus.api.v1alpha1.TokenUsage
+	47,  // 71: colossus.api.v1alpha1.RunUpdate.interaction:type_name -> colossus.api.v1alpha1.Interaction
+	84,  // 72: colossus.api.v1alpha1.RunUpdate.message:type_name -> colossus.api.v1alpha1.SessionMessage
+	58,  // 73: colossus.api.v1alpha1.RunUpdate.notice:type_name -> colossus.api.v1alpha1.RunNotice
+	15,  // 74: colossus.api.v1alpha1.RunUpdate.result:type_name -> colossus.api.v1alpha1.RunResult
+	60,  // 75: colossus.api.v1alpha1.RunUpdate.failure:type_name -> colossus.api.v1alpha1.RunFailed
+	17,  // 76: colossus.api.v1alpha1.RunUpdate.cancellation:type_name -> colossus.api.v1alpha1.RunCancellation
+	57,  // 77: colossus.api.v1alpha1.RunUpdate.provider_retry:type_name -> colossus.api.v1alpha1.ProviderRetry
+	62,  // 78: colossus.api.v1alpha1.ProcessSessionSnapshot.session:type_name -> colossus.api.v1alpha1.ProcessSession
+	63,  // 79: colossus.api.v1alpha1.ProcessSessionSnapshot.chunks:type_name -> colossus.api.v1alpha1.ProcessOutputChunk
+	62,  // 80: colossus.api.v1alpha1.ListProcessSessionsResponse.sessions:type_name -> colossus.api.v1alpha1.ProcessSession
+	64,  // 81: colossus.api.v1alpha1.ReadProcessSessionResponse.snapshot:type_name -> colossus.api.v1alpha1.ProcessSessionSnapshot
+	64,  // 82: colossus.api.v1alpha1.StopProcessSessionResponse.snapshot:type_name -> colossus.api.v1alpha1.ProcessSessionSnapshot
+	5,   // 83: colossus.api.v1alpha1.ListVisibleRunsRequest.statuses:type_name -> colossus.api.v1alpha1.RunStatus
+	82,  // 84: colossus.api.v1alpha1.ListVisibleRunsRequest.page:type_name -> colossus.api.v1alpha1.PageRequest
+	18,  // 85: colossus.api.v1alpha1.VisibleRun.run:type_name -> colossus.api.v1alpha1.Run
+	74,  // 86: colossus.api.v1alpha1.ListVisibleRunsResponse.runs:type_name -> colossus.api.v1alpha1.VisibleRun
+	83,  // 87: colossus.api.v1alpha1.ListVisibleRunsResponse.page:type_name -> colossus.api.v1alpha1.PageResponse
+	65,  // 88: colossus.api.v1alpha1.AgentRunService.ListProcessSessions:input_type -> colossus.api.v1alpha1.ListProcessSessionsRequest
+	67,  // 89: colossus.api.v1alpha1.AgentRunService.ReadProcessSession:input_type -> colossus.api.v1alpha1.ReadProcessSessionRequest
+	69,  // 90: colossus.api.v1alpha1.AgentRunService.StopProcessSession:input_type -> colossus.api.v1alpha1.StopProcessSessionRequest
+	19,  // 91: colossus.api.v1alpha1.AgentRunService.CreateRun:input_type -> colossus.api.v1alpha1.CreateRunRequest
+	25,  // 92: colossus.api.v1alpha1.AgentRunService.GetRun:input_type -> colossus.api.v1alpha1.GetRunRequest
+	27,  // 93: colossus.api.v1alpha1.AgentRunService.ListRuns:input_type -> colossus.api.v1alpha1.ListRunsRequest
+	31,  // 94: colossus.api.v1alpha1.AgentRunService.ListSessionActivity:input_type -> colossus.api.v1alpha1.ListSessionActivityRequest
+	33,  // 95: colossus.api.v1alpha1.AgentRunService.WatchRun:input_type -> colossus.api.v1alpha1.WatchRunRequest
+	35,  // 96: colossus.api.v1alpha1.AgentRunService.CancelRun:input_type -> colossus.api.v1alpha1.CancelRunRequest
+	38,  // 97: colossus.api.v1alpha1.AgentRunService.ArchiveThread:input_type -> colossus.api.v1alpha1.ArchiveThreadRequest
+	40,  // 98: colossus.api.v1alpha1.AgentRunService.RestoreThread:input_type -> colossus.api.v1alpha1.RestoreThreadRequest
+	51,  // 99: colossus.api.v1alpha1.AgentRunService.RespondInteraction:input_type -> colossus.api.v1alpha1.RespondInteractionRequest
+	71,  // 100: colossus.api.v1alpha1.AgentRunService.SetWorkspaceSharing:input_type -> colossus.api.v1alpha1.SetWorkspaceSharingRequest
+	73,  // 101: colossus.api.v1alpha1.AgentRunService.ListVisibleRuns:input_type -> colossus.api.v1alpha1.ListVisibleRunsRequest
+	76,  // 102: colossus.api.v1alpha1.AgentRunService.GetRuntimePolicyPosture:input_type -> colossus.api.v1alpha1.GetRuntimePolicyPostureRequest
+	66,  // 103: colossus.api.v1alpha1.AgentRunService.ListProcessSessions:output_type -> colossus.api.v1alpha1.ListProcessSessionsResponse
+	68,  // 104: colossus.api.v1alpha1.AgentRunService.ReadProcessSession:output_type -> colossus.api.v1alpha1.ReadProcessSessionResponse
+	70,  // 105: colossus.api.v1alpha1.AgentRunService.StopProcessSession:output_type -> colossus.api.v1alpha1.StopProcessSessionResponse
+	24,  // 106: colossus.api.v1alpha1.AgentRunService.CreateRun:output_type -> colossus.api.v1alpha1.CreateRunResponse
+	26,  // 107: colossus.api.v1alpha1.AgentRunService.GetRun:output_type -> colossus.api.v1alpha1.GetRunResponse
+	28,  // 108: colossus.api.v1alpha1.AgentRunService.ListRuns:output_type -> colossus.api.v1alpha1.ListRunsResponse
+	32,  // 109: colossus.api.v1alpha1.AgentRunService.ListSessionActivity:output_type -> colossus.api.v1alpha1.ListSessionActivityResponse
+	34,  // 110: colossus.api.v1alpha1.AgentRunService.WatchRun:output_type -> colossus.api.v1alpha1.WatchRunResponse
+	36,  // 111: colossus.api.v1alpha1.AgentRunService.CancelRun:output_type -> colossus.api.v1alpha1.CancelRunResponse
+	39,  // 112: colossus.api.v1alpha1.AgentRunService.ArchiveThread:output_type -> colossus.api.v1alpha1.ArchiveThreadResponse
+	41,  // 113: colossus.api.v1alpha1.AgentRunService.RestoreThread:output_type -> colossus.api.v1alpha1.RestoreThreadResponse
+	52,  // 114: colossus.api.v1alpha1.AgentRunService.RespondInteraction:output_type -> colossus.api.v1alpha1.RespondInteractionResponse
+	72,  // 115: colossus.api.v1alpha1.AgentRunService.SetWorkspaceSharing:output_type -> colossus.api.v1alpha1.SetWorkspaceSharingResponse
+	75,  // 116: colossus.api.v1alpha1.AgentRunService.ListVisibleRuns:output_type -> colossus.api.v1alpha1.ListVisibleRunsResponse
+	77,  // 117: colossus.api.v1alpha1.AgentRunService.GetRuntimePolicyPosture:output_type -> colossus.api.v1alpha1.GetRuntimePolicyPostureResponse
+	103, // [103:118] is the sub-list for method output_type
+	88,  // [88:103] is the sub-list for method input_type
+	88,  // [88:88] is the sub-list for extension type_name
+	88,  // [88:88] is the sub-list for extension extendee
+	0,   // [0:88] is the sub-list for field type_name
 }
 
 func init() { file_colossus_api_v1alpha1_agent_run_proto_init() }
@@ -6086,13 +6536,14 @@ func file_colossus_api_v1alpha1_agent_run_proto_init() {
 	file_colossus_api_v1alpha1_agent_run_proto_msgTypes[47].OneofWrappers = []any{}
 	file_colossus_api_v1alpha1_agent_run_proto_msgTypes[50].OneofWrappers = []any{}
 	file_colossus_api_v1alpha1_agent_run_proto_msgTypes[51].OneofWrappers = []any{}
+	file_colossus_api_v1alpha1_agent_run_proto_msgTypes[58].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_colossus_api_v1alpha1_agent_run_proto_rawDesc), len(file_colossus_api_v1alpha1_agent_run_proto_rawDesc)),
 			NumEnums:      15,
-			NumMessages:   57,
+			NumMessages:   64,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/sdk/go/gen/colossus/api/v1alpha1/agent_run_grpc.pb.go b/sdk/go/gen/colossus/api/v1alpha1/agent_run_grpc.pb.go
index 8fbff3ae5..5047d1bcc 100644
--- a/sdk/go/gen/colossus/api/v1alpha1/agent_run_grpc.pb.go
+++ b/sdk/go/gen/colossus/api/v1alpha1/agent_run_grpc.pb.go
@@ -19,18 +19,21 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	AgentRunService_ListProcessSessions_FullMethodName = "/colossus.api.v1alpha1.AgentRunService/ListProcessSessions"
-	AgentRunService_ReadProcessSession_FullMethodName  = "/colossus.api.v1alpha1.AgentRunService/ReadProcessSession"
-	AgentRunService_StopProcessSession_FullMethodName  = "/colossus.api.v1alpha1.AgentRunService/StopProcessSession"
-	AgentRunService_CreateRun_FullMethodName           = "/colossus.api.v1alpha1.AgentRunService/CreateRun"
-	AgentRunService_GetRun_FullMethodName              = "/colossus.api.v1alpha1.AgentRunService/GetRun"
-	AgentRunService_ListRuns_FullMethodName            = "/colossus.api.v1alpha1.AgentRunService/ListRuns"
-	AgentRunService_ListSessionActivity_FullMethodName = "/colossus.api.v1alpha1.AgentRunService/ListSessionActivity"
-	AgentRunService_WatchRun_FullMethodName            = "/colossus.api.v1alpha1.AgentRunService/WatchRun"
-	AgentRunService_CancelRun_FullMethodName           = "/colossus.api.v1alpha1.AgentRunService/CancelRun"
-	AgentRunService_ArchiveThread_FullMethodName       = "/colossus.api.v1alpha1.AgentRunService/ArchiveThread"
-	AgentRunService_RestoreThread_FullMethodName       = "/colossus.api.v1alpha1.AgentRunService/RestoreThread"
-	AgentRunService_RespondInteraction_FullMethodName  = "/colossus.api.v1alpha1.AgentRunService/RespondInteraction"
+	AgentRunService_ListProcessSessions_FullMethodName     = "/colossus.api.v1alpha1.AgentRunService/ListProcessSessions"
+	AgentRunService_ReadProcessSession_FullMethodName      = "/colossus.api.v1alpha1.AgentRunService/ReadProcessSession"
+	AgentRunService_StopProcessSession_FullMethodName      = "/colossus.api.v1alpha1.AgentRunService/StopProcessSession"
+	AgentRunService_CreateRun_FullMethodName               = "/colossus.api.v1alpha1.AgentRunService/CreateRun"
+	AgentRunService_GetRun_FullMethodName                  = "/colossus.api.v1alpha1.AgentRunService/GetRun"
+	AgentRunService_ListRuns_FullMethodName                = "/colossus.api.v1alpha1.AgentRunService/ListRuns"
+	AgentRunService_ListSessionActivity_FullMethodName     = "/colossus.api.v1alpha1.AgentRunService/ListSessionActivity"
+	AgentRunService_WatchRun_FullMethodName                = "/colossus.api.v1alpha1.AgentRunService/WatchRun"
+	AgentRunService_CancelRun_FullMethodName               = "/colossus.api.v1alpha1.AgentRunService/CancelRun"
+	AgentRunService_ArchiveThread_FullMethodName           = "/colossus.api.v1alpha1.AgentRunService/ArchiveThread"
+	AgentRunService_RestoreThread_FullMethodName           = "/colossus.api.v1alpha1.AgentRunService/RestoreThread"
+	AgentRunService_RespondInteraction_FullMethodName      = "/colossus.api.v1alpha1.AgentRunService/RespondInteraction"
+	AgentRunService_SetWorkspaceSharing_FullMethodName     = "/colossus.api.v1alpha1.AgentRunService/SetWorkspaceSharing"
+	AgentRunService_ListVisibleRuns_FullMethodName         = "/colossus.api.v1alpha1.AgentRunService/ListVisibleRuns"
+	AgentRunService_GetRuntimePolicyPosture_FullMethodName = "/colossus.api.v1alpha1.AgentRunService/GetRuntimePolicyPosture"
 )
 
