From 00c99ca51fc2f010cb2e9f03cba03fb75f0f2e72 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 13:14:23 +0800
Subject: [PATCH 1/9] Rename the Codex runtime build and Web storage keys
 (#464)

---
 .github/workflows/release.yml                        |  4 ++--
 Makefile                                             |  6 +++---
 apps/web/e2e/access.spec.ts                          |  4 ++--
 apps/web/e2e/console.ts                              |  2 +-
 apps/web/e2e/overview-readiness.spec.ts              |  2 +-
 apps/web/index.html                                  |  2 +-
 .../src/features/overview/getting-started.test.ts    |  6 +++---
 apps/web/src/features/overview/getting-started.ts    |  4 ++--
 apps/web/src/features/sandbox/NodeEnrollment.tsx     |  2 +-
 apps/web/src/i18n/i18n.test.tsx                      |  2 +-
 apps/web/src/i18n/index.ts                           |  7 ++-----
 apps/web/src/lib/locale.test.ts                      |  7 -------
 apps/web/src/lib/locale.ts                           |  5 -----
 apps/web/src/lib/theme.ts                            |  2 +-
 docs/maintainers.md                                  | 10 +++++-----
 docs/zh/maintainers.md                               | 12 ++++++------
 ...uild-agents-runtime.sh => build-codex-runtime.sh} | 10 +++++-----
 scripts/build-core-distribution.sh                   |  6 ++----
 scripts/check-names.py                               |  2 +-
 scripts/ci_plan.py                                   |  2 +-
 20 files changed, 40 insertions(+), 57 deletions(-)
 rename scripts/{build-agents-runtime.sh => build-codex-runtime.sh} (77%)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 72bcd1f5b..d798c1976 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -124,9 +124,9 @@ jobs:
           CORE_DISTRIBUTION_OFFLINE: ${{ (github.event_name == 'push' || inputs.offline) && '1' || '0' }}
         run: |
           inputs="$HOME/.oac/build/release-inputs/inputs.json"
-          AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
+          CODEX_CLI_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
           MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
-          export AGENTS_RUNTIME_CODEX_PACKAGE MCODE_HARNESS_BUILD_DIR
+          export CODEX_CLI_DIR MCODE_HARNESS_BUILD_DIR
           export CORE_DISTRIBUTION_RELEASE_BASE_URL="https://github.com/$RELEASE_REPOSITORY/releases/download/$RELEASE_TAG"
           bash scripts/build-core-distribution.sh
           mkdir -p "$HOME/.oac/build/release-upload"
diff --git a/Makefile b/Makefile
index 03060591a..24b6a13ab 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@ SQLC_VERSION ?= v1.29.0
 SQLC ?= go run github.com/sqlc-dev/sqlc/cmd/sqlc@$(SQLC_VERSION)
 SWAG_VERSION ?= v1.16.4
 
-.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-web check-mcode-harness build-daemon build-core check-core check-core-packages check-core-integration docker-build-core check-core-container build-agents-runtime build-claude-runtime build-claude-sdk-runtime build-mcode-harness build-mcode-runtime
+.PHONY: help check check-database check-go check-sqlc sqlc-generate node-deps check-claude-sdk check-web check-mcode-harness build-daemon build-core check-core check-core-packages check-core-integration docker-build-core check-core-container build-codex-runtime build-claude-runtime build-claude-sdk-runtime build-mcode-harness build-mcode-runtime
 
 help:
 	@printf '%s\n' 'make build-core        Build standalone Core commands' 'make build-daemon      Build the execution daemon' 'make check             Run Core, persistence and runtime checks' 'See README.md for runtime prerequisites and deployment.'
@@ -145,8 +145,8 @@ check-mcode-harness:
 	@for script in packages/mcode-harness/*.mjs; do node --check "$$script"; done
 	bash -n scripts/build-mcode-harness.sh scripts/build-mcode-runtime.sh
 
-build-agents-runtime:
-	./scripts/build-agents-runtime.sh
+build-codex-runtime:
+	./scripts/build-codex-runtime.sh
 
 build-claude-runtime:
 	./scripts/build-claude-runtime.sh
diff --git a/apps/web/e2e/access.spec.ts b/apps/web/e2e/access.spec.ts
index d5a1a90ab..41149ef97 100644
--- a/apps/web/e2e/access.spec.ts
+++ b/apps/web/e2e/access.spec.ts
@@ -14,7 +14,7 @@ const browserStorage = (page: Page) => page.evaluate(() => JSON.stringify({ ...w
 test("signs in with the Core key, keeps it out of the browser, and signs out and back in", async ({ page, request }) => {
   await resetFixture(request, "login");
   await recordV1Requests(page);
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.language", "en"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.language", "en"));
   await page.goto("/");
 
   await expect(page.getByRole("heading", { name: "Sign in to OpenAgentCore" })).toBeVisible();
@@ -47,7 +47,7 @@ test("signs in with the Core key, keeps it out of the browser, and signs out and
 test("opens a fresh install on the Overview's Getting started: a project and its key shown once, then the step is done", async ({ page, request }) => {
   await resetFixture(request, "login", { fresh: true });
   await recordV1Requests(page);
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.language", "en"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.language", "en"));
   await page.goto("/");
   await signIn(page, FIXTURE_CORE_KEY);
 
diff --git a/apps/web/e2e/console.ts b/apps/web/e2e/console.ts
index 78000a332..1e50de4db 100644
--- a/apps/web/e2e/console.ts
+++ b/apps/web/e2e/console.ts
@@ -40,7 +40,7 @@ export async function openConsole(page: Page, request: APIRequestContext, hash =
   await resetFixture(request, "authenticated", options);
   await recordV1Requests(page);
   await page.context().addCookies([{ name: "core_console", value: "fixture-session", url: web }]);
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.language", "en"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.language", "en"));
   await page.goto(`/#${hash}`);
 }
 
diff --git a/apps/web/e2e/overview-readiness.spec.ts b/apps/web/e2e/overview-readiness.spec.ts
index 5f22542d5..540a37405 100644
--- a/apps/web/e2e/overview-readiness.spec.ts
+++ b/apps/web/e2e/overview-readiness.spec.ts
@@ -164,7 +164,7 @@ test("failed summary and Session refreshes preserve their previous evidence unti
 });
 
 test("installation failure cannot complete onboarding and its retry reveals local-only blockage", async ({ page, request }) => {
-  await page.addInitScript(() => window.localStorage.setItem("agents-core-web.getting-started.7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", "open"));
+  await page.addInitScript(() => window.localStorage.setItem("oac-web.getting-started.7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", "open"));
   await page.route("**/core/v1/installation", (route) => route.fulfill(reject));
   await openConsole(page, request, "overview", { installation: "local" });
   const step = page.locator(".getting-started-step").first();
diff --git a/apps/web/index.html b/apps/web/index.html
index b65773249..4bd5a5edd 100644
--- a/apps/web/index.html
+++ b/apps/web/index.html
@@ -13,7 +13,7 @@
     <title>OpenAgentCore</title>
     <script>
       ;(() => {
-        const stored = localStorage.getItem("agents-core-web.theme")
+        const stored = localStorage.getItem("oac-web.theme")
         const preference =
           stored === "light" || stored === "dark" || stored === "system" ? stored : "system"
         const resolved =
diff --git a/apps/web/src/features/overview/getting-started.test.ts b/apps/web/src/features/overview/getting-started.test.ts
index 356c075dc..56a9990a7 100644
--- a/apps/web/src/features/overview/getting-started.test.ts
+++ b/apps/web/src/features/overview/getting-started.test.ts
@@ -126,10 +126,10 @@ describe("Getting started visibility", () => {
     const stored = new Map<string, string>();
     vi.stubGlobal("window", { localStorage: { getItem: (key: string) => stored.get(key) ?? null, setItem: (key: string, value: string) => stored.set(key, value) } });
     const down: FleetState = { status: "failed", error: new Error("down") };
-    expect(checklistStorageKey(fleet(deployment({ installation_id: "inst-1" })))).toBe("agents-core-web.getting-started.inst-1");
-    expect(checklistStorageKey(down)).toBe("agents-core-web.getting-started");
+    expect(checklistStorageKey(fleet(deployment({ installation_id: "inst-1" })))).toBe("oac-web.getting-started.inst-1");
+    expect(checklistStorageKey(down)).toBe("oac-web.getting-started");
     rememberInstallation("inst-1");
-    expect(checklistStorageKey(down)).toBe("agents-core-web.getting-started.inst-1");
+    expect(checklistStorageKey(down)).toBe("oac-web.getting-started.inst-1");
     expect(checklistStorageKey({ status: "loading" })).toBeNull();
   });
 });
diff --git a/apps/web/src/features/overview/getting-started.ts b/apps/web/src/features/overview/getting-started.ts
index f1f803ce9..24d47382f 100644
--- a/apps/web/src/features/overview/getting-started.ts
+++ b/apps/web/src/features/overview/getting-started.ts
@@ -131,9 +131,9 @@ export function checklistView(states: readonly StepState[], memory: ChecklistMem
   return memory === "open" && states.some((state) => state !== null) ? "full" : "hidden";
 }
 
-const MEMORY_KEY = "agents-core-web.getting-started";
+const MEMORY_KEY = "oac-web.getting-started";
 /** The installation this browser last read, so the checklist keeps its entry while the deployment cannot be read. */
-const INSTALLATION_KEY = "agents-core-web.last-installation";
+const INSTALLATION_KEY = "oac-web.last-installation";
 
 /**
  * The storage entry for this installation, so a reinstall at the same origin
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index bd9cab55c..2ffc21f72 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -21,7 +21,7 @@ import { enrolledNode, enrollmentProgress, formatCountdown, progressSteps, type
 import { sandboxConsoleConfigQuery } from "./sandbox-queries";
 
 /** The host requirements open by default until this browser has shown them once. */
-const REQUIREMENTS_SEEN = "agents-core-web.node-requirements-seen";
+const REQUIREMENTS_SEEN = "oac-web.node-requirements-seen";
 function requirementsSeen(): boolean {
   try { return window.localStorage.getItem(REQUIREMENTS_SEEN) === "1"; } catch { return false; }
 }
diff --git a/apps/web/src/i18n/i18n.test.tsx b/apps/web/src/i18n/i18n.test.tsx
index f49befe07..59595904b 100644
--- a/apps/web/src/i18n/i18n.test.tsx
+++ b/apps/web/src/i18n/i18n.test.tsx
@@ -44,7 +44,7 @@ describe("Web internationalization", () => {
   });
 
   it("honors a saved choice and otherwise selects the first supported browser preference", () => {
-    expect(resolveLanguage("zh", ["en-US"])).toBe("zh-CN");
+    expect(resolveLanguage("zh-CN", ["en-US"])).toBe("zh-CN");
     expect(resolveLanguage("en", ["zh-CN"])).toBe("en");
     expect(resolveLanguage(null, ["en-US", "zh-CN"])).toBe("en");
     expect(resolveLanguage(null, ["fr-FR", "zh-Hans", "en-US"])).toBe("zh-CN");
diff --git a/apps/web/src/i18n/index.ts b/apps/web/src/i18n/index.ts
index baa7b0cfb..8837b0473 100644
--- a/apps/web/src/i18n/index.ts
+++ b/apps/web/src/i18n/index.ts
@@ -6,12 +6,10 @@ import { defaultNamespace, resources } from "./resources";
 export const supportedLanguages = ["en", "zh-CN"] as const;
 export type SupportedLanguage = (typeof supportedLanguages)[number];
 
-const LANGUAGE_STORAGE_KEY = "agents-core-web.language";
-const LEGACY_LANGUAGE_STORAGE_KEY = "agents-core-web.locale";
+const LANGUAGE_STORAGE_KEY = "oac-web.language";
 
 export function resolveLanguage(stored: string | null, languages: readonly string[]): SupportedLanguage {
   if (stored === "en" || stored === "zh-CN") return stored;
-  if (stored === "zh") return "zh-CN";
   for (const language of languages) {
     const normalized = language.toLowerCase();
     if (normalized.startsWith("zh")) return "zh-CN";
@@ -24,7 +22,7 @@ function browserLanguage(): SupportedLanguage {
   if (typeof window === "undefined") return "en";
   let stored: string | null = null;
   try {
-    stored = window.localStorage.getItem(LANGUAGE_STORAGE_KEY) ?? window.localStorage.getItem(LEGACY_LANGUAGE_STORAGE_KEY);
+    stored = window.localStorage.getItem(LANGUAGE_STORAGE_KEY);
   } catch {
     // Storage can be unavailable in privacy-restricted browser contexts.
   }
@@ -49,7 +47,6 @@ export function setLanguage(language: SupportedLanguage): Promise<unknown> {
   if (typeof window !== "undefined") {
     try {
       window.localStorage.setItem(LANGUAGE_STORAGE_KEY, language);
-      window.localStorage.removeItem(LEGACY_LANGUAGE_STORAGE_KEY);
     } catch {
       // Keep the in-memory choice when persistence is unavailable.
     }
diff --git a/apps/web/src/lib/locale.test.ts b/apps/web/src/lib/locale.test.ts
index 18248783f..fc47a3e83 100644
--- a/apps/web/src/lib/locale.test.ts
+++ b/apps/web/src/lib/locale.test.ts
@@ -1,16 +1,9 @@
 import { describe, expect, it } from "vitest";
-import { resolveLocale } from "./locale";
 import { AgentCoreError } from "@oac/agents-client";
 import { sandboxRequestError, sandboxStateLabel } from "./sandbox-labels";
 import { sandboxDiagnosticMessage } from "./sandbox-diagnostic";
 
 describe("sandbox localization", () => {
-  it("uses saved choices and defaults to the browser's preferred language", () => {
-    expect(resolveLocale(null, ["zh-CN", "en-US"])).toBe("zh");
-    expect(resolveLocale("en", ["zh-TW"])).toBe("en");
-    expect(resolveLocale("zh", ["en-US"])).toBe("zh");
-    expect(resolveLocale("invalid", ["fr"])).toBe("en");
-  });
   it("localizes every persisted allocation and compute state without exposing unknown values", () => {
     for (const state of ["creating", "running", "cleanup_pending", "released", "disabled", "quiescing", "suspending", "suspended", "restoring", "waking"]) {
       expect(sandboxStateLabel(state, "zh")).toMatch(/[\u4e00-\u9fff]/);
diff --git a/apps/web/src/lib/locale.ts b/apps/web/src/lib/locale.ts
index 22d250fda..9f02335c9 100644
--- a/apps/web/src/lib/locale.ts
+++ b/apps/web/src/lib/locale.ts
@@ -1,10 +1,5 @@
 import { chinese, type MessageKey } from "./locale-strings";
 export type Locale = "en" | "zh";
-export const localeStorageKey = "agents-core-web.locale";
-export function resolveLocale(saved: string | null, languages: readonly string[]): Locale {
-  if (saved === "en" || saved === "zh") return saved;
-  return languages[0]?.toLowerCase().startsWith("zh") ? "zh" : "en";
-}
 export function translate(locale: Locale, key: MessageKey): string {
   return locale === "zh" ? chinese[key] : key;
 }
diff --git a/apps/web/src/lib/theme.ts b/apps/web/src/lib/theme.ts
index 0167777ce..b369a4ba8 100644
--- a/apps/web/src/lib/theme.ts
+++ b/apps/web/src/lib/theme.ts
@@ -9,7 +9,7 @@ export interface ThemeContextValue {
   setPreference: (preference: ThemePreference) => void;
 }
 
-export const themeStorageKey = "agents-core-web.theme";
+export const themeStorageKey = "oac-web.theme";
 export const defaultThemePreference: ThemePreference = "system";
 export const ThemeContext = createContext<ThemeContextValue | null>(null);
 
diff --git a/docs/maintainers.md b/docs/maintainers.md
index 18fbde9b7..47d162b70 100644
--- a/docs/maintainers.md
+++ b/docs/maintainers.md
@@ -13,7 +13,7 @@ Build on Linux x86_64 with a glibc compatible with Debian 12, Docker, the Go ver
 ```sh
 bash scripts/prepare-release-runtimes.sh
 inputs="$HOME/.oac/build/release-inputs/inputs.json"
-export AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
+export CODEX_CLI_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
 export MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
 export CORE_DISTRIBUTION_RELEASE_BASE_URL=https://github.com/MiniMax-AI/OpenAgentCore/releases/download/v1.2.3
 make build-core-distribution
@@ -25,7 +25,7 @@ make build-core-distribution
 | --- | --- |
 | `CORE_DISTRIBUTION_RELEASE_BASE_URL` | Versioned HTTPS directory that will serve the generated asset file names (never `latest`). Required unless `CORE_DISTRIBUTION_OFFLINE=1` |
 | `CORE_DISTRIBUTION_OFFLINE` | `1` also builds the offline archive |
-| `AGENTS_RUNTIME_CODEX_PACKAGE`, `MCODE_HARNESS_BUILD_DIR` | Pinned Runtime inputs from `prepare-release-runtimes.sh` |
+| `CODEX_CLI_DIR`, `MCODE_HARNESS_BUILD_DIR` | Pinned Runtime inputs from `prepare-release-runtimes.sh` |
 | `CORE_DISTRIBUTION_CODEX_IMAGE`, `CORE_DISTRIBUTION_CLAUDE_IMAGE`, `CORE_DISTRIBUTION_MCODE_IMAGE` | Use existing Harness images, given as immutable `sha256:` image IDs, instead of building them; set all three or none. Each must contain the daemon built from this commit |
 | `OAC_NATIVE_INSTALLER_BUILD_DIR` | Native installer catalog directory; see [Native installers](#native-installers) |
 | `CORE_DISTRIBUTION_BUILD_DIR` | Output directory under `~/.oac`. Default: `~/.oac/build/core-distribution` |
@@ -59,9 +59,9 @@ The catalog records the commit, the Runtime protocol version, each archive's SHA
 **Codex Runtime image.** Extract the official npm package `@openai/codex@0.153.4-linux-x64` under `~/.oac` (for example with `npm pack --ignore-scripts` and `tar -xzf`), then:
 
 ```sh
-export AGENTS_RUNTIME_CODEX_PACKAGE=/absolute/path/to/package
-make build-agents-runtime
-docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/agents-runtime"
+export CODEX_CLI_DIR=/absolute/path/to/package
+make build-codex-runtime
+docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/codex-runtime"
 ```
 
 The script checks the package version, builds `oac-daemon` for Linux amd64 and prepares a context with only the daemon, the unmodified native executable, its resources and `services/core/deploy/codex/Dockerfile`.
diff --git a/docs/zh/maintainers.md b/docs/zh/maintainers.md
index afb79b2fa..3b553a3da 100644
--- a/docs/zh/maintainers.md
+++ b/docs/zh/maintainers.md
@@ -1,7 +1,7 @@
 ---
 title: "构建并发布 OpenAgentCore"
 source: docs/maintainers.md
-source_hash: cfab5d1ad336c809b2b27bc870b02934f54184f3778e2c5d770a945c6830e097
+source_hash: 679fb7cf8af9fc6aa2adfb9b04e1766497a32937fd184162614ae813707cb90b
 ---
 
 本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请使用 [安装指南](getting-started/install.md)。安装器代码遵循的规则见 [部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) 和 [节点安装器](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
@@ -15,7 +15,7 @@ source_hash: cfab5d1ad336c809b2b27bc870b02934f54184f3778e2c5d770a945c6830e097
 ```sh
 bash scripts/prepare-release-runtimes.sh
 inputs="$HOME/.oac/build/release-inputs/inputs.json"
-export AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
+export CODEX_CLI_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"
 export MCODE_HARNESS_BUILD_DIR="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["mcode"])' "$inputs")"
 export CORE_DISTRIBUTION_RELEASE_BASE_URL=https://github.com/MiniMax-AI/OpenAgentCore/releases/download/v1.2.3
 make build-core-distribution
@@ -27,7 +27,7 @@ make build-core-distribution
 | --- | --- |
 | `CORE_DISTRIBUTION_RELEASE_BASE_URL` | 用于提供生成的资源文件名的带版本 HTTPS 目录（绝不能使用 `latest`）。除非 `CORE_DISTRIBUTION_OFFLINE=1`，否则为必填项 |
 | `CORE_DISTRIBUTION_OFFLINE` | 设为 `1` 时还会构建离线归档 |
-| `AGENTS_RUNTIME_CODEX_PACKAGE`、`MCODE_HARNESS_BUILD_DIR` | `prepare-release-runtimes.sh` 固定的 Runtime 输入 |
+| `CODEX_CLI_DIR`、`MCODE_HARNESS_BUILD_DIR` | `prepare-release-runtimes.sh` 固定的 Runtime 输入 |
 | `CORE_DISTRIBUTION_CODEX_IMAGE`、`CORE_DISTRIBUTION_CLAUDE_IMAGE`、`CORE_DISTRIBUTION_MCODE_IMAGE` | 使用现有 Harness 镜像，而不是构建这些镜像；值必须是以不可变 `sha256:` 镜像 ID 表示的现有镜像。三个变量必须全部设置或全部不设置；每个镜像都必须包含由该提交构建的守护进程 |
 | `OAC_NATIVE_INSTALLER_BUILD_DIR` | 原生安装器目录；请参阅[原生安装器](#native-installers) |
 | `CORE_DISTRIBUTION_BUILD_DIR` | `~/.oac` 下的输出目录。默认值：`~/.oac/build/core-distribution` |
@@ -61,9 +61,9 @@ export OAC_NATIVE_INSTALLER_BUILD_DIR=OUTPUT_DIR
 **Codex Runtime 镜像。** 在 `~/.oac` 下解压官方 npm 包 `@openai/codex@0.153.4-linux-x64`（例如使用 `npm pack --ignore-scripts` 和 `tar -xzf`），然后执行：
 
 ```sh
-export AGENTS_RUNTIME_CODEX_PACKAGE=/absolute/path/to/package
-make build-agents-runtime
-docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/agents-runtime"
+export CODEX_CLI_DIR=/absolute/path/to/package
+make build-codex-runtime
+docker build --platform linux/amd64 -t oac-runtime:codex "${OAC_DEV_HOME:-$HOME/.oac}/build/codex-runtime"
 ```
 
 该脚本会检查软件包版本，为 Linux amd64 构建 `oac-daemon`，并准备一个仅包含守护进程、未修改的原生可执行文件、相关资源和 `services/core/deploy/codex/Dockerfile` 的上下文。
diff --git a/scripts/build-agents-runtime.sh b/scripts/build-codex-runtime.sh
similarity index 77%
rename from scripts/build-agents-runtime.sh
rename to scripts/build-codex-runtime.sh
index 4b00f5d21..fcae07a81 100755
--- a/scripts/build-agents-runtime.sh
+++ b/scripts/build-codex-runtime.sh
@@ -3,9 +3,9 @@ set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 runtime_root="${OAC_DEV_HOME:-$HOME/.oac}"
-output_dir="${AGENTS_RUNTIME_BUILD_DIR:-$runtime_root/build/agents-runtime}"
+output_dir="${AGENTS_RUNTIME_BUILD_DIR:-$runtime_root/build/codex-runtime}"
 # Extract the official @openai/codex@0.153.4-linux-x64 npm package here.
-package_dir="${AGENTS_RUNTIME_CODEX_PACKAGE:?Set AGENTS_RUNTIME_CODEX_PACKAGE to the extracted pinned platform package}"
+package_dir="${CODEX_CLI_DIR:?Set CODEX_CLI_DIR to the extracted pinned platform package}"
 for directory in "$runtime_root" "$output_dir" "$package_dir"; do
   if [[ "$directory" != /* ]]; then
     printf 'Runtime build directories must be absolute: %s\n' "$directory" >&2
@@ -23,7 +23,7 @@ for executable in "$native_dir/bin/codex"; do
 done
 test -d "$native_dir/codex-resources"
 mkdir -p "$runtime_root/cache/oac-runtime-builds"
-context="$(mktemp -d "$runtime_root/cache/oac-runtime-builds/bundle.XXXXXX")"
+context="$(mktemp -d "$runtime_root/cache/oac-runtime-builds/codex.XXXXXX")"
 trap 'rm -rf "$context"' EXIT
 (
   cd "$repo_root"
@@ -36,5 +36,5 @@ cp "$repo_root/services/core/deploy/codex/Dockerfile" "$context/Dockerfile"
 # Preserve the previous bundle if compilation or validation failed.
 mkdir -p "$output_dir"
 cp -R "$context/." "$output_dir/"
-printf 'Runtime image context: %s\n' "$output_dir"
-printf 'Build with: docker build --platform linux/amd64 -t agents-runtime:local %q\n' "$output_dir"
+printf 'Codex Runtime image context: %s\n' "$output_dir"
+printf 'Build with: docker build --platform linux/amd64 -t oac-runtime:codex %q\n' "$output_dir"
diff --git a/scripts/build-core-distribution.sh b/scripts/build-core-distribution.sh
index bc661b251..e6635f418 100755
--- a/scripts/build-core-distribution.sh
+++ b/scripts/build-core-distribution.sh
@@ -160,14 +160,12 @@ if [[ -n "$codex_image$claude_image$mcode_image" ]]; then
     exit 1
   fi
 else
-  : "${AGENTS_RUNTIME_CODEX_PACKAGE:?Set the extracted pinned Codex Linux x64 package directory}"
+  : "${CODEX_CLI_DIR:?Set the extracted pinned Codex Linux x64 package directory}"
   : "${MCODE_HARNESS_BUILD_DIR:?Set the existing built pinned MiniMax Code companion directory}"
   export CLAUDE_SDK_BUILD_DIR="$stage/claude-sdk"
   scripts/build-claude-sdk-runtime.sh
   for harness in codex claude mcode; do
-    script="scripts/build-$harness-runtime.sh"
-    if [[ "$harness" == codex ]]; then script=scripts/build-agents-runtime.sh; fi
-    AGENTS_RUNTIME_BUILD_DIR="$stage/$harness" bash "$script"
+    AGENTS_RUNTIME_BUILD_DIR="$stage/$harness" bash "scripts/build-$harness-runtime.sh"
     build_image "$harness" "$stage/$harness"
   done
   codex_image="$(cat "$stage/codex.id")"
diff --git a/scripts/check-names.py b/scripts/check-names.py
index f2e3b00f0..d1fba0a4f 100644
--- a/scripts/check-names.py
+++ b/scripts/check-names.py
@@ -16,7 +16,7 @@
     r"(?i:parsar)|\bAGENTS_CORE_WEB_[A-Z][A-Z0-9_]*|\bAGENTS_API_[A-Z][A-Z0-9_]*|\bCORE_CONSOLE_[A-Z][A-Z0-9_]*"
     r"|\bagents-api(?:-(?:migrate|device|environment-key|e2b-provider|microsandbox-provider"
     r"|tool-root|codex-directory|codex-write|workspace-export|runtime-initialize|claude-shell-prefix))?\b"
-    r"|\bcore-console\b|\bagents-runtime-|(?i:\bAgents? Core(?: Web)?\b)|@agents-core-web/"
+    r"|\bcore-console\b|\bagents-runtime\b|(?i:\bAgents? Core(?: Web)?\b)|\bagents-core-web\b"
     r"|(?i:\bminimax-ai-dev\b)",
 )
 
diff --git a/scripts/ci_plan.py b/scripts/ci_plan.py
index 30d0f61b2..7b45e8bbf 100644
--- a/scripts/ci_plan.py
+++ b/scripts/ci_plan.py
@@ -79,7 +79,7 @@
     (("scripts/build-e2b-provider.sh",), (".sh",), ("backend", "api", "distribution")),
     (("scripts/build-claude", "scripts/check-claude", "scripts/build-mcode", "scripts/prepare-release-runtimes.sh"),
      SCRIPTS, ("harness", "native", "backend", "distribution")),
-    (("scripts/build-agents-runtime.sh",), (".sh",), ("backend", "native", "distribution")),
+    (("scripts/build-codex-runtime.sh",), (".sh",), ("backend", "native", "distribution")),
     (("scripts/generate-harness-catalog", "scripts/harness-catalog/", "scripts/openapi-split/", "scripts/patch-agents-openapi.py",
       "scripts/extract-agents-api-upstream.py"), SCRIPTS, JOBS),
     (("scripts/check-sqlc.py", "scripts/go-test-shard.py"), (".py",), ("backend",)),

From dfc38781504d017cf8dbc8cc813a53c557b5daa0 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 13:30:22 +0800
Subject: [PATCH 2/9] Report corrupt stored data as internal errors (#465)

---
 services/core/internal/api/handler_test.go    |  8 ++++++-
 .../internal/api/session_model_defaults.go    |  3 +--
 .../internal/environmenttemplates/errors.go   |  2 +-
 .../persistence/postgres/sessionpg/devices.go | 10 ++++----
 .../sessionpg/execution_environment.go        |  4 ++--
 .../persistence/postgres/sessionpg/frozen.go  |  4 ++--
 .../persistence/postgres/sessionpg/rows.go    |  8 +++----
 .../persistence/postgres/templatepg/seal.go   |  3 ++-
 .../persistence/postgres/templatepg/store.go  | 20 +++++++++++-----
 .../postgres/templatepg/store_test.go         | 24 ++++++++++++-------
 .../integration/session_reads_fixture_test.go |  2 +-
 .../integration/turn_journal_reads_test.go    |  2 +-
 12 files changed, 55 insertions(+), 35 deletions(-)

diff --git a/services/core/internal/api/handler_test.go b/services/core/internal/api/handler_test.go
index 8257827b7..04b28b3f6 100644
--- a/services/core/internal/api/handler_test.go
+++ b/services/core/internal/api/handler_test.go
@@ -149,6 +149,7 @@ func TestHTTPRejectsUntrustedOrUnsupportedRequests(t *testing.T) {
 		{"initial input", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", valid, 503},
 		{"stream unavailable", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"agent":`, `"stream":true,"agent":`, 1), 503},
 		{"unknown saved agent", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"agent":`, `"agent_id":"saved","agent":`, 1), 404},
+		{"saved agent without its model provider bundle", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"agent":`, `"agent_id":"saved","agent":`, 1), 500},
 		{"unknown agent option", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", strings.Replace(valid, `"model":`, `"tools":[{}],"model":`, 1), 400},
 		{"multiple objects", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", valid + `{}`, 400},
 		{"null body as empty object", "Bearer test-api-key", "agents=v1", "/v1/agents/sessions", `null`, 400},
@@ -158,10 +159,15 @@ func TestHTTPRejectsUntrustedOrUnsupportedRequests(t *testing.T) {
 			unavailable := 0
 			h, s, _ := testHandler(t, func(_ *Dependencies, f *testFakes) {
 				f.metrics.recordUnavailable = func() { unavailable++ }
-				if test.name == "unknown saved agent" {
+				switch test.name {
+				case "unknown saved agent":
 					f.agentsReader.getAgentWithModelProvider = func(context.Context, string, string) (agents.Agent, *v1.ModelProviderInput, error) {
 						return agents.Agent{}, nil, agents.ErrNotFound
 					}
+				case "saved agent without its model provider bundle":
+					f.agentsReader.getAgentWithModelProvider = func(context.Context, string, string) (agents.Agent, *v1.ModelProviderInput, error) {
+						return agents.Agent{ID: "saved", Configuration: json.RawMessage(`{"model":"example","x_agents_core":{"model_provider":{"protocol":"responses","base_url":"https://model.invalid"}}}`)}, nil, nil
+					}
 				}
 			})
 			r := httptest.NewRequest(http.MethodPost, test.path, strings.NewReader(test.body))
diff --git a/services/core/internal/api/session_model_defaults.go b/services/core/internal/api/session_model_defaults.go
index c897bd7c7..93bdffd7d 100644
--- a/services/core/internal/api/session_model_defaults.go
+++ b/services/core/internal/api/session_model_defaults.go
@@ -7,7 +7,6 @@ import (
 
 	v1 "github.com/MiniMax-AI/OpenAgentCore/contracts/agents-api/v1"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/agents"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/credentialcrypto"
 	"github.com/google/uuid"
 )
 
@@ -34,7 +33,7 @@ func (h *Handler) sessionAgentDefaults(ctx context.Context, tenant string, input
 		return nil, nil, err
 	}
 	if inherit && saved.XAgentsCore != nil && saved.XAgentsCore.ModelProvider != nil && provider == nil {
-		return nil, nil, credentialcrypto.ErrUnavailable
+		return nil, nil, errors.New("saved agent model provider bundle is missing")
 	}
 	return saved, provider, nil
 }
diff --git a/services/core/internal/environmenttemplates/errors.go b/services/core/internal/environmenttemplates/errors.go
index 1591eaeee..7730fa274 100644
--- a/services/core/internal/environmenttemplates/errors.go
+++ b/services/core/internal/environmenttemplates/errors.go
@@ -7,6 +7,6 @@ var (
 	// the tenant. Missing, malformed and foreign IDs are indistinguishable.
 	ErrNotFound = errors.New("environment template not found")
 	// ErrInvalidInput reports input that is not a valid Template, or a saved
-	// Template whose configuration no longer decodes as one.
+	// Template whose configuration no longer passes validation.
 	ErrInvalidInput = errors.New("invalid environment template")
 )
diff --git a/services/core/internal/persistence/postgres/sessionpg/devices.go b/services/core/internal/persistence/postgres/sessionpg/devices.go
index 9bf5e67e5..7512586b3 100644
--- a/services/core/internal/persistence/postgres/sessionpg/devices.go
+++ b/services/core/internal/persistence/postgres/sessionpg/devices.go
@@ -16,7 +16,7 @@ import (
 )
 
 func (s *Store) GetSessionDevice(ctx context.Context, tenant, session string) (sessions.ExecutionDevice, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
@@ -27,7 +27,7 @@ func (s *Store) GetSessionDevice(ctx context.Context, tenant, session string) (s
 }
 
 func (s *Store) GetSessionExecutionBinding(ctx context.Context, tenant, session string) (sessions.ExecutionBinding, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return sessions.ExecutionBinding{}, err
 	}
@@ -77,7 +77,7 @@ func (s *Store) ListExecutionDevices(ctx context.Context, tenant string) ([]sess
 }
 
 func (s *Store) GetSessionRuntimeDevice(ctx context.Context, tenant, session string) (sessions.ExecutionDevice, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
@@ -176,7 +176,7 @@ func (s *Store) CreateDevice(ctx context.Context, tenant string, registration se
 }
 
 func (s *Store) RevokeDevice(ctx context.Context, tenant, device string) error {
-	lookup, err := DeviceLookup(tenant, device)
+	lookup, err := ResourceLookup(tenant, device)
 	if err != nil {
 		return err
 	}
@@ -217,7 +217,7 @@ func (s *Store) WithEnrollment(ctx context.Context, environment, credentialHash
 	if err != nil {
 		return err
 	}
-	lookup, err := DeviceLookup(tenant, current.ID)
+	lookup, err := ResourceLookup(tenant, current.ID)
 	if err != nil {
 		return err
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/execution_environment.go b/services/core/internal/persistence/postgres/sessionpg/execution_environment.go
index 505f859ec..de4bf3cd5 100644
--- a/services/core/internal/persistence/postgres/sessionpg/execution_environment.go
+++ b/services/core/internal/persistence/postgres/sessionpg/execution_environment.go
@@ -32,7 +32,7 @@ func (e *Execution) WithConnection(ctx context.Context, tenant, environment stri
 		if err != nil {
 			return err
 		}
-		lookup, err := DeviceLookup(tenant, current.SessionID)
+		lookup, err := ResourceLookup(tenant, current.SessionID)
 		if err != nil {
 			return err
 		}
@@ -43,7 +43,7 @@ func (e *Execution) WithConnection(ctx context.Context, tenant, environment stri
 }
 
 func (e *Execution) WithDeviceBinding(ctx context.Context, tenant, session string, apply func(context.Context, sessions.DeviceBindingTx, sessions.LockedSession) error) error {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return err
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/frozen.go b/services/core/internal/persistence/postgres/sessionpg/frozen.go
index 40e36f0ef..d7a638f78 100644
--- a/services/core/internal/persistence/postgres/sessionpg/frozen.go
+++ b/services/core/internal/persistence/postgres/sessionpg/frozen.go
@@ -19,7 +19,7 @@ import (
 // data that does not open, decode or validate is corrupt stored data, never
 // the caller's input, so it is an internal error.
 func (s *Store) ReadEnvironmentSetup(ctx context.Context, tenant, session string) (environmentconfig.Setup, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return environmentconfig.Setup{}, sessions.ErrNotFound
 	}
@@ -51,7 +51,7 @@ func (s *Store) ReadEnvironmentSetup(ctx context.Context, tenant, session string
 // position. A file that does not open or match its recorded size is corrupt
 // stored data, so it is an internal error.
 func (s *Store) ReadInitialEnvironmentFile(ctx context.Context, tenant, session string, position int) (environmentconfig.InitialFileMetadata, []byte, error) {
-	lookup, err := DeviceLookup(tenant, session)
+	lookup, err := ResourceLookup(tenant, session)
 	if err != nil {
 		return environmentconfig.InitialFileMetadata{}, nil, err
 	}
diff --git a/services/core/internal/persistence/postgres/sessionpg/rows.go b/services/core/internal/persistence/postgres/sessionpg/rows.go
index a07c5a342..d635b72bf 100644
--- a/services/core/internal/persistence/postgres/sessionpg/rows.go
+++ b/services/core/internal/persistence/postgres/sessionpg/rows.go
@@ -42,10 +42,10 @@ func TurnLookup(tenantID, sessionID, turnID string) (sqlc.GetTurnParams, error)
 	return p, err
 }
 