 // AgentRunServiceClient is the client API for AgentRunService service.
@@ -63,6 +66,12 @@ type AgentRunServiceClient interface {
 	RestoreThread(ctx context.Context, in *RestoreThreadRequest, opts ...grpc.CallOption) (*RestoreThreadResponse, error)
 	// RespondInteraction answers one caller-bound prompt or approval exactly once.
 	RespondInteraction(ctx context.Context, in *RespondInteractionRequest, opts ...grpc.CallOption) (*RespondInteractionResponse, error)
+	// The local application explicitly releases its own workspace sessions.
+	SetWorkspaceSharing(ctx context.Context, in *SetWorkspaceSharingRequest, opts ...grpc.CallOption) (*SetWorkspaceSharingResponse, error)
+	// Discovery includes only owned or explicitly shared released runs.
+	ListVisibleRuns(ctx context.Context, in *ListVisibleRunsRequest, opts ...grpc.CallOption) (*ListVisibleRunsResponse, error)
+	// Caller-scoped configuration metadata; never an enforcement attestation or raw config.
+	GetRuntimePolicyPosture(ctx context.Context, in *GetRuntimePolicyPostureRequest, opts ...grpc.CallOption) (*GetRuntimePolicyPostureResponse, error)
 }
 
 type agentRunServiceClient struct {
@@ -202,6 +211,36 @@ func (c *agentRunServiceClient) RespondInteraction(ctx context.Context, in *Resp
 	return out, nil
 }
 
+func (c *agentRunServiceClient) SetWorkspaceSharing(ctx context.Context, in *SetWorkspaceSharingRequest, opts ...grpc.CallOption) (*SetWorkspaceSharingResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(SetWorkspaceSharingResponse)
+	err := c.cc.Invoke(ctx, AgentRunService_SetWorkspaceSharing_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *agentRunServiceClient) ListVisibleRuns(ctx context.Context, in *ListVisibleRunsRequest, opts ...grpc.CallOption) (*ListVisibleRunsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListVisibleRunsResponse)
+	err := c.cc.Invoke(ctx, AgentRunService_ListVisibleRuns_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *agentRunServiceClient) GetRuntimePolicyPosture(ctx context.Context, in *GetRuntimePolicyPostureRequest, opts ...grpc.CallOption) (*GetRuntimePolicyPostureResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetRuntimePolicyPostureResponse)
+	err := c.cc.Invoke(ctx, AgentRunService_GetRuntimePolicyPosture_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // AgentRunServiceServer is the server API for AgentRunService service.
 // All implementations must embed UnimplementedAgentRunServiceServer
 // for forward compatibility.
@@ -232,6 +271,12 @@ type AgentRunServiceServer interface {
 	RestoreThread(context.Context, *RestoreThreadRequest) (*RestoreThreadResponse, error)
 	// RespondInteraction answers one caller-bound prompt or approval exactly once.
 	RespondInteraction(context.Context, *RespondInteractionRequest) (*RespondInteractionResponse, error)
+	// The local application explicitly releases its own workspace sessions.
+	SetWorkspaceSharing(context.Context, *SetWorkspaceSharingRequest) (*SetWorkspaceSharingResponse, error)
+	// Discovery includes only owned or explicitly shared released runs.
+	ListVisibleRuns(context.Context, *ListVisibleRunsRequest) (*ListVisibleRunsResponse, error)
+	// Caller-scoped configuration metadata; never an enforcement attestation or raw config.
+	GetRuntimePolicyPosture(context.Context, *GetRuntimePolicyPostureRequest) (*GetRuntimePolicyPostureResponse, error)
 	mustEmbedUnimplementedAgentRunServiceServer()
 }
 
@@ -278,6 +323,15 @@ func (UnimplementedAgentRunServiceServer) RestoreThread(context.Context, *Restor
 func (UnimplementedAgentRunServiceServer) RespondInteraction(context.Context, *RespondInteractionRequest) (*RespondInteractionResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method RespondInteraction not implemented")
 }
+func (UnimplementedAgentRunServiceServer) SetWorkspaceSharing(context.Context, *SetWorkspaceSharingRequest) (*SetWorkspaceSharingResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method SetWorkspaceSharing not implemented")
+}
+func (UnimplementedAgentRunServiceServer) ListVisibleRuns(context.Context, *ListVisibleRunsRequest) (*ListVisibleRunsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListVisibleRuns not implemented")
+}
+func (UnimplementedAgentRunServiceServer) GetRuntimePolicyPosture(context.Context, *GetRuntimePolicyPostureRequest) (*GetRuntimePolicyPostureResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetRuntimePolicyPosture not implemented")
+}
 func (UnimplementedAgentRunServiceServer) mustEmbedUnimplementedAgentRunServiceServer() {}
 func (UnimplementedAgentRunServiceServer) testEmbeddedByValue()                         {}
 
@@ -508,6 +562,60 @@ func _AgentRunService_RespondInteraction_Handler(srv interface{}, ctx context.Co
 	return interceptor(ctx, in, info, handler)
 }
 
+func _AgentRunService_SetWorkspaceSharing_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetWorkspaceSharingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AgentRunServiceServer).SetWorkspaceSharing(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AgentRunService_SetWorkspaceSharing_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AgentRunServiceServer).SetWorkspaceSharing(ctx, req.(*SetWorkspaceSharingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AgentRunService_ListVisibleRuns_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListVisibleRunsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AgentRunServiceServer).ListVisibleRuns(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AgentRunService_ListVisibleRuns_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AgentRunServiceServer).ListVisibleRuns(ctx, req.(*ListVisibleRunsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _AgentRunService_GetRuntimePolicyPosture_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetRuntimePolicyPostureRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(AgentRunServiceServer).GetRuntimePolicyPosture(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: AgentRunService_GetRuntimePolicyPosture_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(AgentRunServiceServer).GetRuntimePolicyPosture(ctx, req.(*GetRuntimePolicyPostureRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // AgentRunService_ServiceDesc is the grpc.ServiceDesc for AgentRunService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -559,6 +667,18 @@ var AgentRunService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RespondInteraction",
 			Handler:    _AgentRunService_RespondInteraction_Handler,
 		},
+		{
+			MethodName: "SetWorkspaceSharing",
+			Handler:    _AgentRunService_SetWorkspaceSharing_Handler,
+		},
+		{
+			MethodName: "ListVisibleRuns",
+			Handler:    _AgentRunService_ListVisibleRuns_Handler,
+		},
+		{
+			MethodName: "GetRuntimePolicyPosture",
+			Handler:    _AgentRunService_GetRuntimePolicyPosture_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{
diff --git a/sdk/go/generated-output.sha256 b/sdk/go/generated-output.sha256
index 709d1d040..23fc789c5 100644
--- a/sdk/go/generated-output.sha256
+++ b/sdk/go/generated-output.sha256
@@ -1 +1 @@
-6c32794d71246e8c66af6bdbc88d3ddbde2f73705e698383d71b3338d1c63c79
+a165f2e71312d1503144fc790ddc7b311183364e2fd667107b8ed27397a0fca4
diff --git a/sdk/go/go.mod b/sdk/go/go.mod
index 9cb795157..48080247d 100644
--- a/sdk/go/go.mod
+++ b/sdk/go/go.mod
@@ -3,13 +3,13 @@ module github.com/obscuritylabs/colossus/sdk/go
 go 1.25.0
 
 require (
-	google.golang.org/grpc v1.81.1
+	google.golang.org/grpc v1.83.2
 	google.golang.org/protobuf v1.36.11
 )
 