-// DeviceLookup parses a tenant and the internal identifier of one of its
+// ResourceLookup parses a tenant and the internal identifier of one of its
 // resources, such as a device, Session or Environment; a malformed one is
 // sessions.ErrInvalidInput.
-func DeviceLookup(tenantID, id string) (sqlc.GetDeviceParams, error) {
+func ResourceLookup(tenantID, id string) (sqlc.GetDeviceParams, error) {
 	var p sqlc.GetDeviceParams
 	var err error
 	if p.TenantID, err = parseID(tenantID); err != nil {
@@ -76,7 +76,7 @@ func sessionFromRow(row sqlc.Session) (sessions.Session, error) {
 	session.Creator = creator
 	configuration, err := jsonobject.Normalize(row.Configuration)
 	if err != nil {
-		return sessions.Session{}, fmt.Errorf("decode session configuration: %w: %w", sessions.ErrInvalidInput, err)
+		return sessions.Session{}, fmt.Errorf("decode session configuration: %w", err)
 	}
 	session.Configuration = configuration
 	if err := json.Unmarshal(row.Metadata, &session.Metadata); err != nil {
@@ -110,7 +110,7 @@ func environmentFromRow(row sqlc.Environment, tenant pgtype.UUID, configuration
 	}
 	configuration, err = jsonobject.Normalize(configuration)
 	if err != nil {
-		return sessions.Environment{}, fmt.Errorf("decode environment configuration: %w: %w", sessions.ErrInvalidInput, err)
+		return sessions.Environment{}, fmt.Errorf("decode environment configuration: %w", err)
 	}
 	return sessions.Environment{
 		ID: uuid.UUID(row.ID.Bytes).String(), SessionID: uuid.UUID(row.SessionID.Bytes).String(),
diff --git a/services/core/internal/persistence/postgres/templatepg/seal.go b/services/core/internal/persistence/postgres/templatepg/seal.go
index fd504ecbc..06b2f0749 100644
--- a/services/core/internal/persistence/postgres/templatepg/seal.go
+++ b/services/core/internal/persistence/postgres/templatepg/seal.go
@@ -2,6 +2,7 @@ package templatepg
 
 import (
 	"encoding/json"
+	"errors"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/credentialcrypto"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/environmentconfig"
@@ -87,7 +88,7 @@ func (s *Store) openSetup(tenant, id pgtype.UUID, field string, ciphertext []byt
 		return err
 	}
 	if environmentconfig.Decode(plaintext, output) != nil {
-		return environmenttemplates.ErrInvalidInput
+		return errors.New("invalid stored environment template " + field)
 	}
 	return nil
 }
diff --git a/services/core/internal/persistence/postgres/templatepg/store.go b/services/core/internal/persistence/postgres/templatepg/store.go
index 61f93bb4b..cb3d1d502 100644
--- a/services/core/internal/persistence/postgres/templatepg/store.go
+++ b/services/core/internal/persistence/postgres/templatepg/store.go
@@ -169,8 +169,10 @@ func (s *Store) List(ctx context.Context, tenantID string, query environmenttemp
 }
 
 // Resolve reads one row, so the metadata and every confidential field come
-// from the same committed version. Stored Skill and Plugin metadata must match
-// the sealed archives they describe. Any malformed ID resolves to ErrNotFound.
+// from the same committed version. Stored data that does not decode or match
+// its sealed contents is corrupt, an internal error; configuration that decodes
+// but fails current validation is ErrInvalidInput. Any malformed ID resolves to
+// ErrNotFound.
 func (s *Store) Resolve(ctx context.Context, tenantID, templateID string) (environmenttemplates.Resolved, error) {
 	tenant, err := pgunit.ParseID(tenantID)
 	if err != nil {
@@ -203,12 +205,15 @@ func (s *Store) Resolve(ctx context.Context, tenantID, templateID string) (envir
 			return environmenttemplates.Resolved{}, err
 		}
 	}
-	if !matches(metadata.Skills, resolved.Setup.SkillMetadata()) || !matches(metadata.Plugins, resolved.Setup.PluginMetadata()) || resolved.Setup.Validate() != nil {
+	if !matches(metadata.Skills, resolved.Setup.SkillMetadata()) || !matches(metadata.Plugins, resolved.Setup.PluginMetadata()) {
+		return environmenttemplates.Resolved{}, errors.New("stored environment template metadata does not match its sealed setup")
+	}
+	if resolved.Setup.Validate() != nil {
 		return environmenttemplates.Resolved{}, environmenttemplates.ErrInvalidInput
 	}
 	if len(row.FileContents) == 0 {
 		if len(metadata.Files) > 0 {
-			return environmenttemplates.Resolved{}, environmenttemplates.ErrInvalidInput
+			return environmenttemplates.Resolved{}, errors.New("stored environment template files have no contents")
 		}
 		return resolved, nil
 	}
@@ -219,7 +224,10 @@ func (s *Store) Resolve(ctx context.Context, tenantID, templateID string) (envir
 	if err != nil {
 		return environmenttemplates.Resolved{}, err
 	}
-	if json.Unmarshal(plaintext, &resolved.Files) != nil || environmentconfig.ValidateInitialFiles(resolved.Files) != nil {
+	if json.Unmarshal(plaintext, &resolved.Files) != nil {
+		return environmenttemplates.Resolved{}, errors.New("invalid stored environment template files")
+	}
+	if environmentconfig.ValidateInitialFiles(resolved.Files) != nil {
 		return environmenttemplates.Resolved{}, environmenttemplates.ErrInvalidInput
 	}
 	return resolved, nil
@@ -246,7 +254,7 @@ func template(row metadataRow) (environmenttemplates.Template, error) {
 		result.Name = &row.Name.String
 	}
 	if json.Unmarshal(row.Files, &result.Files) != nil || environmentconfig.Decode(row.Packages, &result.Packages) != nil || json.Unmarshal(row.Skills, &result.Skills) != nil || json.Unmarshal(row.Plugins, &result.Plugins) != nil {
-		return environmenttemplates.Template{}, environmenttemplates.ErrInvalidInput
+		return environmenttemplates.Template{}, errors.New("invalid stored environment template metadata")
 	}
 	return result, nil
 }
diff --git a/services/core/internal/persistence/postgres/templatepg/store_test.go b/services/core/internal/persistence/postgres/templatepg/store_test.go
index ee5b02b82..7710eb447 100644
--- a/services/core/internal/persistence/postgres/templatepg/store_test.go
+++ b/services/core/internal/persistence/postgres/templatepg/store_test.go
@@ -370,9 +370,10 @@ func TestMissingKeyIsUnavailable(t *testing.T) {
 	}
 }
 
-// Stored package metadata naming the removed system manager is rejected on
-// every read instead of being silently dropped.
-func TestStoredSystemPackagesRejected(t *testing.T) {
+// Stored package metadata naming the removed system manager no longer decodes,
+// so every read fails with an internal error instead of dropping it. Packages
+// that decode but fail current validation are an invalid Template.
+func TestStoredPackagesRejected(t *testing.T) {
 	f := newFixture(t, pgtest.Open(t))
 	ctx := t.Context()
 	tenant := uuid.NewString()
@@ -383,18 +384,23 @@ func TestStoredSystemPackagesRejected(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
+	internal := func(err error) bool { return err != nil && !errors.Is(err, environmenttemplates.ErrInvalidInput) }
 	for _, value := range []string{`null`, `[]`, `["jq"]`} {
 		store(`{"npm":[],"python":[],"system":` + value + `}`)
-		if _, err := f.keyless.Get(ctx, tenant, template.ID); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
-			t.Fatal("get silently ignored removed system packages", value, err)
+		if _, err := f.keyless.Get(ctx, tenant, template.ID); !internal(err) {
+			t.Fatal("get did not fail internally on removed system packages", value, err)
 		}
-		if _, err := f.keyless.List(ctx, tenant, environmenttemplates.ListQuery{Limit: 1}); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
-			t.Fatal("list silently ignored removed system packages", value, err)
+		if _, err := f.keyless.List(ctx, tenant, environmenttemplates.ListQuery{Limit: 1}); !internal(err) {
+			t.Fatal("list did not fail internally on removed system packages", value, err)
 		}
-		if _, err := f.keyed.Resolve(ctx, tenant, template.ID); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
-			t.Fatal("resolve silently ignored removed system packages", value, err)
+		if _, err := f.keyed.Resolve(ctx, tenant, template.ID); !internal(err) {
+			t.Fatal("resolve did not fail internally on removed system packages", value, err)
 		}
 	}
+	store(`{"npm":["-x"],"python":[]}`)
+	if _, err := f.keyed.Resolve(ctx, tenant, template.ID); !errors.Is(err, environmenttemplates.ErrInvalidInput) {
+		t.Fatal("resolve accepted packages that fail validation", err)
+	}
 	store(`{"npm":["semver"],"python":["packaging"]}`)
 	if got, err := f.keyless.Get(ctx, tenant, template.ID); err != nil || !reflect.DeepEqual(got.Packages, v1.EnvironmentPackages{NPM: []string{"semver"}, Python: []string{"packaging"}}) {
 		t.Fatal("supported stored package managers rejected", got.Packages, err)
diff --git a/services/core/tests/integration/session_reads_fixture_test.go b/services/core/tests/integration/session_reads_fixture_test.go
index 43f097c11..6dbc04a1b 100644
--- a/services/core/tests/integration/session_reads_fixture_test.go
+++ b/services/core/tests/integration/session_reads_fixture_test.go
@@ -24,7 +24,7 @@ func FixtureEnvironmentDevice(ctx context.Context, pool *pgxpool.Pool, tenant, e
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
-	lookup, err := sessionpg.DeviceLookup(tenant, current.SessionID)
+	lookup, err := sessionpg.ResourceLookup(tenant, current.SessionID)
 	if err != nil {
 		return sessions.ExecutionDevice{}, err
 	}
diff --git a/services/core/tests/integration/turn_journal_reads_test.go b/services/core/tests/integration/turn_journal_reads_test.go
index 09ee32b68..1bb705a24 100644
--- a/services/core/tests/integration/turn_journal_reads_test.go
+++ b/services/core/tests/integration/turn_journal_reads_test.go
@@ -50,7 +50,7 @@ type SubagentIdentity struct {
 // GetSubagentIdentity reads a binding in its authorized, visible Session. Only
 // tests read bindings back.
 func (s *Store) GetSubagentIdentity(ctx context.Context, tenantID, sessionID, nativeID string) (SubagentIdentity, error) {
-	p, err := sessionpg.DeviceLookup(tenantID, sessionID)
+	p, err := sessionpg.ResourceLookup(tenantID, sessionID)
 	if err != nil {
 		return SubagentIdentity{}, err
 	}

From 1074e470108d05df6b1d6a1307fe34a1b05fb80d Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 14:26:14 +0800
Subject: [PATCH 3/9] docs: point website links to openagentcore.dev (#467)

---
 README.md       | 36 ++++++++++++++++++------------------
 README.zh-CN.md | 36 ++++++++++++++++++------------------
 2 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/README.md b/README.md
index 6277909fd..5713ac292 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
 
 An open-source, self-hosted implementation of the OpenAI Agents API with multiple native harnesses.
 
-[Website](https://minimax-ai.github.io/OpenAgentCore/) · [Install](#install) · [Call the API](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/quickstart) · [Documentation](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/) · [Contributing](CONTRIBUTING.md)
+[Website](https://openagentcore.dev/) · [Install](#install) · [Call the API](https://openagentcore.dev/docs/getting-started/quickstart) · [Documentation](https://openagentcore.dev/docs/getting-started/) · [Contributing](CONTRIBUTING.md)
 
 **English** · [简体中文](README.zh-CN.md)
 
@@ -17,9 +17,9 @@ An open-source, self-hosted implementation of the OpenAI Agents API with multipl
 OpenAgentCore runs AI agents on your own infrastructure behind the [OpenAI Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview).
 
 - **Same API as OpenAI.** Point the [OpenAI Agent API](https://developers.openai.com/api/docs/guides/agents/sdk), or plain HTTP, at your installation. No new client to learn.
-- **Your choice of agent.** Each [Session](https://minimax-ai.github.io/OpenAgentCore/docs/api/public-agent-api) runs a [native harness](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/harness-onboarding): [Codex](https://github.com/openai/codex), [Claude Code](https://code.claude.com/docs/en/overview) or [MiniMax Code](https://github.com/MiniMax-AI/minimax-code), with the [model provider you configure](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/model-execution).
-- **Your choice of machine.** Agents work in a [managed sandbox](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/sandbox-deployment) ([Docker](https://www.docker.com/), [microsandbox](https://github.com/zerocore-ai/microsandbox) or [E2B](https://e2b.dev/)), or on your own Linux, macOS or Windows machine.
-- **Every part is replaceable.** [Sandboxes](https://minimax-ai.github.io/OpenAgentCore/docs/sandbox-provider), [harnesses](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/harness-onboarding) and [model providers](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/model-execution) plug in through [defined protocols](AGENTS.md#protocols-at-every-boundary).
+- **Your choice of agent.** Each [Session](https://openagentcore.dev/docs/api/public-agent-api) runs a [native harness](https://openagentcore.dev/contracts/agents-api/harness-onboarding): [Codex](https://github.com/openai/codex), [Claude Code](https://code.claude.com/docs/en/overview) or [MiniMax Code](https://github.com/MiniMax-AI/minimax-code), with the [model provider you configure](https://openagentcore.dev/contracts/agents-api/model-execution).
+- **Your choice of machine.** Agents work in a [managed sandbox](https://openagentcore.dev/contracts/agents-api/sandbox-deployment) ([Docker](https://www.docker.com/), [microsandbox](https://github.com/zerocore-ai/microsandbox) or [E2B](https://e2b.dev/)), or on your own Linux, macOS or Windows machine.
+- **Every part is replaceable.** [Sandboxes](https://openagentcore.dev/docs/sandbox-provider), [harnesses](https://openagentcore.dev/contracts/agents-api/harness-onboarding) and [model providers](https://openagentcore.dev/contracts/agents-api/model-execution) plug in through [defined protocols](AGENTS.md#protocols-at-every-boundary).
 
 ## How it fits together
 
@@ -29,10 +29,10 @@ Applications and operators use these Core APIs:
 
 | API | Path | Used by |
 | --- | --- | --- |
-| **[Agents API](https://minimax-ai.github.io/OpenAgentCore/docs/api/public-agent-api)** | `/v1` | Your applications. Same protocol as [OpenAI's Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) |
-| **[Core API](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/admin-api)** | `/core/v1` | Operators, through Web |
+| **[Agents API](https://openagentcore.dev/docs/api/public-agent-api)** | `/v1` | Your applications. Same protocol as [OpenAI's Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) |
+| **[Core API](https://openagentcore.dev/contracts/agents-api/admin-api)** | `/core/v1` | Operators, through Web |
 
-Core keeps durable execution state. The Runtime runs the chosen harness inside the Environment. Each connection is a defined protocol, so any part can be replaced on its own. See the [architecture guide](https://minimax-ai.github.io/OpenAgentCore/docs/architecture).
+Core keeps durable execution state. The Runtime runs the chosen harness inside the Environment. Each connection is a defined protocol, so any part can be replaced on its own. See the [architecture guide](https://openagentcore.dev/docs/architecture).
 
 ## Screenshots
 
@@ -53,20 +53,20 @@ Then:
 1. **Sign in to Web**, the admin console, with the Core key the installer created, and **configure the domain and HTTPS**.
 2. **Set a default model** and **issue a Project API key**.
 3. **Add execution capacity:** a node, E2B, or your own machine.
-4. **[Run your first Session](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/quickstart)** with the OpenAI SDK.
+4. **[Run your first Session](https://openagentcore.dev/docs/getting-started/quickstart)** with the OpenAI SDK.
 
-The [installation guide](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/install) covers each step, HTTPS and a quick local trial. Listen addresses, ports and other options: [installation options](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/install-options).
+The [installation guide](https://openagentcore.dev/docs/getting-started/install) covers each step, HTTPS and a quick local trial. Listen addresses, ports and other options: [installation options](https://openagentcore.dev/docs/getting-started/install-options).
 
 ## Documentation
 
 | I want to | Start with |
 | --- | --- |
-| Install and operate an installation | [Installation](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/install), then [operations](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/operations) |
-| Build an application on the API | [Quickstart](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/quickstart), then the [Agents API guide](https://minimax-ai.github.io/OpenAgentCore/docs/api/public-agent-api) |
-| See a complete application | [Examples](https://minimax-ai.github.io/OpenAgentCore/docs/examples) |
-| Run agents on my own machine | [Self-hosted execution](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/self-hosted) |
-| Check Harness capabilities and limits | [Harness capabilities](https://minimax-ai.github.io/OpenAgentCore/contracts/agents-api/harness-capabilities) |
-| Understand the design | [Architecture](https://minimax-ai.github.io/OpenAgentCore/docs/architecture) |
-| Add a sandbox, harness or other component | [Developer guide](https://minimax-ai.github.io/OpenAgentCore/docs/development) |
-
-All pages: [documentation index](https://minimax-ai.github.io/OpenAgentCore/docs/getting-started/). Before changing code, read the [contributor rules](CONTRIBUTING.md).
+| Install and operate an installation | [Installation](https://openagentcore.dev/docs/getting-started/install), then [operations](https://openagentcore.dev/docs/getting-started/operations) |
+| Build an application on the API | [Quickstart](https://openagentcore.dev/docs/getting-started/quickstart), then the [Agents API guide](https://openagentcore.dev/docs/api/public-agent-api) |
+| See a complete application | [Examples](https://openagentcore.dev/docs/examples) |
+| Run agents on my own machine | [Self-hosted execution](https://openagentcore.dev/docs/getting-started/self-hosted) |
+| Check Harness capabilities and limits | [Harness capabilities](https://openagentcore.dev/contracts/agents-api/harness-capabilities) |
+| Understand the design | [Architecture](https://openagentcore.dev/docs/architecture) |
+| Add a sandbox, harness or other component | [Developer guide](https://openagentcore.dev/docs/development) |
+
+All pages: [documentation index](https://openagentcore.dev/docs/getting-started/). Before changing code, read the [contributor rules](CONTRIBUTING.md).
diff --git a/README.zh-CN.md b/README.zh-CN.md
index b2d5f42a9..5414cea3c 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -6,7 +6,7 @@
 
 OpenAI Agents API 的开源实现，支持多种原生执行引擎，可部署在自己的基础设施上。
 
-[官网](https://minimax-ai.github.io/OpenAgentCore/zh/) · [安装](#安装) · [调用 API](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/quickstart) · [文档](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/) · [参与贡献](CONTRIBUTING.md)
+[官网](https://openagentcore.dev/zh/) · [安装](#安装) · [调用 API](https://openagentcore.dev/zh/docs/getting-started/quickstart) · [文档](https://openagentcore.dev/zh/docs/getting-started/) · [参与贡献](CONTRIBUTING.md)
 
 [English](README.md) · **简体中文**
 
@@ -20,19 +20,19 @@ OpenAI Agents API 的开源实现，支持多种原生执行引擎，可部署
 
 | API | 路径 | 调用方 |
 | --- | --- | --- |
-| **[Agents API](https://minimax-ai.github.io/OpenAgentCore/zh/docs/api/public-agent-api)** | `/v1` | 你的应用，与 [OpenAI 的 Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) 协议一致 |
-| **[Core API](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/admin-api)** | `/core/v1` | 管理员，通过 Web 调用 |
+| **[Agents API](https://openagentcore.dev/zh/docs/api/public-agent-api)** | `/v1` | 你的应用，与 [OpenAI 的 Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview) 协议一致 |
+| **[Core API](https://openagentcore.dev/zh/contracts/agents-api/admin-api)** | `/core/v1` | 管理员，通过 Web 调用 |
 
-持久化执行状态由 Core 保存；Runtime 在 Environment 中运行所选 Harness。各部件之间都通过既定协议连接， 任何一个都可以单独替换。详见[架构说明](https://minimax-ai.github.io/OpenAgentCore/zh/docs/architecture)。
+持久化执行状态由 Core 保存；Runtime 在 Environment 中运行所选 Harness。各部件之间都通过既定协议连接， 任何一个都可以单独替换。详见[架构说明](https://openagentcore.dev/zh/docs/architecture)。
 
 ## 这是什么
 
 OpenAgentCore 在你自己的基础设施上运行 AI Agent，对外提供 [OpenAI Agents API](https://developers.openai.com/api/docs/guides/agents-api/overview)。
 
 - **与 OpenAI 相同的 API。** [官方 OpenAI SDK](https://developers.openai.com/api/docs/guides/agents/sdk) 或直接 HTTP 调用，改一下地址即可，无需学习新客户端。
-- **自选 Agent。** 每个 [Session](https://minimax-ai.github.io/OpenAgentCore/zh/docs/api/public-agent-api) 运行一个[原生 Harness](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/harness-onboarding)：[Codex](https://github.com/openai/codex)、[Claude Code](https://code.claude.com/docs/en/overview) 或 [MiniMax Code](https://github.com/MiniMax-AI/minimax-code)， 使用[你配置的模型供应商](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/model-execution)。
-- **自选机器。** Agent 可以在[托管沙箱](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/sandbox-deployment)（[Docker](https://www.docker.com/)、[microsandbox](https://github.com/zerocore-ai/microsandbox) 或 [E2B](https://e2b.dev/)）里工作， 也可以在你自己的 Linux、macOS 或 Windows 机器上工作。
-- **每个部件都可替换。** [沙箱](https://minimax-ai.github.io/OpenAgentCore/zh/docs/sandbox-provider)、[Harness](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/harness-onboarding) 和[模型供应商](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/model-execution)都通过[既定协议](AGENTS.md#protocols-at-every-boundary)接入。
+- **自选 Agent。** 每个 [Session](https://openagentcore.dev/zh/docs/api/public-agent-api) 运行一个[原生 Harness](https://openagentcore.dev/zh/contracts/agents-api/harness-onboarding)：[Codex](https://github.com/openai/codex)、[Claude Code](https://code.claude.com/docs/en/overview) 或 [MiniMax Code](https://github.com/MiniMax-AI/minimax-code)， 使用[你配置的模型供应商](https://openagentcore.dev/zh/contracts/agents-api/model-execution)。
+- **自选机器。** Agent 可以在[托管沙箱](https://openagentcore.dev/zh/contracts/agents-api/sandbox-deployment)（[Docker](https://www.docker.com/)、[microsandbox](https://github.com/zerocore-ai/microsandbox) 或 [E2B](https://e2b.dev/)）里工作， 也可以在你自己的 Linux、macOS 或 Windows 机器上工作。
+- **每个部件都可替换。** [沙箱](https://openagentcore.dev/zh/docs/sandbox-provider)、[Harness](https://openagentcore.dev/zh/contracts/agents-api/harness-onboarding) 和[模型供应商](https://openagentcore.dev/zh/contracts/agents-api/model-execution)都通过[既定协议](AGENTS.md#protocols-at-every-boundary)接入。
 
 ## 界面预览
 
@@ -53,20 +53,20 @@ curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/
 1. 用安装器生成的 Core key **登录 Web**（管理控制台），并**配置域名和 HTTPS**。
 2. **设置默认模型**，并**签发 Project API key**。
 3. **添加执行资源**：节点、E2B，或你自己的机器。
-4. 用 OpenAI SDK **[运行第一个 Session](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/quickstart)**。
+4. 用 OpenAI SDK **[运行第一个 Session](https://openagentcore.dev/zh/docs/getting-started/quickstart)**。
 
-[安装指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/install)详细介绍每一步，以及 HTTPS 配置和本地快速试用。监听地址、端口等参数见[安装配置选项](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/install-options)。
+[安装指南](https://openagentcore.dev/zh/docs/getting-started/install)详细介绍每一步，以及 HTTPS 配置和本地快速试用。监听地址、端口等参数见[安装配置选项](https://openagentcore.dev/zh/docs/getting-started/install-options)。
 
 ## 文档
 
 | 我想要 | 从这里开始 |
 | --- | --- |
-| 安装并运维 | [安装指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/install)，然后看[运维](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/operations) |
-| 基于 API 开发应用 | [快速开始](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/quickstart)，然后看 [Agents API 指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/api/public-agent-api) |
-| 看一个完整的应用 | [示例](https://minimax-ai.github.io/OpenAgentCore/zh/docs/examples) |
-| 在自己的机器上运行 Agent | [自托管执行](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/self-hosted) |
-| 查看 Harness 能力和限制 | [Harness 能力](https://minimax-ai.github.io/OpenAgentCore/zh/contracts/agents-api/harness-capabilities) |
-| 了解设计 | [架构说明](https://minimax-ai.github.io/OpenAgentCore/zh/docs/architecture) |
-| 接入新的沙箱、Harness 或其他组件 | [开发指南](https://minimax-ai.github.io/OpenAgentCore/zh/docs/development) |
-
-全部文档见[文档目录](https://minimax-ai.github.io/OpenAgentCore/zh/docs/getting-started/)。修改代码前请阅读[贡献规范](CONTRIBUTING.md)。
+| 安装并运维 | [安装指南](https://openagentcore.dev/zh/docs/getting-started/install)，然后看[运维](https://openagentcore.dev/zh/docs/getting-started/operations) |
+| 基于 API 开发应用 | [快速开始](https://openagentcore.dev/zh/docs/getting-started/quickstart)，然后看 [Agents API 指南](https://openagentcore.dev/zh/docs/api/public-agent-api) |
+| 看一个完整的应用 | [示例](https://openagentcore.dev/zh/docs/examples) |
+| 在自己的机器上运行 Agent | [自托管执行](https://openagentcore.dev/zh/docs/getting-started/self-hosted) |
+| 查看 Harness 能力和限制 | [Harness 能力](https://openagentcore.dev/zh/contracts/agents-api/harness-capabilities) |
+| 了解设计 | [架构说明](https://openagentcore.dev/zh/docs/architecture) |
+| 接入新的沙箱、Harness 或其他组件 | [开发指南](https://openagentcore.dev/zh/docs/development) |
+
+全部文档见[文档目录](https://openagentcore.dev/zh/docs/getting-started/)。修改代码前请阅读[贡献规范](CONTRIBUTING.md)。

From da97031bb304a35c94de8252f6793cb14dd51a90 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 14:32:42 +0800
Subject: [PATCH 4/9] Drop unsent Harness options and reject prompts without an
 environment (#468)

Core sends only model, system_prompt, model_provider and harness_config
in agent_options. Delete the adapter keys no Core path produces: codex
override_system_prompt, reasoning_summary, mode, mcp_servers,
enable_features, disable_features, skills and the controls copied into
web_search/model_verbosity; mcode mode, override_system_prompt, skills,
plugins and mcp_servers. Codex reads ExecutionControls directly. The
managed Skill installer, the Runtime capability-download and skill-upload
wrappers, the Runtime capability-context flags and the no-op feature
preference removals go with them.

Dispatch now rejects any other agent_options key, and an execution
preparation with neither or both of local_environment and
disable_execution_environment, with unsupported_configuration before a
factory runs. claude_sdk's own unknown-key branch is unreachable and
removed. agent.ManagedSkillsRoot becomes StateDir, its only remaining
use.
---
 .../internal/agent/claudesdk/options.go       |   2 -
 .../internal/agent/claudesdk/session_test.go  |   4 +-
 .../agent/claudesdk/workspace_test.go         |   4 +-
 .../internal/agent/codex/declaration.go       |   2 +-
 .../internal/agent/codex/declaration_test.go  |   2 +-
 .../agent/codex/execution_controls.go         |  26 -
 .../agent/codex/execution_controls_test.go    |  31 +-
 .../internal/agent/codex/generation_config.go |  17 -
 .../agent/codex/harness_config_test.go        |   6 +-
 .../daemon/internal/agent/codex/mcp_config.go |  24 +-
 .../internal/agent/codex/mcp_config_test.go   |  17 +-
 apps/daemon/internal/agent/codex/mcp_http.go  |   1 -
 .../agent/codex/mcp_http_bearer_test.go       |   2 +-
 .../agent/codex/mcp_http_preflight.go         |   3 +-
 .../internal/agent/codex/mcp_http_test.go     |  15 +-
 .../internal/agent/codex/model_route_test.go  |   4 +-
 .../agent/codex/model_verbosity_test.go       |   4 +-
 apps/daemon/internal/agent/codex/options.go   | 203 +-------
 .../internal/agent/codex/options_test.go      | 162 +-----
 .../agent/codex/permission_profile.go         |   6 +-
 .../internal/agent/codex/preparation.go       |   1 -
 .../agent/codex/preparation_helpers_test.go   |   3 +-
 .../agent/codex/programmatic_tools.go         |   1 -
 .../agent/codex/programmatic_tools_test.go    |   9 +-
 apps/daemon/internal/agent/codex/protocol.go  |   5 +-
 .../agent/codex/protocol_wire_test.go         |   6 +-
 .../agent/codex/provider_config_test.go       |   6 +-
 .../internal/agent/codex/session_plan.go      |  28 +-
 .../agent/codex/session_policy_test.go        |   2 +-
 .../internal/agent/codex/session_run.go       |  32 +-
 .../codex/session_steering_lifecycle_test.go  |   2 +-
 apps/daemon/internal/agent/codex/skills.go    |  23 -
 .../internal/agent/codex/skills_test.go       |  24 -
 .../internal/agent/codex/subagent_profile.go  |   6 +-
 .../agent/codex/subagent_profile_test.go      |   2 +-
 apps/daemon/internal/agent/codex/subagents.go |   3 +-
 .../internal/agent/codex/subagents_test.go    |  12 +-
 .../internal/agent/codex/verbosity_test.go    |  33 --
 .../internal/agent/codex/web_search_test.go   |  33 --
 apps/daemon/internal/agent/harness.go         |  17 +-
 .../internal/agent/managedskills/archive.go   | 289 -----------
 .../agent/managedskills/archive_test.go       | 486 ------------------
 .../agent/managedskills/concurrency_test.go   | 144 ------
 .../internal/agent/managedskills/skills.go    | 237 ---------
 .../agent/managedskills/skills_test.go        | 165 ------
 .../internal/agent/mcode/declaration.go       |   3 +-
 .../internal/agent/mcode/declaration_test.go  |   2 +-
 .../agent/mcode/environment_mcp_test.go       |   8 +-
 apps/daemon/internal/agent/mcode/execution.go |  10 +-
 .../internal/agent/mcode/execution_test.go    |   4 +-
 apps/daemon/internal/agent/mcode/executor.go  |   4 +-
 .../agent/mcode/harness_config_test.go        |   5 +-
 .../agent/mcode/model_provider_test.go        |   8 +-
 .../internal/agent/mcode/native_test.go       |  94 +---
 apps/daemon/internal/agent/mcode/options.go   | 120 +----
 .../internal/agent/mcode/options_test.go      |  29 +-
 apps/daemon/internal/agent/mcode/session.go   |   2 +-
 .../agent/mcode/tool_environment_test.go      |   4 +-
 apps/daemon/internal/agent/mcode/workspace.go |   5 +-
 .../agent/mcode/workspace_network_test.go     |   2 +-
 .../agent/mcode/workspace_skills_test.go      |   2 +-
 apps/daemon/internal/agent/runtime_paths.go   |  14 +-
 .../internal/agent/runtime_paths_test.go      |  16 +-
 .../daemon/internal/cli/agent_registration.go |  11 +-
 .../internal/cli/capability_downloads.go      |  85 ---
 .../internal/cli/capability_downloads_test.go | 115 -----
 .../cli/claude_sdk_live_linux_test.go         |   2 +-
 apps/daemon/internal/cli/companion_path.go    |  18 +
 apps/daemon/internal/cli/connect.go           |   2 +-
 .../internal/cli/native_discovery_test.go     |   2 +-
 apps/daemon/internal/cli/preparation_test.go  |   2 +-
 apps/daemon/internal/cli/skill_upload.go      |  44 --
 apps/daemon/internal/cli/skill_upload_test.go |  41 --
 apps/daemon/internal/dispatch/environment.go  |   3 +
 apps/daemon/internal/dispatch/executor.go     |   2 +-
 .../daemon/internal/dispatch/executor_test.go |  19 +
 contracts/agents-api/harness-onboarding.md    |   2 +-
 contracts/agents-api/zh/harness-onboarding.md |   4 +-
 docs/runtime-protocol.md                      |   3 +
 docs/zh/runtime-protocol.md                   |   5 +-
 internal/agentdaemon/proto/outbound.go        |  24 +-
 packages/claude-sdk-adapter/README.md         |   2 +-
 scripts/name-allowlist.json                   |  25 +-
 services/core/deploy/codex/README.md          |   6 +-
 84 files changed, 258 insertions(+), 2595 deletions(-)
 delete mode 100644 apps/daemon/internal/agent/codex/execution_controls.go
 delete mode 100644 apps/daemon/internal/agent/codex/generation_config.go
 delete mode 100644 apps/daemon/internal/agent/codex/verbosity_test.go
 delete mode 100644 apps/daemon/internal/agent/codex/web_search_test.go
 delete mode 100644 apps/daemon/internal/agent/managedskills/archive.go
 delete mode 100644 apps/daemon/internal/agent/managedskills/archive_test.go
 delete mode 100644 apps/daemon/internal/agent/managedskills/concurrency_test.go
 delete mode 100644 apps/daemon/internal/agent/managedskills/skills.go
 delete mode 100644 apps/daemon/internal/agent/managedskills/skills_test.go
 delete mode 100644 apps/daemon/internal/cli/capability_downloads.go
 delete mode 100644 apps/daemon/internal/cli/capability_downloads_test.go
 create mode 100644 apps/daemon/internal/cli/companion_path.go
 delete mode 100644 apps/daemon/internal/cli/skill_upload.go
 delete mode 100644 apps/daemon/internal/cli/skill_upload_test.go

diff --git a/apps/daemon/internal/agent/claudesdk/options.go b/apps/daemon/internal/agent/claudesdk/options.go
index 5f9bae245..47c1ac3e1 100644
--- a/apps/daemon/internal/agent/claudesdk/options.go
+++ b/apps/daemon/internal/agent/claudesdk/options.go
@@ -135,8 +135,6 @@ func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startR
 			start.Model = value
 		case "system_prompt":
 			start.SystemPrompt = value
-		default:
-			return fail("unsupported option: " + name)
 		}
 	}
 	if strings.TrimSpace(start.Model) == "" {
diff --git a/apps/daemon/internal/agent/claudesdk/session_test.go b/apps/daemon/internal/agent/claudesdk/session_test.go
index c1808a754..3ea42c618 100644
--- a/apps/daemon/internal/agent/claudesdk/session_test.go
+++ b/apps/daemon/internal/agent/claudesdk/session_test.go
@@ -74,7 +74,7 @@ func TestTextFactoryCompletionAndFailures(t *testing.T) {
 }
 
 func TestTextFactoryRejectsUnsupportedInput(t *testing.T) {
-	for _, kind := range []string{"execution-controls", "tool", "option", "outside"} {
+	for _, kind := range []string{"execution-controls", "tool", "outside"} {
 		t.Run(kind, func(t *testing.T) {
 			root := t.TempDir()
 			t.Setenv("OAC_RUNTIME_HOME", root)
@@ -85,8 +85,6 @@ func TestTextFactoryRejectsUnsupportedInput(t *testing.T) {
 				request.ExecutionControls = &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "low"}
 			case "tool":
 				request.FunctionTools = []proto.FunctionTool{{}}
-			case "option":
-				request.AgentOptions["allowed_tools"] = "anything"
 			case "outside":
 				config.StateDir = filepath.Dir(root)
 			}
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_test.go b/apps/daemon/internal/agent/claudesdk/workspace_test.go
index b84b767a7..2dab86f61 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_test.go
@@ -76,7 +76,7 @@ func TestWorkspaceTrustedBindingAndEnvironment(t *testing.T) {
 }
 
 func TestWorkspaceRejectsConflictsBeforeSideEffects(t *testing.T) {
-	for _, name := range []string{"none", "workspace-root", "mcp", "caller-policy", "relative", "missing", "ambient-setting", "duplicate-env", "bad-env"} {
+	for _, name := range []string{"none", "workspace-root", "mcp", "relative", "missing", "ambient-setting", "duplicate-env", "bad-env"} {
 		t.Run(name, func(t *testing.T) {
 			config := workspaceFixture(t)
 			req := workspaceRequest()
@@ -88,8 +88,6 @@ func TestWorkspaceRejectsConflictsBeforeSideEffects(t *testing.T) {
 				req.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "enabled", WorkspaceRoot: config.Workspace.ScratchDir}
 			case "mcp":
 				req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "remote", ServerURL: "https://example.test/mcp"}}
-			case "caller-policy":
-				req.AgentOptions["workspace"] = "override"
 			case "relative":
 				config.Workspace.Directory = "relative"
 			case "missing":
diff --git a/apps/daemon/internal/agent/codex/declaration.go b/apps/daemon/internal/agent/codex/declaration.go
index 2c962fe2c..ea6bfab51 100644
--- a/apps/daemon/internal/agent/codex/declaration.go
+++ b/apps/daemon/internal/agent/codex/declaration.go
@@ -51,7 +51,7 @@ func discover(ctx context.Context, options agent.DiscoveryOptions, info proto.Su
 	return discoverWithCheck(ctx, options, info, CheckCLIAvailable)
 }
 func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, info proto.SupportedAgentKind, check func(context.Context, string) (string, error)) *agent.Runtime {
-	runtime := &agent.Runtime{Info: info, Session: Factory, SessionCapabilityContext: true, ExecutorCapabilityContext: true}
+	runtime := &agent.Runtime{Info: info, Session: Factory}
 	ctx, cancel := context.WithTimeout(parent, 15*time.Second)
 	defer cancel()
 	version, err := check(ctx, "")
diff --git a/apps/daemon/internal/agent/codex/declaration_test.go b/apps/daemon/internal/agent/codex/declaration_test.go
index 652c5cc1e..d3a364b97 100644
--- a/apps/daemon/internal/agent/codex/declaration_test.go
+++ b/apps/daemon/internal/agent/codex/declaration_test.go
@@ -15,7 +15,7 @@ func TestMCPRequiredDiscoveryRequiresPinnedNative(t *testing.T) {
 	for _, version := range []string{"codex-cli 0.153.4", "codex-cli 0.153.3", "codex-cli 0.154.0"} {
 		runtime := discoverWithCheck(t.Context(), agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}, Declaration.Info, func(context.Context, string) (string, error) { return version, nil })
 