 require (
-	golang.org/x/net v0.51.0 // indirect
-	golang.org/x/sys v0.42.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
 )
diff --git a/sdk/go/go.sum b/sdk/go/go.sum
index 44c671d1e..2d3ad8d12 100644
--- a/sdk/go/go.sum
+++ b/sdk/go/go.sum
@@ -12,27 +12,27 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
-golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
diff --git a/sdk/go/posture.go b/sdk/go/posture.go
new file mode 100644
index 000000000..219faa555
--- /dev/null
+++ b/sdk/go/posture.go
@@ -0,0 +1,279 @@
+package colossus
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"regexp"
+	"unicode/utf8"
+
+	v1alpha1 "github.com/obscuritylabs/colossus/sdk/go/gen/colossus/api/v1alpha1"
+	"google.golang.org/grpc"
+)
+
+// PolicyProvenance identifies a configuration report rather than an attestation.
+type PolicyProvenance string
+
+const PolicyRuntimeReported PolicyProvenance = "runtime_reported"
+
+// PolicySandboxBackend is the runtime's released execution boundary.
+type PolicySandboxBackend string
+
+const (
+	PolicySandboxNative           PolicySandboxBackend = "native"
+	PolicySandboxWindowsJob       PolicySandboxBackend = "windows_job"
+	PolicySandboxOCI              PolicySandboxBackend = "oci"
+	PolicySandboxExternal         PolicySandboxBackend = "external"
+	PolicySandboxDangerFullAccess PolicySandboxBackend = "danger_full_access"
+	PolicySandboxUnknown          PolicySandboxBackend = "unknown"
+)
+
+// PolicyApprovalMode is native-owned public approval behavior.
+type PolicyApprovalMode string
+
+const (
+	PolicyApprovalDeny       PolicyApprovalMode = "deny"
+	PolicyApprovalAsk        PolicyApprovalMode = "ask"
+	PolicyApprovalRiskAuto   PolicyApprovalMode = "risk_auto"
+	PolicyApprovalDangerAuto PolicyApprovalMode = "danger_auto"
+	PolicyApprovalUnknown    PolicyApprovalMode = "unknown"
+)
+
+// PolicyFindingCode is a closed configuration-risk taxonomy, not a violation count.
+type PolicyFindingCode string
+
+const (
+	PolicyFindingEphemeral        PolicyFindingCode = "storage.ephemeral"
+	PolicyFindingPlaintext        PolicyFindingCode = "storage.plaintext"
+	PolicyFindingFullAccess       PolicyFindingCode = "sandbox.danger_full_access"
+	PolicyFindingSensitiveJournal PolicyFindingCode = "observability.sensitive_journal_payloads"
+	PolicyFindingPlaintextOAuth   PolicyFindingCode = "credentials.mcp_oauth_plaintext"
+)
+
+// PolicyFindingSeverity is the closed severity of a configuration finding.
+type PolicyFindingSeverity string
+
+const PolicyFindingWarning PolicyFindingSeverity = "warning"
+
+// PolicyTelemetryProvenance describes the canonical counter evidence source.
+type PolicyTelemetryProvenance string
+
+const PolicyTelemetryUnavailable PolicyTelemetryProvenance = "unavailable"
+
+// PolicyModelLabel contains safe logical profile/model identifiers only.
+type PolicyModelLabel struct {
+	Profile string `json:"profile"`
+	Label   string `json:"label"`
+}
+
+// PolicyFinding reports a known configuration warning.
+type PolicyFinding struct {
+	Code     PolicyFindingCode     `json:"code"`
+	Severity PolicyFindingSeverity `json:"severity"`
+}
+
+// PolicyTelemetry preserves unknown counters as nil instead of zero.
+type PolicyTelemetry struct {
+	Provenance         PolicyTelemetryProvenance `json:"provenance"`
+	DeniedRequests     *uint64                   `json:"denied_requests"`
+	ApprovalRequests   *uint64                   `json:"approval_requests"`
+	OutcomeUnknownRuns *uint64                   `json:"outcome_unknown_runs"`
+}
+
+// RuntimePolicyPosture is bounded released metadata. It never grants authority.
+type RuntimePolicyPosture struct {
+	SchemaVersion         uint32               `json:"schema_version"`
+	Provenance            PolicyProvenance     `json:"provenance"`
+	Fingerprint           string               `json:"fingerprint"`
+	ConfigurationRevision *uint64              `json:"configuration_revision"`
+	AccessProfile         string               `json:"access_profile"`
+	SandboxBackend        PolicySandboxBackend `json:"sandbox_backend"`
+	SandboxProfile        string               `json:"sandbox_profile"`
+	BoundaryAcknowledged  bool                 `json:"boundary_acknowledged"`
+	ApprovalMode          PolicyApprovalMode   `json:"approval_mode"`
+	AllowedRoles          []string             `json:"allowed_roles"`
+	AllowedTools          []string             `json:"allowed_tools"`
+	Capabilities          []string             `json:"capabilities"`
+	Models                []PolicyModelLabel   `json:"models"`
+	Findings              []PolicyFinding      `json:"findings"`
+	Telemetry             PolicyTelemetry      `json:"telemetry"`
+}
+
+// ErrRuntimePolicyPosture omits malformed response contents and private values.
+var ErrRuntimePolicyPosture = errors.New("invalid bounded runtime policy metadata")
+var policyIdentifier = regexp.MustCompile(`^[A-Za-z0-9._-]{1,128}$`)
+var policyFingerprint = regexp.MustCompile(`^[0-9a-f]{64}$`)
+
+func policyJSON(decoder *json.Decoder, depth int) (any, error) {
+	if depth > 8 {
+		return nil, ErrRuntimePolicyPosture
+	}
+	token, err := decoder.Token()
+	if err != nil {
+		return nil, ErrRuntimePolicyPosture
+	}
+	if delimiter, ok := token.(json.Delim); ok {
+		if delimiter == '{' {
+			object := map[string]any{}
+			for decoder.More() {
+				token, err := decoder.Token()
+				if err != nil {
+					return nil, ErrRuntimePolicyPosture
+				}
+				key, ok := token.(string)
+				if !ok {
+					return nil, ErrRuntimePolicyPosture
+				}
+				if _, duplicate := object[key]; duplicate {
+					return nil, ErrRuntimePolicyPosture
+				}
+				value, err := policyJSON(decoder, depth+1)
+				if err != nil {
+					return nil, err
+				}
+				object[key] = value
+			}
+			end, err := decoder.Token()
+			if err != nil || end != json.Delim('}') {
+				return nil, ErrRuntimePolicyPosture
+			}
+			return object, nil
+		}
+		if delimiter == '[' {
+			array := []any{}
+			for decoder.More() {
+				value, err := policyJSON(decoder, depth+1)
+				if err != nil {
+					return nil, err
+				}
+				array = append(array, value)
+			}
+			end, err := decoder.Token()
+			if err != nil || end != json.Delim(']') {
+				return nil, ErrRuntimePolicyPosture
+			}
+			return array, nil
+		}
+		return nil, ErrRuntimePolicyPosture
+	}
+	return token, nil
+}
+func policyObject(value any, required []string, optional ...string) (map[string]any, bool) {
+	object, ok := value.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	allowed := map[string]bool{}
+	for _, key := range required {
+		allowed[key] = true
+		if _, exists := object[key]; !exists {
+			return nil, false
+		}
+	}
+	for _, key := range optional {
+		allowed[key] = true
+	}
+	for key := range object {
+		if !allowed[key] {
+			return nil, false
+		}
+	}
+	return object, true
+}
+func policyList(values []string, max int) bool {
+	if values == nil || len(values) > max {
+		return false
+	}
+	for i, value := range values {
+		if !policyIdentifier.MatchString(value) || i > 0 && values[i-1] >= value {
+			return false
+		}
+	}
+	return true
+}
+func policyChoice[T ~string](value T, allowed ...T) bool {
+	for _, item := range allowed {
+		if value == item {
+			return true
+		}
+	}
+	return false
+}
+
+// DecodeRuntimePolicyPosture validates closed JSON before releasing a typed DTO.
+func DecodeRuntimePolicyPosture(payload []byte) (*RuntimePolicyPosture, error) {
+	if len(payload) == 0 || len(payload) > 64*1024 || !utf8.Valid(payload) {
+		return nil, ErrRuntimePolicyPosture
+	}
+	decoder := json.NewDecoder(bytes.NewReader(payload))
+	decoder.UseNumber()
+	raw, err := policyJSON(decoder, 0)
+	if err != nil {
+		return nil, ErrRuntimePolicyPosture
+	}
+	if _, err = decoder.Token(); err != io.EOF {
+		return nil, ErrRuntimePolicyPosture
+	}
+	object, ok := policyObject(raw, []string{"schema_version", "provenance", "fingerprint", "access_profile", "sandbox_backend", "sandbox_profile", "boundary_acknowledged", "approval_mode", "allowed_roles", "allowed_tools", "capabilities", "models", "findings", "telemetry"}, "configuration_revision")
+	if !ok {
+		return nil, ErrRuntimePolicyPosture
+	}
+	if _, ok := object["boundary_acknowledged"].(bool); !ok {
+		return nil, ErrRuntimePolicyPosture
+	}
+	for _, key := range []string{"models", "findings"} {
+		items, ok := object[key].([]any)
+		if !ok {
+			return nil, ErrRuntimePolicyPosture
+		}
+		for _, item := range items {
+			required := []string{"profile", "label"}
+			if key == "findings" {
+				required = []string{"code", "severity"}
+			}
+			if _, ok = policyObject(item, required); !ok {
+				return nil, ErrRuntimePolicyPosture
+			}
+		}
+	}
+	if _, ok = policyObject(object["telemetry"], []string{"provenance"}, "denied_requests", "approval_requests", "outcome_unknown_runs"); !ok {
+		return nil, ErrRuntimePolicyPosture
+	}
+	var posture RuntimePolicyPosture
+	strict := json.NewDecoder(bytes.NewReader(payload))
+	strict.DisallowUnknownFields()
+	if strict.Decode(&posture) != nil {
+		return nil, ErrRuntimePolicyPosture
+	}
+	if posture.SchemaVersion != 1 || posture.Provenance != PolicyRuntimeReported || !policyFingerprint.MatchString(posture.Fingerprint) || !policyIdentifier.MatchString(posture.AccessProfile) || !policyIdentifier.MatchString(posture.SandboxProfile) || !policyChoice(posture.SandboxBackend, PolicySandboxNative, PolicySandboxWindowsJob, PolicySandboxOCI, PolicySandboxExternal, PolicySandboxDangerFullAccess, PolicySandboxUnknown) || !policyChoice(posture.ApprovalMode, PolicyApprovalDeny, PolicyApprovalAsk, PolicyApprovalRiskAuto, PolicyApprovalDangerAuto, PolicyApprovalUnknown) || !policyList(posture.AllowedRoles, 64) || !policyList(posture.AllowedTools, 256) || !policyList(posture.Capabilities, 256) || posture.Models == nil || len(posture.Models) > 64 || posture.Findings == nil || len(posture.Findings) > 16 || posture.Telemetry.Provenance != "unavailable" || posture.Telemetry.DeniedRequests != nil || posture.Telemetry.ApprovalRequests != nil || posture.Telemetry.OutcomeUnknownRuns != nil {
+		return nil, ErrRuntimePolicyPosture
+	}
+	for _, model := range posture.Models {
+		if !policyIdentifier.MatchString(model.Profile) || !policyIdentifier.MatchString(model.Label) {
+			return nil, ErrRuntimePolicyPosture
+		}
+	}
+	for _, finding := range posture.Findings {
+		if finding.Severity != "warning" || !policyChoice(finding.Code, PolicyFindingEphemeral, PolicyFindingPlaintext, PolicyFindingFullAccess, PolicyFindingSensitiveJournal, PolicyFindingPlaintextOAuth) {
+			return nil, ErrRuntimePolicyPosture
+		}
+	}
+	return &posture, nil
+}
+
+// GetRuntimePolicyPosture reads once through an authenticated generated client.
+func GetRuntimePolicyPosture(ctx context.Context, client v1alpha1.AgentRunServiceClient, options ...grpc.CallOption) (*RuntimePolicyPosture, error) {
+	if client == nil {
+		return nil, ErrRuntimePolicyPosture
+	}
+	response, err := client.GetRuntimePolicyPosture(ctx, &v1alpha1.GetRuntimePolicyPostureRequest{}, options...)
+	if err != nil {
+		return nil, err
+	}
+	if response == nil {
+		return nil, ErrRuntimePolicyPosture
+	}
+	return DecodeRuntimePolicyPosture(response.PolicyJson)
+}
diff --git a/sdk/go/posture_test.go b/sdk/go/posture_test.go
new file mode 100644
index 000000000..6c48dc486
--- /dev/null
+++ b/sdk/go/posture_test.go
@@ -0,0 +1,62 @@
+package colossus
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	v1alpha1 "github.com/obscuritylabs/colossus/sdk/go/gen/colossus/api/v1alpha1"
+	"google.golang.org/grpc"
+	"strings"
+	"testing"
+)
+
+func validPolicy() RuntimePolicyPosture {
+	return RuntimePolicyPosture{SchemaVersion: 1, Provenance: PolicyRuntimeReported, Fingerprint: strings.Repeat("a", 64), AccessProfile: "minimal", SandboxBackend: PolicySandboxNative, SandboxProfile: "offline", ApprovalMode: PolicyApprovalAsk, AllowedRoles: []string{"primary"}, AllowedTools: []string{"filesystem.read"}, Capabilities: []string{"runs.read"}, Models: []PolicyModelLabel{{Profile: "main", Label: "safe-model"}}, Findings: []PolicyFinding{{Code: PolicyFindingEphemeral, Severity: PolicyFindingWarning}}, Telemetry: PolicyTelemetry{Provenance: PolicyTelemetryUnavailable}}
+}
+func TestPolicyU64AndUnknownCounters(t *testing.T) {
+	posture := validPolicy()
+	revision := ^uint64(0)
+	posture.ConfigurationRevision = &revision
+	payload, err := json.Marshal(posture)
+	if err != nil {
+		t.Fatal(err)
+	}
+	decoded, err := DecodeRuntimePolicyPosture(payload)
+	if err != nil || decoded == nil || decoded.ConfigurationRevision == nil || *decoded.ConfigurationRevision != revision {
+		t.Fatal("u64 revision must remain exact", err)
+	}
+	if decoded.Telemetry.DeniedRequests != nil {
+		t.Fatal("unknown must not become zero")
+	}
+}
+func TestPolicyClosedBoundedShapes(t *testing.T) {
+	bytes, err := json.Marshal(validPolicy())
+	if err != nil {
+		t.Fatal(err)
+	}
+	base := string(bytes)
+	cases := []string{strings.Replace(base, `"schema_version":1`, `"schema_version":1,"secret":"withheld"`, 1), strings.Replace(base, `"schema_version":1`, `"schema_version":2`, 1), strings.Replace(base, `"schema_version":1`, `"schema_version":1,"schema_version":1`, 1), strings.Replace(base, `"boundary_acknowledged":false`, `"boundary_acknowledged":null`, 1), strings.Replace(base, `"allowed_roles":["primary"]`, `"allowed_roles":["primary","primary"]`, 1), strings.Replace(base, `"allowed_tools":["filesystem.read"]`, `"allowed_tools":null`, 1), strings.Replace(base, `"sandbox_backend":"native"`, `"sandbox_backend":"custom"`, 1), strings.Replace(base, `"label":"safe-model"`, `"label":"https://private.invalid"`, 1), strings.Replace(base, `"denied_requests":null`, `"denied_requests":0`, 1), strings.Replace(base, `"configuration_revision":null`, `"configuration_revision":18446744073709551616`, 1), base + " {}", strings.Repeat(" ", 65537), string([]byte{0xff})}
+	for index, value := range cases {
+		if _, err = DecodeRuntimePolicyPosture([]byte(value)); !errors.Is(err, ErrRuntimePolicyPosture) {
+			t.Fatalf("case %d must fail closed", index)
+		}
+	}
+}
+
+type policyClient struct {
+	v1alpha1.AgentRunServiceClient
+	calls int
+	err   error
+}
+
+func (client *policyClient) GetRuntimePolicyPosture(context.Context, *v1alpha1.GetRuntimePolicyPostureRequest, ...grpc.CallOption) (*v1alpha1.GetRuntimePolicyPostureResponse, error) {
+	client.calls++
+	return nil, client.err
+}
+func TestPolicyReadDoesNotRetry(t *testing.T) {
+	failure := errors.New("unavailable")
+	client := &policyClient{err: failure}
+	if _, err := GetRuntimePolicyPosture(context.Background(), client); !errors.Is(err, failure) || client.calls != 1 {
+		t.Fatal("read must propagate the original failure once")
+	}
+}
diff --git a/sdk/go/sharing_test.go b/sdk/go/sharing_test.go
new file mode 100644
index 000000000..83632fe12
--- /dev/null
+++ b/sdk/go/sharing_test.go
@@ -0,0 +1,40 @@
+package colossus
+
+import (
+	"testing"
+
+	v1alpha1 "github.com/obscuritylabs/colossus/sdk/go/gen/colossus/api/v1alpha1"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestSharedRunMissingAuthorityIsReadOnly(t *testing.T) {
+	var visible v1alpha1.VisibleRun
+	if err := proto.Unmarshal(nil, &visible); err != nil {
+		t.Fatal(err)
+	}
+	if visible.GetControllable() || visible.GetContinuable() {
+		t.Fatal("missing flags must not grant authority")
+	}
+	request := &v1alpha1.SetWorkspaceSharingRequest{RecipientApplicationId: "app:cloud", Enabled: true}
+	encoded, err := proto.Marshal(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var decoded v1alpha1.SetWorkspaceSharingRequest
+	if err := proto.Unmarshal(encoded, &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if !proto.Equal(request, &decoded) {
+		t.Fatal("explicit sharing request changed")
+	}
+	if request.ProtoReflect().Descriptor().Fields().ByName("owner_application_id") != nil {
+		t.Fatal("caller must not select source ownership")
+	}
+	service := v1alpha1.File_colossus_api_v1alpha1_agent_run_proto.Services().ByName("AgentRunService")
+	if service.Methods().ByName("ListVisibleRuns").Input().Name() != "ListVisibleRunsRequest" {
+		t.Fatal("discovery RPC shape changed")
+	}
+	if service.Methods().ByName("SetWorkspaceSharing").Output().Name() != "SetWorkspaceSharingResponse" {
+		t.Fatal("sharing RPC shape changed")
+	}
+}
diff --git a/sdk/python/README.md b/sdk/python/README.md
index 862236a69..6a252249c 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -66,3 +66,15 @@ carries the generated tree, output manifest, and build support forward so its ow
 build can repeat the output check without requiring repository-only schema inputs. The
 SDK relies on `googleapis-common-protos` for the canonical `google.rpc.Status`; it never
 packages a second `google.rpc` implementation.
+
+### Runtime policy metadata
+
+`await client.agent_runs.get_runtime_policy_posture()` returns the immutable, typed
+`RuntimePolicyPosture` dataclass. `decode_runtime_policy_posture` validates a released
+response independently. Closed enums, safe model labels, and bounded tool/role lists
+exclude private configuration. Configuration revisions use exact Python integers;
+missing counters remain `None`. Unknown or duplicate fields, unsafe identifiers,
+invalid UTF-8, oversized metadata, and unsupported schemas fail with a generic
+`ValueError` without revealing the payload. The getter makes one authenticated read
+and does not retry. This report describes native configuration and does not change
+policy or independently attest its enforcement.
diff --git a/sdk/python/generated-output.sha256 b/sdk/python/generated-output.sha256
index 8d7723961..2475dc129 100644
--- a/sdk/python/generated-output.sha256
+++ b/sdk/python/generated-output.sha256
@@ -1 +1 @@
-2d735baa32f864e4ad1cb8a9cb9ada6ba7e9f4439c7db35bb155c1b6eba4c966
+4bb6e6499ab512cd4259cb582864c8c6a3d9b47fdf2999621da573bd7a8f8c3c
diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
index 4f1e9320f..da3937324 100644
--- a/sdk/python/pyproject.toml
+++ b/sdk/python/pyproject.toml
@@ -20,7 +20,7 @@ classifiers = [
   "Typing :: Typed",
 ]
 dependencies = [
-  "cryptography>=46,<50",
+  "cryptography>=50,<51",
   "googleapis-common-protos>=1.75,<2",
   "grpcio>=1.82.1,<2",
   "protobuf>=7.35.1,<8",
diff --git a/sdk/python/requirements-codegen.txt b/sdk/python/requirements-codegen.txt
index 8b198a1ba..d8d4d7ebe 100644
--- a/sdk/python/requirements-codegen.txt
+++ b/sdk/python/requirements-codegen.txt
@@ -1,6 +1,6 @@
 build==1.5.0
 cffi==2.1.0
-cryptography==49.0.0
+cryptography==50.0.0
 googleapis-common-protos==1.75.0
 grpcio==1.82.1
 grpcio-tools==1.82.1
diff --git a/sdk/python/src/colossus_sdk/__init__.py b/sdk/python/src/colossus_sdk/__init__.py
index ae284efbc..6b5e1e16e 100644
--- a/sdk/python/src/colossus_sdk/__init__.py
+++ b/sdk/python/src/colossus_sdk/__init__.py
@@ -19,6 +19,19 @@
     ErrorOutcomeCertainty,
     decode_colossus_rpc_error,
 )
+from .posture import (
+    PolicyApprovalMode,
+    PolicyFinding,
+    PolicyFindingCode,
+    PolicyFindingSeverity,
+    PolicyModelLabel,
+    PolicyProvenance,
+    PolicySandboxBackend,
+    PolicyTelemetry,
+    PolicyTelemetryProvenance,
+    RuntimePolicyPosture,
+    decode_runtime_policy_posture,
+)
 from .watch import (
     RunFeedItem,
     RunFeedProtocolError,
@@ -27,6 +40,17 @@
 )
 