-		if !runtime.Info.Available || runtime.Executor == nil || (runtime.Preparation != nil) != SupportsLocalEnvironment(version) || !runtime.SessionCapabilityContext || !runtime.ExecutorCapabilityContext {
+		if !runtime.Info.Available || runtime.Executor == nil || (runtime.Preparation != nil) != SupportsLocalEnvironment(version) {
 			t.Fatalf("factories: %+v", runtime)
 		}
 		if runtime.Info.Capabilities.MCPHTTPRequired.IsSupported() != (version == "codex-cli 0.153.4") {
diff --git a/apps/daemon/internal/agent/codex/execution_controls.go b/apps/daemon/internal/agent/codex/execution_controls.go
deleted file mode 100644
index 1ffde7adf..000000000
--- a/apps/daemon/internal/agent/codex/execution_controls.go
+++ /dev/null
@@ -1,26 +0,0 @@
-package codex
-
-import (
-	"maps"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func executionOptions(req proto.PromptRequestPayload) map[string]any {
-	if req.ExecutionControls == nil && req.MCPHTTPServers == nil {
-		return req.AgentOptions
-	}
-	options := maps.Clone(req.AgentOptions)
-	if options == nil {
-		options = make(map[string]any)
-	}
-	if req.ExecutionControls != nil {
-		// Reuse native validation/catalog handling, overriding lower-priority operator options.
-		options["web_search"] = req.ExecutionControls.WebSearch
-		options["model_verbosity"] = req.ExecutionControls.TextVerbosity
-	}
-	if req.MCPHTTPServers != nil {
-		delete(options, "mcp_servers")
-	}
-	return options
-}
diff --git a/apps/daemon/internal/agent/codex/execution_controls_test.go b/apps/daemon/internal/agent/codex/execution_controls_test.go
index b1cd9eac9..65f8a058f 100644
--- a/apps/daemon/internal/agent/codex/execution_controls_test.go
+++ b/apps/daemon/internal/agent/codex/execution_controls_test.go
@@ -7,36 +7,18 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestExecutionControlsOverrideWithoutMutatingNativeOptions(t *testing.T) {
+func TestExecutionControlsSelectNativeSettings(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	original := map[string]any{"model": "test-model", "web_search": "live", "model_verbosity": "high"}
-	request := proto.PromptRequestPayload{AgentOptions: original}
-	if got := executionOptions(request); !reflect.DeepEqual(got, original) {
-		t.Fatal("ordinary options changed")
-	}
 	for _, search := range []string{"disabled", "cached", "live"} {
 		for _, verbosity := range []string{"low", "medium", "high"} {
-			request.ExecutionControls = &proto.ExecutionControls{WebSearch: search, TextVerbosity: verbosity}
-			options := executionOptions(request)
-			if options["model"] != "test-model" || original["web_search"] != "live" || original["model_verbosity"] != "high" {
-				t.Fatal("operator options mutated")
-			}
-			plan, err := BuildSessionPlan("run", "state", options)
+			plan, err := BuildSessionPlan("state", map[string]any{"model": "test-model"}, &proto.ExecutionControls{WebSearch: search, TextVerbosity: verbosity})
 			if err != nil {
 				t.Fatal(err)
 			}
-			want := map[string]string{"web_search": `"` + search + `"`, "model_verbosity": `"` + verbosity + `"`}
-			for _, kv := range plan.ExtraConfig {
-				if v, ok := want[kv[0]]; ok {
-					if kv[1] != v {
-						t.Fatal("native control differs", kv)
-					}
-					delete(want, kv[0])
-				}
-			}
 			plan.Cleanup()
-			if len(want) != 0 {
-				t.Fatal("native settings omitted", want)
+			want := [][2]string{{"web_search", `"` + search + `"`}, {"model_verbosity", `"` + verbosity + `"`}}
+			if !reflect.DeepEqual(plan.ExtraConfig, want) {
+				t.Fatalf("config = %v, want %v", plan.ExtraConfig, want)
 			}
 		}
 	}
@@ -48,8 +30,7 @@ func TestExecutionControlsRejectIncompleteOrInvalidValues(t *testing.T) {
 		{}, {WebSearch: "disabled"}, {TextVerbosity: "medium"},
 		{WebSearch: "invalid", TextVerbosity: "medium"}, {WebSearch: "disabled", TextVerbosity: "invalid"},
 	} {
-		options := executionOptions(proto.PromptRequestPayload{ExecutionControls: &controls})
-		if plan, err := BuildSessionPlan("run", "state", options); err == nil {
+		if plan, err := BuildSessionPlan("state", nil, &controls); err == nil {
 			plan.Cleanup()
 			t.Fatal("invalid controls accepted", controls)
 		}
diff --git a/apps/daemon/internal/agent/codex/generation_config.go b/apps/daemon/internal/agent/codex/generation_config.go
deleted file mode 100644
index 8cce97fbf..000000000
--- a/apps/daemon/internal/agent/codex/generation_config.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package codex
-
-func extraConfigFromOpts(opts map[string]any) [][2]string {
-	var out [][2]string
-	if rs := stringOpt(opts, "reasoning_summary"); rs != "" {
-		// codex app-server has no per-call flag; route via -c override.
-		// TOML literal — quoted string keeps shell-safe special chars.
-		out = append(out, [2]string{"model_reasoning_summary", strconv(rs)})
-	}
-	if mode := stringOpt(opts, "web_search"); mode != "" {
-		out = append(out, [2]string{"web_search", strconv(mode)})
-	}
-	if verbosity := stringOpt(opts, "model_verbosity"); verbosity != "" {
-		out = append(out, [2]string{"model_verbosity", strconv(verbosity)})
-	}
-	return out
-}
diff --git a/apps/daemon/internal/agent/codex/harness_config_test.go b/apps/daemon/internal/agent/codex/harness_config_test.go
index 1efa79cc5..cd3577d3c 100644
--- a/apps/daemon/internal/agent/codex/harness_config_test.go
+++ b/apps/daemon/internal/agent/codex/harness_config_test.go
@@ -13,10 +13,10 @@ import (
 
 func TestHarnessConfigAppliedWithoutChangingProvider(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	plan, err := BuildSessionPlan("run", "native-config", map[string]any{
+	plan, err := BuildSessionPlan("native-config", map[string]any{
 		"model": "fixture", "harness_config": map[string]any{"model_reasoning_effort": "high"},
 		"model_provider": map[string]any{"base_url": "https://provider.invalid/v1", "protocol": "responses", "api_key": "test-key"},
-	})
+	}, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -27,7 +27,7 @@ func TestHarnessConfigAppliedWithoutChangingProvider(t *testing.T) {
 }
 
 func TestHarnessConfigConflictFailsBeforePreparation(t *testing.T) {
-	_, err := BuildSessionPlan("run", "", map[string]any{"harness_config": map[string]any{"model_provider": "bypass"}})
+	_, err := BuildSessionPlan("", map[string]any{"harness_config": map[string]any{"model_provider": "bypass"}}, nil)
 	if err != harnessconfig.ErrHarnessConfig {
 		t.Fatalf("configuration must fail before filesystem preparation: %v", err)
 	}
diff --git a/apps/daemon/internal/agent/codex/mcp_config.go b/apps/daemon/internal/agent/codex/mcp_config.go
index aac6309cb..653726a43 100644
--- a/apps/daemon/internal/agent/codex/mcp_config.go
+++ b/apps/daemon/internal/agent/codex/mcp_config.go
@@ -8,17 +8,14 @@ import (
 	"strings"
 )
 
-// mcpServerConfig is the daemon-internal MCP server config flattened
-// from agent_options["mcp_servers"] (rendered by render.TargetCodex /
-// the mcpServers JSON shape). Written into <CODEX_HOME>/config.toml
+// mcpServerConfig is the daemon-internal MCP server config resolved from
+// the request's MCP bindings. Written into <CODEX_HOME>/config.toml
 // before spawning the app-server child.
 type mcpServerConfig struct {
 	Name              string
 	URL               string
-	Headers           map[string]string
 	Command           string
 	Args              []string
-	Env               map[string]string
 	EnabledTools      *[]string
 	Required          bool
 	BearerTokenEnvVar string
@@ -76,7 +73,6 @@ func writeCodexMCPConfig(codexHome string, servers map[string]mcpServerConfig) e
 				}
 				b.WriteString("]\n")
 			}
-			writeMCPHeaderMap(&b, "http_headers", srv.Headers)
 			writeMCPHeaderMap(&b, "env_http_headers", srv.EnvHTTPHeaders)
 			b.WriteByte('\n')
 			continue
@@ -94,22 +90,6 @@ func writeCodexMCPConfig(codexHome string, servers map[string]mcpServerConfig) e
 			}
 			b.WriteString("]\n")
 		}
-		if len(srv.Env) > 0 {
-			envKeys := make([]string, 0, len(srv.Env))
-			for k := range srv.Env {
-				envKeys = append(envKeys, k)
-			}
-			sort.Strings(envKeys)
-			b.WriteString("\n[mcp_servers.")
-			b.WriteString(tomlQuoteString(name))
-			b.WriteString(".env]\n")
-			for _, k := range envKeys {
-				b.WriteString(tomlQuoteString(k))
-				b.WriteString(" = ")
-				b.WriteString(tomlQuoteString(srv.Env[k]))
-				b.WriteByte('\n')
-			}
-		}
 		b.WriteByte('\n')
 	}
 
diff --git a/apps/daemon/internal/agent/codex/mcp_config_test.go b/apps/daemon/internal/agent/codex/mcp_config_test.go
index 499733029..c55ca481a 100644
--- a/apps/daemon/internal/agent/codex/mcp_config_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_config_test.go
@@ -33,14 +33,13 @@ func TestWriteCodexMCPConfig_DeterministicOrdering(t *testing.T) {
 	}
 }
 
-func TestWriteCodexMCPConfig_EmitsCommandArgsEnv(t *testing.T) {
+func TestWriteCodexMCPConfig_EmitsCommandArgs(t *testing.T) {
 	dir := t.TempDir()
 	servers := map[string]mcpServerConfig{
 		"docs": {
 			Name:    "docs",
 			Command: "docs-server",
 			Args:    []string{"--port", "8080"},
-			Env:     map[string]string{"DOCS_TOKEN": "secret"},
 		},
 	}
 	if err := writeCodexMCPConfig(dir, servers); err != nil {
@@ -53,21 +52,14 @@ func TestWriteCodexMCPConfig_EmitsCommandArgsEnv(t *testing.T) {
 	if !strings.Contains(string(body), `args = ["--port", "8080"]`) {
 		t.Fatalf("missing args: %s", body)
 	}
-	if !strings.Contains(string(body), `[mcp_servers."docs".env]`) {
-		t.Fatalf("missing env table: %s", body)
-	}
-	if !strings.Contains(string(body), `"DOCS_TOKEN" = "secret"`) {
-		t.Fatalf("missing env entry: %s", body)
-	}
 }
 
 func TestWriteCodexMCPConfig_EmitsStreamableHTTPURL(t *testing.T) {
 	dir := t.TempDir()
 	servers := map[string]mcpServerConfig{
 		"docs": {
-			Name:    "docs",
-			URL:     "https://docs.example.com/mcp",
-			Headers: map[string]string{"Authorization": "Bearer token"},
+			Name: "docs",
+			URL:  "https://docs.example.com/mcp",
 		},
 	}
 	if err := writeCodexMCPConfig(dir, servers); err != nil {
@@ -77,9 +69,6 @@ func TestWriteCodexMCPConfig_EmitsStreamableHTTPURL(t *testing.T) {
 	if !strings.Contains(string(body), `url = "https://docs.example.com/mcp"`) || strings.Contains(string(body), "command =") {
 		t.Fatalf("remote config: %s", body)
 	}
-	if !strings.Contains(string(body), `http_headers = {"Authorization" = "Bearer token"}`) {
-		t.Fatalf("remote headers: %s", body)
-	}
 }
 
 // TestWriteCodexMCPConfig_FreshHomeDropsStaleEntries documents the
diff --git a/apps/daemon/internal/agent/codex/mcp_http.go b/apps/daemon/internal/agent/codex/mcp_http.go
index bdeb2af17..d5a935f7d 100644
--- a/apps/daemon/internal/agent/codex/mcp_http.go
+++ b/apps/daemon/internal/agent/codex/mcp_http.go
@@ -63,7 +63,6 @@ func configureMCP(plan *SessionPlan, servers map[string]mcpServerConfig) error {
 		return errors.New("codex: cannot write public MCP configuration")
 	}
 	for _, feature := range []string{"plugins", "apps"} {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
diff --git a/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go b/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go
index 4c1ed5d8c..0223e6716 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_bearer_test.go
@@ -81,7 +81,7 @@ func TestMCPHTTPBearerDoesNotReachModelCatalogProbe(t *testing.T) {
 	token := "synthetic-catalog-secret"
 	servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "tools", ServerURL: "https://tools.example/mcp", BearerToken: &token}}
 	req := proto.PromptRequestPayload{AgentStateKey: "catalog", DisableExecutionEnvironment: true, MCPHTTPServers: &servers,
-		AgentOptions: map[string]any{"model": "fixture-model", "model_verbosity": "medium"}}
+		AgentOptions: map[string]any{"model": "fixture-model"}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
 	cfg := defaultSessionConfig()
 	cfg.codexBinary = binary
 	plan, _, err := prepareSessionPlan(t.Context(), req, cfg)
diff --git a/apps/daemon/internal/agent/codex/mcp_http_preflight.go b/apps/daemon/internal/agent/codex/mcp_http_preflight.go
index 7aeae62aa..b499038fb 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_preflight.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_preflight.go
@@ -46,8 +46,7 @@ func matchesMCPConfig(raw json.RawMessage, declared map[string]mcpServerConfig)
 			return false
 		}
 		if expected.URL != "" {
-			if server["url"] != expected.URL || !matchesMCPHeaderMap(server, "http_headers", expected.Headers) ||
-				!matchesMCPHeaderMap(server, "env_http_headers", expected.EnvHTTPHeaders) {
+			if server["url"] != expected.URL || !matchesMCPHeaderMap(server, "env_http_headers", expected.EnvHTTPHeaders) {
 				return false
 			}
 			delete(server, "url")
diff --git a/apps/daemon/internal/agent/codex/mcp_http_test.go b/apps/daemon/internal/agent/codex/mcp_http_test.go
index 7720bee3f..20ac1767f 100644
--- a/apps/daemon/internal/agent/codex/mcp_http_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_http_test.go
@@ -20,21 +20,13 @@ func TestPublicMCPHTTPPlanOwnsConfigurationAndPreservesHistory(t *testing.T) {
 		{ConnectionOrigin: "service", ServerLabel: "docs.server", ServerURL: "https://docs.example/mcp", AllowedTools: &tools, Required: true},
 		{ConnectionOrigin: "service", ServerLabel: "blocked", ServerURL: "http://127.0.0.1:12345/mcp", AllowedTools: &denyAll},
 	}
-	original := map[string]any{
-		"mcp_servers":     map[string]any{"operator": map[string]any{"command": "operator-mcp"}},
-		"enable_features": []any{"apps", "plugins", "unrelated"},
-	}
-	req := proto.PromptRequestPayload{AgentStateKey: "public-mcp", DisableExecutionEnvironment: true, MCPHTTPServers: &servers, AgentOptions: original}
-	req.AgentOptions = executionOptions(req)
+	req := proto.PromptRequestPayload{AgentStateKey: "public-mcp", DisableExecutionEnvironment: true, MCPHTTPServers: &servers}
 	plan, _, err := prepareSessionPlan(t.Context(), req, defaultSessionConfig())
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer plan.Cleanup()
-	if original["mcp_servers"] == nil || req.AgentOptions["mcp_servers"] != nil {
-		t.Fatal("declaration failed to replace operator MCP without mutation")
-	}
-	if !slices.Equal(plan.EnableFeatures, []string{"unrelated"}) || !slices.Contains(plan.DisableFeatures, "apps") || !slices.Contains(plan.DisableFeatures, "plugins") || !slices.Contains(plan.ExtraConfig, [2]string{"mcp_oauth_credentials_store", `"file"`}) {
+	if !slices.Contains(plan.DisableFeatures, "apps") || !slices.Contains(plan.DisableFeatures, "plugins") || !slices.Contains(plan.ExtraConfig, [2]string{"mcp_oauth_credentials_store", `"file"`}) {
 		t.Fatal("native profile was not pinned")
 	}
 	home, err := allocCodexHome(req.AgentStateKey)
@@ -53,9 +45,6 @@ func TestPublicMCPHTTPPlanOwnsConfigurationAndPreservesHistory(t *testing.T) {
 			t.Fatalf("missing native config %q", expected)
 		}
 	}
-	if strings.Contains(string(config), "operator") {
-		t.Fatal("operator MCP was rendered")
-	}
 	tools[0] = "mutated"
 	if (*plan.mcpServers["docs.server"].EnabledTools)[0] != "lookup.docs" {
 		t.Fatal("prepared allowlist retained caller-owned memory")
diff --git a/apps/daemon/internal/agent/codex/model_route_test.go b/apps/daemon/internal/agent/codex/model_route_test.go
index 2e4a716cc..32aeb4680 100644
--- a/apps/daemon/internal/agent/codex/model_route_test.go
+++ b/apps/daemon/internal/agent/codex/model_route_test.go
@@ -11,7 +11,7 @@ func TestPlanRejectsNonNativeFrozenProvider(t *testing.T) {
 	for _, protocol := range []string{"anthropic", "chat_completions"} {
 		t.Run(protocol, func(t *testing.T) {
 			provider := map[string]any{"protocol": protocol, "base_url": "https://model.invalid/v1", "api_key": "private-sentinel"}
-			plan, err := BuildSessionPlan("recovered", "frozen-state", map[string]any{"model": "frozen-model", "model_provider": provider})
+			plan, err := BuildSessionPlan("frozen-state", map[string]any{"model": "frozen-model", "model_provider": provider}, nil)
 			if plan.Cleanup != nil {
 				plan.Cleanup()
 			}
@@ -30,7 +30,7 @@ func TestPlanRejectsIncompleteExplicitProvider(t *testing.T) {
 		{"model": "chosen", "model_provider": nil},
 		{"model_provider": map[string]any{"protocol": "responses", "base_url": "https://model.example/v1", "api_key": "fixture"}},
 	} {
-		if _, err := BuildSessionPlan("frozen", "state", options); err == nil {
+		if _, err := BuildSessionPlan("state", options, nil); err == nil {
 			t.Fatal("explicit provider fell back to native defaults")
 		}
 	}
diff --git a/apps/daemon/internal/agent/codex/model_verbosity_test.go b/apps/daemon/internal/agent/codex/model_verbosity_test.go
index 957a70132..e1b9ecd45 100644
--- a/apps/daemon/internal/agent/codex/model_verbosity_test.go
+++ b/apps/daemon/internal/agent/codex/model_verbosity_test.go
@@ -37,7 +37,7 @@ func TestPrepareModelVerbosity(t *testing.T) {
 	if err := os.WriteFile(binary, []byte("#!/bin/sh\nprintf '%s' '"+catalog+"'\n"), 0700); err != nil {
 		t.Fatal(err)
 	}
-	plan, err := BuildSessionPlan("run", "state", map[string]any{"model": "known-model", "model_verbosity": "high"})
+	plan, err := BuildSessionPlan("state", map[string]any{"model": "known-model"}, &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "high"})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -80,7 +80,7 @@ func TestPrepareDefaultModelVerbosity(t *testing.T) {
 	for _, model := range []string{"supported", "unsupported", "unknown-provider-model"} {
 		for _, level := range []string{"low", "medium", "high"} {
 			t.Run(model+"/"+level, func(t *testing.T) {
-				plan, err := BuildSessionPlan("run", "state", executionOptions(proto.PromptRequestPayload{AgentOptions: map[string]any{"model": model}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: level}}))
+				plan, err := BuildSessionPlan("state", map[string]any{"model": model}, &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: level})
 				if err != nil {
 					t.Fatal(err)
 				}
diff --git a/apps/daemon/internal/agent/codex/options.go b/apps/daemon/internal/agent/codex/options.go
index 54defb0c9..2e0457cb2 100644
--- a/apps/daemon/internal/agent/codex/options.go
+++ b/apps/daemon/internal/agent/codex/options.go
@@ -6,10 +6,12 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"sort"
 	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	harnessconfiguration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/codex"
 )
 
@@ -22,17 +24,16 @@ type SessionPlan struct {
 	Cwd string
 
 	// Env is the full environment slice (KEY=value) to layer onto
-	// os.Environ() before spawning. Includes CODEX_HOME, plus any
-	// caller-provided OPENAI_API_KEY / CODEX_API_KEY / proxy vars.
+	// os.Environ() before spawning. Includes CODEX_HOME and the entries
+	// of the env option.
 	Env []string
 
 	// ExtraConfig is a list of `-c key=value` overrides applied at the
-	// app-server CLI. Used to layer model_reasoning_summary etc. without
-	// editing config.toml.
+	// app-server CLI.
 	ExtraConfig [][2]string
 
 	// EnableFeatures / DisableFeatures forward to `--enable / --disable`
-	// flags. Today empty by default; reserved for future ARC opt-in.
+	// flags for the profiles the adapter configures.
 	EnableFeatures  []string
 	DisableFeatures []string
 
@@ -54,9 +55,6 @@ type SessionPlan struct {
 	// SystemPrompt is forwarded as developerInstructions on thread/start.
 	SystemPrompt string
 
-	// CollaborationMode selects Codex's default or plan tool surface.
-	CollaborationMode CollaborationModeKind
-
 	// ModelReasoningEffort is frozen for launch and every native Turn.
 	ModelReasoningEffort string
 
@@ -69,38 +67,25 @@ type SessionPlan struct {
 	Cleanup func()
 }
 
-// BuildSessionPlan derives a SessionPlan from PromptRequestPayload's
-// fields. Options use a string-keyed map.
-//
-// The agent_options keys this function reads:
+// BuildSessionPlan derives a SessionPlan from the request's agent_options and
+// execution controls. It reads these agent_options keys:
 //
-//	model                 string          codex model slug, e.g. "gpt-5.5"
-//	system_prompt         string          forwarded as developerInstructions
-//	override_system_prompt string         replaces system_prompt entirely when
-//	                                      non-empty
-//	env                   map[string]any  extra env vars (KEY=string-value)
-//	mcp_servers           map[string]any  rendered MCP server config — written
-//	                                      to <CODEX_HOME>/config.toml [mcp_servers]
-//	model_provider       object          frozen upstream protocol, endpoint, credential and token limits
-//	reasoning_summary     string          one of auto/concise/detailed/none —
-//	                                      routed via -c model_reasoning_summary
-//	mode                  string          Codex collaboration mode: default/plan
-//	enable_features       []any           string list, forwarded as --enable
-//	disable_features      []any           string list, forwarded as --disable
+//	model           string  codex model slug, e.g. "gpt-5.5"
+//	system_prompt   string  forwarded as developerInstructions
+//	model_provider  object  frozen upstream protocol, endpoint, credential and token limits
+//	harness_config  object  native parameters accepted by harnessconfig/codex
+//	env             object  extra env vars (KEY=string-value); the Runtime's
+//	                        authoring bridge supplies it
 //
-// The codex binary itself is resolved via PATH only — there's no
-// per-prompt override knob. If a deployment needs a custom binary
-// location, set it via the daemon's process environment (PATH /
-// codexBinary in sessionConfig) rather than per-call.
+// Execution controls select the native web_search and model_verbosity settings.
+// The codex binary itself is resolved via PATH only.
 //
 // Daemon-managed Codex sessions bypass approvals and the engine sandbox.
-func BuildSessionPlan(runID, agentStateKey string, opts map[string]any) (SessionPlan, error) {
-	cleanup := func() {}
+func BuildSessionPlan(agentStateKey string, opts map[string]any, controls *proto.ExecutionControls) (SessionPlan, error) {
 	plan := SessionPlan{
-		CollaborationMode: CollaborationModeDefault,
-		ApprovalPolicy:    AskForApproval{String: "never"},
-		Sandbox:           SandboxDangerFullAcces,
-		Cleanup:           cleanup,
+		ApprovalPolicy: AskForApproval{String: "never"},
+		Sandbox:        SandboxDangerFullAcces,
+		Cleanup:        func() {},
 	}
 
 	nativeConfig, err := harnessconfiguration.Configuration().PrepareHarnessConfig(opts)
@@ -112,35 +97,17 @@ func BuildSessionPlan(runID, agentStateKey string, opts map[string]any) (Session
 		return plan, errors.New("codex: model and complete model_provider are required")
 	}
 
-	if value, present := opts["web_search"]; present {
-		switch value {
-		case "disabled", "cached", "live":
-		default:
-			return plan, fmt.Errorf("codex: web_search must be disabled, cached or live")
+	if controls != nil {
+		if !slices.Contains([]string{"disabled", "cached", "live"}, controls.WebSearch) {
+			return plan, errors.New("codex: web_search must be disabled, cached or live")
 		}
-	}
-
-	if value, present := opts["model_verbosity"]; present {
-		switch value {
-		case "low", "medium", "high":
-		default:
-			return plan, fmt.Errorf("codex: model_verbosity must be low, medium or high")
+		if !slices.Contains([]string{"low", "medium", "high"}, controls.TextVerbosity) {
+			return plan, errors.New("codex: text_verbosity must be low, medium or high")
 		}
 	}
 
 	plan.Model = stringOpt(opts, "model")
 	plan.SystemPrompt = stringOpt(opts, "system_prompt")
-	if override := stringOpt(opts, "override_system_prompt"); override != "" {
-		plan.SystemPrompt = override
-	}
-	if mode := CollaborationModeKind(stringOpt(opts, "mode")); mode != "" {
-		switch mode {
-		case CollaborationModeDefault, CollaborationModePlan:
-			plan.CollaborationMode = mode
-		default:
-			return plan, fmt.Errorf("codex: unsupported collaboration mode %q", mode)
-		}
-	}
 
 	env, err := buildSessionEnv(opts)
 	if err != nil {
@@ -156,36 +123,21 @@ func BuildSessionPlan(runID, agentStateKey string, opts map[string]any) (Session
 	}
 	env = append(env, "CODEX_HOME="+codexHome)
 
-	// MCP servers come pre-rendered from server/internal/connector/agentdaemon
-	// (capabilityAdditions.MCPServers, rendered via render.TargetCodex)
-	// as a map of name → {command,args,env}. Write them into
-	// <CODEX_HOME>/config.toml so codex picks them up on startup.
-	mcpServers, err := normaliseMCPServers(opts["mcp_servers"])
-	if err != nil {
-		return plan, err
-	}
-	if len(mcpServers) > 0 {
-		if err := writeCodexMCPConfig(codexHome, mcpServers); err != nil {
-			return plan, err
-		}
-	}
-
 	provider, hasProvider, err := normaliseProviderConfig(opts["model_provider"])
 	if err != nil {
-		cleanup()
 		return plan, err
 	}
 	if hasProvider {
 		if err := writeCodexProviderConfig(codexHome, provider); err != nil {
-			cleanup()
 			return plan, err
 		}
 		plan.ModelProvider = oacProviderSlug
 	}
 
 	plan.Env = env
-	plan.Cleanup = cleanup
-	plan.ExtraConfig = extraConfigFromOpts(opts)
+	if controls != nil {
+		plan.ExtraConfig = [][2]string{{"web_search", strconv(controls.WebSearch)}, {"model_verbosity", strconv(controls.TextVerbosity)}}
+	}
 	if effort, ok := nativeConfig["model_reasoning_effort"].(string); ok {
 		plan.ModelReasoningEffort = effort
 		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"model_reasoning_effort", strconv(effort)})
@@ -198,8 +150,6 @@ func BuildSessionPlan(runID, agentStateKey string, opts map[string]any) (Session
 		plan.ExtraConfig = append(plan.ExtraConfig,
 			[2]string{"model_provider", strconv(plan.ModelProvider)})
 	}
-	plan.EnableFeatures = stringListOpt(opts, "enable_features")
-	plan.DisableFeatures = stringListOpt(opts, "disable_features")
 	return plan, nil
 }
 
@@ -280,84 +230,6 @@ func buildSessionEnv(opts map[string]any) ([]string, error) {
 	return env, nil
 }
 
-func stringListOpt(opts map[string]any, key string) []string {
-	if opts == nil {
-		return nil
-	}
-	raw, ok := opts[key]
-	if !ok || raw == nil {
-		return nil
-	}
-	arr, ok := raw.([]any)
-	if !ok {
-		return nil
-	}
-	out := make([]string, 0, len(arr))
-	for _, v := range arr {
-		if s, ok := v.(string); ok && strings.TrimSpace(s) != "" {
-			out = append(out, s)
-		}
-	}
-	return out
-}
-
-func normaliseMCPServers(raw any) (map[string]mcpServerConfig, error) {
-	if raw == nil {
-		return nil, nil
-	}
-	m, ok := raw.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("codex: mcp_servers must be object, got %T", raw)
-	}
-	out := make(map[string]mcpServerConfig, len(m))
-	for name, v := range m {
-		entry, ok := v.(map[string]any)
-		if !ok {
-			return nil, fmt.Errorf("codex: mcp_servers[%q] must be object, got %T", name, v)
-		}
-		srv := mcpServerConfig{Name: name}
-		if url, ok := entry["url"].(string); ok {
-			srv.URL = strings.TrimSpace(url)
-		}
-		if cmd, ok := entry["command"].(string); ok {
-			srv.Command = cmd
-		}
-		if args, ok := entry["args"].([]any); ok {
-			for _, a := range args {
-				if s, ok := a.(string); ok {
-					srv.Args = append(srv.Args, s)
-				}
-			}
-		}
-		if env, ok := entry["env"].(map[string]any); ok {
-			srv.Env = make(map[string]string, len(env))
-			for k, val := range env {
-				if s, ok := val.(string); ok {
-					srv.Env[k] = s
-				}
-			}
-		}
-		if headers, ok := entry["headers"].(map[string]any); ok {
-			srv.Headers = make(map[string]string, len(headers))
-			for key, value := range headers {
-				if text, ok := value.(string); ok {
-					srv.Headers[key] = text
-				}
-			}
-		} else if headers, ok := entry["headers"].(map[string]string); ok {
-			srv.Headers = headers
-		}
-		if srv.Command == "" && srv.URL == "" {
-			return nil, fmt.Errorf("codex: mcp_servers[%q] missing command or url", name)
-		}
-		if srv.Command != "" && srv.URL != "" {
-			return nil, fmt.Errorf("codex: mcp_servers[%q] cannot set both command and url", name)
-		}
-		out[name] = srv
-	}
-	return out, nil
-}
-
 // normaliseProviderConfig validates and renders the frozen native provider.
 func normaliseProviderConfig(raw any) (providerConfig, bool, error) {
 	if raw == nil {
@@ -370,25 +242,6 @@ func normaliseProviderConfig(raw any) (providerConfig, bool, error) {
 	return providerConfig{BaseURL: provider.BaseURL, BearerToken: provider.APIKey, WireAPI: "responses"}, true, nil
 }
 
-// intOpt extracts an integer-shaped value from a map. JSON-decoded
-// numbers arrive as float64; tests sometimes pass int directly. Both
-// are accepted; non-numeric / missing yields 0.
-func intOpt(m map[string]any, key string) int {
-	v, ok := m[key]
-	if !ok || v == nil {
-		return 0
-	}
-	switch x := v.(type) {
-	case int:
-		return x
-	case int64:
-		return int(x)
-	case float64:
-		return int(x)
-	}
-	return 0
-}
-
 func stringOpt(opts map[string]any, key string) string {
 	if opts == nil {
 		return ""
diff --git a/apps/daemon/internal/agent/codex/options_test.go b/apps/daemon/internal/agent/codex/options_test.go
index b8b8587ac..f5fec2fdb 100644
--- a/apps/daemon/internal/agent/codex/options_test.go
+++ b/apps/daemon/internal/agent/codex/options_test.go
@@ -2,13 +2,12 @@ package codex
 
 import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"os"
 	"strings"
 	"testing"
 )
 
 func TestBuildSessionPlan_DefaultsToBypass(t *testing.T) {
-	plan, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", nil)
+	plan, err := BuildSessionPlan("conv-1/agent-1/codex", nil, nil)
 	if err != nil {
 		t.Fatalf("BuildSessionPlan: %v", err)
 	}
@@ -25,11 +24,11 @@ func TestBuildSessionPlan_DefaultsToBypass(t *testing.T) {
 }
 
 func TestBuildSessionPlan_AllocsCodexHomeAndEnv(t *testing.T) {
-	plan, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
+	plan, err := BuildSessionPlan("conv-1/agent-1/codex", map[string]any{
 		"env": map[string]any{
 			"OPENAI_API_KEY": "sk-test",
 		},
-	})
+	}, nil)
 	if err != nil {
 		t.Fatalf("BuildSessionPlan: %v", err)
 	}
@@ -60,11 +59,11 @@ func TestBuildSessionPlan_AllocsCodexHomeAndEnv(t *testing.T) {
 
 func TestBuildSessionPlan_StableCodexHomeByStateKey(t *testing.T) {
 	stateKey := "conv-stable/agent-stable/codex"
-	planA, err := BuildSessionPlan("run-a", stateKey, nil)
+	planA, err := BuildSessionPlan(stateKey, nil, nil)
 	if err != nil {
 		t.Fatalf("BuildSessionPlan A: %v", err)
 	}
-	planB, err := BuildSessionPlan("run-b", stateKey, nil)
+	planB, err := BuildSessionPlan(stateKey, nil, nil)
 	if err != nil {
 		t.Fatalf("BuildSessionPlan B: %v", err)
 	}
@@ -73,26 +72,6 @@ func TestBuildSessionPlan_StableCodexHomeByStateKey(t *testing.T) {
 	}
 }
 
-func TestBuildSessionPlan_RoutesReasoningSummary(t *testing.T) {
-	plan, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
-		"reasoning_summary": "detailed",
-	})
-	if err != nil {
-		t.Fatalf("BuildSessionPlan: %v", err)
-	}
-	defer plan.Cleanup()
-	if len(plan.ExtraConfig) != 1 {
-		t.Fatalf("ExtraConfig = %+v", plan.ExtraConfig)
-	}
-	kv := plan.ExtraConfig[0]
-	if kv[0] != "model_reasoning_summary" {
-		t.Fatalf("override key = %q", kv[0])
-	}
-	if kv[1] != `"detailed"` {
-		t.Fatalf("override value = %q (must be TOML-quoted)", kv[1])
-	}
-}
-
 func codexHomeFromEnv(env []string) string {
 	for _, kv := range env {
 		if strings.HasPrefix(kv, "CODEX_HOME=") {
@@ -102,128 +81,6 @@ func codexHomeFromEnv(env []string) string {
 	return ""
 }
 
-func TestBuildSessionPlan_OverrideSystemPromptReplacesAppend(t *testing.T) {
-	plan, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
-		"system_prompt":          "user base",
-		"override_system_prompt": "you are pirate",
-	})
-	if err != nil {
-		t.Fatalf("BuildSessionPlan: %v", err)
-	}
-	defer plan.Cleanup()
-	if plan.SystemPrompt != "you are pirate" {
-		t.Fatalf("SystemPrompt = %q, want %q", plan.SystemPrompt, "you are pirate")
-	}
-}
-
-func TestBuildSessionPlan_EmptyOverrideKeepsSystemPrompt(t *testing.T) {
-	plan, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
-		"system_prompt":          "user base",
-		"override_system_prompt": "",
-	})
-	if err != nil {
-		t.Fatalf("BuildSessionPlan: %v", err)
-	}
-	defer plan.Cleanup()
-	if plan.SystemPrompt != "user base" {
-		t.Fatalf("SystemPrompt = %q, want %q (empty override should not clobber)", plan.SystemPrompt, "user base")
-	}
-}
-
-func TestBuildSessionPlan_ParsesCollaborationMode(t *testing.T) {
-	plan, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
-		"mode": "plan",
-	})
-	if err != nil {
-		t.Fatalf("BuildSessionPlan: %v", err)
-	}
-	defer plan.Cleanup()
-	if plan.CollaborationMode != CollaborationModePlan {
-		t.Fatalf("CollaborationMode = %q, want plan", plan.CollaborationMode)
-	}
-}
-
-func TestBuildSessionPlan_OmittedModeRetainsCurrentInstructions(t *testing.T) {
-	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	for _, mode := range []string{"", "default"} {
-		opts := map[string]any{"system_prompt": "current reference", "model": "MiniMax-M3"}
-		if mode != "" {
-			opts["mode"] = mode
-		}
-		plan, err := BuildSessionPlan("run", "conv/agent/codex", opts)
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer plan.Cleanup()
-		if plan.CollaborationMode != CollaborationModeDefault || plan.SystemPrompt != "current reference" || plan.Model != "MiniMax-M3" {
-			t.Fatalf("mode %q did not retain the default turn instructions: %+v", mode, plan)
-		}
-	}
-}
-
-func TestBuildSessionPlan_RejectsUnknownCollaborationMode(t *testing.T) {
-	_, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
-		"mode": "autopilot",
-	})
-	if err == nil || !strings.Contains(err.Error(), "unsupported collaboration mode") {
-		t.Fatalf("expected unsupported collaboration mode error, got %v", err)
-	}
-}
-
-func TestBuildSessionPlan_WritesMCPConfig(t *testing.T) {
-	plan, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
-		"mcp_servers": map[string]any{
-			"docs": map[string]any{
-				"command": "docs-server",
-				"args":    []any{"--port", "8080"},
-				"env":     map[string]any{"TOKEN": "abc"},
-			},
-		},
-	})
-	if err != nil {
-		t.Fatalf("BuildSessionPlan: %v", err)
-	}
-	defer plan.Cleanup()
-	// Find CODEX_HOME so we can verify the config.toml was written there.
-	codexHome := ""
-	for _, kv := range plan.Env {
-		if strings.HasPrefix(kv, "CODEX_HOME=") {
-			codexHome = strings.TrimPrefix(kv, "CODEX_HOME=")
-			break
-		}
-	}
-	if codexHome == "" {
-		t.Fatal("CODEX_HOME not in plan.Env")
-	}
-	// mcp_config.go writes <codexHome>/config.toml — verify it exists
-	// and contains the rendered server.
-	bodyBytes, err := os.ReadFile(codexHome + "/config.toml")
-	if err != nil {
-		t.Fatalf("read config.toml: %v", err)
-	}
-	body := string(bodyBytes)
-	if !strings.Contains(body, `[mcp_servers."docs"]`) {
-		t.Fatalf("config.toml missing docs server: %s", body)
-	}
-	if !strings.Contains(body, `command = "docs-server"`) {
-		t.Fatalf("config.toml missing command: %s", body)
-	}
-}
-
-func TestBuildSessionPlan_MissingMCPCommandErrors(t *testing.T) {
-	_, err := BuildSessionPlan("run-1", "conv-1/agent-1/codex", map[string]any{
-		"mcp_servers": map[string]any{
-			"broken": map[string]any{
-				"args": []any{"--x"},
-				// no command
-			},
-		},
-	})
-	if err == nil {
-		t.Fatal("missing mcp command must surface as error")
-	}
-}
-
 func TestNativeInputPreservesText(t *testing.T) {
 	inputs, err := nativeInput(proto.TextInput("  hello world  "))
 	if err != nil {
@@ -250,12 +107,3 @@ func TestFirstUserInput_WhitespaceIsUnchanged(t *testing.T) {
 		t.Fatalf("input = %+v, %v", inputs, err)
 	}
 }
-
-func TestStringListOpt_FiltersEmpties(t *testing.T) {
-	got := stringListOpt(map[string]any{
-		"enable_features": []any{"a", "", "  ", "b"},
-	}, "enable_features")
-	if len(got) != 2 || got[0] != "a" || got[1] != "b" {
-		t.Fatalf("filter = %+v", got)
-	}
-}
diff --git a/apps/daemon/internal/agent/codex/permission_profile.go b/apps/daemon/internal/agent/codex/permission_profile.go
index 46911ca67..f5e7cb807 100644
--- a/apps/daemon/internal/agent/codex/permission_profile.go
+++ b/apps/daemon/internal/agent/codex/permission_profile.go
@@ -6,9 +6,9 @@ import (
 )
 