 __all__ = [
+    "PolicyApprovalMode",
+    "PolicyFinding",
+    "PolicyFindingCode",
+    "PolicyFindingSeverity",
+    "PolicyModelLabel",
+    "PolicyProvenance",
+    "PolicySandboxBackend",
+    "PolicyTelemetry",
+    "PolicyTelemetryProvenance",
+    "RuntimePolicyPosture",
+    "decode_runtime_policy_posture",
     "AgentRuns",
     "ColossusClient",
     "ColossusFieldViolation",
diff --git a/sdk/python/src/colossus_sdk/client.py b/sdk/python/src/colossus_sdk/client.py
index 125047a35..8df9da69f 100644
--- a/sdk/python/src/colossus_sdk/client.py
+++ b/sdk/python/src/colossus_sdk/client.py
@@ -9,6 +9,7 @@
 
 from .credential import StaticBearerCredential
 from .endpoint import EndpointDescriptor, assert_pinned_leaf_certificate
+from .posture import RuntimePolicyPosture, decode_runtime_policy_posture
 from .watch import RunFeedItem, RunWatchReconciliation, watch_run
 
 _TERMINAL_UPDATE_CASES = frozenset({"result", "failure", "cancellation"})
@@ -48,6 +49,13 @@ def __init__(self, stub: Any, pb2: ModuleType) -> None:
         self._stub = stub
         self._pb2 = pb2
 
+    async def get_runtime_policy_posture(self) -> RuntimePolicyPosture:
+        """Read released policy metadata once; malformed responses fail closed."""
+        response = await self._stub.GetRuntimePolicyPosture(
+            self._pb2.GetRuntimePolicyPostureRequest()
+        )
+        return decode_runtime_policy_posture(response.policy_json)
+
     async def create_run(self, request: Any) -> Any:
         """Create a run once; the SDK does not retry this effectful call."""
 
@@ -59,6 +67,16 @@ async def get_run(self, run_id: str) -> Any:
     async def list_runs(self, request: Any) -> Any:
         return await self._stub.ListRuns(request)
 
+    async def list_visible_runs(self, request: Any) -> Any:
+        """Discover only runtime-authorized owned and explicitly shared runs."""
+
+        return await self._stub.ListVisibleRuns(request)
+
+    async def set_workspace_sharing(self, request: Any) -> Any:
+        """Change source-owned disclosure once, without retrying this mutation."""
+
+        return await self._stub.SetWorkspaceSharing(request)
+
     async def cancel_run(self, run_id: str, idempotency_key: str) -> Any:
         request = self._pb2.CancelRunRequest(
             run_id=run_id,
diff --git a/sdk/python/src/colossus_sdk/posture.py b/sdk/python/src/colossus_sdk/posture.py
new file mode 100644
index 000000000..f64ddfd35
--- /dev/null
+++ b/sdk/python/src/colossus_sdk/posture.py
@@ -0,0 +1,234 @@
+"""Closed, bounded runtime configuration metadata; never execution authority."""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from enum import Enum
+from typing import Any, TypeVar
+
+
+class PolicyProvenance(str, Enum):
+    RUNTIME_REPORTED = "runtime_reported"
+
+
+class PolicySandboxBackend(str, Enum):
+    NATIVE = "native"
+    WINDOWS_JOB = "windows_job"
+    OCI = "oci"
+    EXTERNAL = "external"
+    DANGER_FULL_ACCESS = "danger_full_access"
+    UNKNOWN = "unknown"
+
+
+class PolicyApprovalMode(str, Enum):
+    DENY = "deny"
+    ASK = "ask"
+    RISK_AUTO = "risk_auto"
+    DANGER_AUTO = "danger_auto"
+    UNKNOWN = "unknown"
+
+
+class PolicyFindingCode(str, Enum):
+    EPHEMERAL = "storage.ephemeral"
+    PLAINTEXT = "storage.plaintext"
+    FULL_ACCESS = "sandbox.danger_full_access"
+    SENSITIVE_JOURNAL = "observability.sensitive_journal_payloads"
+    PLAINTEXT_OAUTH = "credentials.mcp_oauth_plaintext"
+
+
+class PolicyFindingSeverity(str, Enum):
+    WARNING = "warning"
+
+
+class PolicyTelemetryProvenance(str, Enum):
+    UNAVAILABLE = "unavailable"
+
+
+@dataclass(frozen=True, slots=True)
+class PolicyModelLabel:
+    profile: str
+    label: str
+
+
+@dataclass(frozen=True, slots=True)
+class PolicyFinding:
+    code: PolicyFindingCode
+    severity: PolicyFindingSeverity
+
+
+@dataclass(frozen=True, slots=True)
+class PolicyTelemetry:
+    provenance: PolicyTelemetryProvenance
+    denied_requests: None = None
+    approval_requests: None = None
+    outcome_unknown_runs: None = None
+
+
+@dataclass(frozen=True, slots=True)
+class RuntimePolicyPosture:
+    schema_version: int
+    provenance: PolicyProvenance
+    fingerprint: str
+    configuration_revision: int | None
+    access_profile: str
+    sandbox_backend: PolicySandboxBackend
+    sandbox_profile: str
+    boundary_acknowledged: bool
+    approval_mode: PolicyApprovalMode
+    allowed_roles: tuple[str, ...]
+    allowed_tools: tuple[str, ...]
+    capabilities: tuple[str, ...]
+    models: tuple[PolicyModelLabel, ...]
+    findings: tuple[PolicyFinding, ...]
+    telemetry: PolicyTelemetry
+
+
+_INVALID = "Invalid bounded runtime policy metadata"
+_IDENTIFIER = re.compile(r"[A-Za-z0-9._-]{1,128}\Z", re.ASCII)
+_EnumType = TypeVar("_EnumType", bound=Enum)
+
+
+def _pairs(items: list[tuple[str, Any]]) -> dict[str, object]:
+    result: dict[str, object] = {}
+    for key, value in items:
+        if key in result:
+            raise ValueError(_INVALID)
+        result[key] = value
+    return result
+
+
+def _object(value: object, required: set[str], optional: set[str] | None = None) -> dict[str, Any]:
+    if not isinstance(value, dict):
+        raise ValueError(_INVALID)
+    allowed = required | (optional or set())
+    if not required <= value.keys() or not value.keys() <= allowed:
+        raise ValueError(_INVALID)
+    return value
+
+
+def _identifier(value: object) -> str:
+    if not isinstance(value, str) or _IDENTIFIER.fullmatch(value) is None:
+        raise ValueError(_INVALID)
+    return value
+
+
+def _list(value: object, maximum: int) -> tuple[str, ...]:
+    if not isinstance(value, list) or len(value) > maximum:
+        raise ValueError(_INVALID)
+    items = tuple(_identifier(item) for item in value)
+    if any(left >= right for left, right in zip(items, items[1:])):
+        raise ValueError(_INVALID)
+    return items
+
+
+def _enum(value: object, kind: type[_EnumType]) -> _EnumType:
+    if not isinstance(value, str):
+        raise ValueError(_INVALID)
+    return kind(value)
+
+
+def _reject_number(_value: str) -> None:
+    raise ValueError(_INVALID)
+
+
+def decode_runtime_policy_posture(payload: bytes) -> RuntimePolicyPosture:
+    """Reject unknown/duplicate fields, invalid enums, oversized and private metadata."""
+    if not isinstance(payload, bytes) or not 0 < len(payload) <= 65_536:
+        raise ValueError(_INVALID)
+    try:
+        raw: object = json.loads(
+            payload.decode("utf-8", errors="strict"),
+            object_pairs_hook=_pairs,
+            parse_float=_reject_number,
+            parse_constant=_reject_number,
+        )
+        p = _object(
+            raw,
+            {
+                "schema_version",
+                "provenance",
+                "fingerprint",
+                "access_profile",
+                "sandbox_backend",
+                "sandbox_profile",
+                "boundary_acknowledged",
+                "approval_mode",
+                "allowed_roles",
+                "allowed_tools",
+                "capabilities",
+                "models",
+                "findings",
+                "telemetry",
+            },
+            {"configuration_revision"},
+        )
+        if type(p["schema_version"]) is not int or p["schema_version"] != 1:
+            raise ValueError(_INVALID)
+        if (
+            not isinstance(p["fingerprint"], str)
+            or re.fullmatch(r"[0-9a-f]{64}", p["fingerprint"]) is None
+        ):
+            raise ValueError(_INVALID)
+        revision = p.get("configuration_revision")
+        if revision is not None and (type(revision) is not int or not 0 <= revision <= 2**64 - 1):
+            raise ValueError(_INVALID)
+        if type(p["boundary_acknowledged"]) is not bool:
+            raise ValueError(_INVALID)
+        if not isinstance(p["models"], list) or len(p["models"]) > 64:
+            raise ValueError(_INVALID)
+        if not isinstance(p["findings"], list) or len(p["findings"]) > 16:
+            raise ValueError(_INVALID)
+        models = []
+        for value in p["models"]:
+            model = _object(value, {"profile", "label"})
+            models.append(
+                PolicyModelLabel(_identifier(model["profile"]), _identifier(model["label"]))
+            )
+        findings = []
+        for value in p["findings"]:
+            finding = _object(value, {"code", "severity"})
+            findings.append(
+                PolicyFinding(
+                    _enum(finding["code"], PolicyFindingCode),
+                    _enum(finding["severity"], PolicyFindingSeverity),
+                )
+            )
+        telemetry = _object(
+            p["telemetry"],
+            {"provenance"},
+            {
+                "denied_requests",
+                "approval_requests",
+                "outcome_unknown_runs",
+            },
+        )
+        if any(
+            telemetry.get(key) is not None
+            for key in (
+                "denied_requests",
+                "approval_requests",
+                "outcome_unknown_runs",
+            )
+        ):
+            raise ValueError(_INVALID)
+        return RuntimePolicyPosture(
+            schema_version=1,
+            provenance=_enum(p["provenance"], PolicyProvenance),
+            fingerprint=p["fingerprint"],
+            configuration_revision=revision,
+            access_profile=_identifier(p["access_profile"]),
+            sandbox_backend=_enum(p["sandbox_backend"], PolicySandboxBackend),
+            sandbox_profile=_identifier(p["sandbox_profile"]),
+            boundary_acknowledged=p["boundary_acknowledged"],
+            approval_mode=_enum(p["approval_mode"], PolicyApprovalMode),
+            allowed_roles=_list(p["allowed_roles"], 64),
+            allowed_tools=_list(p["allowed_tools"], 256),
+            capabilities=_list(p["capabilities"], 256),
+            models=tuple(models),
+            findings=tuple(findings),
+            telemetry=PolicyTelemetry(_enum(telemetry["provenance"], PolicyTelemetryProvenance)),
+        )
+    except (ValueError, TypeError, OverflowError, RecursionError):
+        raise ValueError(_INVALID) from None
diff --git a/sdk/python/tests/test_posture.py b/sdk/python/tests/test_posture.py
new file mode 100644
index 000000000..15e230dcf
--- /dev/null
+++ b/sdk/python/tests/test_posture.py
@@ -0,0 +1,95 @@
+import json
+import unittest
+
+from colossus.api.v1alpha1 import agent_run_pb2
+
+from colossus_sdk.client import AgentRuns
+from colossus_sdk.posture import decode_runtime_policy_posture
+
+
+def valid():
+    return {
+        "schema_version": 1,
+        "provenance": "runtime_reported",
+        "fingerprint": "a" * 64,
+        "configuration_revision": None,
+        "access_profile": "minimal",
+        "sandbox_backend": "native",
+        "sandbox_profile": "offline",
+        "boundary_acknowledged": False,
+        "approval_mode": "ask",
+        "allowed_roles": ["primary"],
+        "allowed_tools": ["filesystem.read"],
+        "capabilities": ["runs.read"],
+        "models": [{"profile": "main", "label": "safe-model"}],
+        "findings": [{"code": "storage.ephemeral", "severity": "warning"}],
+        "telemetry": {
+            "provenance": "unavailable",
+            "denied_requests": None,
+            "approval_requests": None,
+            "outcome_unknown_runs": None,
+        },
+    }
+
+
+class PostureTests(unittest.TestCase):
+    def test_exact_u64_and_unknown_counters(self):
+        value = valid()
+        value["configuration_revision"] = 2**64 - 1
+        result = decode_runtime_policy_posture(json.dumps(value).encode())
+        self.assertEqual(result.configuration_revision, 2**64 - 1)
+        self.assertIsNone(result.telemetry.denied_requests)
+        self.assertEqual(result.models[0].label, "safe-model")
+
+    def test_closed_bounded_shapes(self):
+        cases = [
+            {**valid(), "secret": "withheld"},
+            {**valid(), "schema_version": True},
+            {**valid(), "schema_version": 2},
+            {**valid(), "sandbox_backend": "custom"},
+            {**valid(), "boundary_acknowledged": None},
+            {**valid(), "allowed_tools": None},
+            {**valid(), "allowed_roles": ["primary", "primary"]},
+            {**valid(), "models": [{"profile": "main", "label": "https://private.invalid"}]},
+            {**valid(), "configuration_revision": 2**64},
+            {**valid(), "configuration_revision": 1.5},
+            {**valid(), "telemetry": {"provenance": "unavailable", "denied_requests": 0}},
+        ]
+        for value in cases:
+            with self.subTest(value=list(value)):
+                with self.assertRaisesRegex(
+                    ValueError, "^Invalid bounded runtime policy metadata$"
+                ):
+                    decode_runtime_policy_posture(json.dumps(value).encode())
+        for payload in [
+            b"",
+            b" " * 65537,
+            b"\xff",
+            json.dumps(valid()).encode() + b" {}",
+            json.dumps(valid())
+            .replace('"schema_version": 1', '"schema_version": 1,"schema_version": 1')
+            .encode(),
+        ]:
+            with self.assertRaisesRegex(ValueError, "^Invalid bounded runtime policy metadata$"):
+                decode_runtime_policy_posture(payload)
+
+
+class PostureClientTests(unittest.IsolatedAsyncioTestCase):
+    async def test_one_typed_read_and_transport_failure(self):
+        calls = []
+
+        class Stub:
+            async def GetRuntimePolicyPosture(self, request):
+                calls.append(request)
+                if len(calls) > 1:
+                    raise RuntimeError("unavailable")
+                return agent_run_pb2.GetRuntimePolicyPostureResponse(
+                    policy_json=json.dumps(valid()).encode()
+                )
+
+        runs = AgentRuns(Stub(), agent_run_pb2)
+        result = await runs.get_runtime_policy_posture()
+        self.assertEqual(result.models[0].profile, "main")
+        with self.assertRaisesRegex(RuntimeError, "unavailable"):
+            await runs.get_runtime_policy_posture()
+        self.assertEqual(len(calls), 2)
diff --git a/sdk/python/tests/test_sharing.py b/sdk/python/tests/test_sharing.py
new file mode 100644
index 000000000..a929d39dd
--- /dev/null
+++ b/sdk/python/tests/test_sharing.py
@@ -0,0 +1,52 @@
+import unittest
+
+from colossus.api.v1alpha1 import agent_run_pb2, common_pb2
+
+from colossus_sdk.client import AgentRuns
+
+
+class SharingTests(unittest.TestCase):
+    def test_missing_authority_is_read_only_and_owner_cannot_be_selected(self) -> None:
+        visible = agent_run_pb2.VisibleRun.FromString(b"")
+        self.assertFalse(visible.controllable)
+        self.assertFalse(visible.continuable)
+        request = agent_run_pb2.SetWorkspaceSharingRequest(
+            recipient_application_id="app:cloud", enabled=True, allow_continuation=False
+        )
+        self.assertNotIn("owner_application_id", request.DESCRIPTOR.fields_by_name)
+        self.assertEqual(
+            agent_run_pb2.SetWorkspaceSharingRequest.FromString(request.SerializeToString()),
+            request,
+        )
+        methods = agent_run_pb2.DESCRIPTOR.services_by_name["AgentRunService"].methods_by_name
+        self.assertEqual(methods["ListVisibleRuns"].input_type.name, "ListVisibleRunsRequest")
+        self.assertEqual(
+            methods["SetWorkspaceSharing"].output_type.name, "SetWorkspaceSharingResponse"
+        )
+
+
+class SharingClientTests(unittest.IsolatedAsyncioTestCase):
+    async def test_sharing_mutations_are_not_retried_and_discovery_keeps_its_cursor(self) -> None:
+        calls = []
+
+        class Stub:
+            async def SetWorkspaceSharing(self, request):
+                calls.append(request)
+                raise RuntimeError("lost reply")
+
+            async def ListVisibleRuns(self, request):
+                calls.append(request)
+                return agent_run_pb2.ListVisibleRunsResponse()
+
+        runs = AgentRuns(Stub(), agent_run_pb2)
+        with self.assertRaisesRegex(RuntimeError, "lost reply"):
+            await runs.set_workspace_sharing(
+                agent_run_pb2.SetWorkspaceSharingRequest(recipient_application_id="app:cloud")
+            )
+        self.assertEqual(len(calls), 1)
+        cursor = "source-cursor"
+        request = agent_run_pb2.ListVisibleRunsRequest(
+            page=common_pb2.PageRequest(page_size=32, page_token=cursor)
+        )
+        await runs.list_visible_runs(request)
+        self.assertIs(calls[-1], request)
diff --git a/sdk/typescript/README.md b/sdk/typescript/README.md
index 03a84cf48..da8766ee3 100644
--- a/sdk/typescript/README.md
+++ b/sdk/typescript/README.md
@@ -22,7 +22,9 @@ import { AgentRunServiceClient } from "@obscuritylabs/colossus-sdk/gen/colossus/
 import { DeploymentMode } from "@obscuritylabs/colossus-sdk/gen/colossus/api/v1alpha1/system";
 