 // Runtime execution uses the current user; isolation belongs to its outer host.
-func runtimePermissionProfile(req proto.PromptRequestPayload) (string, error) {
+func validatePermissionProfile(req proto.PromptRequestPayload) error {
 	if req.LocalEnvironment != nil && (req.DisableExecutionEnvironment || req.WorkspaceReadOnly || req.LocalEnvironment.NetworkAccess != "enabled" || len(req.LocalEnvironment.AllowedDomains) != 0) {
-		return "", fmt.Errorf("codex: Runtime execution requires unrestricted host access")
+		return fmt.Errorf("codex: Runtime execution requires unrestricted host access")
 	}
-	return "", nil
+	return nil
 }
diff --git a/apps/daemon/internal/agent/codex/preparation.go b/apps/daemon/internal/agent/codex/preparation.go
index 44d750c04..663f060d2 100644
--- a/apps/daemon/internal/agent/codex/preparation.go
+++ b/apps/daemon/internal/agent/codex/preparation.go
@@ -63,7 +63,6 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	}
 	req.AgentStateKey = effectiveAgentStateKey(req)
 
-	req.AgentOptions = executionOptions(req)
 	plan, skillRoots, err := prepareSessionPlan(parent, req, cfg)
 	if err != nil {
 		return nil, err
diff --git a/apps/daemon/internal/agent/codex/preparation_helpers_test.go b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
index d56acef77..65625bcec 100644
--- a/apps/daemon/internal/agent/codex/preparation_helpers_test.go
+++ b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
@@ -43,7 +43,8 @@ func preparationFixture(t *testing.T) (proto.PromptRequestPayload, sessionConfig
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "prepared-session",
 		ReleaseOnCompletion: true, StrictResume: true,
-		AgentOptions:                map[string]any{"model": "fixture-model", "model_verbosity": "medium"},
+		AgentOptions:                map[string]any{"model": "fixture-model"},
+		ExecutionControls:           &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"},
 		DisableExecutionEnvironment: true,
 		FunctionTools:               []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object","properties":{"value":{"type":"integer"}}}`)}},
 	}
diff --git a/apps/daemon/internal/agent/codex/programmatic_tools.go b/apps/daemon/internal/agent/codex/programmatic_tools.go
index e0d377fa0..c2da9f9a1 100644
--- a/apps/daemon/internal/agent/codex/programmatic_tools.go
+++ b/apps/daemon/internal/agent/codex/programmatic_tools.go
@@ -16,7 +16,6 @@ func disableProgrammaticTools(plan *SessionPlan, controls *proto.ExecutionContro
 		return
 	}
 	for _, feature := range programmaticFeatures {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
diff --git a/apps/daemon/internal/agent/codex/programmatic_tools_test.go b/apps/daemon/internal/agent/codex/programmatic_tools_test.go
index df9064dc4..fd0aeee8a 100644
--- a/apps/daemon/internal/agent/codex/programmatic_tools_test.go
+++ b/apps/daemon/internal/agent/codex/programmatic_tools_test.go
@@ -3,7 +3,6 @@ package codex
 import (
 	"context"
 	"encoding/json"
-	"reflect"
 	"slices"
 	"testing"
 	"time"
@@ -12,16 +11,12 @@ import (
 )
 
 func TestProgrammaticToolsExplicitDisableOverridesNativeOptions(t *testing.T) {
-	plan := SessionPlan{EnableFeatures: []string{"code_mode", "unrelated", "code_mode_only", "code_mode_prewarm"}, ExtraConfig: [][2]string{{"features.code_mode", "true"}}}
-	before := slices.Clone(plan.EnableFeatures)
+	plan := SessionPlan{ExtraConfig: [][2]string{{"features.code_mode", "true"}}}
 	disableProgrammaticTools(&plan, nil)
-	if !reflect.DeepEqual(plan.EnableFeatures, before) {
+	if len(plan.DisableFeatures) != 0 || len(plan.ExtraConfig) != 1 {
 		t.Fatal("omission changed native configuration")
 	}
 	disableProgrammaticTools(&plan, &proto.ExecutionControls{DisableProgrammaticToolCalling: true})
-	if !slices.Equal(plan.EnableFeatures, []string{"unrelated"}) {
-		t.Fatal(plan.EnableFeatures)
-	}
 	for _, feature := range programmaticFeatures {
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			t.Fatal("missing disable", feature)
diff --git a/apps/daemon/internal/agent/codex/protocol.go b/apps/daemon/internal/agent/codex/protocol.go
index 2aa988740..462c10f3e 100644
--- a/apps/daemon/internal/agent/codex/protocol.go
+++ b/apps/daemon/internal/agent/codex/protocol.go
@@ -238,10 +238,7 @@ type TurnStartParams struct {
 
 type CollaborationModeKind string
 
-const (
-	CollaborationModePlan    CollaborationModeKind = "plan"
-	CollaborationModeDefault CollaborationModeKind = "default"
-)
+const CollaborationModeDefault CollaborationModeKind = "default"
 
 type CollaborationMode struct {
 	Mode     CollaborationModeKind     `json:"mode"`
diff --git a/apps/daemon/internal/agent/codex/protocol_wire_test.go b/apps/daemon/internal/agent/codex/protocol_wire_test.go
index 5a513043b..d32590d7c 100644
--- a/apps/daemon/internal/agent/codex/protocol_wire_test.go
+++ b/apps/daemon/internal/agent/codex/protocol_wire_test.go
@@ -106,13 +106,13 @@ func TestThreadStartParams_ModelProviderIsCamelCaseField(t *testing.T) {
 	}
 }
 
-func TestTurnStartParams_CollaborationModeUsesPlanWireShape(t *testing.T) {
+func TestTurnStartParams_CollaborationModeWireShape(t *testing.T) {
 	developerInstructions := "stay within the configured workspace"
 	params := TurnStartParams{
 		ThreadID: "thread-1",
 		Input:    []UserInput{{Type: UserInputText, Text: "ask me a question"}},
 		CollaborationMode: &CollaborationMode{
-			Mode: CollaborationModePlan,
+			Mode: CollaborationModeDefault,
 			Settings: CollaborationModeSettings{
 				Model:                 "MiniMax-M3",
 				DeveloperInstructions: &developerInstructions,
@@ -124,7 +124,7 @@ func TestTurnStartParams_CollaborationModeUsesPlanWireShape(t *testing.T) {
 		t.Fatalf("marshal: %v", err)
 	}
 	body := string(raw)
-	if !strings.Contains(body, `"collaborationMode":{"mode":"plan","settings":{"model":"MiniMax-M3","developer_instructions":"stay within the configured workspace"}}`) {
+	if !strings.Contains(body, `"collaborationMode":{"mode":"default","settings":{"model":"MiniMax-M3","developer_instructions":"stay within the configured workspace"}}`) {
 		t.Fatalf("collaboration mode missing or malformed: %s", body)
 	}
 	if strings.Contains(body, `"collaboration_mode"`) {
diff --git a/apps/daemon/internal/agent/codex/provider_config_test.go b/apps/daemon/internal/agent/codex/provider_config_test.go
index 345a86378..80eb8d48b 100644
--- a/apps/daemon/internal/agent/codex/provider_config_test.go
+++ b/apps/daemon/internal/agent/codex/provider_config_test.go
@@ -156,13 +156,13 @@ func TestNormaliseProviderConfig_Nil(t *testing.T) {
 }
 
 func TestBuildSessionPlan_PinsModelProviderWhenProviderSet(t *testing.T) {
-	plan, err := BuildSessionPlan("run-x", "conv-1/agent-1/codex", map[string]any{
+	plan, err := BuildSessionPlan("conv-1/agent-1/codex", map[string]any{
 		"model": "fixture-model",
 		"model_provider": map[string]any{"protocol": "responses",
 			"base_url": "https://x/v1",
 			"api_key":  "sk-x",
 		},
-	})
+	}, nil)
 	if err != nil {
 		t.Fatalf("BuildSessionPlan: %v", err)
 	}
@@ -194,7 +194,7 @@ func TestBuildSessionPlan_PinsModelProviderWhenProviderSet(t *testing.T) {
 }
 
 func TestBuildSessionPlan_NoProviderLeavesBuiltinDefault(t *testing.T) {
-	plan, err := BuildSessionPlan("run-y", "conv-1/agent-1/codex", nil)
+	plan, err := BuildSessionPlan("conv-1/agent-1/codex", nil, nil)
 	if err != nil {
 		t.Fatalf("BuildSessionPlan: %v", err)
 	}
diff --git a/apps/daemon/internal/agent/codex/session_plan.go b/apps/daemon/internal/agent/codex/session_plan.go
index 0fde0a6e0..216b6717a 100644
--- a/apps/daemon/internal/agent/codex/session_plan.go
+++ b/apps/daemon/internal/agent/codex/session_plan.go
@@ -13,15 +13,14 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 	if err := validateNativeTransportEnvironment(req); err != nil {
 		return SessionPlan{}, nil, err
 	}
-	_, err := runtimePermissionProfile(req)
-	if err != nil {
+	if err := validatePermissionProfile(req); err != nil {
 		return SessionPlan{}, nil, err
 	}
 	mcpServers, mcpEnv, err := runtimeMCPServers(req)
 	if err != nil {
 		return SessionPlan{}, nil, err
 	}
-	plan, err := BuildSessionPlan(req.RunID, req.AgentStateKey, req.AgentOptions)
+	plan, err := BuildSessionPlan(req.AgentStateKey, req.AgentOptions, req.ExecutionControls)
 	if err != nil {
 		return SessionPlan{}, nil, fmt.Errorf("codex: build session plan: %w", err)
 	}
@@ -35,7 +34,7 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 		plan.Sandbox = "danger-full-access"
 		plan.Permissions = ""
 		plan.ApprovalPolicy = AskForApproval{String: "never"}
-	} else if req.DisableExecutionEnvironment {
+	} else {
 		// environment:none has no workspace; the Session's private home is its cwd.
 		plan.Cwd = nativeHomeFromPlan(plan)
 	}
@@ -64,7 +63,7 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 		}
 	}
 
-	if stringOpt(req.AgentOptions, "model_verbosity") != "" {
+	if req.ExecutionControls != nil {
 		if err := prepareModelVerbosity(ctx, cfg.codexBinary, &plan); err != nil {
 			plan.Cleanup()
 			return SessionPlan{}, nil, err
@@ -76,23 +75,14 @@ func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg
 	}
 	var skillRoots []string
 	if req.LocalEnvironment != nil && len(req.LocalEnvironment.Skills) > 0 {
-		err = verifyHostedSkills(req.LocalEnvironment.Skills)
-		if err == nil {
-			for _, skill := range req.LocalEnvironment.Skills {
-				skillRoots = append(skillRoots, localworkspace.SkillPath(skill))
-			}
+		if err := verifyHostedSkills(req.LocalEnvironment.Skills); err != nil {
+			plan.Cleanup()
+			return SessionPlan{}, nil, err
 		}
-	} else if !req.DisableExecutionEnvironment {
-		var root string
-		root, err = prepareManagedSkills(ctx, cfg.logger, req)
-		if root != "" {
-			skillRoots = []string{root}
+		for _, skill := range req.LocalEnvironment.Skills {
+			skillRoots = append(skillRoots, localworkspace.SkillPath(skill))
 		}
 	}
-	if err != nil {
-		plan.Cleanup()
-		return SessionPlan{}, nil, err
-	}
 
 	plan.Env = append(plan.Env, mcpEnv...)
 
diff --git a/apps/daemon/internal/agent/codex/session_policy_test.go b/apps/daemon/internal/agent/codex/session_policy_test.go
index e21e793c9..86c5b3c74 100644
--- a/apps/daemon/internal/agent/codex/session_policy_test.go
+++ b/apps/daemon/internal/agent/codex/session_policy_test.go
@@ -16,7 +16,7 @@ func TestThreadRequestsApplyDeploymentPolicy(t *testing.T) {
 			for _, method := range []string{"thread/start", "thread/resume"} {
 				t.Run(method, func(t *testing.T) {
 					t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-					plan, _, err := prepareSessionPlan(context.Background(), proto.PromptRequestPayload{AgentStateKey: "conv/agent/codex", DisableSubagents: true, AgentOptions: map[string]any{"permissions": ":danger-full-access"}}, sessionConfig{})
+					plan, _, err := prepareSessionPlan(context.Background(), proto.PromptRequestPayload{AgentStateKey: "conv/agent/codex", DisableSubagents: true, DisableExecutionEnvironment: true}, sessionConfig{})
 					if err != nil {
 						t.Fatal(err)
 					}
diff --git a/apps/daemon/internal/agent/codex/session_run.go b/apps/daemon/internal/agent/codex/session_run.go
index 9051ea3c4..7517bfb98 100644
--- a/apps/daemon/internal/agent/codex/session_run.go
+++ b/apps/daemon/internal/agent/codex/session_run.go
@@ -47,23 +47,21 @@ func (s *Session) startNative(ctx context.Context, plan SessionPlan, req proto.P
 		ThreadID: s.currentThreadID(),
 		Input:    input,
 	}
-	if plan.CollaborationMode != "" {
-		model := strings.TrimSpace(s.resolvedModel)
-		if model == "" {
-			return fmt.Errorf("codex: collaboration mode requires a resolved model")
-		}
-		var developerInstructions *string
-		if plan.SystemPrompt != "" {
-			developerInstructions = &plan.SystemPrompt
-		}
-		turnParams.CollaborationMode = &CollaborationMode{
-			Mode: plan.CollaborationMode,
-			Settings: CollaborationModeSettings{
-				ReasoningEffort:       plan.ModelReasoningEffort,
-				Model:                 model,
-				DeveloperInstructions: developerInstructions,
-			},
-		}
+	model := strings.TrimSpace(s.resolvedModel)
+	if model == "" {
+		return fmt.Errorf("codex: collaboration mode requires a resolved model")
+	}
+	var developerInstructions *string
+	if plan.SystemPrompt != "" {
+		developerInstructions = &plan.SystemPrompt
+	}
+	turnParams.CollaborationMode = &CollaborationMode{
+		Mode: CollaborationModeDefault,
+		Settings: CollaborationModeSettings{
+			ReasoningEffort:       plan.ModelReasoningEffort,
+			Model:                 model,
+			DeveloperInstructions: developerInstructions,
+		},
 	}
 	turnCtx, turnCancel := context.WithTimeout(ctx, 10*time.Second)
 	_, ackErr := s.rpc.requestWithResult(turnCtx, "turn/start", turnParams, s.bindTurnResult)
diff --git a/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go b/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
index c886439de..9b2bf38f0 100644
--- a/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
+++ b/apps/daemon/internal/agent/codex/session_steering_lifecycle_test.go
@@ -84,7 +84,7 @@ func TestBlockedSteeringWriteEndsRunWithTerminalFrames(t *testing.T) {
 	defer cancel()
 	out := make(chan proto.Envelope, 8)
 	s := &Session{
-		runID: "run", rpc: client.JSONRPCClient, cancelCtx: ctx, out: out,
+		runID: "run", rpc: client.JSONRPCClient, cancelCtx: ctx, out: out, resolvedModel: "synthetic",
 		cfg: sessionConfig{logger: obslog.Bg()}, waitDone: make(chan struct{}), cleanup: func() {},
 		bufs: NewItemBuffers(), interactions: newPendingCodexInteractions(),
 	}
diff --git a/apps/daemon/internal/agent/codex/skills.go b/apps/daemon/internal/agent/codex/skills.go
index aacb6d0ca..69994f5ee 100644
--- a/apps/daemon/internal/agent/codex/skills.go
+++ b/apps/daemon/internal/agent/codex/skills.go
@@ -2,12 +2,8 @@ package codex
 
 import (
 	"context"
-	"fmt"
-	"log/slog"
 	"strings"
 
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/managedskills"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
@@ -24,25 +20,6 @@ func effectiveAgentStateKey(req proto.PromptRequestPayload) string {
 	return ""
 }
 
-func prepareManagedSkills(ctx context.Context, logger *slog.Logger, req proto.PromptRequestPayload) (string, error) {
-	rawSkills := req.AgentOptions["skills"]
-	root, err := agent.ManagedSkillsRoot("codex", req.AgentStateKey, req.ConversationID, req.RunID)
-	if err != nil {
-		return "", fmt.Errorf("codex: resolve managed skills root: %w", err)
-	}
-	result, err := managedskills.InstallManagedSkills(ctx, logger, root, rawSkills)
-	if err != nil {
-		return "", fmt.Errorf("codex: install skills: %w", err)
-	}
-	for _, warning := range result.Warnings {
-		logger.Warn("codex: skill install warning", "run_id", req.RunID, "msg", warning)
-	}
-	if len(result.SkillDirs) == 0 {
-		return "", nil
-	}
-	return root, nil
-}
-
 func setSkillExtraRoots(ctx context.Context, rpc *JSONRPCClient, roots []string) error {
 	if len(roots) == 0 {
 		return nil
diff --git a/apps/daemon/internal/agent/codex/skills_test.go b/apps/daemon/internal/agent/codex/skills_test.go
index 35d031ba5..1f90c574b 100644
--- a/apps/daemon/internal/agent/codex/skills_test.go
+++ b/apps/daemon/internal/agent/codex/skills_test.go
@@ -3,8 +3,6 @@ package codex
 import (
 	"context"
 	"encoding/json"
-	"os"
-	"path/filepath"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -43,28 +41,6 @@ func TestSetSkillExtraRootsUsesCodexRPC(t *testing.T) {
 	}
 }
 
-func TestPrepareManagedSkillsPrunesWhenPayloadOmitsSkills(t *testing.T) {
-	home := t.TempDir()
-	t.Setenv("OAC_RUNTIME_HOME", home)
-	stale := filepath.Join(home, "runtime", "codex", "state", "conv-1", "agent-1", "codex", "skills", "stale")
-	if err := os.MkdirAll(stale, 0o755); err != nil {
-		t.Fatal(err)
-	}
-
-	root, err := prepareManagedSkills(context.Background(), nil, proto.PromptRequestPayload{
-		AgentStateKey: "conv-1/agent-1/codex",
-	})
-	if err != nil {
-		t.Fatalf("prepareManagedSkills: %v", err)
-	}
-	if root != "" {
-		t.Fatalf("root = %q, want empty", root)
-	}
-	if _, err := os.Stat(stale); !os.IsNotExist(err) {
-		t.Fatalf("stale skill still exists: %v", err)
-	}
-}
-
 func TestEffectiveAgentStateKeyFallsBackToConversation(t *testing.T) {
 	got := effectiveAgentStateKey(proto.PromptRequestPayload{
 		ConversationID: "conv-legacy",
diff --git a/apps/daemon/internal/agent/codex/subagent_profile.go b/apps/daemon/internal/agent/codex/subagent_profile.go
index 6bf395c68..68afc9626 100644
--- a/apps/daemon/internal/agent/codex/subagent_profile.go
+++ b/apps/daemon/internal/agent/codex/subagent_profile.go
@@ -15,16 +15,12 @@ func configureSubagentObservations(plan *SessionPlan, req proto.PromptRequestPay
 		return nil
 	}
 	for _, feature := range []string{"hooks", "plugins", "code_mode", "code_mode_only", "code_mode_prewarm", "multi_agent_v2"} {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
 		plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features." + feature, "false"})
 	}
-	plan.DisableFeatures = slices.DeleteFunc(plan.DisableFeatures, func(value string) bool { return value == "multi_agent" })
-	if !slices.Contains(plan.EnableFeatures, "multi_agent") {
-		plan.EnableFeatures = append(plan.EnableFeatures, "multi_agent")
-	}
+	plan.EnableFeatures = append(plan.EnableFeatures, "multi_agent")
 	plan.ExtraConfig = append(plan.ExtraConfig, [2]string{"features.multi_agent", "true"}, [2]string{"agents.max_depth", "64"})
 	if req.MaxConcurrentSubagents != nil {
 		if *req.MaxConcurrentSubagents < 1 {
diff --git a/apps/daemon/internal/agent/codex/subagent_profile_test.go b/apps/daemon/internal/agent/codex/subagent_profile_test.go
index 5e9df85a0..14ee5aa5a 100644
--- a/apps/daemon/internal/agent/codex/subagent_profile_test.go
+++ b/apps/daemon/internal/agent/codex/subagent_profile_test.go
@@ -10,7 +10,7 @@ import (
 
 func TestSubagentProfileOverridesUnsafeNativeFeatures(t *testing.T) {
 	limit := 6
-	plan := SessionPlan{EnableFeatures: []string{"hooks", "code_mode", "plugins", "multi_agent_v2"}, DisableFeatures: []string{"multi_agent"}}
+	plan := SessionPlan{}
 	if err := configureSubagentObservations(&plan, proto.PromptRequestPayload{ObserveSubagentIdentities: true, MaxConcurrentSubagents: &limit}); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/codex/subagents.go b/apps/daemon/internal/agent/codex/subagents.go
index 710e12215..1c273779d 100644
--- a/apps/daemon/internal/agent/codex/subagents.go
+++ b/apps/daemon/internal/agent/codex/subagents.go
@@ -3,9 +3,8 @@ package codex
 import "slices"
 
 func disableSubagents(plan *SessionPlan) {
-	// Native v1 and v2 controls must override operator feature preferences.
+	// Disable both native Subagent feature versions.
 	for _, feature := range []string{"multi_agent", "multi_agent_v2"} {
-		plan.EnableFeatures = slices.DeleteFunc(plan.EnableFeatures, func(value string) bool { return value == feature })
 		if !slices.Contains(plan.DisableFeatures, feature) {
 			plan.DisableFeatures = append(plan.DisableFeatures, feature)
 		}
diff --git a/apps/daemon/internal/agent/codex/subagents_test.go b/apps/daemon/internal/agent/codex/subagents_test.go
index 9e725e0cf..b70d17d7c 100644
--- a/apps/daemon/internal/agent/codex/subagents_test.go
+++ b/apps/daemon/internal/agent/codex/subagents_test.go
@@ -5,14 +5,10 @@ import (
 	"testing"
 )
 
-func TestDisableSubagentsOverridesNativeFeaturePreferences(t *testing.T) {
-	plan := SessionPlan{
-		EnableFeatures:  []string{"multi_agent", "unrelated", "multi_agent_v2"},
-		DisableFeatures: []string{"another", "multi_agent"},
-	}
+func TestDisableSubagentsDisablesBothNativeFeatures(t *testing.T) {
+	plan := SessionPlan{DisableFeatures: []string{"another", "multi_agent"}}
 	disableSubagents(&plan)
-	if !reflect.DeepEqual(plan.EnableFeatures, []string{"unrelated"}) ||
-		!reflect.DeepEqual(plan.DisableFeatures, []string{"another", "multi_agent", "multi_agent_v2"}) {
-		t.Fatal(plan.EnableFeatures, plan.DisableFeatures)
+	if !reflect.DeepEqual(plan.DisableFeatures, []string{"another", "multi_agent", "multi_agent_v2"}) {
+		t.Fatal(plan.DisableFeatures)
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/verbosity_test.go b/apps/daemon/internal/agent/codex/verbosity_test.go
deleted file mode 100644
index 924cc52e3..000000000
--- a/apps/daemon/internal/agent/codex/verbosity_test.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package codex
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestVerbosityConfiguration(t *testing.T) {
-	for _, mode := range []string{"", "low", "medium", "high"} {
-		t.Run(mode, func(t *testing.T) {
-			t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-			opts := map[string]any{}
-			var want [][2]string
-			if mode != "" {
-				opts["model_verbosity"] = mode
-				want = [][2]string{{"model_verbosity", `"` + mode + `"`}}
-			}
-			plan, err := BuildSessionPlan("run", "state", opts)
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer plan.Cleanup()
-			if !reflect.DeepEqual(plan.ExtraConfig, want) {
-				t.Fatalf("config = %v, want %v", plan.ExtraConfig, want)
-			}
-		})
-	}
-	for _, value := range []any{nil, "", "enabled", true, 1, map[string]any{}, []any{}} {
-		if _, err := BuildSessionPlan("run", "state", map[string]any{"model_verbosity": value}); err == nil {
-			t.Fatalf("accepted invalid model_verbosity %T", value)
-		}
-	}
-}
diff --git a/apps/daemon/internal/agent/codex/web_search_test.go b/apps/daemon/internal/agent/codex/web_search_test.go
deleted file mode 100644
index 43fc00de9..000000000
--- a/apps/daemon/internal/agent/codex/web_search_test.go
+++ /dev/null
@@ -1,33 +0,0 @@
-package codex
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestWebSearchConfiguration(t *testing.T) {
-	for _, mode := range []string{"", "disabled", "cached", "live"} {
-		t.Run(mode, func(t *testing.T) {
-			t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-			opts := map[string]any{}
-			var want [][2]string
-			if mode != "" {
-				opts["web_search"] = mode
-				want = [][2]string{{"web_search", `"` + mode + `"`}}
-			}
-			plan, err := BuildSessionPlan("run", "state", opts)
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer plan.Cleanup()
-			if !reflect.DeepEqual(plan.ExtraConfig, want) {
-				t.Fatalf("config = %v, want %v", plan.ExtraConfig, want)
-			}
-		})
-	}
-	for _, value := range []any{nil, "", "enabled", true, 1, map[string]any{}, []any{}} {
-		if _, err := BuildSessionPlan("run", "state", map[string]any{"web_search": value}); err == nil {
-			t.Fatalf("accepted invalid web_search %T", value)
-		}
-	}
-}
diff --git a/apps/daemon/internal/agent/harness.go b/apps/daemon/internal/agent/harness.go
index 7d0f715dd..5ca1f91e6 100644
--- a/apps/daemon/internal/agent/harness.go
+++ b/apps/daemon/internal/agent/harness.go
@@ -50,17 +50,12 @@ type DiscoveryOptions struct {
 }
 
 // Runtime binds one discovered descriptor to its native factories.
-// SessionCapabilityContext and ExecutorCapabilityContext request the Runtime's
-// capability-download URL and scoped product-upload context for those factories.
-// Preparation never receives those execution-only effects.
 type Runtime struct {
-	Info                      proto.SupportedAgentKind
-	Session                   Factory
-	Preparation               PreparationFactory
-	Executor                  ExecutorFactory
-	WorkspaceReadPreparation  bool
-	SessionCapabilityContext  bool
-	ExecutorCapabilityContext bool
+	Info                     proto.SupportedAgentKind
+	Session                  Factory
+	Preparation              PreparationFactory
+	Executor                 ExecutorFactory
+	WorkspaceReadPreparation bool
 }
 
 // Register installs a discovered Runtime with its declaration's configuration.
@@ -297,7 +292,7 @@ func (r *Registry) RegisterExecutor(kind string, factory ExecutorFactory) {
 }
 