 const descriptor = parseEndpointDescriptor(descriptorJson);
-const credential = new StaticBearerCredential(tokenObtainedFromSecureEnrollment);
+const credential = new StaticBearerCredential(
+  tokenObtainedFromSecureEnrollment,
+);
 const runs = await createSecureGrpcClient(
   AgentRunServiceClient,
   descriptor,
@@ -66,3 +68,15 @@ to the watch cursor or the helper fails closed. Pass
 directory. The gate verifies both the schema/tool input digest and the exact generated
 TypeScript tree recorded in `generated-output.sha256`, so a stale ignored binding tree
 cannot be published accidentally.
+
+### Runtime policy metadata
+
+`getRuntimePolicyPosture(agentRunClient)` returns a validated `RuntimePolicyPosture`
+with closed approval/sandbox enums, safe model labels, tools, roles, capabilities,
+configuration fingerprint, and explicit unavailable counters. `configurationRevision`
+is `bigint | null`, preserving Rust's full unsigned 64-bit range. The helper makes one
+read through the authenticated generated client and rejects malformed UTF-8, unknown
+or duplicate fields, unsafe labels, oversized metadata, and unsupported schema versions.
+The standalone `decodeRuntimePolicyPosture` applies the same checks to a released
+response. This configuration report does not grant tools or independently attest
+policy enforcement; null counters are unknown, not zero.
diff --git a/sdk/typescript/generated-output.sha256 b/sdk/typescript/generated-output.sha256
index 89a632764..6eb3f4b6a 100644
--- a/sdk/typescript/generated-output.sha256
+++ b/sdk/typescript/generated-output.sha256
@@ -1 +1 @@
-ebe1258d7f7c05283bd2cf0597bbebc75a3c24c54f67c43146cfe949fdd499c6
+046a67eb09ab7292a3574e11a1741849d61474a84e711077f94c58adacd78080
diff --git a/sdk/typescript/src/index.ts b/sdk/typescript/src/index.ts
index 0a4b63963..871cb472f 100644
--- a/sdk/typescript/src/index.ts
+++ b/sdk/typescript/src/index.ts
@@ -1,7 +1,4 @@
-export {
-  StaticBearerCredential,
-  type MetadataWriter,
-} from "./credential.js";
+export { StaticBearerCredential, type MetadataWriter } from "./credential.js";
 export {
   type EndpointDescriptor,
   assertPinnedLeafCertificate,
@@ -32,3 +29,15 @@ export {
   isTerminalRunUpdate,
   watchRun,
 } from "./watch.js";
+export {
+  type PolicyProvenance,
+  type PolicySandboxBackend,
+  type PolicyApprovalMode,
+  type PolicyFindingCode,
+  type PolicyModelLabel,
+  type PolicyFinding,
+  type PolicyTelemetry,
+  type RuntimePolicyPosture,
+  decodeRuntimePolicyPosture,
+  getRuntimePolicyPosture,
+} from "./posture.js";
diff --git a/sdk/typescript/src/posture.ts b/sdk/typescript/src/posture.ts
new file mode 100644
index 000000000..3cf9dfd0f
--- /dev/null
+++ b/sdk/typescript/src/posture.ts
@@ -0,0 +1,343 @@
+import { Metadata, type CallOptions } from "@grpc/grpc-js";
+import type { AgentRunServiceClient } from "./gen/colossus/api/v1alpha1/agent_run.js";
+
+export type PolicyProvenance = "runtime_reported";
+export type PolicySandboxBackend =
+  | "native"
+  | "windows_job"
+  | "oci"
+  | "external"
+  | "danger_full_access"
+  | "unknown";
+export type PolicyApprovalMode =
+  "deny" | "ask" | "risk_auto" | "danger_auto" | "unknown";
+export type PolicyFindingCode =
+  | "storage.ephemeral"
+  | "storage.plaintext"
+  | "sandbox.danger_full_access"
+  | "observability.sensitive_journal_payloads"
+  | "credentials.mcp_oauth_plaintext";
+export interface PolicyModelLabel {
+  profile: string;
+  label: string;
+}
+export interface PolicyFinding {
+  code: PolicyFindingCode;
+  severity: "warning";
+}
+export interface PolicyTelemetry {
+  provenance: "unavailable";
+  deniedRequests: null;
+  approvalRequests: null;
+  outcomeUnknownRuns: null;
+}
+/** Released configuration metadata only; this report does not attest enforcement. */
+export interface RuntimePolicyPosture {
+  schemaVersion: 1;
+  provenance: PolicyProvenance;
+  fingerprint: string;
+  configurationRevision: bigint | null;
+  accessProfile: string;
+  sandboxBackend: PolicySandboxBackend;
+  sandboxProfile: string;
+  boundaryAcknowledged: boolean;
+  approvalMode: PolicyApprovalMode;
+  allowedRoles: string[];
+  allowedTools: string[];
+  capabilities: string[];
+  models: PolicyModelLabel[];
+  findings: PolicyFinding[];
+  telemetry: PolicyTelemetry;
+}
+const INVALID = "Invalid bounded runtime policy metadata";
+function fail(): never {
+  throw new TypeError(INVALID);
+}
+
+// Bounded JSON reader preserves all integer tokens exactly and rejects duplicate keys.
+// JSON.parse alone would round a Rust u64 before a reviver can validate its value.
+function exactJson(text: string): unknown {
+  let at = 0;
+  function whitespace() {
+    while (at < text.length && /[\t\n\r ]/u.test(text[at]!)) at++;
+  }
+  function string(): string {
+    const start = at++;
+    while (at < text.length) {
+      const char = text[at++];
+      if (char === '"') {
+        try {
+          return JSON.parse(text.slice(start, at)) as string;
+        } catch {
+          fail();
+        }
+      }
+      if (char === "\\") at++;
+    }
+    return fail();
+  }
+  function value(depth: number): unknown {
+    if (depth > 8) fail();
+    whitespace();
+    const char = text[at];
+    if (char === '"') return string();
+    if (char === "{") {
+      at++;
+      whitespace();
+      const object: Record<string, unknown> = Object.create(null) as Record<
+        string,
+        unknown
+      >;
+      if (text[at] === "}") {
+        at++;
+        return object;
+      }
+      for (;;) {
+        whitespace();
+        if (text[at] !== '"') fail();
+        const key = string();
+        if (Object.hasOwn(object, key)) fail();
+        whitespace();
+        if (text[at++] !== ":") fail();
+        object[key] = value(depth + 1);
+        whitespace();
+        if (text[at] === "}") {
+          at++;
+          return object;
+        }
+        if (text[at++] !== ",") fail();
+      }
+    }
+    if (char === "[") {
+      at++;
+      whitespace();
+      const array: unknown[] = [];
+      if (text[at] === "]") {
+        at++;
+        return array;
+      }
+      for (;;) {
+        array.push(value(depth + 1));
+        whitespace();
+        if (text[at] === "]") {
+          at++;
+          return array;
+        }
+        if (text[at++] !== ",") fail();
+      }
+    }
+    for (const [literal, result] of [
+      ["null", null],
+      ["true", true],
+      ["false", false],
+    ] as const) {
+      if (text.startsWith(literal, at)) {
+        at += literal.length;
+        return result;
+      }
+    }
+    const match = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/u.exec(
+      text.slice(at),
+    );
+    if (!match || !/^\d{1,20}$/u.test(match[0])) fail();
+    at += match[0].length;
+    return BigInt(match[0]);
+  }
+  const result = value(0);
+  whitespace();
+  if (at !== text.length) fail();
+  return result;
+}
+function object(
+  value: unknown,
+  required: string[],
+  optional: string[] = [],
+): Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    fail();
+  const record = value as Record<string, unknown>;
+  if (
+    Object.keys(record).some(
+      (key) => !required.includes(key) && !optional.includes(key),
+    ) ||
+    required.some((key) => !Object.hasOwn(record, key))
+  )
+    fail();
+  return record;
+}
+function identifier(value: unknown): string {
+  if (
+    typeof value !== "string" ||
+    value.length === 0 ||
+    value.length > 128 ||
+    /[^A-Za-z0-9._-]/u.test(value)
+  )
+    fail();
+  return value;
+}
+function list(value: unknown, max: number): string[] {
+  if (!Array.isArray(value) || value.length > max) fail();
+  const values = value.map(identifier);
+  if (values.some((item, index) => index > 0 && values[index - 1]! >= item))
+    fail();
+  return values;
+}
+function choice<T extends string>(value: unknown, options: readonly T[]): T {
+  if (typeof value !== "string" || !options.includes(value as T)) fail();
+  return value as T;
+}
+export function decodeRuntimePolicyPosture(
+  payload: Uint8Array,
+): RuntimePolicyPosture {
+  if (
+    !(payload instanceof Uint8Array) ||
+    payload.byteLength === 0 ||
+    payload.byteLength > 65536
+  )
+    fail();
+  let parsed: unknown;
+  try {
+    parsed = exactJson(
+      new TextDecoder("utf-8", { fatal: true }).decode(payload),
+    );
+  } catch {
+    fail();
+  }
+  const p = object(
+    parsed,
+    [
+      "schema_version",
+      "provenance",
+      "fingerprint",
+      "access_profile",
+      "sandbox_backend",
+      "sandbox_profile",
+      "boundary_acknowledged",
+      "approval_mode",
+      "allowed_roles",
+      "allowed_tools",
+      "capabilities",
+      "models",
+      "findings",
+      "telemetry",
+    ],
+    ["configuration_revision"],
+  );
+  if (
+    p.schema_version !== 1n ||
+    typeof p.fingerprint !== "string" ||
+    p.fingerprint.length !== 64 ||
+    /[^0-9a-f]/u.test(p.fingerprint) ||
+    typeof p.boundary_acknowledged !== "boolean"
+  )
+    fail();
+  const revision = p.configuration_revision ?? null;
+  if (
+    revision !== null &&
+    (typeof revision !== "bigint" ||
+      revision < 0n ||
+      revision > 18446744073709551615n)
+  )
+    fail();
+  if (
+    !Array.isArray(p.models) ||
+    p.models.length > 64 ||
+    !Array.isArray(p.findings) ||
+    p.findings.length > 16
+  )
+    fail();
+  const models = p.models.map((value) => {
+    const model = object(value, ["profile", "label"]);
+    return {
+      profile: identifier(model.profile),
+      label: identifier(model.label),
+    };
+  });
+  const findings = p.findings.map((value) => {
+    const finding = object(value, ["code", "severity"]);
+    return {
+      code: choice(finding.code, [
+        "storage.ephemeral",
+        "storage.plaintext",
+        "sandbox.danger_full_access",
+        "observability.sensitive_journal_payloads",
+        "credentials.mcp_oauth_plaintext",
+      ] as const),
+      severity: choice(finding.severity, ["warning"] as const),
+    };
+  });
+  const telemetry = object(
+    p.telemetry,
+    ["provenance"],
+    ["denied_requests", "approval_requests", "outcome_unknown_runs"],
+  );
+  choice(telemetry.provenance, ["unavailable"]);
+  if (
+    [
+      telemetry.denied_requests,
+      telemetry.approval_requests,
+      telemetry.outcome_unknown_runs,
+    ].some((value) => value !== undefined && value !== null)
+  )
+    fail();
+  return {
+    schemaVersion: 1,
+    provenance: choice(p.provenance, ["runtime_reported"]),
+    fingerprint: p.fingerprint,
+    configurationRevision: revision,
+    accessProfile: identifier(p.access_profile),
+    sandboxBackend: choice(p.sandbox_backend, [
+      "native",
+      "windows_job",
+      "oci",
+      "external",
+      "danger_full_access",
+      "unknown",
+    ]),
+    sandboxProfile: identifier(p.sandbox_profile),
+    boundaryAcknowledged: p.boundary_acknowledged,
+    approvalMode: choice(p.approval_mode, [
+      "deny",
+      "ask",
+      "risk_auto",
+      "danger_auto",
+      "unknown",
+    ]),
+    allowedRoles: list(p.allowed_roles, 64),
+    allowedTools: list(p.allowed_tools, 256),
+    capabilities: list(p.capabilities, 256),
+    models,
+    findings,
+    telemetry: {
+      provenance: "unavailable",
+      deniedRequests: null,
+      approvalRequests: null,
+      outcomeUnknownRuns: null,
+    },
+  };
+}
+/** Read once through the caller's authenticated service client. No transport retries. */
+export async function getRuntimePolicyPosture(
+  client: Pick<AgentRunServiceClient, "getRuntimePolicyPosture">,
+  options: Partial<CallOptions> = {},
+): Promise<RuntimePolicyPosture> {
+  const response = await new Promise<Uint8Array>((resolve, reject) =>
+    client.getRuntimePolicyPosture(
+      {},
+      new Metadata(),
+      { deadline: Date.now() + 5000, ...options },
+      (error, result) => {
+        if (error !== null) {
+          reject(error);
+          return;
+        }
+        if (!result || !(result.policyJson instanceof Uint8Array)) {
+          reject(new TypeError(INVALID));
+          return;
+        }
+        resolve(result.policyJson);
+      },
+    ),
+  );
+  return decodeRuntimePolicyPosture(response);
+}
diff --git a/sdk/typescript/test/posture.test.ts b/sdk/typescript/test/posture.test.ts
new file mode 100644
index 000000000..a0a604dd0
--- /dev/null
+++ b/sdk/typescript/test/posture.test.ts
@@ -0,0 +1,115 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  decodeRuntimePolicyPosture,
+  getRuntimePolicyPosture,
+} from "../src/posture.js";
+import type {
+  AgentRunServiceClient,
+  GetRuntimePolicyPostureResponse,
+} from "../src/gen/colossus/api/v1alpha1/agent_run.js";
+import type { ServiceError } from "@grpc/grpc-js";
+const valid = () => ({
+  schema_version: 1,
+  provenance: "runtime_reported",
+  fingerprint: "a".repeat(64),
+  configuration_revision: null,
+  access_profile: "minimal",
+  sandbox_backend: "native",
+  sandbox_profile: "offline",
+  boundary_acknowledged: false,
+  approval_mode: "ask",
+  allowed_roles: ["primary"],
+  allowed_tools: ["filesystem.read"],
+  capabilities: ["runs.read"],
+  models: [{ profile: "main", label: "safe-model" }],
+  findings: [{ code: "storage.ephemeral", severity: "warning" }],
+  telemetry: {
+    provenance: "unavailable",
+    denied_requests: null,
+    approval_requests: null,
+    outcome_unknown_runs: null,
+  },
+});
+const encode = (value: unknown) =>
+  new TextEncoder().encode(JSON.stringify(value));
+test("typed policy report preserves u64 revisions and explicit unavailable counters", () => {
+  const json = JSON.stringify(valid()).replace(
+    '"configuration_revision":null',
+    '"configuration_revision":18446744073709551615',
+  );
+  const result = decodeRuntimePolicyPosture(new TextEncoder().encode(json));
+  assert.equal(result.configurationRevision, 18446744073709551615n);
+  assert.equal(result.telemetry.deniedRequests, null);
+  assert.equal(result.models[0]?.label, "safe-model");
+});
+test("closed policy metadata rejects private fields and malformed bounded shapes", () => {
+  const invalid: unknown[] = [
+    { ...valid(), secret: "withheld" },
+    { ...valid(), schema_version: 2 },
+    { ...valid(), sandbox_backend: "custom" },
+    { ...valid(), boundary_acknowledged: null },
+    { ...valid(), allowed_roles: ["primary", "primary"] },
+    { ...valid(), allowed_roles: ["primary\n"] },
+    { ...valid(), fingerprint: "a".repeat(64) + "\n" },
+    { ...valid(), allowed_tools: null },
+    { ...valid(), capabilities: ["z", "a"] },
+    {
+      ...valid(),
+      models: [{ profile: "main", label: "https://private.invalid" }],
+    },
+    {
+      ...valid(),
+      models: [{ profile: "main", label: "safe", endpoint: "withheld" }],
+    },
+    { ...valid(), findings: [{ code: "arbitrary", severity: "warning" }] },
+    { ...valid(), telemetry: { ...valid().telemetry, denied_requests: 0 } },
+    { ...valid(), configuration_revision: 1.5 },
+  ];
+  for (const value of invalid)
+    assert.throws(
+      () => decodeRuntimePolicyPosture(encode(value)),
+      /^TypeError: Invalid bounded runtime policy metadata$/u,
+    );
+  for (const bytes of [
+    new Uint8Array(),
+    new Uint8Array(65537),
+    new Uint8Array([0xff]),
+    new TextEncoder().encode(
+      JSON.stringify(valid()).replace(
+        '"schema_version":1',
+        '"schema_version":1,"schema_version":1',
+      ),
+    ),
+    new TextEncoder().encode(JSON.stringify(valid()) + " {}"),
+    new TextEncoder().encode(
+      JSON.stringify(valid()).replace(
+        '"configuration_revision":null',
+        '"configuration_revision":18446744073709551616',
+      ),
+    ),
+  ])
+    assert.throws(() => decodeRuntimePolicyPosture(bytes), /Invalid bounded/u);
+});
+test("policy getter makes one authenticated read and propagates transport failures", async () => {
+  let calls = 0;
+  const failure = Object.assign(new Error("Unavailable"), {
+    code: 14,
+  }) as ServiceError;
+  const client = {
+    getRuntimePolicyPosture(
+      _request: unknown,
+      _metadata: unknown,
+      _options: unknown,
+      callback: (
+        error: ServiceError | null,
+        response?: GetRuntimePolicyPostureResponse,
+      ) => void,
+    ) {
+      calls++;
+      callback(failure);
+    },
+  } as Pick<AgentRunServiceClient, "getRuntimePolicyPosture">;
+  await assert.rejects(() => getRuntimePolicyPosture(client), failure);
+  assert.equal(calls, 1);
+});
diff --git a/sdk/typescript/test/sharing.test.ts b/sdk/typescript/test/sharing.test.ts
new file mode 100644
index 000000000..752752a1d
--- /dev/null
+++ b/sdk/typescript/test/sharing.test.ts
@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import {
+  AgentRunServiceService,
+  ListVisibleRunsRequest,
+  SetWorkspaceSharingRequest,
+  VisibleRun,
+} from "../src/gen/colossus/api/v1alpha1/agent_run.js";
+
+test("missing disclosure authority remains read-only on the public wire", () => {
+  const legacy = VisibleRun.decode(new Uint8Array());
+  assert.equal(legacy.controllable, false);
+  assert.equal(legacy.continuable, false);
+  const access = VisibleRun.fromPartial({
+    controllable: false,
+    continuable: true,
+  });
+  assert.deepEqual(
+    VisibleRun.decode(VisibleRun.encode(access).finish()),
+    access,
+  );
+  const request = SetWorkspaceSharingRequest.fromPartial({
+    recipientApplicationId: "app:cloud",
+    enabled: true,
+    allowContinuation: false,
+  });
+  assert.deepEqual(
+    SetWorkspaceSharingRequest.decode(
+      SetWorkspaceSharingRequest.encode(request).finish(),
+    ),
+    request,
+  );
+  assert.equal("ownerApplicationId" in request, false);
+});
+
+test("discovery and sharing use dedicated bounded public RPC shapes", () => {
+  assert.equal(
+    AgentRunServiceService.listVisibleRuns.path,
+    "/colossus.api.v1alpha1.AgentRunService/ListVisibleRuns",
+  );
+  assert.equal(
+    AgentRunServiceService.setWorkspaceSharing.path,
+    "/colossus.api.v1alpha1.AgentRunService/SetWorkspaceSharing",
+  );
+  const request = ListVisibleRunsRequest.fromPartial({
+    page: { pageSize: 32, pageToken: "source-cursor" },
+    includeArchived: true,
+  });
+  assert.equal(
+    ListVisibleRunsRequest.decode(
+      ListVisibleRunsRequest.encode(request).finish(),
+    ).page?.pageToken,
+    "source-cursor",
+  );
+  assert.equal("ownerApplicationId" in request, false);
+});
diff --git a/xtask/src/checks/mod.rs b/xtask/src/checks/mod.rs
index 1c4318768..4e0dc9c0c 100644
--- a/xtask/src/checks/mod.rs
+++ b/xtask/src/checks/mod.rs
@@ -72,6 +72,7 @@ fn component_check(
             sdk::check(repository, &base)
         }
         Component::Desktop => surfaces::desktop(repository),
+        Component::Web => surfaces::web(repository),
         Component::Docs => surfaces::docs(repository),
         Component::Dependencies => surfaces::dependencies(repository),
         Component::Workflows => surfaces::workflows(repository),
diff --git a/xtask/src/checks/surfaces.rs b/xtask/src/checks/surfaces.rs
index 99ae006c7..ed18d82f6 100644
--- a/xtask/src/checks/surfaces.rs
+++ b/xtask/src/checks/surfaces.rs
@@ -2,11 +2,16 @@ use std::{env, ffi::OsString};
 