 // RegisterPreparation installs a separate execution-only path. Product factory
-// wrappers must not add authoring or capability-download side effects to it.
+// wrappers must not add authoring side effects to it.
 func (r *Registry) RegisterPreparation(kind string, workspaceRead bool, prepare PreparationFactory) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
diff --git a/apps/daemon/internal/agent/managedskills/archive.go b/apps/daemon/internal/agent/managedskills/archive.go
deleted file mode 100644
index 363f8b0da..000000000
--- a/apps/daemon/internal/agent/managedskills/archive.go
+++ /dev/null
@@ -1,289 +0,0 @@
-package managedskills
-
-import (
-	"archive/zip"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-)
-
-// pluginInstallTimeout caps a single plugin's download + extract step.
-const pluginInstallTimeout = 60 * time.Second
-
-// maxPluginZipBytes mirrors the server-side cap in
-// server/internal/capability/parser/plugin_validator.go. Defense in
-// depth.
-const maxPluginZipBytes int64 = 32 * 1024 * 1024
-
-// pluginsHTTPClient timeout is larger than pluginInstallTimeout so the
-// per-call context cancel dominates.
-var pluginsHTTPClient = &http.Client{
-	Timeout: pluginInstallTimeout + 10*time.Second,
-}
-
-// fetchPluginZip GETs url into dst, capping the body at
-// maxPluginZipBytes. Returns an OPEN file descriptor positioned at
-// offset 0; the caller closes it. Holding the FD across verify +
-// extract closes the TOCTOU between hashing the on-disk bytes and
-// reading them for extract — even if someone swaps the file, the open
-// FD points at the original inode.
-//
-// Only http/https are accepted to defend against a future
-// canonical_spec letting attacker-supplied download_url reach this
-// code with file:// or http://internal-ip/... values.
-func fetchPluginZip(ctx context.Context, downloadURL, dst string) (*os.File, error) {
-	parsed, err := url.Parse(downloadURL)
-	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") {
-		// Don't include downloadURL — it carries the signature query
-		// string.
-		return nil, errors.New("download_url must be http(s)")
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
-	if err != nil {
-		return nil, errors.New("build request failed")
-	}
-	resp, err := pluginsHTTPClient.Do(req)
-	if err != nil {
-		// Strip embedded URL via sanitizeHTTPClientError —
-		// OSSAccessKeyId + Signature would otherwise leak into the
-		// daemon log.
-		return nil, fmt.Errorf("get failed: %s", sanitizeHTTPClientError(err))
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode/100 != 2 {
-		_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4*1024))
-		return nil, fmt.Errorf("get: status %d", resp.StatusCode)
-	}
-
-	// O_EXCL — the per-call uuid in the path makes a collision a
-	// programmer error, not an attacker condition. Failing fast is
-	// safer than silent truncation.
-	f, err := os.OpenFile(dst, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0o600)
-	if err != nil {
-		return nil, fmt.Errorf("open dst: %w", err)
-	}
-
-	limited := io.LimitReader(resp.Body, maxPluginZipBytes+1)
-	written, err := io.Copy(f, limited)
-	if err != nil {
-		_ = f.Close()
-		return nil, fmt.Errorf("copy body: %w", err)
-	}
-	if written > maxPluginZipBytes {
-		_ = f.Close()
-		return nil, fmt.Errorf("zip exceeds %d byte cap", maxPluginZipBytes)
-	}
-	if _, err := f.Seek(0, io.SeekStart); err != nil {
-		_ = f.Close()
-		return nil, fmt.Errorf("seek after write: %w", err)
-	}
-	return f, nil
-}
-
-// sanitizeHTTPClientError strips the URL embedded by *url.Error.
-// net/http returns errors that include the full request URL — for
-// presigned OSS URLs that's OSSAccessKeyId + Signature + Expires.
-// Without redaction those credentials land in the daemon log via
-// PluginInstallResult.Warnings → session.go logger.Warn.
-//
-// Format is `<method> "<url>": <inner>` — keep the method + inner
-// message, drop the URL.
-func sanitizeHTTPClientError(err error) string {
-	if err == nil {
-		return ""
-	}
-	msg := err.Error()
-	open := strings.Index(msg, `"`)
-	if open < 0 {
-		return msg
-	}
-	close := strings.Index(msg[open+1:], `"`)
-	if close < 0 {
-		return msg
-	}
-	closeAbs := open + 1 + close
-	if closeAbs+2 > len(msg) {
-		return msg
-	}
-	return msg[:open] + "<redacted-url>" + msg[closeAbs+1:]
-}
-
-// verifyPluginSHA256FromFD hashes the bytes the open FD points at and
-// compares against want (lowercase hex). Rewinds the FD afterwards.
-func verifyPluginSHA256FromFD(fd *os.File, want string) error {
-	want = strings.ToLower(strings.TrimSpace(want))
-	if want == "" {
-		return errors.New("verify: empty expected sha256")
-	}
-	if _, err := fd.Seek(0, io.SeekStart); err != nil {
-		return fmt.Errorf("verify: seek: %w", err)
-	}
-	h := sha256.New()
-	if _, err := io.Copy(h, fd); err != nil {
-		return fmt.Errorf("verify: hash: %w", err)
-	}
-	got := hex.EncodeToString(h.Sum(nil))
-	if got != want {
-		return fmt.Errorf("verify: sha256 mismatch (want=%s got=%s)", want, got)
-	}
-	return nil
-}
-
-// extractPluginZipFromFD reads via io.NewSectionReader rather than
-// re-opening the path so the byte stream stays identical to the
-// verified one (TOCTOU defense).
-func extractPluginZipFromFD(fd *os.File, size int64, dst string) error {
-	zr, err := zip.NewReader(io.NewSectionReader(fd, 0, size), size)
-	if err != nil {
-		return fmt.Errorf("extract: open zip: %w", err)
-	}
-
-	root := detectSingleZipRoot(zr.File)
-	absDst, err := filepath.Abs(dst)
-	if err != nil {
-		return fmt.Errorf("extract: abs dst: %w", err)
-	}
-
-	for _, f := range zr.File {
-		name := normaliseZipPath(f.Name)
-		if name == "" || strings.HasPrefix(name, "__MACOSX/") || name == "__MACOSX" {
-			continue
-		}
-		// Skip non-regular zip entries (symlinks, devices, named
-		// pipes). Symlink entries flagged with Unix lrwxrwxrwx mode
-		// bits would otherwise be written as plain files containing
-		// the link target string — an exfil vector.
-		mode := f.Mode()
-		if !f.FileInfo().IsDir() && !mode.IsRegular() {
-			continue
-		}
-		if root != "" {
-			if !strings.HasPrefix(name, root) {
-				continue
-			}
-			name = strings.TrimPrefix(name, root)
-			if name == "" {
-				continue
-			}
-		}
-
-		target := filepath.Join(absDst, name)
-		rel, err := filepath.Rel(absDst, target)
-		if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
-			return fmt.Errorf("extract: entry %q escapes target", f.Name)
-		}
-
-		if f.FileInfo().IsDir() {
-			if err := os.MkdirAll(target, 0o755); err != nil {
-				return fmt.Errorf("extract: mkdir %s: %w", target, err)
-			}
-			continue
-		}
-		if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
-			return fmt.Errorf("extract: mkdir parent of %s: %w", target, err)
-		}
-		if err := writeZipEntry(f, target); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// writeZipEntry streams one zip entry into target preserving the
-// entry's mode bits (executables stay executable — hook scripts need
-// this). 0644 default when no mode is set.
-func writeZipEntry(f *zip.File, target string) error {
-	rc, err := f.Open()
-	if err != nil {
-		return fmt.Errorf("extract: open entry %s: %w", f.Name, err)
-	}
-	defer rc.Close()
-
-	mode := f.Mode().Perm()
-	if mode == 0 {
-		mode = 0o644
-	}
-	out, err := os.OpenFile(target, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, mode)
-	if err != nil {
-		return fmt.Errorf("extract: open target %s: %w", target, err)
-	}
-	defer out.Close()
-	if _, err := io.Copy(out, rc); err != nil {
-		return fmt.Errorf("extract: copy %s: %w", target, err)
-	}
-	return nil
-}
-
-// detectSingleZipRoot returns the common root directory (with trailing
-// slash) shared by every non-MACOSX entry, or "" when there is none.
-// Hidden directories (".*") are NOT treated as wrappers because
-// `.claude-plugin/` is a legitimate plugin component.
-//
-// `normaliseZipPath` strips trailing slashes, so a bare directory
-// entry like `my-plugin/` arrives as `my-plugin` —
-// indistinguishable from a top-level file. Skipping entries without an
-// internal "/" lets us pick a real file path and infer the wrapper.
-// Without this, `zip -r foo foo/` would short-circuit on the leading
-// `foo/` directory entry and leave the manifest nested.
-// (Mirrors server-side plugin_validator.detectSingleRoot — the two
-// must agree.)
-func detectSingleZipRoot(files []*zip.File) string {
-	var first string
-	for _, f := range files {
-		name := normaliseZipPath(f.Name)
-		if name == "" || strings.HasPrefix(name, "__MACOSX/") || name == "__MACOSX" {
-			continue
-		}
-		if !strings.Contains(name, "/") {
-			continue
-		}
-		first = name
-		break
-	}
-	if first == "" {
-		return ""
-	}
-	idx := strings.Index(first, "/")
-	if idx <= 0 {
-		return ""
-	}
-	root := first[:idx+1]
-	if strings.HasPrefix(root, ".") {
-		return ""
-	}
-	for _, f := range files {
-		name := normaliseZipPath(f.Name)
-		if name == "" || strings.HasPrefix(name, "__MACOSX/") || name == "__MACOSX" {
-			continue
-		}
-		// Bare directory entries (e.g. `my-plugin`) arrive without a
-		// trailing slash. If the entry equals the root with the slash
-		// trimmed, it's the wrapping dir itself.
-		if name+"/" == root {
-			continue
-		}
-		if !strings.HasPrefix(name, root) {
-			return ""
-		}
-	}
-	return root
-}
-
-// normaliseZipPath converts back-slashes to forward slashes (some
-// Windows zip writers emit `\`) and strips trailing slashes that
-// directory entries may carry.
-func normaliseZipPath(name string) string {
-	p := strings.ReplaceAll(name, "\\", "/")
-	return strings.TrimSuffix(p, "/")
-}
-
-func stringField(m map[string]any, key string) string { s, _ := m[key].(string); return s }
diff --git a/apps/daemon/internal/agent/managedskills/archive_test.go b/apps/daemon/internal/agent/managedskills/archive_test.go
deleted file mode 100644
index af5c30a55..000000000
--- a/apps/daemon/internal/agent/managedskills/archive_test.go
+++ /dev/null
@@ -1,486 +0,0 @@
-package managedskills
-
-import (
-	"archive/zip"
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// pluginZipFile mirrors the server-side validator test helper.
-type pluginZipFile struct {
-	Name string
-	Body string
-	Mode os.FileMode // 0 → default
-}
-
-func buildPluginZipBytes(t *testing.T, files []pluginZipFile) []byte {
-	t.Helper()
-	var buf bytes.Buffer
-	zw := zip.NewWriter(&buf)
-	for _, f := range files {
-		hdr := &zip.FileHeader{Name: f.Name, Method: zip.Deflate}
-		if f.Mode != 0 {
-			hdr.SetMode(f.Mode)
-		}
-		w, err := zw.CreateHeader(hdr)
-		if err != nil {
-			t.Fatalf("zip header %q: %v", f.Name, err)
-		}
-		if _, err := w.Write([]byte(f.Body)); err != nil {
-			t.Fatalf("zip write %q: %v", f.Name, err)
-		}
-	}
-	if err := zw.Close(); err != nil {
-		t.Fatalf("zip close: %v", err)
-	}
-	return buf.Bytes()
-}
-
-// validPluginZipBytes is the baseline fixture every install test uses
-// unless it explicitly mutates the entry set.
-func validPluginZipBytes(t *testing.T) []byte {
-	return buildPluginZipBytes(t, []pluginZipFile{
-		{Name: ".claude-plugin/plugin.json", Body: `{"name":"my-plugin","version":"1.0.0"}`},
-		{Name: "commands/hello.md", Body: "---\nname: hello\n---\nbody"},
-	})
-}
-
-func sha256Hex(body []byte) string {
-	h := sha256.Sum256(body)
-	return hex.EncodeToString(h[:])
-}
-
-// pluginServer is a deterministic stand-in for the OSS presigned GET
-// endpoint. It counts hits so cache-hit tests can verify the second
-// install call did NOT round-trip.
-type pluginServer struct {
-	*httptest.Server
-	hits *int
-	body []byte
-	stat int
-}
-
-func startPluginServer(t *testing.T, body []byte) *pluginServer {
-	t.Helper()
-	var hits int
-	ps := &pluginServer{hits: &hits, body: body, stat: http.StatusOK}
-	ps.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		hits++
-		w.WriteHeader(ps.stat)
-		_, _ = w.Write(ps.body)
-	}))
-	t.Cleanup(ps.Close)
-	return ps
-}
-
-func (s *pluginServer) Hits() int { return *s.hits }
-
-func discardLogger() *slog.Logger {
-	return slog.New(slog.NewTextHandler(io.Discard, nil))
-}
-
-func TestInstallPlugins_HappyPath_ExtractsAndStampsCacheKey(t *testing.T) {
-	t.Parallel()
-	body := validPluginZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "my-plugin", Version: "1.0.0", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	})
-	if err != nil {
-		t.Fatalf("installPlugins: %v", err)
-	}
-	if len(res.SkillDirs) != 1 {
-		t.Fatalf("SkillDirs = %v, want 1 entry", res.SkillDirs)
-	}
-	if len(res.Warnings) != 0 {
-		t.Fatalf("unexpected warnings: %v", res.Warnings)
-	}
-
-	dir := res.SkillDirs[0]
-	if filepath.Base(dir) != "my-plugin" {
-		t.Fatalf("dir basename = %q, want my-plugin", filepath.Base(dir))
-	}
-	if _, err := os.Stat(filepath.Join(dir, ".claude-plugin", "plugin.json")); err != nil {
-		t.Fatalf("manifest missing: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "commands", "hello.md")); err != nil {
-		t.Fatalf("commands entry missing: %v", err)
-	}
-	stamped, err := os.ReadFile(filepath.Join(dir, ".cache-key"))
-	if err != nil {
-		t.Fatalf("read cache-key: %v", err)
-	}
-	want := "my-plugin@" + sha256Hex(body)
-	if string(stamped) != want {
-		t.Fatalf("cache-key = %q, want %q", stamped, want)
-	}
-}
-
-func TestInstallPlugins_CacheHitSkipsDownload(t *testing.T) {
-	t.Parallel()
-	body := validPluginZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	desc := []skillDescriptor{
-		{Name: "my-plugin", Version: "1.0.0", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	}
-	if _, err := installSkillsForTest(context.Background(), discardLogger(), workDir, desc); err != nil {
-		t.Fatalf("first install: %v", err)
-	}
-	hitsAfterFirst := srv.Hits()
-	if hitsAfterFirst != 1 {
-		t.Fatalf("first install hits = %d, want 1", hitsAfterFirst)
-	}
-
-	// Second install with the same descriptor — cache-key match
-	// short-circuits BEFORE any HTTP call.
-	if _, err := installSkillsForTest(context.Background(), discardLogger(), workDir, desc); err != nil {
-		t.Fatalf("second install: %v", err)
-	}
-	if got := srv.Hits(); got != hitsAfterFirst {
-		t.Fatalf("second install made %d additional hits; cache should have prevented network", got-hitsAfterFirst)
-	}
-}
-
-func TestInstallPlugins_CacheInvalidatedBySHA256Change(t *testing.T) {
-	t.Parallel()
-	body := validPluginZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-	logger := discardLogger()
-
-	first := []skillDescriptor{
-		{Name: "my-plugin", Version: "1.0.0", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	}
-	if _, err := installSkillsForTest(context.Background(), logger, workDir, first); err != nil {
-		t.Fatalf("first install: %v", err)
-	}
-
-	// Swap the server payload + sha. Cache key contains the sha so it
-	// must be invalidated.
-	newBody := buildPluginZipBytes(t, []pluginZipFile{
-		{Name: ".claude-plugin/plugin.json", Body: `{"name":"my-plugin","version":"1.0.0"}`},
-		{Name: "commands/different.md", Body: "---\nname: different\n---\nbody"},
-	})
-	srv.body = newBody
-
-	second := []skillDescriptor{
-		{Name: "my-plugin", Version: "1.0.0", DownloadURL: srv.URL, SHA256: sha256Hex(newBody)},
-	}
-	if _, err := installSkillsForTest(context.Background(), logger, workDir, second); err != nil {
-		t.Fatalf("second install: %v", err)
-	}
-	dir := filepath.Join(workDir, "my-plugin")
-	if _, err := os.Stat(filepath.Join(dir, "commands", "different.md")); err != nil {
-		t.Fatalf("new content not extracted: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "commands", "hello.md")); err == nil {
-		t.Fatal("old content survived the re-install")
-	}
-}
-
-func TestInstallPlugins_SHA256MismatchDemotesToWarning(t *testing.T) {
-	t.Parallel()
-	body := validPluginZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	// Wrong sha → no install, no hard error; rest of the prompt
-	// continues without this plugin.
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "my-plugin", Version: "1.0.0", DownloadURL: srv.URL, SHA256: strings.Repeat("0", 64)},
-	})
-	if err != nil {
-		t.Fatalf("installPlugins: %v", err)
-	}
-	if len(res.SkillDirs) != 0 {
-		t.Fatalf("SkillDirs = %v, want empty after sha mismatch", res.SkillDirs)
-	}
-	if len(res.Warnings) == 0 {
-		t.Fatal("expected warning on sha mismatch")
-	}
-	if !strings.Contains(res.Warnings[0], "sha256 mismatch") {
-		t.Fatalf("warning text = %q, want sha256-mismatch hint", res.Warnings[0])
-	}
-	// No .cache-key file must be stamped — would short-circuit future
-	// retries with the same bad sha.
-	if _, err := os.Stat(filepath.Join(workDir, "my-plugin", ".cache-key")); err == nil {
-		t.Fatal("cache-key stamped despite sha mismatch")
-	}
-}
-
-func TestInstallPlugins_HTTPErrorDemotesToWarning(t *testing.T) {
-	t.Parallel()
-	workDir := t.TempDir()
-	srv := startPluginServer(t, nil)
-	srv.stat = http.StatusForbidden
-
-	res, _ := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "p", Version: "1", DownloadURL: srv.URL, SHA256: strings.Repeat("a", 64)},
-	})
-	if len(res.SkillDirs) != 0 {
-		t.Fatal("expected no installed dirs on 403")
-	}
-	if len(res.Warnings) == 0 {
-		t.Fatal("expected warning on 403")
-	}
-}
-
-func TestInstallPlugins_StripWrappingRoot(t *testing.T) {
-	t.Parallel()
-	body := buildPluginZipBytes(t, []pluginZipFile{
-		{Name: "wrapper-dir/.claude-plugin/plugin.json", Body: `{"name":"x","version":"1"}`},
-		{Name: "wrapper-dir/commands/hi.md", Body: "---\nname: hi\n---"},
-	})
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "x", Version: "1", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	})
-	if err != nil {
-		t.Fatalf("install: %v", err)
-	}
-	if len(res.SkillDirs) != 1 {
-		t.Fatalf("SkillDirs = %v", res.SkillDirs)
-	}
-	dir := res.SkillDirs[0]
-	if _, err := os.Stat(filepath.Join(dir, ".claude-plugin", "plugin.json")); err != nil {
-		t.Fatalf("manifest at expected path missing (wrapper not stripped?): %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "wrapper-dir")); err == nil {
-		t.Fatal("wrapper-dir survived the strip")
-	}
-}
-
-// TestInstallPlugins_StripWrappingRootWithBareDirEntry locks in the
-// production fix: real `zip -r my-plugin.zip my-plugin/` archives emit
-// a bare directory entry first; naive root-inference sees no internal
-// "/" and concludes "no wrapper to strip". The fix skips directory-
-// only entries when picking the first candidate.
-func TestInstallPlugins_StripWrappingRootWithBareDirEntry(t *testing.T) {
-	t.Parallel()
-	body := buildPluginZipBytes(t, []pluginZipFile{
-		// Bare directory entry — the gotcha.
-		{Name: "wrapper-dir/", Body: ""},
-		{Name: "wrapper-dir/.claude-plugin/plugin.json", Body: `{"name":"x","version":"1"}`},
-		{Name: "wrapper-dir/commands/hi.md", Body: "---\nname: hi\n---"},
-	})
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "x", Version: "1", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	})
-	if err != nil {
-		t.Fatalf("install: %v", err)
-	}
-	if len(res.SkillDirs) != 1 {
-		t.Fatalf("SkillDirs = %v", res.SkillDirs)
-	}
-	dir := res.SkillDirs[0]
-	if _, err := os.Stat(filepath.Join(dir, ".claude-plugin", "plugin.json")); err != nil {
-		t.Fatalf("manifest at expected path missing (bare dir entry confused wrapper detection?): %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "wrapper-dir")); err == nil {
-		t.Fatal("wrapper-dir survived the strip")
-	}
-}
-
-func TestInstallPlugins_MacOSXMetadataIgnored(t *testing.T) {
-	t.Parallel()
-	body := buildPluginZipBytes(t, []pluginZipFile{
-		{Name: "__MACOSX/._plugin.json", Body: "binary metadata"},
-		{Name: ".claude-plugin/plugin.json", Body: `{"name":"x","version":"1"}`},
-	})
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "x", Version: "1", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	})
-	if err != nil {
-		t.Fatalf("install: %v", err)
-	}
-	dir := res.SkillDirs[0]
-	if _, err := os.Stat(filepath.Join(dir, "__MACOSX")); err == nil {
-		t.Fatal("__MACOSX dir was extracted despite filter")
-	}
-	if _, err := os.Stat(filepath.Join(dir, ".claude-plugin", "plugin.json")); err != nil {
-		t.Fatalf("manifest missing: %v", err)
-	}
-}
-
-func TestInstallPlugins_PathTraversalRejected(t *testing.T) {
-	t.Parallel()
-	// "../../etc/passwd" entry must not write outside the target dir.
-	body := buildPluginZipBytes(t, []pluginZipFile{
-		{Name: ".claude-plugin/plugin.json", Body: `{"name":"x","version":"1"}`},
-		{Name: "../../escape", Body: "should never land outside dir"},
-	})
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	res, _ := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "x", Version: "1", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	})
-	if len(res.SkillDirs) != 0 {
-		t.Fatalf("SkillDirs = %v, want empty on path-traversal", res.SkillDirs)
-	}
-	if len(res.Warnings) == 0 {
-		t.Fatal("expected warning on path-traversal")
-	}
-	if !strings.Contains(res.Warnings[0], "escapes") {
-		t.Fatalf("warning text = %q, want escape hint", res.Warnings[0])
-	}
-}
-
-func TestInstallPlugins_SymlinkEntrySkipped(t *testing.T) {
-	t.Parallel()
-	// archive/zip's SetMode() drops file-type bits, so to test a real
-	// symlink entry we set ExternalAttrs by hand — upper 16 bits are
-	// the Unix mode (S_IFLNK | perm), which is how attacker-crafted
-	// zips actually mark symlinks.
-	var buf bytes.Buffer
-	zw := zip.NewWriter(&buf)
-	{
-		hdr := &zip.FileHeader{Name: ".claude-plugin/plugin.json", Method: zip.Deflate}
-		w, err := zw.CreateHeader(hdr)
-		if err != nil {
-			t.Fatalf("create manifest: %v", err)
-		}
-		if _, err := w.Write([]byte(`{"name":"x","version":"1"}`)); err != nil {
-			t.Fatalf("write manifest: %v", err)
-		}
-	}
-	{
-		hdr := &zip.FileHeader{Name: "commands/evil.md", Method: zip.Deflate}
-		// 0xA1ED = S_IFLNK (0xA000) | 0755. External attrs are
-		// (unix_mode << 16) per the zip spec.
-		hdr.ExternalAttrs = 0xA1ED << 16
-		hdr.CreatorVersion = 3 << 8 // UNIX host system
-		w, err := zw.CreateHeader(hdr)
-		if err != nil {
-			t.Fatalf("create symlink: %v", err)
-		}
-		if _, err := w.Write([]byte("/etc/passwd")); err != nil {
-			t.Fatalf("write symlink target: %v", err)
-		}
-	}
-	if err := zw.Close(); err != nil {
-		t.Fatalf("zip close: %v", err)
-	}
-	body := buf.Bytes()
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "x", Version: "1", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	})
-	if err != nil {
-		t.Fatalf("install: %v", err)
-	}
-	if len(res.SkillDirs) != 1 {
-		t.Fatalf("SkillDirs = %v, want 1", res.SkillDirs)
-	}
-	dir := res.SkillDirs[0]
-	if _, err := os.Stat(filepath.Join(dir, ".claude-plugin", "plugin.json")); err != nil {
-		t.Fatalf("manifest missing: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "commands", "evil.md")); err == nil {
-		t.Fatal("symlink entry was extracted as a regular file; symlinks must be skipped")
-	}
-}
-
-func TestInstallPlugins_ConcurrentSamePluginNoTruncation(t *testing.T) {
-	t.Parallel()
-	// Per-call uuid in the temp filename makes each install's temp
-	// file independent; concurrent installs of the same (name,
-	// version) must both succeed.
-	body := validPluginZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	done := make(chan error, 2)
-	for i := 0; i < 2; i++ {
-		go func() {
-			res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-				{Name: "my-plugin", Version: "1.0.0", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-			})
-			if err != nil {
-				done <- err
-				return
-			}
-			if len(res.SkillDirs) != 1 {
-				done <- fmt.Errorf("SkillDirs = %v", res.SkillDirs)
-				return
-			}
-			done <- nil
-		}()
-	}
-	for i := 0; i < 2; i++ {
-		if err := <-done; err != nil {
-			t.Fatalf("concurrent install failed: %v", err)
-		}
-	}
-}
-
-func TestInstallPlugins_PartialInstall(t *testing.T) {
-	t.Parallel()
-	// Good descriptor installs; bad-sha descriptor demotes to warning.
-	bodyOK := buildPluginZipBytes(t, []pluginZipFile{
-		{Name: ".claude-plugin/plugin.json", Body: `{"name":"good","version":"1"}`},
-	})
-	srvOK := startPluginServer(t, bodyOK)
-	srvBAD := startPluginServer(t, bodyOK)
-	workDir := t.TempDir()
-
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "good", Version: "1", DownloadURL: srvOK.URL, SHA256: sha256Hex(bodyOK)},
-		{Name: "bad", Version: "1", DownloadURL: srvBAD.URL, SHA256: strings.Repeat("0", 64)},
-	})
-	if err != nil {
-		t.Fatalf("install: %v", err)
-	}
-	if len(res.SkillDirs) != 1 {
-		t.Fatalf("SkillDirs = %v, want 1 (only the good one)", res.SkillDirs)
-	}
-	if !strings.HasSuffix(res.SkillDirs[0], "/good") {
-		t.Fatalf("SkillDirs[0] = %q, want trailing /good", res.SkillDirs[0])
-	}
-	if len(res.Warnings) == 0 {
-		t.Fatal("expected warning for the bad plugin")
-	}
-}
-
-func TestInstallPlugins_EmptyListIsNoop(t *testing.T) {
-	t.Parallel()
-	res, err := installSkillsForTest(context.Background(), discardLogger(), t.TempDir(), nil)
-	if err != nil {
-		t.Fatalf("install: %v", err)
-	}
-	if len(res.SkillDirs) != 0 || len(res.Warnings) != 0 {
-		t.Fatalf("expected empty result; got %+v", res)
-	}
-}
-
-func installSkillsForTest(ctx context.Context, logger *slog.Logger, root string, descriptors []skillDescriptor) (SkillInstallResult, error) {
-	raw := make([]any, 0, len(descriptors))
-	for _, d := range descriptors {
-		raw = append(raw, map[string]any{"name": d.Name, "version": d.Version, "download_url": d.DownloadURL, "sha256": d.SHA256})
-	}
-	return InstallManagedSkills(ctx, logger, root, raw)
-}
diff --git a/apps/daemon/internal/agent/managedskills/concurrency_test.go b/apps/daemon/internal/agent/managedskills/concurrency_test.go
deleted file mode 100644
index dd2f40255..000000000
--- a/apps/daemon/internal/agent/managedskills/concurrency_test.go
+++ /dev/null
@@ -1,144 +0,0 @@
-package managedskills
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-func installConcurrentFixture(ctx context.Context, kind, root, url string, body []byte) error {
-	result, err := InstallManagedSkills(ctx, discardLogger(), root, []any{map[string]any{"name": "fixture", "version": "1.0.0", "download_url": url, "sha256": sha256Hex(body)}})
-	dirs, warnings := result.SkillDirs, result.Warnings
-
-	if err != nil {
-		return err
-	}
-	if len(dirs) != 1 || len(warnings) != 0 {
-		return fmt.Errorf("dirs=%v warnings=%v", dirs, warnings)
-	}
-	content, err := os.ReadFile(filepath.Join(dirs[0], "SKILL.md"))
-	if err != nil {
-		return err
-	}
-	if string(content) != "Complete fixture contents.\n" {
-		return fmt.Errorf("incomplete file: %q", content)
-	}
-	return nil
-}
-
-func TestInstallsConcurrentSameRoot(t *testing.T) {
-	for _, kind := range []string{"managed"} {
-		t.Run(kind, func(t *testing.T) {
-			body := buildPluginZipBytes(t, []pluginZipFile{{Name: "SKILL.md", Body: "Complete fixture contents.\n"}})
-			var calls atomic.Int32
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				calls.Add(1)
-				_, _ = w.Write(body)
-			}))
-			defer srv.Close()
-			parent := t.TempDir()
-			alias := filepath.Join(t.TempDir(), "alias")
-			if err := os.Symlink(parent, alias); err != nil {
-				t.Fatal(err)
-			}
-			results := make(chan error, 8)
-			for i := range 8 {
-				root := filepath.Join(parent, "new", "root")
-				if i%2 == 1 {
-					root = filepath.Join(alias, "new", "root")
-				}
-				go func() { results <- installConcurrentFixture(context.Background(), kind, root, srv.URL, body) }()
-			}
-			for range 8 {
-				if err := <-results; err != nil {
-					t.Error(err)
-				}
-			}
-			if calls.Load() != 1 {
-				t.Errorf("downloads=%d, want one installation shared through the cache", calls.Load())
-			}
-		})
-	}
-}
-
-func TestInstallWaitCancellation(t *testing.T) {
-	for _, kind := range []string{"managed"} {
-		t.Run(kind, func(t *testing.T) {
-			body := buildPluginZipBytes(t, []pluginZipFile{{Name: "SKILL.md", Body: "Complete fixture contents.\n"}})
-			started, release := make(chan struct{}, 2), make(chan struct{})
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				started <- struct{}{}
-				select {
-				case <-release:
-					_, _ = w.Write(body)
-				case <-r.Context().Done():
-				}
-			}))
-			defer srv.Close()
-			ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-			defer cancel()
-			root := t.TempDir()
-			first := make(chan error, 1)
-			go func() { first <- installConcurrentFixture(ctx, kind, root, srv.URL, body) }()
-			select {
-			case <-started:
-			case <-ctx.Done():
-				t.Fatal("first download did not start")
-			}
-			waiting, cancelWait := context.WithCancel(ctx)
-			cancelWait()
-			if err := installConcurrentFixture(waiting, kind, root, srv.URL, body); err != context.Canceled {
-				t.Errorf("waiting install error=%v, want cancellation", err)
-			}
-			close(release)
-			if err := <-first; err != nil {
-				t.Fatal(err)
-			}
-			if err := installConcurrentFixture(ctx, kind, root, srv.URL, body); err != nil {
-				t.Fatalf("cancelled waiter damaged installation: %v", err)
-			}
-			if len(started) != 0 {
-				t.Fatal("cancelled waiter started another download")
-			}
-		})
-	}
-}
-
-func TestInstallsIndependentRootsRemainConcurrent(t *testing.T) {
-	body := buildPluginZipBytes(t, []pluginZipFile{{Name: "SKILL.md", Body: "Complete fixture contents.\n"}})
-	started, release := make(chan struct{}, 2), make(chan struct{})
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		started <- struct{}{}
-		select {
-		case <-release:
-			_, _ = w.Write(body)
-		case <-r.Context().Done():
-		}
-	}))
-	defer srv.Close()
-	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-	defer cancel()
-	results := make(chan error, 2)
-	for _, root := range []string{t.TempDir(), t.TempDir()} {
-		go func() { results <- installConcurrentFixture(ctx, "managed", root, srv.URL, body) }()
-	}
-	for range 2 {
-		select {
-		case <-started:
-		case <-ctx.Done():
-			t.Fatal("independent roots were serialized")
-		}
-	}
-	close(release)
-	for range 2 {
-		if err := <-results; err != nil {
-			t.Error(err)
-		}
-	}
-}
diff --git a/apps/daemon/internal/agent/managedskills/skills.go b/apps/daemon/internal/agent/managedskills/skills.go
deleted file mode 100644
index 3f052ca1c..000000000
--- a/apps/daemon/internal/agent/managedskills/skills.go
+++ /dev/null
@@ -1,237 +0,0 @@
-package managedskills
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/installroot"
-	obslog "github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
-	"github.com/google/uuid"
-)
-
-// skillDescriptor is the daemon-side view of one server-sent skill entry
-// under agent_options["skills"].
-type skillDescriptor struct {
-	Name        string
-	Version     string
-	DownloadURL string
-	SHA256      string
-}
-
-// SkillInstallResult carries installed directories and warnings.
-type SkillInstallResult struct {
-	SkillDirs []string
-	Warnings  []string
-}
-
-// InstallManagedSkills decodes the portable agent_options["skills"] payload,
-// materializes it below root, and removes entries that are no longer active.
-func InstallManagedSkills(ctx context.Context, logger *slog.Logger, root string, raw any) (SkillInstallResult, error) {
-	if strings.TrimSpace(root) == "" {
-		return SkillInstallResult{}, errors.New("managed skills: root is required")
-	}
-	unlock, err := installroot.Lock(ctx, root)
-	if err != nil {
-		return SkillInstallResult{}, err
-	}
-	defer unlock()
-	skills, decodeWarnings := decodeSkillDescriptors(raw)
-	result, err := installSkillsAtRootLocked(ctx, logger, root, skills, "managed skills")
-	result.Warnings = append(decodeWarnings, result.Warnings...)
-	if err != nil {
-		return result, err
-	}
-	if err := pruneManagedSkills(root, result.SkillDirs); err != nil {
-		return result, err
-	}
-	return result, nil
-}
-
-func installSkillsAtRootLocked(
-	ctx context.Context,
-	logger *slog.Logger,
-	root string,
-	skills []skillDescriptor,
-	logLabel string,
-) (SkillInstallResult, error) {
-	if logger == nil {
-		logger = obslog.Bg()
-	}
-	if len(skills) == 0 {
-		return SkillInstallResult{}, nil
-	}
-
-	result := SkillInstallResult{}
-	for _, s := range skills {
-		if err := s.validate(); err != nil {
-			result.Warnings = append(result.Warnings, fmt.Sprintf("skip skill (invalid descriptor): %v", err))
-			logger.Warn(logLabel+": invalid descriptor", "err", err.Error())
-			continue
-		}
-
-		dir := filepath.Join(root, s.Name)
-		cacheKey := filepath.Join(dir, ".cache-key")
-		expectedKey := s.cacheKey()
-
-		if existing, err := os.ReadFile(cacheKey); err == nil && string(existing) == expectedKey {
-			logger.Info(logLabel+": cache hit",
-				"name", s.Name, "version", s.Version, "dir", dir)
-			result.SkillDirs = append(result.SkillDirs, dir)
-			continue
-		}
-
-		// Bound each archive download and extraction.
-		perCtx, cancel := context.WithTimeout(ctx, pluginInstallTimeout)
-		err := installOneSkill(perCtx, logger, root, dir, cacheKey, expectedKey, s, logLabel)
-		cancel()
-		if err != nil {
-			result.Warnings = append(result.Warnings,
-				fmt.Sprintf("skill %s@%s: %v", s.Name, s.Version, err))
-			logger.Warn(logLabel+": install failed",
-				"name", s.Name, "version", s.Version, "err", err.Error())
-			continue
-		}
-		result.SkillDirs = append(result.SkillDirs, dir)
-		logger.Info(logLabel+": installed",
-			"name", s.Name, "version", s.Version, "dir", dir)
-	}
-	return result, nil
-}
-
-func pruneManagedSkills(root string, activeDirs []string) error {
-	entries, err := os.ReadDir(root)
-	if os.IsNotExist(err) {
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("managed skills: read root %s: %w", root, err)
-	}
-	active := make(map[string]struct{}, len(activeDirs))
-	for _, dir := range activeDirs {
-		active[filepath.Base(dir)] = struct{}{}
-	}
-	for _, entry := range entries {
-		if entry.Name() == ".tmp" {
-			continue
-		}
-		if _, ok := active[entry.Name()]; ok {
-			continue
-		}
-		path := filepath.Join(root, entry.Name())
-		if err := os.RemoveAll(path); err != nil {
-			return fmt.Errorf("managed skills: remove stale entry %s: %w", path, err)
-		}
-	}
-	return nil
-}
-
-// installOneSkill downloads, verifies and extracts one skill archive.
-func installOneSkill(
-	ctx context.Context,
-	logger *slog.Logger,
-	root, dir, cacheKey, expectedKey string,
-	s skillDescriptor,
-	logLabel string,
-) error {
-	tmpDir := filepath.Join(root, ".tmp")
-	if err := os.MkdirAll(tmpDir, 0o755); err != nil {
-		return fmt.Errorf("mkdir tmp: %w", err)
-	}
-
-	zipPath := filepath.Join(tmpDir, fmt.Sprintf("%s-%s-%s.zip", s.Name, s.Version, uuid.NewString()))
-	defer func() {
-		_ = os.Remove(zipPath)
-	}()
-
-	fd, err := fetchPluginZip(ctx, s.DownloadURL, zipPath)
-	if err != nil {
-		return err
-	}
-	defer fd.Close()
-
-	if err := verifyPluginSHA256FromFD(fd, s.SHA256); err != nil {
-		return err
-	}
-	if _, err := fd.Seek(0, io.SeekStart); err != nil {
-		return fmt.Errorf("seek: %w", err)
-	}
-	fi, err := fd.Stat()
-	if err != nil {
-		return fmt.Errorf("stat: %w", err)
-	}
-
-	if err := os.RemoveAll(dir); err != nil {
-		return fmt.Errorf("rm old dir: %w", err)
-	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return fmt.Errorf("mkdir target: %w", err)
-	}
-	if err := extractPluginZipFromFD(fd, fi.Size(), dir); err != nil {
-		_ = os.RemoveAll(dir)
-		return err
-	}
-
-	if err := os.WriteFile(cacheKey, []byte(expectedKey), 0o644); err != nil {
-		logger.Warn(logLabel+": write cache key failed",
-			"path", cacheKey, "err", err.Error())
-	}
-	return nil
-}
-
-// decodeSkillDescriptors converts agent_options["skills"] into typed descriptors.
-func decodeSkillDescriptors(raw any) ([]skillDescriptor, []string) {
-	if raw == nil {
-		return nil, nil
-	}
-	items, ok := raw.([]any)
-	if !ok {
-		return nil, []string{fmt.Sprintf("agent_options[skills] must be array, got %T", raw)}
-	}
-	out := make([]skillDescriptor, 0, len(items))
-	warnings := make([]string, 0)
-	for i, item := range items {
-		obj, ok := item.(map[string]any)
-		if !ok {
-			warnings = append(warnings, fmt.Sprintf("skills[%d]: not an object", i))
-			continue
-		}
-		s := skillDescriptor{
-			Name:        stringField(obj, "name"),
-			Version:     stringField(obj, "version"),
-			DownloadURL: stringField(obj, "download_url"),
-			SHA256:      stringField(obj, "sha256"),
-		}
-		if err := s.validate(); err != nil {
-			warnings = append(warnings, fmt.Sprintf("skills[%d] (%s): %v", i, s.Name, err))
-			continue
-		}
-		out = append(out, s)
-	}
-	return out, warnings
-}
-
-func (s skillDescriptor) validate() error {
-	if strings.TrimSpace(s.Name) == "" {
-		return errors.New("name is required")
-	}
-	if strings.ContainsAny(s.Name, "/\\") || s.Name == "." || s.Name == ".." {
-		return fmt.Errorf("name %q contains path separator or dot-ref", s.Name)
-	}
-	if strings.TrimSpace(s.DownloadURL) == "" {
-		return errors.New("download_url is required")
-	}
-	if len(s.SHA256) != 64 {
-		return fmt.Errorf("sha256 must be 64 hex chars (got %d)", len(s.SHA256))
-	}
-	return nil
-}
-
-func (s skillDescriptor) cacheKey() string {
-	return fmt.Sprintf("%s@%s", strings.TrimSpace(s.Name), strings.ToLower(s.SHA256))
-}
diff --git a/apps/daemon/internal/agent/managedskills/skills_test.go b/apps/daemon/internal/agent/managedskills/skills_test.go
deleted file mode 100644
index f2977f371..000000000
--- a/apps/daemon/internal/agent/managedskills/skills_test.go
+++ /dev/null
@@ -1,165 +0,0 @@
-package managedskills
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// validSkillZipBytes is a minimal SKILL.md-rooted zip.
-func validSkillZipBytes(t *testing.T) []byte {
-	return buildPluginZipBytes(t, []pluginZipFile{
-		{Name: "SKILL.md", Body: "---\nname: code-review\ndescription: Review code\n---\nBody"},
-	})
-}
-
-func TestInstallSkills_HappyPath_ExtractsAndStampsCacheKey(t *testing.T) {
-	t.Parallel()
-	body := validSkillZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		{Name: "code-review", Version: "1.0.0", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	})
-	if err != nil {
-		t.Fatalf("installSkills: %v", err)
-	}
-	if len(res.Warnings) != 0 {
-		t.Fatalf("unexpected warnings: %v", res.Warnings)
-	}
-
-	dir := filepath.Join(workDir, "code-review")
-	if len(res.SkillDirs) != 1 || res.SkillDirs[0] != dir {
-		t.Fatalf("skill dirs = %v, want [%s]", res.SkillDirs, dir)
-	}
-	if _, err := os.Stat(filepath.Join(dir, "SKILL.md")); err != nil {
-		t.Fatalf("SKILL.md missing: %v", err)
-	}
-	stamped, err := os.ReadFile(filepath.Join(dir, ".cache-key"))
-	if err != nil {
-		t.Fatalf("read cache-key: %v", err)
-	}
-	want := "code-review@" + sha256Hex(body)
-	if string(stamped) != want {
-		t.Fatalf("cache-key = %q, want %q", stamped, want)
-	}
-}
-
-func TestInstallSkills_CacheHitSkipsDownload(t *testing.T) {
-	t.Parallel()
-	body := validSkillZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	desc := []skillDescriptor{
-		{Name: "code-review", Version: "1.0.0", DownloadURL: srv.URL, SHA256: sha256Hex(body)},
-	}
-	if _, err := installSkillsForTest(context.Background(), discardLogger(), workDir, desc); err != nil {
-		t.Fatalf("first install: %v", err)
-	}
-	hitsAfterFirst := srv.Hits()
-	if hitsAfterFirst != 1 {
-		t.Fatalf("first install hits = %d, want 1", hitsAfterFirst)
-	}
-	second, err := installSkillsForTest(context.Background(), discardLogger(), workDir, desc)
-	if err != nil {
-		t.Fatalf("second install: %v", err)
-	}
-	if len(second.SkillDirs) != 1 {
-		t.Fatalf("cache hit skill dirs = %v", second.SkillDirs)
-	}
-	if got := srv.Hits(); got != hitsAfterFirst {
-		t.Fatalf("cache should prevent second download; got %d extra hits", got-hitsAfterFirst)
-	}
-}
-
-func TestInstallManagedSkillsPrunesInactiveEntries(t *testing.T) {
-	body := validSkillZipBytes(t)
-	srv := startPluginServer(t, body)
-	root := t.TempDir()
-	stale := filepath.Join(root, "old-skill")
-	if err := os.MkdirAll(stale, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(stale, "SKILL.md"), []byte("old"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	res, err := InstallManagedSkills(context.Background(), discardLogger(), root, []any{
-		map[string]any{
-			"name": "code-review", "version": "1.0.0",
-			"download_url": srv.URL, "sha256": sha256Hex(body),
-		},
-	})
-	if err != nil {
-		t.Fatalf("InstallManagedSkills: %v", err)
-	}
-	if len(res.SkillDirs) != 1 || res.SkillDirs[0] != filepath.Join(root, "code-review") {
-		t.Fatalf("skill dirs = %v", res.SkillDirs)
-	}
-	if _, err := os.Stat(stale); !os.IsNotExist(err) {
-		t.Fatalf("stale skill still exists: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(root, "code-review", "SKILL.md")); err != nil {
-		t.Fatalf("active skill missing: %v", err)
-	}
-}
-
-func TestInstallSkills_SHA256MismatchDemotesToWarning(t *testing.T) {
-	t.Parallel()
-	body := validSkillZipBytes(t)
-	srv := startPluginServer(t, body)
-	workDir := t.TempDir()
-
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, []skillDescriptor{
-		// Wrong sha256 (all-zero pattern is 64 hex chars, never matches body)
-		{Name: "code-review", Version: "1.0.0", DownloadURL: srv.URL, SHA256: "0000000000000000000000000000000000000000000000000000000000000000"},
-	})
-	if err != nil {
-		t.Fatalf("installSkills should not hard-error on sha mismatch: %v", err)
-	}
-	if len(res.Warnings) != 1 {
-		t.Fatalf("want 1 warning, got %d: %v", len(res.Warnings), res.Warnings)
-	}
-	if _, err := os.Stat(filepath.Join(workDir, "code-review", "SKILL.md")); err == nil {
-		t.Fatal("SKILL.md should not exist after sha mismatch")
-	}
-}
-
-func TestInstallSkills_EmptyListIsNoop(t *testing.T) {
-	t.Parallel()
-	workDir := t.TempDir()
-	res, err := installSkillsForTest(context.Background(), discardLogger(), workDir, nil)
-	if err != nil {
-		t.Fatalf("empty install: %v", err)
-	}
-	if len(res.Warnings) != 0 {
-		t.Fatalf("unexpected warnings: %v", res.Warnings)
-	}
-}
-
-func TestDecodeSkillDescriptors_ArrayShape(t *testing.T) {
-	raw := []any{
-		map[string]any{
-			"name":         "code-review",
-			"version":      "1.0.0",
-			"download_url": "https://x",
-			"sha256":       "0000000000000000000000000000000000000000000000000000000000000000",
-		},
-	}
-	got, warns := decodeSkillDescriptors(raw)
-	if len(got) != 1 || len(warns) != 0 {
-		t.Fatalf("got=%+v warns=%v", got, warns)
-	}
-}
-
-func TestDecodeSkillDescriptors_NilAndWrongType(t *testing.T) {
-	if got, warns := decodeSkillDescriptors(nil); got != nil || warns != nil {
-		t.Fatalf("nil raw should be (nil, nil), got (%v, %v)", got, warns)
-	}
-	if got, warns := decodeSkillDescriptors("not-array"); got != nil || len(warns) != 1 {
-		t.Fatalf("string raw should warn, got got=%v warns=%v", got, warns)
-	}
-}
diff --git a/apps/daemon/internal/agent/mcode/declaration.go b/apps/daemon/internal/agent/mcode/declaration.go
index bfab385d3..5a6682dbb 100644
--- a/apps/daemon/internal/agent/mcode/declaration.go
+++ b/apps/daemon/internal/agent/mcode/declaration.go
@@ -48,7 +48,7 @@ func discover(ctx context.Context, options agent.DiscoveryOptions, info proto.Su
 	return discoverWithCheck(ctx, options, info, CheckCLIAvailable)
 }
 func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, result proto.SupportedAgentKind, check func(context.Context, string) (string, error)) *agent.Runtime {
-	runtime := &agent.Runtime{Info: result, Session: Factory, SessionCapabilityContext: true, ExecutorCapabilityContext: true}
+	runtime := &agent.Runtime{Info: result, Session: Factory}
 
 	ctx, cancel := context.WithTimeout(parent, 15*time.Second)
 	defer cancel()
@@ -78,7 +78,6 @@ func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, r
 		runtime.Executor = NewExecutorFactory(workspace)
 	}
 	if workspace != nil {
-		runtime.SessionCapabilityContext = false
 		runtime.Info.Capabilities.WorkspaceAuthoring = proto.CapabilityUnsupported
 		runtime.Preparation = NewPreparationFactory(*workspace)
 		runtime.WorkspaceReadPreparation = true
diff --git a/apps/daemon/internal/agent/mcode/declaration_test.go b/apps/daemon/internal/agent/mcode/declaration_test.go
index ab845b1c2..16ec2df71 100644
--- a/apps/daemon/internal/agent/mcode/declaration_test.go
+++ b/apps/daemon/internal/agent/mcode/declaration_test.go
@@ -19,7 +19,7 @@ func TestMCodeExecutionOptInIsVersionBound(t *testing.T) {
 			t.Setenv("OAC_RUNTIME_MCODE_AGENTS_API", tc.enabled)
 			rc := agent.DiscoveryOptions{Stdout: io.Discard, Stderr: io.Discard}
 			runtime := discoverWithCheck(t.Context(), rc, Declaration.Info, func(context.Context, string) (string, error) { return tc.version, nil })
-			if runtime.Executor == nil || runtime.Preparation != nil || !runtime.SessionCapabilityContext || !runtime.ExecutorCapabilityContext {
+			if runtime.Executor == nil || runtime.Preparation != nil {
 				t.Fatalf("factories: %+v", runtime)
 			}
 			info := runtime.Info
diff --git a/apps/daemon/internal/agent/mcode/environment_mcp_test.go b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
index 1e2c745cb..d4ccae14a 100644
--- a/apps/daemon/internal/agent/mcode/environment_mcp_test.go
+++ b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
@@ -98,7 +98,7 @@ func TestEnvironmentMCPRejectsUnqualifiedAuthorityBeforePreparation(t *testing.T
 			case "reserved":
 				req.LocalEnvironment.MCP[0].Server.Name = "oac_workspace"
 			}
-			if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil || strings.Contains(err.Error(), "confidential-http-token") {
+			if _, err := prepareWorkspaceOptions(c, req); err == nil || strings.Contains(err.Error(), "confidential-http-token") {
 				t.Fatal("unqualified declaration accepted or credential exposed")
 			}
 		})
@@ -238,7 +238,7 @@ func TestPublicEnvironmentHTTPMCPKeepsCredentialTransient(t *testing.T) {
 	c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 	token := "selected-public-vault-canary"
 	req.MCPHTTPServers = &[]proto.MCPHTTPServer{{ConnectionOrigin: "environment", ServerLabel: "remote", ServerURL: "https://example.test/mcp", BearerToken: &token}}
-	opts, err := prepareWorkspaceOptions(t.Context(), c, req)
+	opts, err := prepareWorkspaceOptions(c, req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -267,12 +267,12 @@ func TestPublicEnvironmentHTTPMCPKeepsCredentialTransient(t *testing.T) {
 	}
 	empty := []string{}
 	(*req.MCPHTTPServers)[0].AllowedTools = &empty
-	if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil {
+	if _, err := prepareWorkspaceOptions(c, req); err == nil {
 		t.Fatal("empty allowlist silently treated as all")
 	}
 	(*req.MCPHTTPServers)[0].AllowedTools = nil
 	(*req.MCPHTTPServers)[0].Required = true
-	if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil {
+	if _, err := prepareWorkspaceOptions(c, req); err == nil {
 		t.Fatal("required initialization silently ignored")
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/execution.go b/apps/daemon/internal/agent/mcode/execution.go
index a54bfc742..82dd3c9f8 100644
--- a/apps/daemon/internal/agent/mcode/execution.go
+++ b/apps/daemon/internal/agent/mcode/execution.go
@@ -27,14 +27,8 @@ func validateExecutionRequest(req proto.PromptRequestPayload) error {
 			return err
 		}
 	}
-	if mode := optionString(req.AgentOptions, "mode"); mode != "" {
-		return fmt.Errorf("mcode: text execution uses default native permissions")
-	}
-	if req.AgentOptions["plugins"] != nil {
-		return fmt.Errorf("mcode: execution cannot import plugins")
-	}
-	if req.AgentOptions["skills"] != nil || req.AgentOptions["mcp_servers"] != nil || req.AgentOptions["env"] != nil {
-		return fmt.Errorf("mcode: execution cannot import product capabilities or environment")
+	if req.AgentOptions["env"] != nil {
+		return fmt.Errorf("mcode: execution cannot import an environment")
 	}
 	return nil
 }
diff --git a/apps/daemon/internal/agent/mcode/execution_test.go b/apps/daemon/internal/agent/mcode/execution_test.go
index ac7bcd53b..839c594ad 100644
--- a/apps/daemon/internal/agent/mcode/execution_test.go
+++ b/apps/daemon/internal/agent/mcode/execution_test.go
@@ -21,7 +21,7 @@ func TestExecutionOptionsInheritUserEnvironment(t *testing.T) {
 	r := executionRequest(t)
 	t.Setenv("OAC_TEST_SECRET_CANARY", "secret")
 	t.Setenv("NODE_OPTIONS", "--import=untrusted")
-	opts, err := prepareOptions(t.Context(), r)
+	opts, err := prepareOptions(r)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -56,7 +56,7 @@ func TestExecutionRejectsUnqualifiedAuthority(t *testing.T) {
 	} {
 		r := executionRequest(t)
 		change(&r)
-		if _, err := prepareOptions(t.Context(), r); err == nil {
+		if _, err := prepareOptions(r); err == nil {
 			t.Fatal("unsupported execution accepted")
 		}
 	}
diff --git a/apps/daemon/internal/agent/mcode/executor.go b/apps/daemon/internal/agent/mcode/executor.go
index 69cf28357..c63473397 100644
--- a/apps/daemon/internal/agent/mcode/executor.go
+++ b/apps/daemon/internal/agent/mcode/executor.go
@@ -46,10 +46,10 @@ func NewExecutorFactory(config *WorkspaceConfig) agent.ExecutorFactory {
 		var opts launchOptions
 		binary := defaultBinary()
 		if frozen == nil {
-			opts, err = prepareOptions(ctx, req)
+			opts, err = prepareOptions(req)
 		} else {
 			binary = frozen.Binary
-			opts, err = prepareWorkspaceOptions(ctx, *frozen, req)
+			opts, err = prepareWorkspaceOptions(*frozen, req)
 		}
 		if err != nil {
 			return nil, err
diff --git a/apps/daemon/internal/agent/mcode/harness_config_test.go b/apps/daemon/internal/agent/mcode/harness_config_test.go
index eaf4f2c1a..a704912f9 100644
--- a/apps/daemon/internal/agent/mcode/harness_config_test.go
+++ b/apps/daemon/internal/agent/mcode/harness_config_test.go
@@ -1,7 +1,6 @@
 package mcode
 
 import (
-	"context"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
 	"testing"
 )
@@ -9,11 +8,11 @@ import (
 func TestNativeConfigDoesNotPretendToSupportParameters(t *testing.T) {
 	req := testRequest(t)
 	req.AgentOptions["harness_config"] = map[string]any{}
-	if _, err := prepareOptions(context.Background(), req); err != nil {
+	if _, err := prepareOptions(req); err != nil {
 		t.Fatal(err)
 	}
 	req.AgentOptions["harness_config"] = map[string]any{"temperature": 0.5}
-	if _, err := prepareOptions(context.Background(), req); err != harnessconfig.ErrHarnessConfig {
+	if _, err := prepareOptions(req); err != harnessconfig.ErrHarnessConfig {
 		t.Fatalf("unsupported parameter accepted: %v", err)
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/model_provider_test.go b/apps/daemon/internal/agent/mcode/model_provider_test.go
index 715bf181c..f97b50508 100644
--- a/apps/daemon/internal/agent/mcode/model_provider_test.go
+++ b/apps/daemon/internal/agent/mcode/model_provider_test.go
@@ -16,7 +16,7 @@ func TestOptionsModelProviderProtocols(t *testing.T) {
 			req := testRequest(t)
 			req.AgentOptions["model_provider"].(map[string]any)["protocol"] = tc.protocol
 			req.AgentOptions["model"] = "chosen-model"
-			opts, err := prepareOptions(t.Context(), req)
+			opts, err := prepareOptions(req)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -60,7 +60,7 @@ func TestOptionsRejectInvalidProvider(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			req := testRequest(t)
 			req.AgentOptions["model_provider"].(map[string]any)[tc.field] = tc.value
-			if _, err := prepareOptions(t.Context(), req); err == nil {
+			if _, err := prepareOptions(req); err == nil {
 				t.Fatal("invalid model provider accepted")
 			}
 		})
@@ -69,7 +69,7 @@ func TestOptionsRejectInvalidProvider(t *testing.T) {
 		req := testRequest(t)
 		req.AgentOptions["mcode_provider"] = req.AgentOptions["model_provider"]
 		delete(req.AgentOptions, "model_provider")
-		if _, err := prepareOptions(t.Context(), req); err == nil {
+		if _, err := prepareOptions(req); err == nil {
 			t.Fatal("retired native provider option accepted")
 		}
 	})
@@ -78,7 +78,7 @@ func TestOptionsRejectInvalidProvider(t *testing.T) {
 func TestOptionsAllowLoopbackProviderFixture(t *testing.T) {
 	req := testRequest(t)
 	req.AgentOptions["model_provider"].(map[string]any)["base_url"] = "http://127.0.0.1:4321/v1"
-	if _, err := prepareOptions(t.Context(), req); err != nil {
+	if _, err := prepareOptions(req); err != nil {
 		t.Fatal(err)
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/native_test.go b/apps/daemon/internal/agent/mcode/native_test.go
index bb61fdeb3..042f577de 100644
--- a/apps/daemon/internal/agent/mcode/native_test.go
+++ b/apps/daemon/internal/agent/mcode/native_test.go
@@ -1,11 +1,7 @@
 package mcode
 
 import (
-	"archive/zip"
-	"bytes"
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -28,42 +24,6 @@ func TestNativeMCodeACP(t *testing.T) {
 	req := testRequest(t)
 	var mu sync.Mutex
 	var requests []string
-	mcpCalls := 0
-	mcp := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "POST" {
-			w.WriteHeader(http.StatusMethodNotAllowed)
-			return
-		}
-		var msg struct {
-			ID     json.RawMessage `json:"id"`
-			Method string          `json:"method"`
-		}
-		if json.NewDecoder(r.Body).Decode(&msg) != nil {
-			w.WriteHeader(400)
-			return
-		}
-		if len(msg.ID) == 0 {
-			w.WriteHeader(http.StatusAccepted)
-			return
-		}
-		var result any
-		switch msg.Method {
-		case "initialize":
-			result = map[string]any{"protocolVersion": "2024-11-05", "capabilities": map[string]any{"tools": map[string]any{}}, "serverInfo": map[string]string{"name": "fixture", "version": "1"}}
-		case "tools/list":
-			result = map[string]any{"tools": []map[string]any{{"name": "get_fixture", "description": "Returns the fixture marker", "inputSchema": map[string]any{"type": "object", "properties": map[string]any{}}}}}
-		case "tools/call":
-			mu.Lock()
-			mcpCalls++
-			mu.Unlock()
-			result = map[string]any{"content": []map[string]string{{"type": "text", "text": "MCP-READY"}}}
-		default:
-			result = map[string]any{}
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]any{"jsonrpc": "2.0", "id": msg.ID, "result": result})
-	}))
-	defer mcp.Close()
 	model := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		var body map[string]any
 		if json.NewDecoder(r.Body).Decode(&body) != nil {
@@ -74,34 +34,12 @@ func TestNativeMCodeACP(t *testing.T) {
 		mu.Lock()
 		requests = append(requests, string(raw))
 		mu.Unlock()
-		tool := ""
-		if !strings.Contains(string(raw), "MCP-READY") && strings.Contains(string(raw), "QA-CALL-MCP") {
-			tools, _ := body["tools"].([]any)
-			for _, entry := range tools {
-				value, _ := entry.(map[string]any)
-				name, _ := value["name"].(string)
-				if strings.Contains(name, "get_fixture") {
-					tool = name
-					break
-				}
-			}
-		}
-		writeNativeResponse(w, tool)
+		writeNativeResponse(w)
 	}))
 	defer model.Close()
-	var archive bytes.Buffer
-	zw := zip.NewWriter(&archive)
-	f, _ := zw.Create("SKILL.md")
-	_, _ = f.Write([]byte("---\nname: qa-mcode-skill\ndescription: Test skill marker SKILL-MCODE-451\n---\nReturn SKILL-MCODE-451.\n"))
-	_ = zw.Close()
-	digest := sha256.Sum256(archive.Bytes())
-	skill := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write(archive.Bytes()) }))
-	defer skill.Close()
 	req.AgentOptions["model_provider"] = map[string]any{"protocol": "anthropic", "base_url": model.URL, "api_key": "fixture-only", "context_window": 64000, "max_output_tokens": 4096}
-	req.AgentOptions["skills"] = []any{map[string]any{"name": "qa-mcode-skill", "version": "1", "download_url": skill.URL, "sha256": hex.EncodeToString(digest[:])}}
-	req.AgentOptions["mcp_servers"] = map[string]any{"qa": map[string]any{"type": "http", "url": mcp.URL}}
-	req.AgentOptions["system_prompt"] = "SP-MCODE-672: use the available tools when requested."
-	req.Input = proto.TextInput("QA-CALL-MCP: call get_fixture, then reply OAC-MCODE-OK.")
+	req.AgentOptions["system_prompt"] = "SP-MCODE-672: reply as instructed."
+	req.Input = proto.TextInput("Reply OAC-MCODE-OK.")
 	run := func() proto.DonePayload {
 		ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 		t.Cleanup(cancel)
@@ -138,19 +76,14 @@ func TestNativeMCodeACP(t *testing.T) {
 	done := run()
 	mu.Lock()
 	firstRequests := strings.Join(requests, "\n")
-	calls := mcpCalls
 	requests = nil
 	mu.Unlock()
-	if !strings.Contains(firstRequests, "SP-MCODE-672") || !strings.Contains(firstRequests, "qa-mcode-skill") {
-		t.Fatalf("native context missing: prompt=%t skill=%t", strings.Contains(firstRequests, "SP-MCODE-672"), strings.Contains(firstRequests, "qa-mcode-skill"))
-	}
-	if calls == 0 {
-		t.Fatal("native MCP was not called")
+	if !strings.Contains(firstRequests, "SP-MCODE-672") {
+		t.Fatal("native instructions missing")
 	}
 	req.RunID = "run-2"
 	req.AgentSessionID = done.Metadata[proto.DoneMetaAgentSessionID].(string)
 	req.AgentOptions["system_prompt"] = "SP-MCODE-NEW: reply concisely."
-	req.AgentOptions["skills"] = []any{}
 	req.AgentOptions["model"] = "fixture-new"
 	req.Input = proto.TextInput("Now reply OAC-MCODE-OK.")
 	run()
@@ -163,26 +96,19 @@ func TestNativeMCodeACP(t *testing.T) {
 	if !strings.Contains(resumed, `"model":"fixture-new"`) {
 		t.Fatal("resume did not use the updated model")
 	}
-	t.Logf("native new/resume, model, instructions, Skill discovery and MCP verified (%d tool calls)", calls)
+	t.Log("native new/resume, model and instructions verified")
 }
 
-func writeNativeResponse(w http.ResponseWriter, tool string) {
+func writeNativeResponse(w http.ResponseWriter) {
 	w.Header().Set("Content-Type", "text/event-stream")
 	send := func(kind string, payload any) {
 		data, _ := json.Marshal(payload)
 		_, _ = fmt.Fprintf(w, "event: %s\ndata: %s\n\n", kind, data)
 	}
 	send("message_start", map[string]any{"type": "message_start", "message": map[string]any{"id": "msg_qa", "type": "message", "role": "assistant", "model": "fixture", "content": []any{}, "stop_reason": nil, "stop_sequence": nil, "usage": map[string]int{"input_tokens": 20, "output_tokens": 0}}})
-	stop := "end_turn"
-	if tool != "" {
-		send("content_block_start", map[string]any{"type": "content_block_start", "index": 0, "content_block": map[string]any{"type": "tool_use", "id": "call_fixture", "name": tool, "input": map[string]any{}}})
-		send("content_block_delta", map[string]any{"type": "content_block_delta", "index": 0, "delta": map[string]string{"type": "input_json_delta", "partial_json": "{}"}})
-		stop = "tool_use"
-	} else {
-		send("content_block_start", map[string]any{"type": "content_block_start", "index": 0, "content_block": map[string]string{"type": "text", "text": ""}})
-		send("content_block_delta", map[string]any{"type": "content_block_delta", "index": 0, "delta": map[string]string{"type": "text_delta", "text": "OAC-MCODE-OK"}})
-	}
+	send("content_block_start", map[string]any{"type": "content_block_start", "index": 0, "content_block": map[string]string{"type": "text", "text": ""}})
+	send("content_block_delta", map[string]any{"type": "content_block_delta", "index": 0, "delta": map[string]string{"type": "text_delta", "text": "OAC-MCODE-OK"}})
 	send("content_block_stop", map[string]any{"type": "content_block_stop", "index": 0})
-	send("message_delta", map[string]any{"type": "message_delta", "delta": map[string]any{"stop_reason": stop, "stop_sequence": nil}, "usage": map[string]int{"output_tokens": 8}})
+	send("message_delta", map[string]any{"type": "message_delta", "delta": map[string]any{"stop_reason": "end_turn", "stop_sequence": nil}, "usage": map[string]int{"output_tokens": 8}})
 	send("message_stop", map[string]string{"type": "message_stop"})
 }
diff --git a/apps/daemon/internal/agent/mcode/options.go b/apps/daemon/internal/agent/mcode/options.go
index 86305f17d..5714e401f 100644
--- a/apps/daemon/internal/agent/mcode/options.go
+++ b/apps/daemon/internal/agent/mcode/options.go
@@ -1,20 +1,16 @@
 package mcode
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
-	"sort"
 	"strconv"
 	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/managedskills"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	harnessconfiguration "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig/mcode"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 )
 
 type launchOptions struct {
@@ -23,11 +19,7 @@ type launchOptions struct {
 	MCP                 []map[string]any
 }
 
-func prepareOptions(ctx context.Context, req proto.PromptRequestPayload) (launchOptions, error) {
-	return prepareOptionsWithSkills(ctx, req, true)
-}
-
-func prepareOptionsWithSkills(ctx context.Context, req proto.PromptRequestPayload, managedSkills bool) (launchOptions, error) {
+func prepareOptions(req proto.PromptRequestPayload) (launchOptions, error) {
 	var result launchOptions
 	if _, err := harnessconfiguration.Configuration().PrepareHarnessConfig(req.AgentOptions); err != nil {
 		return result, err
@@ -40,11 +32,11 @@ func prepareOptionsWithSkills(ctx context.Context, req proto.PromptRequestPayloa
 	if req.Input.HasImages() {
 		return result, fmt.Errorf("mcode: ACP does not support attachments")
 	}
-	root, err := agent.ManagedSkillsRoot("mcode", req.AgentStateKey, req.ConversationID, req.RunID)
+	dataDir, err := agent.StateDir("mcode", req.AgentStateKey, req.ConversationID, req.RunID)
 	if err != nil {
 		return result, err
 	}
-	result.DataDir = filepath.Dir(root)
+	result.DataDir = dataDir
 	result.Dir = filepath.Join(result.DataDir, "workspace")
 	if err := os.MkdirAll(result.DataDir, 0o700); err != nil {
 		return result, err
@@ -52,20 +44,8 @@ func prepareOptionsWithSkills(ctx context.Context, req proto.PromptRequestPayloa
 	if err := os.MkdirAll(result.Dir, 0o700); err != nil {
 		return result, err
 	}
-	if managedSkills {
-		installed, err := managedskills.InstallManagedSkills(ctx, log.With("component", "mcode"), root, req.AgentOptions["skills"])
-		if err != nil {
-			return result, err
-		}
-		if len(installed.Warnings) > 0 {
-			return result, fmt.Errorf("mcode: one or more configured Skills could not be installed")
-		}
-	}
 	opts := req.AgentOptions
 	prompt := optionString(opts, "system_prompt")
-	if override := optionString(opts, "override_system_prompt"); override != "" {
-		prompt = override
-	}
 	if len(prompt) > 32*1024 {
 		return result, fmt.Errorf("mcode: combined instructions exceed the CLI's 32 KiB limit")
 	}
@@ -92,14 +72,7 @@ func prepareOptionsWithSkills(ctx context.Context, req proto.PromptRequestPayloa
 			}}
 		}
 	}
-	mode := optionString(opts, "mode")
-	if mode == "" {
-		mode = "auto"
-	}
-	if mode != "auto" && mode != "default" && mode != "bypassPermissions" {
-		return result, fmt.Errorf("mcode: unsupported permission mode")
-	}
-	config["permissionMode"] = mode
+	config["permissionMode"] = "auto"
 	data, err := json.Marshal(config)
 	if err != nil {
 		return result, err
@@ -137,92 +110,11 @@ func prepareOptionsWithSkills(ctx context.Context, req proto.PromptRequestPayloa
 	if req.StrictResume {
 		result.Env = append(result.Env, "HOME="+result.DataDir, "USERPROFILE="+result.DataDir)
 	}
-	result.MCP, err = mcpServers(opts["mcp_servers"])
-	return result, err
+	result.MCP = []map[string]any{}
+	return result, nil
 }
 
 func optionString(options map[string]any, key string) string {
 	value, _ := options[key].(string)
 	return value
 }
-
-func mcpServers(raw any) ([]map[string]any, error) {
-	result := []map[string]any{}
-	if raw == nil {
-		return result, nil
-	}
-	servers, ok := raw.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("mcode: mcp_servers must be an object")
-	}
-	names := make([]string, 0, len(servers))
-	for name := range servers {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		entry, ok := servers[name].(map[string]any)
-		if !ok {
-			return nil, fmt.Errorf("mcode: invalid MCP server %q", name)
-		}
-		server := map[string]any{"name": name}
-		if url := optionString(entry, "url"); url != "" {
-			kind := optionString(entry, "type")
-			if kind == "" {
-				kind = "http"
-			}
-			if kind != "http" && kind != "sse" {
-				return nil, fmt.Errorf("mcode: unsupported MCP transport %q", kind)
-			}
-			server["type"] = kind
-			server["url"] = url
-			headers, err := namedValues(entry["headers"])
-			if err != nil {
-				return nil, err
-			}
-			server["headers"] = headers
-		} else {
-			command := optionString(entry, "command")
-			if command == "" {
-				return nil, fmt.Errorf("mcode: MCP server %q needs command or URL", name)
-			}
-			server["command"] = command
-			args := entry["args"]
-			if args == nil {
-				args = []string{}
-			}
-			server["args"] = args
-			env, err := namedValues(entry["env"])
-			if err != nil {
-				return nil, err
-			}
-			server["env"] = env
-		}
-		result = append(result, server)
-	}
-	return result, nil
-}
-
-func namedValues(raw any) ([]map[string]string, error) {
-	result := []map[string]string{}
-	if raw == nil {
-		return result, nil
-	}
-	values, ok := raw.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("mcode: MCP headers/env must be an object")
-	}
-	keys := make([]string, 0, len(values))
-	for key := range values {
-		keys = append(keys, key)
-	}
-	sort.Strings(keys)
-	for _, key := range keys {
-		value, ok := values[key].(string)
-		if !ok {
-			return nil, fmt.Errorf("mcode: MCP headers/env values must be strings")
-		}
-		result = append(result, map[string]string{"name": key, "value": value})
-	}
-	return result, nil
-}
diff --git a/apps/daemon/internal/agent/mcode/options_test.go b/apps/daemon/internal/agent/mcode/options_test.go
index dde7201c9..fa7fa94d2 100644
--- a/apps/daemon/internal/agent/mcode/options_test.go
+++ b/apps/daemon/internal/agent/mcode/options_test.go
@@ -1,7 +1,6 @@
 package mcode
 
 import (
-	"context"
 	"encoding/json"
 	"os"
 	"path/filepath"
@@ -14,7 +13,7 @@ import (
 func TestOptionsRefreshManagedState(t *testing.T) {
 	req := testRequest(t)
 	req.AgentOptions["env"] = map[string]any{"MINIMAX_DATA_DIR": "/wrong", "FIXTURE": "yes"}
-	opts, err := prepareOptions(context.Background(), req)
+	opts, err := prepareOptions(req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -25,9 +24,8 @@ func TestOptionsRefreshManagedState(t *testing.T) {
 		t.Fatal("state override did not win")
 	}
 	req.AgentOptions["system_prompt"] = ""
-	req.AgentOptions["mode"] = "default"
 	req.AgentSessionID = "native-1"
-	refreshed, err := prepareOptions(context.Background(), req)
+	refreshed, err := prepareOptions(req)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -46,8 +44,8 @@ func TestOptionsRefreshManagedState(t *testing.T) {
 	if json.Unmarshal(data, &cfg) != nil {
 		t.Fatal("invalid config")
 	}
-	if cfg["permissionMode"] != "default" {
-		t.Fatal("requested native permission mode was not refreshed")
+	if cfg["permissionMode"] != "auto" {
+		t.Fatal("native permission mode changed")
 	}
 	if cfg["skills"].(map[string]any)["external"].(map[string]any)["enabled"] != false {
 		t.Fatal("external discovery enabled")
@@ -69,35 +67,18 @@ func TestOptionsRejectDroppedContext(t *testing.T) {
 		}},
 		{"missing model", func(r *proto.PromptRequestPayload) { delete(r.AgentOptions, "model") }},
 		{"missing provider", func(r *proto.PromptRequestPayload) { delete(r.AgentOptions, "model_provider") }},
-		{"invalid permission mode", func(r *proto.PromptRequestPayload) { r.AgentOptions["mode"] = "plan" }},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			req := testRequest(t)
 			tt.edit(&req)
-			if _, err := prepareOptions(context.Background(), req); err == nil {
+			if _, err := prepareOptions(req); err == nil {
 				t.Fatal("expected validation failure")
 			}
 		})
 	}
 }
 
-func TestMCPTransportConversion(t *testing.T) {
-	servers, err := mcpServers(map[string]any{
-		"local":  map[string]any{"command": "fixture", "args": []any{"--stdio"}, "env": map[string]any{"TOKEN": "test"}},
-		"remote": map[string]any{"type": "http", "url": "https://mcp.example.test", "headers": map[string]any{"Authorization": "Bearer fixture"}},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(servers) != 2 || servers[0]["command"] != "fixture" || servers[1]["type"] != "http" {
-		t.Fatalf("servers=%v", servers)
-	}
-	if servers[0]["env"].([]map[string]string)[0]["name"] != "TOKEN" || servers[1]["headers"].([]map[string]string)[0]["value"] != "Bearer fixture" {
-		t.Fatal("MCP credentials lost")
-	}
-}
-
 func TestQuestionContentPreservesTypesAndValidates(t *testing.T) {
 	pending := pendingQuestion{Properties: map[string]formProperty{"text": {Type: "string"}, "choice": {Type: "string", Options: []formOption{{Value: "eu", Title: "Europe"}}}}, Required: []string{"choice"}}
 	if _, err := questionContent(pending, proto.PromptForUserChoiceDecisionPayload{}); err == nil {
diff --git a/apps/daemon/internal/agent/mcode/session.go b/apps/daemon/internal/agent/mcode/session.go
index d93877cfa..cd32a2edf 100644
--- a/apps/daemon/internal/agent/mcode/session.go
+++ b/apps/daemon/internal/agent/mcode/session.go
@@ -67,7 +67,7 @@ func newSession(ctx context.Context, req proto.PromptRequestPayload, out chan<-
 	if out == nil {
 		return nil, fmt.Errorf("mcode: output channel is required")
 	}
-	opts, err := prepareOptions(ctx, req)
+	opts, err := prepareOptions(req)
 	if err != nil {
 		return nil, err
 	}
diff --git a/apps/daemon/internal/agent/mcode/tool_environment_test.go b/apps/daemon/internal/agent/mcode/tool_environment_test.go
index 557ff5dfa..ab6accd5a 100644
--- a/apps/daemon/internal/agent/mcode/tool_environment_test.go
+++ b/apps/daemon/internal/agent/mcode/tool_environment_test.go
@@ -60,7 +60,7 @@ func TestWorkspaceCredentialsRemainInRuntimeSnapshotAcrossReconnect(t *testing.T
 		if err != nil {
 			t.Fatal(err)
 		}
-		opts, err := prepareWorkspaceOptions(t.Context(), config, prepared)
+		opts, err := prepareWorkspaceOptions(config, prepared)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -125,7 +125,7 @@ func TestWorkspaceRejectsInvalidToolEnvironment(t *testing.T) {
 	}
 	t.Setenv("OAC_RUNTIME_TOOL_ENV_FILE", file)
 	t.Setenv("OAC_RUNTIME_INITIALIZATION_DIRECTORY", t.TempDir())
-	if _, err := prepareWorkspaceOptions(t.Context(), config, req); err == nil {
+	if _, err := prepareWorkspaceOptions(config, req); err == nil {
 		t.Fatal("invalid explicit tool configuration was ignored")
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/workspace.go b/apps/daemon/internal/agent/mcode/workspace.go
index 5c8f5aa6d..7fdf2d3fd 100644
--- a/apps/daemon/internal/agent/mcode/workspace.go
+++ b/apps/daemon/internal/agent/mcode/workspace.go
@@ -1,7 +1,6 @@
 package mcode
 
 import (
-	"context"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -50,7 +49,7 @@ func ConfigureLocal(binary, node, bridge, root, workspace string, network agentn
 	return c, nil
 }
 
-func prepareWorkspaceOptions(ctx context.Context, c WorkspaceConfig, req proto.PromptRequestPayload) (launchOptions, error) {
+func prepareWorkspaceOptions(c WorkspaceConfig, req proto.PromptRequestPayload) (launchOptions, error) {
 	if c.Network != "enabled" || len(c.AllowedDomains) != 0 {
 		return launchOptions{}, fmt.Errorf("mcode: Runtime does not implement network isolation")
 	}
@@ -67,7 +66,7 @@ func prepareWorkspaceOptions(ctx context.Context, c WorkspaceConfig, req proto.P
 	private.LocalEnvironment, private.DisableExecutionEnvironment = nil, true
 	// Public declarations have already been resolved into the transient ACP map.
 	private.MCPHTTPServers = nil
-	opts, err := prepareOptionsWithSkills(ctx, private, false)
+	opts, err := prepareOptions(private)
 	if err != nil {
 		return opts, err
 	}
diff --git a/apps/daemon/internal/agent/mcode/workspace_network_test.go b/apps/daemon/internal/agent/mcode/workspace_network_test.go
index a42d387cd..83b3156ee 100644
--- a/apps/daemon/internal/agent/mcode/workspace_network_test.go
+++ b/apps/daemon/internal/agent/mcode/workspace_network_test.go
@@ -7,7 +7,7 @@ func TestWorkspaceRejectsInnerNetworkIsolation(t *testing.T) {
 		c, req, _ := workspaceFixture(t)
 		c.Network = access
 		req.LocalEnvironment.NetworkAccess = access
-		if _, err := prepareWorkspaceOptions(t.Context(), c, req); err == nil {
+		if _, err := prepareWorkspaceOptions(c, req); err == nil {
 			t.Fatal("unsupported network isolation accepted")
 		}
 	}
diff --git a/apps/daemon/internal/agent/mcode/workspace_skills_test.go b/apps/daemon/internal/agent/mcode/workspace_skills_test.go
index ed89e029f..0d7c9470d 100644
--- a/apps/daemon/internal/agent/mcode/workspace_skills_test.go
+++ b/apps/daemon/internal/agent/mcode/workspace_skills_test.go
@@ -28,7 +28,7 @@ func TestWorkspaceSkillsUseSelectedSnapshotAndNativeLoader(t *testing.T) {
 		Metadata: agentskill.Metadata{Name: "proof", Description: "Read a marker"},
 	}}
 	for range 2 {
-		opts, err := prepareWorkspaceOptions(t.Context(), c, req)
+		opts, err := prepareWorkspaceOptions(c, req)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/apps/daemon/internal/agent/runtime_paths.go b/apps/daemon/internal/agent/runtime_paths.go
index 5f78a1405..0ad41e2f0 100644
--- a/apps/daemon/internal/agent/runtime_paths.go
+++ b/apps/daemon/internal/agent/runtime_paths.go
@@ -8,12 +8,12 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
 )
 
-// ManagedSkillsRoot returns an adapter-owned skill directory scoped to one
-// agent state. It never derives runtime state from the subprocess cwd.
-func ManagedSkillsRoot(agentKind, agentStateKey, conversationID, runID string) (string, error) {
+// StateDir returns an adapter-owned state directory scoped to one agent
+// state. It never derives runtime state from the subprocess cwd.
+func StateDir(agentKind, agentStateKey, conversationID, runID string) (string, error) {
 	root, err := paths.Root()
 	if err != nil {
-		return "", fmt.Errorf("agent: resolve managed skills root: %w", err)
+		return "", fmt.Errorf("agent: resolve state directory: %w", err)
 	}
 	kind := safeRuntimePathPart(agentKind)
 	if kind == "" {
@@ -25,13 +25,13 @@ func ManagedSkillsRoot(agentKind, agentStateKey, conversationID, runID string) (
 		if len(parts) == 0 {
 			return "", fmt.Errorf("agent: invalid agent state key %q", agentStateKey)
 		}
-		return filepath.Join(append([]string{base, "state"}, append(parts, "skills")...)...), nil
+		return filepath.Join(append([]string{base, "state"}, parts...)...), nil
 	}
 	if id := safeRuntimePathPart(conversationID); id != "" {
-		return filepath.Join(base, "conv-"+id, "skills"), nil
+		return filepath.Join(base, "conv-"+id), nil
 	}
 	if id := safeRuntimePathPart(runID); id != "" {
-		return filepath.Join(base, "run-"+id, "skills"), nil
+		return filepath.Join(base, "run-"+id), nil
 	}
 	return "", fmt.Errorf("agent: agent state key, conversation id, or run id is required")
 }
diff --git a/apps/daemon/internal/agent/runtime_paths_test.go b/apps/daemon/internal/agent/runtime_paths_test.go
index 8cf35e5dc..2cc51981a 100644
--- a/apps/daemon/internal/agent/runtime_paths_test.go
+++ b/apps/daemon/internal/agent/runtime_paths_test.go
@@ -5,27 +5,27 @@ import (
 	"testing"
 )
 
-func TestManagedSkillsRootUsesStableAgentState(t *testing.T) {
+func TestStateDirUsesStableAgentState(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", home)
-	got, err := ManagedSkillsRoot("codex", "conv-1/agent-1/codex", "ignored", "ignored")
+	got, err := StateDir("codex", "conv-1/agent-1/codex", "ignored", "ignored")
 	if err != nil {
-		t.Fatalf("ManagedSkillsRoot: %v", err)
+		t.Fatalf("StateDir: %v", err)
 	}
-	want := filepath.Join(home, "runtime", "codex", "state", "conv-1", "agent-1", "codex", "skills")
+	want := filepath.Join(home, "runtime", "codex", "state", "conv-1", "agent-1", "codex")
 	if got != want {
 		t.Fatalf("root = %q, want %q", got, want)
 	}
 }
 