 use crate::repository::Repository;
 
+// OpenID Connect validates provider signatures with public keys only. No RSA
+// private keys are created or used; cloud certificate issuance is Ed25519.
+// Keep this exact exception aligned with deny.toml and ADR 0006.
+const OIDC_RSA_PRIVATE_KEY_ADVISORY: &str = "RUSTSEC-2023-0071";
+
 // Tantivy 0.26.1 stores `usize` keys in its lru cache, so the panicking key
 // destructor required by this advisory is unreachable. Upstream has merged
 // lru 0.18.2 for its next registry release. Keep this cargo-audit exception
 // exact and documented, and remove it with that upgrade. cargo-deny does not
-// report this informational advisory and retains an empty ignore list.
+// report this informational advisory.
 const TANTIVY_LRU_PANIC_SAFETY_ADVISORY: &str = "RUSTSEC-2026-0253";
 
 pub(super) fn sidecar(repository: &Repository) -> Result<(), String> {
@@ -24,6 +29,7 @@ pub(super) fn sidecar(repository: &Repository) -> Result<(), String> {
 }
 
 pub(super) fn desktop(repository: &Repository) -> Result<(), String> {
+    web(repository)?;
     repository
         .task("node")
         .arg("scripts/stage-dictation-model.mjs")
@@ -70,6 +76,29 @@ pub(super) fn desktop(repository: &Repository) -> Result<(), String> {
         .run()
 }
 
+pub(super) fn web(repository: &Repository) -> Result<(), String> {
+    repository
+        .task("npm")
+        .args([
+            "ci",
+            "--ignore-scripts",
+            "--legacy-peer-deps",
+            "--install-links",
+        ])
+        .current_dir("apps/web")
+        .run()?;
+    repository
+        .task("npm")
+        .args(["audit", "--audit-level=high"])
+        .current_dir("apps/web")
+        .run()?;
+    repository
+        .task("npm")
+        .args(["run", "check"])
+        .current_dir("apps/web")
+        .run()
+}
+
 pub(super) fn docs(repository: &Repository) -> Result<(), String> {
     repository.task("./scripts/docs-site").arg("build").run()?;
     repository
@@ -116,6 +145,8 @@ pub(super) fn dependencies(repository: &Repository) -> Result<(), String> {
             "warnings",
             "--ignore",
             TANTIVY_LRU_PANIC_SAFETY_ADVISORY,
+            "--ignore",
+            OIDC_RSA_PRIVATE_KEY_ADVISORY,
             "--file",
             "Cargo.lock",
         ],
@@ -149,6 +180,8 @@ pub(super) fn dependencies(repository: &Repository) -> Result<(), String> {
             "check",
             "-D",
             "warnings",
+            "-A",
+            "advisory-not-detected",
             "advisories",
         ],
     )?;
diff --git a/xtask/src/cli.rs b/xtask/src/cli.rs
index dfd5d312f..9cfa37624 100644
--- a/xtask/src/cli.rs
+++ b/xtask/src/cli.rs
@@ -15,6 +15,7 @@ Components:
   sidecar       Managed Local sidecar contract tests
   sdk           Generated API compatibility and TypeScript, Python, and Go SDKs
   desktop       Desktop renderer audit, checks, tests, and build
+  web           Cloud web renderer audit, checks, tests, and build
   docs          Documentation build and verification
   dependencies  Root, fuzz, and desktop dependency policy
   workflows     CI classification contracts and workflow lint
@@ -26,6 +27,7 @@ pub(super) enum Component {
     Sidecar,
     Sdk,
     Desktop,
+    Web,
     Docs,
     Dependencies,
     Workflows,
@@ -38,6 +40,7 @@ impl Component {
             "sidecar" => Ok(Self::Sidecar),
             "sdk" => Ok(Self::Sdk),
             "desktop" => Ok(Self::Desktop),
+            "web" => Ok(Self::Web),
             "docs" => Ok(Self::Docs),
             "dependencies" => Ok(Self::Dependencies),
             "workflows" => Ok(Self::Workflows),
@@ -53,6 +56,7 @@ impl fmt::Display for Component {
             Self::Sidecar => "sidecar",
             Self::Sdk => "sdk",
             Self::Desktop => "desktop",
+            Self::Web => "web",
             Self::Docs => "docs",
             Self::Dependencies => "dependencies",
             Self::Workflows => "workflows",
diff --git a/zensical.toml b/zensical.toml
index a1b898551..567a335b6 100644
--- a/zensical.toml
+++ b/zensical.toml
@@ -112,6 +112,8 @@ nav = [
     { "Policy and OPA" = "admin/policy-opa.md" },
     { "Sandbox" = "admin/sandbox.md" },
     { "Storage and worker" = "admin/storage-worker.md" },
+    { "Cloud control plane" = "admin/cloud-control-plane.md" },
+    { "Host public documentation" = "admin/documentation-hosting.md" },
     { "Audit, telemetry, and recovery" = "admin/audit-telemetry-recovery.md" },
     { "Offline operation" = "admin/offline-airgap.md" },
     { "Troubleshooting" = "admin/troubleshooting.md" },
@@ -164,10 +166,12 @@ nav = [
       { "ADR 0002: Interface boundary" = "develop/adr/0002-interface-presentation-boundary.md" },
       { "ADR 0004: Desktop Git inspection" = "develop/adr/0004-desktop-git-inspection.md" },
       { "ADR 0005: Desktop file search and diffs" = "develop/adr/0005-desktop-file-diffs.md" },
+      { "ADR 0006: Cloud control plane" = "develop/adr/0006-cloud-control-plane.md" },
     ] },
     { "Runtime and ports" = "develop/runtime-ports.md" },
     { "OpenTelemetry implementation" = "develop/observability.md" },
     { "Public API and application SDKs" = "develop/application-sdk.md" },
+    { "Cloud control plane" = "develop/cloud-control-plane.md" },
     { "Evaluate offline Desktop dictation" = "develop/desktop-dictation.md" },
     { "State and recovery" = "develop/state-recovery.md" },
     { "Security architecture" = "develop/security-architecture.md" },