-func TestManagedSkillsRootSanitizesFallback(t *testing.T) {
+func TestStateDirSanitizesFallback(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", home)
-	got, err := ManagedSkillsRoot("fake_beta", "", "../conv name", "ignored")
+	got, err := StateDir("fake_beta", "", "../conv name", "ignored")
 	if err != nil {
-		t.Fatalf("ManagedSkillsRoot: %v", err)
+		t.Fatalf("StateDir: %v", err)
 	}
-	want := filepath.Join(home, "runtime", "fake_beta", "conv-.._conv_name", "skills")
+	want := filepath.Join(home, "runtime", "fake_beta", "conv-.._conv_name")
 	if got != want {
 		t.Fatalf("root = %q, want %q", got, want)
 	}
diff --git a/apps/daemon/internal/cli/agent_registration.go b/apps/daemon/internal/cli/agent_registration.go
index f2911f217..09472bf6e 100644
--- a/apps/daemon/internal/cli/agent_registration.go
+++ b/apps/daemon/internal/cli/agent_registration.go
@@ -2,15 +2,8 @@ package cli
 
 import "github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 
-func registerAgentKinds(registry *agent.Registry, discovery agentCLIDiscovery, serverURL string) {
+func registerAgentKinds(registry *agent.Registry, discovery agentCLIDiscovery) {
 	for _, discovered := range discovery {
-		runtime := discovered.runtime
-		if runtime.SessionCapabilityContext {
-			runtime.Session = withSkillUploadServer(withCapabilityDownloads(runtime.Session, serverURL), serverURL)
-		}
-		if runtime.Executor != nil && runtime.ExecutorCapabilityContext {
-			runtime.Executor = withExecutorCapabilities(runtime.Executor, serverURL)
-		}
-		registry.Register(discovered.declaration, runtime)
+		registry.Register(discovered.declaration, discovered.runtime)
 	}
 }
diff --git a/apps/daemon/internal/cli/capability_downloads.go b/apps/daemon/internal/cli/capability_downloads.go
deleted file mode 100644
index c6def5f15..000000000
--- a/apps/daemon/internal/cli/capability_downloads.go
+++ /dev/null
@@ -1,85 +0,0 @@
-package cli
-
-import (
-	"context"
-	"maps"
-	"net"
-	"net/url"
-	"slices"
-	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-// Use the paired server address for loopback PG downloads: inside Compose,
-// the public loopback address points to the runtime container itself.
-func withCapabilityDownloads(factory agent.Factory, serverURL string) agent.Factory {
-	base, err := url.Parse(serverURL)
-	if err != nil || base.Host == "" || (base.Scheme != "http" && base.Scheme != "https") {
-		return factory
-	}
-	return func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		req = capabilityDownloadRequest(req, base)
-		return factory(ctx, req, out)
-	}
-}
-
-func capabilityDownloadURL(raw string, base *url.URL) string {
-	u, err := url.Parse(raw)
-	if err != nil || (u.Scheme != "http" && u.Scheme != "https") {
-		return raw
-	}
-	host := u.Hostname()
-	if !strings.EqualFold(host, "localhost") && !net.ParseIP(host).IsLoopback() {
-		return raw
-	}
-	const blobPath = "/internal/blobs/pg:"
-	start := strings.Index(u.Path, blobPath)
-	if start < 0 {
-		return raw
-	}
-	u.Scheme, u.Host, u.User = base.Scheme, base.Host, nil
-	u.Path = strings.TrimRight(base.Path, "/") + u.Path[start:]
-	u.RawPath = ""
-	return u.String()
-}
-
-func capabilityDownloadRequest(req proto.PromptRequestPayload, base *url.URL) proto.PromptRequestPayload {
-	opts := maps.Clone(req.AgentOptions)
-	for _, key := range []string{"skills", "plugins"} {
-		items, ok := opts[key].([]any)
-		if !ok {
-			continue
-		}
-		items = slices.Clone(items)
-		for i, item := range items {
-			descriptor, ok := item.(map[string]any)
-			if !ok {
-				continue
-			}
-			raw, _ := descriptor["download_url"].(string)
-			if resolved := capabilityDownloadURL(raw, base); resolved != raw {
-				updated := maps.Clone(descriptor)
-				updated["download_url"] = resolved
-				items[i] = updated
-			}
-		}
-		opts[key] = items
-	}
-	req.AgentOptions = opts
-	return req
-}
-
-// Executor setup applies the same immutable capability snapshot as ordinary execution.
-func withExecutorCapabilities(factory agent.ExecutorFactory, serverURL string) agent.ExecutorFactory {
-	base, err := url.Parse(serverURL)
-	valid := err == nil && base.Host != "" && (base.Scheme == "http" || base.Scheme == "https")
-	return func(ctx context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
-		if valid {
-			req = capabilityDownloadRequest(req, base)
-		}
-		req = skillUploadRequest(req, serverURL)
-		return factory(ctx, req)
-	}
-}
diff --git a/apps/daemon/internal/cli/capability_downloads_test.go b/apps/daemon/internal/cli/capability_downloads_test.go
deleted file mode 100644
index ecdcbc22f..000000000
--- a/apps/daemon/internal/cli/capability_downloads_test.go
+++ /dev/null
@@ -1,115 +0,0 @@
-package cli
-
-import (
-	"archive/zip"
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent/managedskills"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func TestCapabilityDownloadUsesPairedServerOnlyForLoopbackPG(t *testing.T) {
-	base, _ := url.Parse("https://parsar.example.test/team")
-	for _, tc := range []struct{ raw, want string }{
-		{"http://127.0.0.1:28080/internal/blobs/pg:id?token=a%2Bb", "https://parsar.example.test/team/internal/blobs/pg:id?token=a%2Bb"},
-		{"http://localhost:28080/old/internal/blobs/pg:id?token=a", "https://parsar.example.test/team/internal/blobs/pg:id?token=a"},
-		{"http://[::1]:28080/internal/blobs/pg:id?token=a", "https://parsar.example.test/team/internal/blobs/pg:id?token=a"},
-		{"https://bucket.example.test/skill.zip?Signature=a", "https://bucket.example.test/skill.zip?Signature=a"},
-		{"http://localhost:28080/other.zip", "http://localhost:28080/other.zip"},
-		{"https://public.example.test/internal/blobs/pg:id?token=a", "https://public.example.test/internal/blobs/pg:id?token=a"},
-		{"file:///internal/blobs/pg:id", "file:///internal/blobs/pg:id"},
-	} {
-		if got := capabilityDownloadURL(tc.raw, base); got != tc.want {
-			t.Errorf("%s: got %s, want %s", tc.raw, got, tc.want)
-		}
-	}
-}
-
-func TestCapabilityDownloadsInstallZIPThroughPairedServer(t *testing.T) {
-	var archive bytes.Buffer
-	w := zip.NewWriter(&archive)
-	for name, content := range map[string]string{
-		"SKILL.md":             "---\nname: qa-download\ndescription: Test downloaded context\n---\nRead references/policy.md.\n",
-		"references/policy.md": "Collect the laptop on the third working day.\n",
-	} {
-		file, err := w.Create(name)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := file.Write([]byte(content)); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := w.Close(); err != nil {
-		t.Fatal(err)
-	}
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/team/internal/blobs/pg:test" || r.URL.RawQuery != "token=synthetic%2Bsignature" {
-			t.Errorf("download request changed signed resource: %s", r.URL)
-			http.Error(w, "unexpected request", http.StatusForbidden)
-			return
-		}
-		_, _ = w.Write(archive.Bytes())
-	}))
-	defer server.Close()
-	root := t.TempDir()
-	rawURL := "http://127.0.0.1:1/internal/blobs/pg:test?token=synthetic%2Bsignature"
-	descriptor := map[string]any{"name": "qa-download", "version": "1.0.0", "download_url": rawURL, "sha256": fmt.Sprintf("%x", sha256.Sum256(archive.Bytes()))}
-	opts := map[string]any{"skills": []any{descriptor}, "plugins": []any{descriptor}, "model": "preserved"}
-	factory := withCapabilityDownloads(func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		if req.RunID != "run-test" || req.AgentOptions["model"] != "preserved" {
-			t.Fatal("unrelated request fields changed")
-		}
-		plugin := req.AgentOptions["plugins"].([]any)[0].(map[string]any)
-		skill := req.AgentOptions["skills"].([]any)[0].(map[string]any)
-		if plugin["download_url"] != skill["download_url"] {
-			t.Fatal("plugin and skill routing differs")
-		}
-		result, err := managedskills.InstallManagedSkills(ctx, nil, root, req.AgentOptions["skills"])
-		if err == nil && len(result.Warnings) > 0 {
-			err = fmt.Errorf("installation warnings: %v", result.Warnings)
-		}
-		return nil, err
-	}, server.URL+"/team")
-	if _, err := factory(context.Background(), proto.PromptRequestPayload{RunID: "run-test", AgentOptions: opts}, nil); err != nil {
-		t.Fatal(err)
-	}
-	content, err := os.ReadFile(filepath.Join(root, "qa-download", "references", "policy.md"))
-	if err != nil || string(content) != "Collect the laptop on the third working day.\n" {
-		t.Fatalf("installed reference: %q, %v", content, err)
-	}
-	if descriptor["download_url"] != rawURL {
-		t.Fatal("rewrote the original request options")
-	}
-}
-
-func TestExecutorPreparationUsesCapabilitySnapshotTransform(t *testing.T) {
-	originalURL := "http://localhost:8080/internal/blobs/pg:skill"
-	descriptor := map[string]any{"download_url": originalURL}
-	source := proto.PromptRequestPayload{AgentOptions: map[string]any{"skills": []any{descriptor}}}
-	calls := 0
-	factory := withExecutorCapabilities(func(_ context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
-		calls++
-		actual := req.AgentOptions["skills"].([]any)[0].(map[string]any)["download_url"]
-		if actual != "http://paired-core:8080/internal/blobs/pg:skill" {
-			t.Fatalf("executor capability URL = %v", actual)
-		}
-		return nil, nil
-	}, "http://paired-core:8080")
-	if _, err := factory(t.Context(), source); err != nil {
-		t.Fatal(err)
-	}
-	if calls != 1 || descriptor["download_url"] != originalURL {
-		t.Fatal("preparation changed the source snapshot or repeated setup")
-	}
-}
diff --git a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
index 7c4899315..3b8a14647 100644
--- a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
+++ b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
@@ -72,7 +72,7 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 	run := func(index int, prompt, resume string, callFunction, cancelOnText bool) execution {
 		t.Helper()
 		reg := agent.NewRegistry()
-		registerAgentKinds(reg, discovery, "https://product.invalid")
+		registerAgentKinds(reg, discovery)
 		reg = authoringRegistry(reg, authoring.New(nil))
 		sender := make(registeredSDKSender, 256)
 		router, err := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
diff --git a/apps/daemon/internal/cli/companion_path.go b/apps/daemon/internal/cli/companion_path.go
new file mode 100644
index 000000000..d83814828
--- /dev/null
+++ b/apps/daemon/internal/cli/companion_path.go
@@ -0,0 +1,18 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+)
+
+func addCompanionCLIPath(env map[string]any, dir string) {
+	info, err := os.Stat(filepath.Join(dir, "parsar"))
+	if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0o111 == 0 {
+		return
+	}
+	path, ok := env["PATH"].(string)
+	if !ok {
+		path = os.Getenv("PATH")
+	}
+	env["PATH"] = dir + string(os.PathListSeparator) + path
+}
diff --git a/apps/daemon/internal/cli/connect.go b/apps/daemon/internal/cli/connect.go
index 7fb6e82f8..ae295f0aa 100644
--- a/apps/daemon/internal/cli/connect.go
+++ b/apps/daemon/internal/cli/connect.go
@@ -327,7 +327,7 @@ func mainLoopRemote(parent context.Context, rc *runContext, profile string, prof
 	obslog.Bg().Info("bootstrap ok", "device_id", boot.DeviceID, "ws_url", wsURL, "heartbeat_interval", boot.HeartbeatInterval())
 
 	registry := agent.NewRegistry()
-	registerAgentKinds(registry, agentCLIs, prof.ServerURL)
+	registerAgentKinds(registry, agentCLIs)
 
 	control, err := newSuspendControl()
 	if err != nil {
diff --git a/apps/daemon/internal/cli/native_discovery_test.go b/apps/daemon/internal/cli/native_discovery_test.go
index 8063e0dbd..e6d9e0dee 100644
--- a/apps/daemon/internal/cli/native_discovery_test.go
+++ b/apps/daemon/internal/cli/native_discovery_test.go
@@ -40,7 +40,7 @@ func TestDiscoveryAndRegistration(t *testing.T) {
 				t.Fatalf("probes %v, want %v", called, expected)
 			}
 			registry := agent.NewRegistry()
-			registerAgentKinds(registry, discovery, "")
+			registerAgentKinds(registry, discovery)
 			if len(registry.Kinds()) != len(expected) {
 				t.Fatal(registry.Kinds())
 			}
diff --git a/apps/daemon/internal/cli/preparation_test.go b/apps/daemon/internal/cli/preparation_test.go
index 2fdb8a189..df9082731 100644
--- a/apps/daemon/internal/cli/preparation_test.go
+++ b/apps/daemon/internal/cli/preparation_test.go
@@ -24,7 +24,7 @@ func TestPreparationRegistrationBypassesProductWrappers(t *testing.T) {
 			runtime.Preparation = func(context.Context, proto.PromptRequestPayload) (agent.Prepared, error) { return nil, nil }
 			runtime.WorkspaceReadPreparation = true
 		}
-		registerAgentKinds(reg, agentCLIDiscovery{{declaration: agent.Declaration{Info: info}, runtime: runtime}}, "http://unreachable.invalid")
+		registerAgentKinds(reg, agentCLIDiscovery{{declaration: agent.Declaration{Info: info}, runtime: runtime}})
 
 		_, err := reg.ResolvePreparation("codex")
 		if (err == nil) != supported {
diff --git a/apps/daemon/internal/cli/skill_upload.go b/apps/daemon/internal/cli/skill_upload.go
deleted file mode 100644
index cdb7ef279..000000000
--- a/apps/daemon/internal/cli/skill_upload.go
+++ /dev/null
@@ -1,44 +0,0 @@
-package cli
-
-import (
-	"context"
-	"maps"
-	"os"
-	"path/filepath"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func withSkillUploadServer(factory agent.Factory, serverURL string) agent.Factory {
-	return func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		req = skillUploadRequest(req, serverURL)
-		return factory(ctx, req, out)
-	}
-}
-
-func addCompanionCLIPath(env map[string]any, dir string) {
-	info, err := os.Stat(filepath.Join(dir, "parsar"))
-	if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0o111 == 0 {
-		return
-	}
-	path, ok := env["PATH"].(string)
-	if !ok {
-		path = os.Getenv("PATH")
-	}
-	env["PATH"] = dir + string(os.PathListSeparator) + path
-}
-
-func skillUploadRequest(req proto.PromptRequestPayload, serverURL string) proto.PromptRequestPayload {
-	env, _ := req.AgentOptions["env"].(map[string]any)
-	if token, _ := env["PARSAR_CAPABILITY_UPLOAD_TOKEN"].(string); token != "" {
-		env = maps.Clone(env)
-		env["PARSAR_SERVER_URL"] = serverURL
-		if executable, err := os.Executable(); err == nil {
-			addCompanionCLIPath(env, filepath.Dir(executable))
-		}
-		req.AgentOptions = maps.Clone(req.AgentOptions)
-		req.AgentOptions["env"] = env
-	}
-	return req
-}
diff --git a/apps/daemon/internal/cli/skill_upload_test.go b/apps/daemon/internal/cli/skill_upload_test.go
deleted file mode 100644
index ef8fc3921..000000000
--- a/apps/daemon/internal/cli/skill_upload_test.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package cli
-
-import (
-	"context"
-	"os"
-	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func TestSkillUploadUsesPairedAddressPerRequest(t *testing.T) {
-	t.Setenv("PARSAR_SERVER_URL", "unchanged-process-env")
-	env := map[string]any{"PARSAR_CAPABILITY_UPLOAD_TOKEN": "run-a", "PARSAR_SERVER_URL": "http://localhost:1234", "MODEL_KEY": "preserve"}
-	opts := map[string]any{"env": env, "model": "preserve"}
-	calls := 0
-	factory := withSkillUploadServer(func(_ context.Context, req proto.PromptRequestPayload, _ chan<- proto.Envelope) (agent.Session, error) {
-		calls++
-		if calls == 1 {
-			got := req.AgentOptions["env"].(map[string]any)
-			if got["PARSAR_SERVER_URL"] != "http://parsar-server:8080" || got["PARSAR_CAPABILITY_UPLOAD_TOKEN"] != "run-a" || got["MODEL_KEY"] != "preserve" || req.AgentOptions["model"] != "preserve" {
-				t.Fatal("per-run context incorrect")
-			}
-			if _, exists := got["PARSAR_RUNNER_TOKEN"]; exists {
-				t.Fatal("exported device credential")
-			}
-		} else if len(req.AgentOptions) != 0 {
-			t.Fatal("previous run's context leaked")
-		}
-		return nil, nil
-	}, "http://parsar-server:8080")
-	if _, err := factory(t.Context(), proto.PromptRequestPayload{AgentOptions: opts}, nil); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := factory(t.Context(), proto.PromptRequestPayload{}, nil); err != nil {
-		t.Fatal(err)
-	}
-	if env["PARSAR_SERVER_URL"] != "http://localhost:1234" || os.Getenv("PARSAR_SERVER_URL") != "unchanged-process-env" {
-		t.Fatal("mutated caller or process environment")
-	}
-}
diff --git a/apps/daemon/internal/dispatch/environment.go b/apps/daemon/internal/dispatch/environment.go
index 3b0cb4b91..932ad7649 100644
--- a/apps/daemon/internal/dispatch/environment.go
+++ b/apps/daemon/internal/dispatch/environment.go
@@ -7,6 +7,9 @@ import (
 )
 
 func validateExecutionEnvironment(req proto.PromptRequestPayload, caps proto.AgentKindCapabilities) error {
+	if err := req.ValidateAgentOptions(); err != nil {
+		return err
+	}
 	if err := req.ValidateProgrammaticToolCallingDisable(caps.ProgrammaticToolCallingDisable.IsSupported()); err != nil {
 		return err
 	}
diff --git a/apps/daemon/internal/dispatch/executor.go b/apps/daemon/internal/dispatch/executor.go
index 90544c9a7..4e7389cc4 100644
--- a/apps/daemon/internal/dispatch/executor.go
+++ b/apps/daemon/internal/dispatch/executor.go
@@ -60,7 +60,7 @@ func (r *Router) handleExecutorPrepare(ctx context.Context, env proto.Envelope,
 	if err != nil {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
-	if validateExecutionEnvironment(req, caps) != nil || len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported() {
+	if (req.LocalEnvironment != nil) == req.DisableExecutionEnvironment || validateExecutionEnvironment(req, caps) != nil || len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported() {
 		return r.rejectPreparation(env, "unsupported_configuration")
 	}
 	fingerprint, err := executorFingerprint(req)
diff --git a/apps/daemon/internal/dispatch/executor_test.go b/apps/daemon/internal/dispatch/executor_test.go
index 66ec59fba..c8db7c741 100644
--- a/apps/daemon/internal/dispatch/executor_test.go
+++ b/apps/daemon/internal/dispatch/executor_test.go
@@ -294,6 +294,25 @@ func TestExecutorRejectsSessionStateScopeMismatch(t *testing.T) {
 	}
 }
 
+func TestExecutorRejectsUnsupportedConfigurationBeforeFactory(t *testing.T) {
+	for name, change := range map[string]func(*proto.PromptRequestPayload){
+		"no environment":       func(r *proto.PromptRequestPayload) { r.DisableExecutionEnvironment = false },
+		"unknown agent option": func(r *proto.PromptRequestPayload) { r.AgentOptions = map[string]any{"mode": "plan"} },
+	} {
+		t.Run(name, func(t *testing.T) {
+			r, s, calls := executorRouter(t, &reusableExecutor{}, time.Minute)
+			req := executorRequest()
+			change(&req.Configuration)
+			if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "request", req)); err == nil {
+				t.Fatal("unsupported configuration accepted")
+			}
+			if status := waitPreparationStatus(t, s, "request", "rejected", ""); status.ErrorCode != "unsupported_configuration" || calls.Load() != 0 {
+				t.Fatalf("status=%+v factory calls=%d", status, calls.Load())
+			}
+		})
+	}
+}
+
 func TestExecutorRejectsOutputFromAnotherTurn(t *testing.T) {
 	e := &reusableExecutor{starts: make(chan *reusableTurn, 1)}
 	r, s, _ := executorRouter(t, e, time.Minute)
diff --git a/contracts/agents-api/harness-onboarding.md b/contracts/agents-api/harness-onboarding.md
index c382061cf..0d6fba074 100644
--- a/contracts/agents-api/harness-onboarding.md
+++ b/contracts/agents-api/harness-onboarding.md
@@ -151,7 +151,7 @@ A Harness that supports the Subagent reads implements the [neutral observation c
 
 Registration is static and requires a build. Export one `agent.Declaration` from `apps/daemon/internal/agent/<kind>/declaration.go`, then add it to `harnessDeclarations` in [`cli/agent_discovery.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_discovery.go). The declaration contains the kind and complete capability descriptor, the shared model `Configuration` and a `Discover` function. Discovery receives the profile and diagnostic writers, owns native configuration and availability checks, and returns the installed `agent.Runtime` with its descriptor and session, preparation and Executor factories. Return nil when the adapter is not configured; return an unavailable descriptor with a session factory when configured prerequisites fail. Keep version gates and factory-selection conditions inside the adapter.
 
-`Runtime.SessionCapabilityContext` and `Runtime.ExecutorCapabilityContext` explicitly request capability-download URL resolution and scoped product-upload context for the corresponding execution factory. Preparation never receives those effects. An adapter that supports product workspace authoring declares `WorkspaceAuthoring` itself; common registration does not grant it.
+An adapter that supports product workspace authoring declares `WorkspaceAuthoring` itself; common registration does not grant it.
 
 [`cli/agent_registration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_registration.go) iterates the discovered runtimes and calls `Registry.Register` from `agent/harness.go`. It verifies that discovery retained the declared kind and installs factories in this order:
 
diff --git a/contracts/agents-api/zh/harness-onboarding.md b/contracts/agents-api/zh/harness-onboarding.md
index 169fc2566..b22b086bf 100644
--- a/contracts/agents-api/zh/harness-onboarding.md
+++ b/contracts/agents-api/zh/harness-onboarding.md
@@ -1,7 +1,7 @@
 ---
 title: "将原生 Harness 添加到 OpenAgentCore"
 source: contracts/agents-api/harness-onboarding.md
-source_hash: bcc38731520dd485fa91b3d897774da397a1a2ddfa866d1c01e1cc91e348bd97
+source_hash: 32adff66e2fb33956e96f9a453518d70a3f87056eb777e82a60e087fe4e5aa31
 ---
 
 **Harness** 是一种运行模型和工具循环的原生代理引擎（Codex、Claude Code、MiniMax Code）。**Harness 适配器**将 Runtime 的 Executor 和 Turn 契约转换到该引擎的 SDK 或协议。本文档定义 Runtime–Harness 协议：适配器接口及其生命周期义务、注册、Core 资格认定和验收。[Harness capabilities](harness-capabilities.md) 记录了当前每个 Harness 支持的功能。
@@ -153,7 +153,7 @@ MCP、公共函数、延迟函数发现、结构化输出、图像输入、详
 
 注册是静态的，并且需要构建。从 `apps/daemon/internal/agent/<kind>/declaration.go` 导出一个 `agent.Declaration`，然后将其添加到 [`cli/agent_discovery.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_discovery.go) 的 `harnessDeclarations` 中。声明包含 kind、完整能力描述符、共享模型 `Configuration` 和 `Discover` 函数。发现过程接收 profile 和诊断写入器，负责原生配置和可用性检查，并返回已安装的 `agent.Runtime` 及其描述符、session 工厂、准备工厂和 Executor 工厂。未配置适配器时返回 nil；已配置的前置条件失败时，返回不可用描述符和 session 工厂。将版本门控和工厂选择条件保留在适配器内部。
 
-`Runtime.SessionCapabilityContext` 和 `Runtime.ExecutorCapabilityContext` 会为相应的执行工厂显式请求能力下载 URL 解析和限定范围的产品上传上下文。准备过程绝不会收到这些影响。支持产品工作区创作功能的适配器自行声明 `WorkspaceAuthoring`；通用注册不会授予该能力。
+支持产品工作区创作功能的适配器自行声明 `WorkspaceAuthoring`；通用注册不会授予该能力。
 
 [`cli/agent_registration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_registration.go) 遍历已发现的 Runtime，并调用 `agent/harness.go` 中的 `Registry.Register`。它验证发现过程是否保留了声明的 kind，并按以下顺序安装工厂：
 
diff --git a/docs/runtime-protocol.md b/docs/runtime-protocol.md
index aa2cb8441..a0398c22a 100644
--- a/docs/runtime-protocol.md
+++ b/docs/runtime-protocol.md
@@ -57,6 +57,7 @@ The prompt request (`prompt_request`, or the configuration of `execution_prepare
 
 | Field | Set by Core |
 | --- | --- |
+| `agent_options` | Always `model` and `system_prompt` from the Agent; `model_provider` when the Session froze one; `harness_config` when the Agent sets `x_agents_core.harness_config`. Core sends no other key; the Runtime rejects any other key with `unsupported_configuration` before preparation |
 | `execution_controls` | Always: web search `disabled`, the resolved text verbosity (default `medium`), an explicit programmatic-tool-calling disable and any `json_schema` output format. Native option names belong to the adapter |
 | `observe_tool_observations` | Always. Tool-call frames then carry the engine-neutral `observation` |
 | `observe_messages` | When the Runtime declares `message_items`. Text deltas then carry the native item ID, and `output_message` frames report message start, completion, phase and the completion text |
@@ -66,6 +67,8 @@ The prompt request (`prompt_request`, or the configuration of `execution_prepare
 | `strict_resume`, `require_existing_native_session` | Always strict; the second when a native Session must be recovered |
 | `durable_receipt` on `prompt_steer` | For every active input Core delivers |
 
+An execution configuration requires exactly one of `local_environment` and `disable_execution_environment`; `execution_prepare` rejects neither or both with `unsupported_configuration`.
+
 Requests without an opt-in keep the frames and fields they had without it.
 
 ## Envelope and identity
diff --git a/docs/zh/runtime-protocol.md b/docs/zh/runtime-protocol.md
index 8a3077ceb..050b36d91 100644
--- a/docs/zh/runtime-protocol.md
+++ b/docs/zh/runtime-protocol.md
@@ -1,7 +1,7 @@
 ---
 title: "Core–Runtime 协议"
 source: docs/runtime-protocol.md
-source_hash: cbc3c6419e2d4991df82d5bbfe3b556d35cccb57d1e4e7437facca7487caabcc
+source_hash: 13766041c9ed0c012ceb5051fe43dcc8a1738a198fe325aad15f1902fe373ee3
 ---
 
 此协议在 Runtime daemon 获取机器凭据后连接 Core 与 daemon，定义 daemon 连接上消息的含义和顺序。wire 类型、限制和验证器仅在 [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto) 中定义一次；Core 的 [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) 与参考 Runtime 的 [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch) 都使用它们，因此无需同步第二套 payload schema。签发凭据和打开连接的 HTTP 路由见[机器连接 API](../../contracts/agents-api/zh/machine-api.md)。
@@ -59,6 +59,7 @@ prompt 请求（`prompt_request` 或 `execution_prepare` 的配置）携带 Core
 
 | 字段 | Core 设置方式 |
 | --- | --- |
+| `agent_options` | 始终设置 Agent 的 `model` 和 `system_prompt`；Session 冻结了 model provider 时设置 `model_provider`；Agent 设置 `x_agents_core.harness_config` 时设置 `harness_config`。Core 不发送其他键；Runtime 在准备之前以 `unsupported_configuration` 拒绝任何其他键 |
 | `execution_controls` | 始终设置：web search 为 `disabled`、解析后的 text verbosity（默认 `medium`）、明确禁用 programmatic tool calling，以及任何 `json_schema` 输出格式。原生选项名称由 adapter 负责 |
 | `observe_tool_observations` | 始终设置。tool-call frame 随后携带与 engine 无关的 `observation` |
 | `observe_messages` | Runtime 声明 `message_items` 时设置。文本 delta 随后携带原生 item ID，`output_message` frame 报告消息开始、完成、phase 和完成文本 |
@@ -68,6 +69,8 @@ prompt 请求（`prompt_request` 或 `execution_prepare` 的配置）携带 Core
 | `strict_resume`, `require_existing_native_session` | 始终严格；需要恢复原生 Session 时设置第二项 |
 | `prompt_steer` 上的 `durable_receipt` | Core 交付的每个活动输入都设置 |
 
+执行配置必须且只能包含 `local_environment` 和 `disable_execution_environment` 之一；两者都缺失或同时存在时，`execution_prepare` 以 `unsupported_configuration` 拒绝。
+
 未携带显式启用项的请求保留未启用时的 frame 和字段。
 
 ## Envelope 与身份 {#envelope-and-identity}
diff --git a/internal/agentdaemon/proto/outbound.go b/internal/agentdaemon/proto/outbound.go
index 041492308..8f5db4e41 100644
--- a/internal/agentdaemon/proto/outbound.go
+++ b/internal/agentdaemon/proto/outbound.go
@@ -1,6 +1,9 @@
 package proto
 
-import "encoding/json"
+import (
+	"encoding/json"
+	"errors"
+)
 
 // Type constants for server → daemon frames.
 const (
@@ -53,10 +56,8 @@ type PromptRequestPayload struct {
 	// Input preserves ordered user messages and content.
 	Input MessageInput `json:"input,omitempty"`
 
-	// AgentOptions carries agent-specific overrides (model, mode,
-	// allowed_tools, system_prompt, mcp_servers, plugin_dirs, env,
-	// ...). The daemon's agent interprets these; the gateway never
-	// inspects them.
+	// AgentOptions carries only the keys ValidateAgentOptions accepts. The
+	// daemon's agent interprets them; the gateway never inspects them.
 	AgentOptions map[string]any `json:"agent_options,omitempty"`
 
 	// ExecutionControls are authoritative engine-neutral settings, translated by the adapter.
@@ -141,3 +142,16 @@ type OutputFormat struct {
 	Type   string          `json:"type"`
 	Schema json.RawMessage `json:"schema"`
 }
+
+// ValidateAgentOptions rejects any agent_options key other than model,
+// system_prompt, model_provider and harness_config.
+func (r PromptRequestPayload) ValidateAgentOptions() error {
+	for key := range r.AgentOptions {
+		switch key {
+		case "model", "system_prompt", "model_provider", "harness_config":
+		default:
+			return errors.New("unsupported agent option")
+		}
+	}
+	return nil
+}
diff --git a/packages/claude-sdk-adapter/README.md b/packages/claude-sdk-adapter/README.md
index 880cc927d..feca4d537 100644
--- a/packages/claude-sdk-adapter/README.md
+++ b/packages/claude-sdk-adapter/README.md
@@ -66,7 +66,7 @@ Workspace deferred-function discovery uses native ToolSearch alongside the norma
 
 For unmanaged bootstrap, daemon `connect` optionally registers this factory as `claude_sdk` when the operator sets `OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT` to the absolute packaged `dist/main.js`. `OAC_RUNTIME_CLAUDE_SDK_NODE` selects Node (default: `node` on PATH). Discovery resolves Node once and checks that exact configuration before pairing; the SDK's bounded runtime check is independent of CLI version probes. A ready SDK alone is sufficient to start the daemon. No configuration means no SDK probe or descriptor; failed readiness reports an unavailable descriptor with a rejecting factory. Runtime checks establish local readiness, not provider authentication. Installed daemons use `start` and their verified installation manifest for adapter selection and activation; ambient activation variables cannot extend that selection. See [the native installation contract](../../deploy/README.md#native-daemon-installer).
 
-SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in pairing profiles. The daemon registers `claude_sdk` directly, without the capability-download, skill-upload and `WorkspaceAuthoring` wrappers of its product agent kinds. It accepts no caller-supplied environment variables or business write authority.
+SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in pairing profiles. The daemon registers `claude_sdk` directly, without the `WorkspaceAuthoring` wrapper of its product agent kinds. It accepts no caller-supplied environment variables or business write authority.
 
 ### Descriptor and execution profile
 
diff --git a/scripts/name-allowlist.json b/scripts/name-allowlist.json
index 2468c8388..23ac631c9 100644
--- a/scripts/name-allowlist.json
+++ b/scripts/name-allowlist.json
@@ -39,11 +39,6 @@
     "regex": "(?i)parsar|\\bAGENTS_CORE_WEB_[A-Z][A-Z0-9_]*|\\bAGENTS_API_[A-Z][A-Z0-9_]*|\\bCORE_CONSOLE_[A-Z][A-Z0-9_]*|\\bagents-api(?:-(?:migrate|device|environment-key|e2b-provider|microsandbox-provider|tool-root|codex-directory|codex-write|workspace-export|runtime-initialize|claude-shell-prefix))?\\b|\\bcore-console\\b|\\bagents-runtime-|\\bAgents? Core(?: Web)?\\b|@agents-core-web/|\\bminimax-ai-dev\\b",
     "reason": "Guard regression fixtures intentionally contain retired identifiers, including rejected examples."
   },
-  {
-    "path": "apps/daemon/internal/cli/skill_upload*.go",
-    "regex": "\\bPARSAR_(?:CAPABILITY_UPLOAD_TOKEN|SERVER_URL)\\b",
-    "reason": "These settings belong to the separate product capability upload integration; Core does not rename their protocol."
-  },
   {
     "path": "services/core/migrations/000078_oac_runtime_names.sql",
     "regex": "parsar-core-runtime@",
@@ -150,24 +145,14 @@
     "reason": "Historical migration commentary records the environment name used when this migration was written."
   },
   {
-    "path": "apps/daemon/internal/cli/skill_upload.go",
-    "regex": "parsar(?:-server|\\.example\\.test)?|PARSAR_RUNNER_TOKEN",
-    "reason": "The dormant product capability upload/download integration locates the separate product CLI and checks its product credentials; it is explicitly retained."
-  },
-  {
-    "path": "apps/daemon/internal/cli/skill_upload_test.go",
-    "regex": "parsar(?:-server|\\.example\\.test)?|PARSAR_RUNNER_TOKEN",
-    "reason": "The dormant product capability upload/download integration locates the separate product CLI and checks its product credentials; it is explicitly retained."
+    "path": "apps/daemon/internal/cli/companion_path.go",
+    "regex": "\\bparsar\\b",
+    "reason": "The authoring bridge puts the separate product CLI on PATH; that CLI keeps its own name."
   },
   {
     "path": "apps/daemon/internal/cli/companion_path_test.go",
-    "regex": "parsar(?:-server|\\.example\\.test)?|PARSAR_RUNNER_TOKEN",
-    "reason": "The dormant product capability upload/download integration locates the separate product CLI and checks its product credentials; it is explicitly retained."
-  },
-  {
-    "path": "apps/daemon/internal/cli/capability_downloads_test.go",
-    "regex": "parsar(?:-server|\\.example\\.test)?|PARSAR_RUNNER_TOKEN",
-    "reason": "The dormant product capability upload/download integration locates the separate product CLI and checks its product credentials; it is explicitly retained."
+    "regex": "\\bparsar\\b",
+    "reason": "The authoring bridge puts the separate product CLI on PATH; that CLI keeps its own name."
   },
   {
     "path": "CONTRIBUTING.md",
diff --git a/services/core/deploy/codex/README.md b/services/core/deploy/codex/README.md
index 42ef10922..ac0c9c78b 100644
--- a/services/core/deploy/codex/README.md
+++ b/services/core/deploy/codex/README.md
@@ -16,9 +16,9 @@ Each Session has its own `CODEX_HOME` at `$OAC_RUNTIME_HOME/daemon/agent-session
 
 ## Execution controls
 
-The adapter applies Core's typed controls and opt-ins, described in the [Runtime protocol](../../../../docs/runtime-protocol.md#capability-declarations), through native Codex settings on both new and resumed Turns. Explicit controls take precedence over adapter options without changing them.
+The adapter applies Core's typed controls and opt-ins, described in the [Runtime protocol](../../../../docs/runtime-protocol.md#capability-declarations), through native Codex settings on both new and resumed Turns.
 
-- **`environment: none`.** The daemon forces `CODEX_EXEC_SERVER_URL=none` after the caller's environment options and confirms that Codex reports its `local` and `remote` environments as unknown before it starts or resumes a thread; a binary that cannot do this fails closed. The engine process runs on the bound device, which is not a user execution environment.
+- **`environment: none`.** The daemon forces `CODEX_EXEC_SERVER_URL=none` and confirms that Codex reports its `local` and `remote` environments as unknown before it starts or resumes a thread; a binary that cannot do this fails closed. The engine process runs on the bound device, which is not a user execution environment.
 - **Web search.** The control becomes Codex's `web_search` option (`disabled`, `cached` or `live`); Core sends `disabled`.
 - **Programmatic tool calling.** An explicit disable turns off the native `code_mode`, `code_mode_only` and `code_mode_prewarm` features and checks managed requirements before a thread starts or resumes, rejecting a conflicting requirement.
 - **Text verbosity.** The adapter reads the model catalog with `codex debug models`, checks the model's support and pins that catalog snapshot for the execution. The probe needs Unix process-group cancellation, so other hosts do not declare `text_verbosity`. For a model without declared verbosity support, including Codex's unknown-model fallback, `medium` omits the override and keeps native default text; a supported model receives an explicit `medium`. Unsupported `low` or `high` and an unreadable catalog fail before model execution.
@@ -26,7 +26,7 @@ The adapter applies Core's typed controls and opt-ins, described in the [Runtime
 
 ## MCP servers
 
-A typed MCP declaration replaces operator MCP options. The adapter renders it with the native renderer and the original tool names for `enabled_tools`, including `[]`. Before creating or resuming a thread it reads native `config/read` with the exact cwd and rejects additional servers or any difference in the effective configuration. It disables native plugins and apps, selects file-only MCP credentials, and rejects existing credentials in the private native home without deleting them or native history. Reserved native labels are an adapter restriction, not a rule of the saved resource. The check is a snapshot, not a barrier against concurrent operator configuration changes, and discovery of a deny-all server can still contact it.
+The adapter renders a typed MCP declaration with the native renderer and the original tool names for `enabled_tools`, including `[]`. Before creating or resuming a thread it reads native `config/read` with the exact cwd and rejects additional servers or any difference in the effective configuration. It disables native plugins and apps, selects file-only MCP credentials, and rejects existing credentials in the private native home without deleting them or native history. Reserved native labels are an adapter restriction, not a rule of the saved resource. The check is a snapshot, not a barrier against concurrent operator configuration changes, and discovery of a deny-all server can still contact it.
 
 With `required: true`, which needs `mcp_http_required`, root thread creation and cold resume wait for required servers to initialize and send no native Turn until they do; a failed strict resume is never replaced with a new thread. Public work may already be accepted while initialization waits.
 

From 59dc3831d141db65a2f5e0e795b3f5e9acd03803 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 15:19:14 +0800
Subject: [PATCH 5/9] Delete prompt request fields Core never sends (#469)

Core never sets workspace_authoring and always sends strict_resume and
observe_tool_observations as true, so the Runtime carried code paths that
no Core request reaches. Delete them and keep only the behavior Core uses:

- Workspace authoring: the proto messages and socket variable, the
  WorkspaceAuthoring request field and capability, the daemon authoring
  bridge, its CLI wiring and companion PATH helper, the env agent option
  that only the bridge injected, and Core's capability copy and
  authoring_request rejection case.
- strict_resume: resume and recovery are always strict; mcode always runs
  its protected execution profile.
- observe_tool_observations: adapters always attach the neutral
  observation to tool_call frames.
- Codex and the shared StateDir no longer derive legacy state keys from
  the conversation or run; an empty agent state key is rejected.
- clirunner always owns the child's process group (a Job object on
  Windows), because every caller now requests it.

The Core-Runtime protocol doc, Harness onboarding, CONTRIBUTING and the
Claude SDK adapter README drop the deleted fields and features.
---
 CONTRIBUTING.md                               |   1 -
 .../claudesdk/cancellation_live_linux_test.go |   2 +-
 .../internal/agent/claudesdk/commands.go      |  10 +-
 .../agent/claudesdk/commands_session_test.go  | 102 ++++++-------
 .../internal/agent/claudesdk/commands_test.go |  88 ++++++------
 .../internal/agent/claudesdk/declaration.go   |   1 -
 .../agent/claudesdk/declaration_test.go       |   2 +-
 .../internal/agent/claudesdk/executor.go      |   3 -
 .../claudesdk/executor_confirmation_test.go   |   3 +
 .../claudesdk/executor_live_linux_test.go     |   2 +-
 .../internal/agent/claudesdk/executor_turn.go |   4 +-
 .../internal/agent/claudesdk/functions.go     |  10 +-
 .../agent/claudesdk/functions_test.go         |   2 +-
 .../agent/claudesdk/live_linux_test.go        |   3 +-
 apps/daemon/internal/agent/claudesdk/mcp.go   |  10 +-
 .../agent/claudesdk/mcp_environment_test.go   |   4 +-
 .../internal/agent/claudesdk/mcp_test.go      |   4 +-
 .../internal/agent/claudesdk/options.go       |   6 +-
 .../agent/claudesdk/preparation_test.go       |   4 +-
 .../internal/agent/claudesdk/readiness.go     |  18 ++-
 .../internal/agent/claudesdk/session.go       |   2 +-
 .../agent/claudesdk/workspace_launch_test.go  |   4 +-
 .../claudesdk/workspace_live_linux_test.go    |   2 +-
 .../internal/agent/clirunner/process.go       |  94 ++----------
 .../agent/clirunner/process_group_other.go    |   2 +-
 .../clirunner/process_group_unix_test.go      |   6 +-
 .../clirunner/process_group_windows_test.go   |   4 +-
 .../internal/agent/codex/declaration.go       |   1 -
 .../internal/agent/codex/declaration_test.go  |   2 +-
 .../internal/agent/codex/environment.go       |  26 ++--
 .../agent/codex/environment_retired_test.go   |  47 +++---
 apps/daemon/internal/agent/codex/executor.go  |   5 +-
 .../agent/codex/executor_native_test.go       |   2 +-
 .../internal/agent/codex/executor_test.go     |   2 +-
 .../internal/agent/codex/mcp_required_test.go |   1 -
 apps/daemon/internal/agent/codex/options.go   |  37 +----
 .../internal/agent/codex/options_test.go      |  12 +-
 .../internal/agent/codex/preparation.go       |  16 +--
 .../agent/codex/preparation_helpers_test.go   |   2 +-
 apps/daemon/internal/agent/codex/prepared.go  |   3 +-
 .../internal/agent/codex/recovery_test.go     |   8 +-
 apps/daemon/internal/agent/codex/resume.go    |  10 +-
 .../internal/agent/codex/resume_test.go       |  79 +++++------
 apps/daemon/internal/agent/codex/rpc.go       |   2 +-
 .../internal/agent/codex/rpc_close_test.go    |   2 +-
 apps/daemon/internal/agent/codex/session.go   |   9 +-
 .../agent/codex/session_command_output.go     |   3 -
 .../codex/session_command_output_test.go      |  62 ++++----
 .../agent/codex/session_notifications_test.go |   3 +-
 .../internal/agent/codex/session_plan.go      |   2 +-
 .../internal/agent/codex/session_tools.go     |   8 +-
 .../agent/codex/session_tools_test.go         |  70 ++++-----
 apps/daemon/internal/agent/codex/skills.go    |  20 +--
 .../internal/agent/codex/skills_test.go       |  12 --
 .../internal/agent/configuration_test.go      |   8 --
 apps/daemon/internal/agent/harness.go         |   3 +-
 .../internal/agent/installroot/probe.go       |   2 +-
 .../internal/agent/mcode/declaration.go       |   2 -
 .../internal/agent/mcode/declaration_test.go  |   2 +-
 .../agent/mcode/environment_mcp_test.go       |   1 -
 apps/daemon/internal/agent/mcode/events.go    |  25 ++--
 apps/daemon/internal/agent/mcode/execution.go |  19 +--
 .../internal/agent/mcode/execution_test.go    |  17 +--
 .../agent/mcode/executor_native_test.go       |   2 +-
 .../internal/agent/mcode/executor_test.go     |   2 +-
 .../internal/agent/mcode/executor_turn.go     |   6 +-
 .../agent/mcode/mcp_observations_test.go      |   2 +-
 .../agent/mcode/native_history_test.go        |   2 +-
 apps/daemon/internal/agent/mcode/options.go   |  60 +++-----
 .../internal/agent/mcode/options_test.go      |  10 +-
 .../internal/agent/mcode/preparation_test.go  |   2 +-
 apps/daemon/internal/agent/mcode/session.go   |  15 +-
 .../internal/agent/mcode/session_test.go      |  13 +-
 .../internal/agent/mcode/steering_test.go     |   2 +-
 .../internal/agent/mcode/tool_observations.go |  22 ++-
 .../agent/mcode/tool_observations_test.go     |   2 +-
 apps/daemon/internal/agent/mcode/workspace.go |   2 +-
 .../agent/mcode/workspace_readiness.go        |   2 +-
 apps/daemon/internal/agent/registry.go        |  12 --
 apps/daemon/internal/agent/runtime_paths.go   |  20 +--
 .../internal/agent/runtime_paths_test.go      |  17 +--
 apps/daemon/internal/authoring/bridge.go      | 134 ------------------
 apps/daemon/internal/authoring/bridge_test.go | 106 --------------
 apps/daemon/internal/cli/authoring.go         |  77 ----------
 apps/daemon/internal/cli/authoring_test.go    | 101 -------------
 .../cli/claude_sdk_live_linux_test.go         |   6 +-
 apps/daemon/internal/cli/companion_path.go    |  18 ---
 .../internal/cli/companion_path_test.go       |  37 -----
 apps/daemon/internal/cli/connect.go           |   7 -
 .../internal/cli/connect_cleanup_test.go      |   2 +-
 apps/daemon/internal/cli/connect_suspend.go   |  12 +-
 apps/daemon/internal/cli/preparation_test.go  |  32 +----
 apps/daemon/internal/dispatch/executor.go     |   2 +-
 .../dispatch/executor_handoff_test.go         |   2 +-
 .../daemon/internal/dispatch/executor_test.go |   2 +-
 .../dispatch/functions_native_test.go         |   2 +-
 .../internal/dispatch/local_directory_test.go |   4 +-
 apps/daemon/internal/dispatch/preparation.go  |   2 +-
 .../internal/dispatch/preparation_test.go     |   4 +-
 .../daemon/internal/localworkspace/binding.go |   3 +-
 .../internal/localworkspace/binding_test.go   |   8 +-
 .../runtime_initialization_process.go         |   2 +-
 apps/daemon/testdata/onboarding/main.go       |   2 +-
 contracts/agents-api/harness-onboarding.md    |   6 +-
 contracts/agents-api/zh/harness-onboarding.md |   8 +-
 docs/runtime-protocol.md                      |   7 +-
 docs/zh/runtime-protocol.md                   |   9 +-
 internal/agentdaemon/proto/authoring.go       |  31 ----
 internal/agentdaemon/proto/inbound.go         |   1 -
 internal/agentdaemon/proto/outbound.go        |  28 ++--
 internal/agentdaemon/proto/preparation.go     |   6 +-
 .../proto/prototest/capabilities.go           |   1 -
 internal/agentdaemon/proto/prototest/wire.go  |   2 +-
 .../proto/workspace_read_preparation.go       |   6 +-
 packages/claude-sdk-adapter/README.md         |   8 +-
 scripts/name-allowlist.json                   |  10 --
 services/core/internal/execution/delivery.go  |   2 +-
 .../execution/directory_preparation.go        |   2 +-
 .../core/internal/execution/recovery_test.go  |   2 +-
 services/core/internal/execution/request.go   |   5 +-
 services/core/internal/runtimedevice/state.go |   1 -
 .../mcp_bearer_live_linux_test.go             |   2 +-
 .../core/internal/runtimegateway/session.go   |   1 -
 .../tests/integration/execution_tools_test.go |   4 +-
 .../integration/harness_onboarding_test.go    |   2 +-
 125 files changed, 453 insertions(+), 1367 deletions(-)
 delete mode 100644 apps/daemon/internal/authoring/bridge.go
 delete mode 100644 apps/daemon/internal/authoring/bridge_test.go
 delete mode 100644 apps/daemon/internal/cli/authoring.go
 delete mode 100644 apps/daemon/internal/cli/authoring_test.go
 delete mode 100644 apps/daemon/internal/cli/companion_path.go
 delete mode 100644 apps/daemon/internal/cli/companion_path_test.go
 delete mode 100644 internal/agentdaemon/proto/authoring.go

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 12405dd99..04cbec682 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -52,7 +52,6 @@ Core must build, deploy and run independently of product services, frontends and
 - Parsar owns users, workspaces, business authorization, Agent/Team definitions, capabilities, product conversations, IM/sharing, approval decisions and billing. It uses Core for execution.
 - A product conversation may reference several execution Sessions. Core owns native engine session identities; an execution Session has its own lifetime, separate from a daemon connection, process or sandbox.
 - Build application orchestration on the [public Session and event contract](docs/api/public-agent-api.md). Product cursor replay must be an explicit product extension. Business Team orchestration belongs to the application; Core's pinned `multi_agent` and Subagent resources remain part of the public contract.
-- Daemon Skill/SP authoring is a product operation: forward it through a scoped product callback that checks the original requester and workspace. A Runtime credential alone must not authorize business writes.
 
 ### Optional application example
 
diff --git a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
index a16a9d7ce..bc5cec8bd 100644
--- a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
@@ -65,7 +65,7 @@ func TestLiveClaudeSDKCancelResume(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 		defer cancel()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}}
 		running, err := NewFactory(config)(ctx, request, out)
 		if err != nil {
 			t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/commands.go b/apps/daemon/internal/agent/claudesdk/commands.go
index 46dfa31b1..9bc4c266a 100644
--- a/apps/daemon/internal/agent/claudesdk/commands.go
+++ b/apps/daemon/internal/agent/claudesdk/commands.go
@@ -33,9 +33,7 @@ func (c *commandState) receive(event bridgeEvent, start startRequest, sessionID
 		return fmt.Errorf("claudesdk: inconsistent command observation")
 	}
 	c.calls[event.ID] = *n
-	if start.observeFunctions {
-		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: "Bash", Stage: event.Stage, Observation: n})
-	}
+	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: "Bash", Stage: event.Stage, Observation: n})
 	return nil
 }
 
@@ -48,15 +46,13 @@ func (c *commandState) complete() bool {
 	return true
 }
 
-func (c *commandState) close(start startRequest, emit func(string, any)) {
+func (c *commandState) close(emit func(string, any)) {
 	for id, call := range c.calls {
 		if call.Status != "in_progress" {
 			continue
 		}
 		call.Status = "incomplete"
 		c.calls[id] = call
-		if start.observeFunctions {
-			emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: "Bash", Stage: "after", Observation: &call})
-		}
+		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: "Bash", Stage: "after", Observation: &call})
 	}
 }
diff --git a/apps/daemon/internal/agent/claudesdk/commands_session_test.go b/apps/daemon/internal/agent/claudesdk/commands_session_test.go
index de9454556..bc62c8540 100644
--- a/apps/daemon/internal/agent/claudesdk/commands_session_test.go
+++ b/apps/daemon/internal/agent/claudesdk/commands_session_test.go
@@ -16,74 +16,56 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestWorkspaceCommandsRequirePackagedFeatureOnlyWhenRequested(t *testing.T) {
-	for _, observed := range []bool{false, true} {
-		config := preparationFixture(t, "old-command-runtime")
-		req := preparationRequest()
-		req.ObserveToolObservations = observed
-		resource, err := NewPreparationFactory(config)(t.Context(), req)
-		if observed {
-			if err == nil || !strings.Contains(err.Error(), "workspace command observations") {
-				t.Fatal("old bridge accepted requested command observations", err)
-			}
-			if _, err := os.Stat(filepath.Join(config.StateDir, "launched")); !os.IsNotExist(err) {
-				t.Fatal("old bridge started execution before rejection")
-			}
-		} else {
-			if err != nil {
-				t.Fatal("old bridge changed opt-out behavior", err)
-			}
-			if err := resource.Close(); err != nil {
-				t.Fatal(err)
-			}
-		}
+func TestWorkspaceCommandsRequirePackagedFeature(t *testing.T) {
+	config := preparationFixture(t, "old-command-runtime")
+	if _, err := NewPreparationFactory(config)(t.Context(), preparationRequest()); err == nil || !strings.Contains(err.Error(), "workspace preparation is unavailable") {
+		t.Fatal("old bridge accepted command observations", err)
+	}
+	if _, err := os.Stat(filepath.Join(config.StateDir, "launched")); !os.IsNotExist(err) {
+		t.Fatal("old bridge started execution before rejection")
 	}
 }
 
 func TestWorkspaceCommandFramesKeepStartIdentityAndObservedOutput(t *testing.T) {
-	for _, observed := range []bool{false, true} {
-		config := preparationFixture(t, "commands-success")
-		req := preparationRequest()
-		req.ObserveToolObservations = observed
-		resource, err := NewPreparationFactory(config)(t.Context(), req)
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer resource.Close()
-		if _, err := os.Stat(filepath.Join(config.StateDir, "start.json")); !os.IsNotExist(err) {
-			t.Fatal("preparation submitted a command")
-		}
-		out := make(chan proto.Envelope, 16)
-		s, err := resource.Start(t.Context(), "actual-command-run", proto.TextInput("hello"), out)
-		if err != nil {
-			t.Fatal(err)
+	config := preparationFixture(t, "commands-success")
+	resource, err := NewPreparationFactory(config)(t.Context(), preparationRequest())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resource.Close()
+	if _, err := os.Stat(filepath.Join(config.StateDir, "start.json")); !os.IsNotExist(err) {
+		t.Fatal("preparation submitted a command")
+	}
+	out := make(chan proto.Envelope, 16)
+	s, err := resource.Start(t.Context(), "actual-command-run", proto.TextInput("hello"), out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Cancel(context.Background())
+	var frames []proto.ToolCallPayload
+	done := 0
+	for event := range out {
+		if event.ID != "actual-command-run" || event.Type == proto.TypeError || event.Type == proto.TypeCommandOutput {
+			t.Fatal("execution identity or final-only command behavior changed", event.Type)
 		}
-		defer s.Cancel(context.Background())
-		var frames []proto.ToolCallPayload
-		done := 0
-		for event := range out {
-			if event.ID != "actual-command-run" || event.Type == proto.TypeError || event.Type == proto.TypeCommandOutput {
-				t.Fatal("execution identity or final-only command behavior changed", event.Type)
-			}
-			if event.Type == proto.TypeToolCall {
-				var payload proto.ToolCallPayload
-				if err := event.DecodePayload(&payload); err != nil {
-					t.Fatal(err)
-				}
-				frames = append(frames, payload)
-			}
-			if event.Type == proto.TypeDone {
-				done++
+		if event.Type == proto.TypeToolCall {
+			var payload proto.ToolCallPayload
+			if err := event.DecodePayload(&payload); err != nil {
+				t.Fatal(err)
 			}
+			frames = append(frames, payload)
 		}
-		if done != 1 || observed && len(frames) != 2 || !observed && len(frames) != 0 {
-			t.Fatal("completion or observation opt-in changed", done, frames)
-		}
-		if observed && (frames[0].ID != "observed" || frames[1].ID != "observed" || frames[1].Observation.Status != "failed" ||
-			string(frames[1].Observation.Output) != `"Exit code 7\nretained"`) {
-			t.Fatal("native failure output was not retained", frames)
+		if event.Type == proto.TypeDone {
+			done++
 		}
 	}
+	if done != 1 || len(frames) != 2 {
+		t.Fatal("completion or observation changed", done, frames)
+	}
+	if frames[0].ID != "observed" || frames[1].ID != "observed" || frames[1].Observation.Status != "failed" ||
+		string(frames[1].Observation.Output) != `"Exit code 7\nretained"` {
+		t.Fatal("native failure output was not retained", frames)
+	}
 }
 
 func TestWorkspaceCommandCancellationAndBridgeFailuresCloseOnlyPendingCalls(t *testing.T) {
@@ -93,7 +75,7 @@ func TestWorkspaceCommandCancellationAndBridgeFailuresCloseOnlyPendingCalls(t *t
 			defer cancel()
 			config := preparationFixture(t, mode)
 			req := workspaceRequest()
-			req.AgentSessionID, req.ObserveToolObservations = "native-session", true
+			req.AgentSessionID = "native-session"
 			out := make(chan proto.Envelope, 32)
 			s, err := NewFactory(config)(ctx, req, out)
 			if err != nil {
diff --git a/apps/daemon/internal/agent/claudesdk/commands_test.go b/apps/daemon/internal/agent/claudesdk/commands_test.go
index 33b923c7f..f98129c51 100644
--- a/apps/daemon/internal/agent/claudesdk/commands_test.go
+++ b/apps/daemon/internal/agent/claudesdk/commands_test.go
@@ -13,53 +13,45 @@ func commandEvent(id, stage, status, command string) bridgeEvent {
 		Observation: &proto.ToolObservation{Kind: "command", Status: status, Command: command}}
 }
 
-func TestCommandObservationLifecycleAndOptIn(t *testing.T) {
-	for _, observed := range []bool{false, true} {
-		state := commandState{calls: map[string]proto.ToolObservation{}}
-		start := startRequest{Workspace: &workspaceProfile{}, observeFunctions: observed}
-		var events []proto.ToolCallPayload
-		emit := func(kind string, payload any) {
-			if kind != proto.TypeToolCall {
-				t.Fatal(kind)
-			}
-			events = append(events, payload.(proto.ToolCallPayload))
-		}
-		const command = "  printf 'failure\\n'; exit 7  "
-		before := commandEvent("native-call", "before", "in_progress", command)
-		if err := state.receive(before, start, "native-session", emit); err != nil || state.complete() {
-			t.Fatal("call was not pending", err)
-		}
-		if err := state.receive(before, start, "native-session", emit); err == nil {
-			t.Fatal("duplicate bridge call accepted")
-		}
-		after := commandEvent("native-call", "after", "failed", command)
-		after.Observation.Output = json.RawMessage(`"Exit code 7\nfailure"`)
-		if err := state.receive(after, start, "native-session", emit); err != nil || !state.complete() {
-			t.Fatal("native result did not complete the call", err)
-		}
-		if err := state.receive(after, start, "native-session", emit); err == nil {
-			t.Fatal("duplicate bridge result accepted")
-		}
-		if err := state.receive(commandEvent("pending", "before", "in_progress", "sleep 30"), start, "native-session", emit); err != nil {
-			t.Fatal(err)
-		}
-		state.close(start, emit)
-		state.close(start, emit)
-		if !state.complete() || state.calls["pending"].Status != "incomplete" || state.calls["native-call"].Status != "failed" {
-			t.Fatal("closure changed an observed result or lost an unfinished call")
-		}
-		if !observed {
-			if len(events) != 0 {
-				t.Fatal("opt-out emitted observations")
-			}
-			continue
-		}
-		if len(events) != 4 || events[0].ID != "native-call" || events[0].Name != "Bash" || events[0].Observation.Command != command ||
-			string(events[1].Observation.Output) != `"Exit code 7\nfailure"` || events[1].Observation.ExitCode != nil ||
-			events[1].Observation.Cwd != nil || events[1].Observation.DurationMS != nil || events[3].ID != "pending" ||
-			events[3].Observation.Status != "incomplete" || len(events[3].Observation.Output) != 0 {
-			t.Fatal("observation identity, output or unknown metadata changed", events)
+func TestCommandObservationLifecycle(t *testing.T) {
+	state := commandState{calls: map[string]proto.ToolObservation{}}
+	start := startRequest{Workspace: &workspaceProfile{}}
+	var events []proto.ToolCallPayload
+	emit := func(kind string, payload any) {
+		if kind != proto.TypeToolCall {
+			t.Fatal(kind)
 		}
+		events = append(events, payload.(proto.ToolCallPayload))
+	}
+	const command = "  printf 'failure\\n'; exit 7  "
+	before := commandEvent("native-call", "before", "in_progress", command)
+	if err := state.receive(before, start, "native-session", emit); err != nil || state.complete() {
+		t.Fatal("call was not pending", err)
+	}
+	if err := state.receive(before, start, "native-session", emit); err == nil {
+		t.Fatal("duplicate bridge call accepted")
+	}
+	after := commandEvent("native-call", "after", "failed", command)
+	after.Observation.Output = json.RawMessage(`"Exit code 7\nfailure"`)
+	if err := state.receive(after, start, "native-session", emit); err != nil || !state.complete() {
+		t.Fatal("native result did not complete the call", err)
+	}
+	if err := state.receive(after, start, "native-session", emit); err == nil {
+		t.Fatal("duplicate bridge result accepted")
+	}
+	if err := state.receive(commandEvent("pending", "before", "in_progress", "sleep 30"), start, "native-session", emit); err != nil {
+		t.Fatal(err)
+	}
+	state.close(emit)
+	state.close(emit)
+	if !state.complete() || state.calls["pending"].Status != "incomplete" || state.calls["native-call"].Status != "failed" {
+		t.Fatal("closure changed an observed result or lost an unfinished call")
+	}
+	if len(events) != 4 || events[0].ID != "native-call" || events[0].Name != "Bash" || events[0].Observation.Command != command ||
+		string(events[1].Observation.Output) != `"Exit code 7\nfailure"` || events[1].Observation.ExitCode != nil ||
+		events[1].Observation.Cwd != nil || events[1].Observation.DurationMS != nil || events[3].ID != "pending" ||
+		events[3].Observation.Status != "incomplete" || len(events[3].Observation.Output) != 0 {
+		t.Fatal("observation identity, output or unknown metadata changed", events)
 	}
 }
 
@@ -67,7 +59,7 @@ func TestCommandObservationsRejectUnqualifiedOrInconsistentEvents(t *testing.T)
 	for _, mode := range []string{"profile", "uninitialized", "session", "id", "nil", "kind", "empty-command", "name", "cwd", "exit", "duration", "arguments", "error", "output-object", "before-output", "before-status", "after-before", "changed-command", "after-status", "stage"} {
 		t.Run(mode, func(t *testing.T) {
 			state := commandState{calls: map[string]proto.ToolObservation{}}
-			start := startRequest{Workspace: &workspaceProfile{}, observeFunctions: true}
+			start := startRequest{Workspace: &workspaceProfile{}}
 			sessionID := "native-session"
 			event := commandEvent("call", "before", "in_progress", "pwd")
 			if strings.HasPrefix(mode, "after-") || mode == "changed-command" {
@@ -130,7 +122,7 @@ func TestCommandObservationUnknownAndEmptyOutputRemainDistinct(t *testing.T) {
 	for _, output := range []json.RawMessage{nil, json.RawMessage(`null`), json.RawMessage(`""`)} {
 		state := commandState{calls: map[string]proto.ToolObservation{}}
 		start := startRequest{Workspace: &workspaceProfile{}}
-		emit := func(string, any) { t.Fatal("opt-out emitted an observation") }
+		emit := func(string, any) {}
 		if err := state.receive(commandEvent("call", "before", "in_progress", "pwd"), start, "native-session", emit); err != nil {
 			t.Fatal(err)
 		}
diff --git a/apps/daemon/internal/agent/claudesdk/declaration.go b/apps/daemon/internal/agent/claudesdk/declaration.go
index e99650049..21a643f88 100644
--- a/apps/daemon/internal/agent/claudesdk/declaration.go
+++ b/apps/daemon/internal/agent/claudesdk/declaration.go
@@ -26,7 +26,6 @@ var Declaration = agent.Declaration{Info: proto.SupportedAgentKind{Kind: "claude
 	Usage:                          proto.CapabilitySupported,
 	Resume:                         proto.CapabilitySupported,
 	NativeSessionRecovery:          proto.CapabilityUnsupported,
-	WorkspaceAuthoring:             proto.CapabilityUnsupported,
 	Steering:                       proto.CapabilitySupported,
 	MessageItems:                   proto.CapabilitySupported,
 	ToolObservations:               proto.CapabilitySupported,
diff --git a/apps/daemon/internal/agent/claudesdk/declaration_test.go b/apps/daemon/internal/agent/claudesdk/declaration_test.go
index d62d77781..149ef8f65 100644
--- a/apps/daemon/internal/agent/claudesdk/declaration_test.go
+++ b/apps/daemon/internal/agent/claudesdk/declaration_test.go
@@ -122,7 +122,7 @@ func TestRuntimeDiscoveryConfigurationAndRegistration(t *testing.T) {
 			registry := agent.NewRegistry()
 			registry.Register(Declaration, *runtime)
 			info := registry.SupportedAgentKinds()[0]
-			if info.Capabilities.WorkspaceAuthoring.IsSupported() || info.Capabilities.Preparation.IsSupported() != ready {
+			if info.Capabilities.Preparation.IsSupported() != ready {
 				t.Fatal(info)
 			}
 			if !ready {
diff --git a/apps/daemon/internal/agent/claudesdk/executor.go b/apps/daemon/internal/agent/claudesdk/executor.go
index 34240d0c5..55eed30a5 100644
--- a/apps/daemon/internal/agent/claudesdk/executor.go
+++ b/apps/daemon/internal/agent/claudesdk/executor.go
@@ -91,9 +91,6 @@ func validateExecutorFeatures(info RuntimeInfo, start startRequest) error {
 	if start.Subagents != nil && !info.SupportsSubagents() {
 		return errors.New("claudesdk: subagent resources are unavailable")
 	}
-	if start.Workspace != nil && start.observeFunctions && !info.supportsWorkspaceCommands() {
-		return errors.New("claudesdk: packaged runtime does not support workspace command observations")
-	}
 	if start.Workspace != nil && len(start.Functions) > 0 && !info.SupportsWorkspaceFunctions() {
 		return errors.New("claudesdk: workspace functions are unavailable")
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go b/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
index f4cb246bd..bba0b7099 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_confirmation_test.go
@@ -27,6 +27,9 @@ func TestExecutorNativeConfirmationSurvivesCleanup(t *testing.T) {
 				t.Fatal("initial output missing")
 			}
 			if mode == "pending_function" || mode == "pending_function_unconfirmed" {
+				if event := <-out; event.Type != proto.TypeToolCall {
+					t.Fatal("function observation missing")
+				}
 				if event := <-out; event.Type != proto.TypeFunctionCall {
 					t.Fatal("function obligation missing")
 				}
diff --git a/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
index 25fb8fcda..669f2dce1 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_live_linux_test.go
@@ -80,7 +80,7 @@ func TestLiveClaudeExecutorReuseAndCancel(t *testing.T) {
 		_ = os.WriteFile(filepath.Join(proof, "executor-evidence.json"), raw, 0600)
 	}
 	defer persist()
-	request := proto.PromptRequestPayload{StrictResume: true, DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": model, "system_prompt": "Follow requested formats briefly. Remember the exact verification marker across the conversation. Use no tools."}}
+	request := proto.PromptRequestPayload{DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": model, "system_prompt": "Follow requested formats briefly. Remember the exact verification marker across the conversation. Use no tools."}}
 	factory := NewExecutorFactory(config)
 	prepared := time.Now()
 	owner, err := factory(ctx, request)
diff --git a/apps/daemon/internal/agent/claudesdk/executor_turn.go b/apps/daemon/internal/agent/claudesdk/executor_turn.go
index d1b9ce48c..97c6638cf 100644
--- a/apps/daemon/internal/agent/claudesdk/executor_turn.go
+++ b/apps/daemon/internal/agent/claudesdk/executor_turn.go
@@ -197,8 +197,8 @@ func (s *session) runTurn(start startRequest, out chan<- proto.Envelope) {
 	if !s.functionsComplete(cancelled && settlementConfirmed) || !s.steeringComplete() || !mcp.complete() || !commands.complete() {
 		settlementConfirmed, reusable, reason = false, false, "unsettled_native_operations"
 	}
-	mcp.close(start, emit)
-	commands.close(start, emit)
+	mcp.close(emit)
+	commands.close(emit)
 	s.stopSteering()
 	metadata := map[string]any{proto.DoneMetaAgentSessionType: "claude_session"}
 	if id := s.inputSessionID(); id != "" {
diff --git a/apps/daemon/internal/agent/claudesdk/functions.go b/apps/daemon/internal/agent/claudesdk/functions.go
index 80048c70b..752d1347f 100644
--- a/apps/daemon/internal/agent/claudesdk/functions.go
+++ b/apps/daemon/internal/agent/claudesdk/functions.go
@@ -84,13 +84,11 @@ func (s *session) receiveFunction(event bridgeEvent, start startRequest, emit fu
 	if err != nil {
 		return err
 	}
-	if start.observeFunctions {
-		id, stage := event.CallID, "after"
-		if call != nil {
-			id, stage = call.CallID, "before"
-		}
-		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: observation.Name, Stage: stage, Observation: observation})
+	id, stage := event.CallID, "after"
+	if call != nil {
+		id, stage = call.CallID, "before"
 	}
+	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: observation.Name, Stage: stage, Observation: observation})
 	if call != nil {
 		emit(proto.TypeFunctionCall, call)
 	} else {
diff --git a/apps/daemon/internal/agent/claudesdk/functions_test.go b/apps/daemon/internal/agent/claudesdk/functions_test.go
index 09f8b430a..a448790e3 100644
--- a/apps/daemon/internal/agent/claudesdk/functions_test.go
+++ b/apps/daemon/internal/agent/claudesdk/functions_test.go
@@ -22,7 +22,7 @@ func TestFunctionFactoryNativeReceipts(t *testing.T) {
 			root := t.TempDir()
 			t.Setenv("OAC_RUNTIME_HOME", root)
 			config := Config{Node: os.Args[0], Entrypoint: filepath.Join(root, "worker"), StateDir: filepath.Join(root, "state"), Env: []string{"GO_CLAUDE_SDK_HELPER=1", "SDK_HELPER_MODE=" + mode, "GORACE=atexit_sleep_ms=0"}}
-			request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("hello"), AgentSessionID: "native-session", ObserveToolObservations: true, AgentOptions: map[string]any{"model": "fake-model", "system_prompt": "instructions"}, FunctionTools: []proto.FunctionTool{{Name: "lookup", Description: "Lookup.", Parameters: json.RawMessage(`{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}}}}`)}}}
+			request := proto.PromptRequestPayload{RunID: "run", Input: proto.TextInput("hello"), AgentSessionID: "native-session", AgentOptions: map[string]any{"model": "fake-model", "system_prompt": "instructions"}, FunctionTools: []proto.FunctionTool{{Name: "lookup", Description: "Lookup.", Parameters: json.RawMessage(`{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string"}}}}`)}}}
 			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 			defer cancel()
 			out := make(chan proto.Envelope, 16)
diff --git a/apps/daemon/internal/agent/claudesdk/live_linux_test.go b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
index 335ff6ecd..ba2f7ca9d 100644
--- a/apps/daemon/internal/agent/claudesdk/live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
@@ -137,9 +137,8 @@ func TestLiveClaudeSDKTextResume(t *testing.T) {
 		requestStart := len(requests)
 		mu.Unlock()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}}
 		if success != nil {
-			request.ObserveToolObservations = true
 			request.AgentOptions["system_prompt"] = "Call lookup exactly once as requested, then report both result parts and any prior verification value. Never retry a failed tool."
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a synthetic verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
 		}
diff --git a/apps/daemon/internal/agent/claudesdk/mcp.go b/apps/daemon/internal/agent/claudesdk/mcp.go
index a74da05d7..b193136d7 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp.go
@@ -109,9 +109,7 @@ func (m *mcpState) receive(event bridgeEvent, start startRequest, emit func(stri
 		return fmt.Errorf("claudesdk: inconsistent MCP observation")
 	}
 	m.calls[event.ID] = *n
-	if start.observeFunctions {
-		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: n.Name, Stage: event.Stage, Observation: n})
-	}
+	emit(proto.TypeToolCall, proto.ToolCallPayload{ID: event.ID, Name: n.Name, Stage: event.Stage, Observation: n})
 	return nil
 }
 
@@ -124,15 +122,13 @@ func (m *mcpState) complete() bool {
 	return true
 }
 
-func (m *mcpState) close(start startRequest, emit func(string, any)) {
+func (m *mcpState) close(emit func(string, any)) {
 	for id, call := range m.calls {
 		if call.Status != "in_progress" {
 			continue
 		}
 		call.Status = "incomplete"
 		m.calls[id] = call
-		if start.observeFunctions {
-			emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: call.Name, Stage: "after", Observation: &call})
-		}
+		emit(proto.TypeToolCall, proto.ToolCallPayload{ID: id, Name: call.Name, Stage: "after", Observation: &call})
 	}
 }
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go b/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
index 328674950..ab84b3b9e 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_environment_test.go
@@ -73,7 +73,7 @@ func TestEnvironmentMCPRejectsUnqualifiedCombinations(t *testing.T) {
 }
 
 func TestEnvironmentMCPObservationsUseInstalledDeclarations(t *testing.T) {
-	start := startRequest{Workspace: &workspaceProfile{MCP: []environmentMCPServer{{mcpHTTPServer: mcpHTTPServer{ServerLabel: "installed"}}}}, observeFunctions: true}
+	start := startRequest{Workspace: &workspaceProfile{MCP: []environmentMCPServer{{mcpHTTPServer: mcpHTTPServer{ServerLabel: "installed"}}}}}
 	state := mcpState{calls: map[string]proto.ToolObservation{}}
 	observation := proto.ToolObservation{Kind: "mcp", Name: "echo", Server: "installed", Status: "in_progress", Arguments: json.RawMessage(`{}`), Output: json.RawMessage(`null`), Error: json.RawMessage(`null`)}
 	var emitted []proto.ToolCallPayload
@@ -81,7 +81,7 @@ func TestEnvironmentMCPObservationsUseInstalledDeclarations(t *testing.T) {
 	if err := state.receive(bridgeEvent{ID: "native-call", Stage: "before", Observation: &observation}, start, emit); err != nil {
 		t.Fatal(err)
 	}
-	state.close(start, emit)
+	state.close(emit)
 	if len(emitted) != 2 || emitted[1].ID != "native-call" || emitted[1].Observation.Status != "incomplete" {
 		t.Fatal("interrupted environment call lost identity")
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/mcp_test.go b/apps/daemon/internal/agent/claudesdk/mcp_test.go
index 7d1220a01..a8ad18877 100644
--- a/apps/daemon/internal/agent/claudesdk/mcp_test.go
+++ b/apps/daemon/internal/agent/claudesdk/mcp_test.go
@@ -72,7 +72,7 @@ func TestHTTPMCPDeclaration(t *testing.T) {
 }
 
 func TestMCPObservationLifecycle(t *testing.T) {
-	start := startRequest{MCPHTTPServers: &[]mcpHTTPServer{{ServerLabel: "fixture"}}, observeFunctions: true}
+	start := startRequest{MCPHTTPServers: &[]mcpHTTPServer{{ServerLabel: "fixture"}}}
 	state := mcpState{calls: map[string]proto.ToolObservation{}}
 	var observations []proto.ToolCallPayload
 	emit := func(kind string, payload any) {
@@ -107,7 +107,7 @@ func TestMCPObservationLifecycle(t *testing.T) {
 	if err := state.receive(before, start, emit); err != nil {
 		t.Fatal(err)
 	}
-	state.close(start, emit)
+	state.close(emit)
 	if !state.complete() || observations[len(observations)-1].Observation.Status != "incomplete" {
 		t.Fatal("cancellation lost pending call")
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/options.go b/apps/daemon/internal/agent/claudesdk/options.go
index 47c1ac3e1..46ffde096 100644
--- a/apps/daemon/internal/agent/claudesdk/options.go
+++ b/apps/daemon/internal/agent/claudesdk/options.go
@@ -39,7 +39,6 @@ type startRequest struct {
 	MCPHTTPServers     *[]mcpHTTPServer     `json:"mcp_http_servers,omitempty"`
 	Workspace          *workspaceProfile    `json:"workspace,omitempty"`
 	RequireHistory     bool                 `json:"require_history,omitempty"`
-	observeFunctions   bool
 }
 
 func prepare(config Config, req proto.PromptRequestPayload) (startRequest, []string, error) {
@@ -55,7 +54,7 @@ func prepare(config Config, req proto.PromptRequestPayload) (startRequest, []str
 }
 
 func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startRequest, []string, error) {
-	start := startRequest{Type: "start", Resume: req.AgentSessionID, RequireHistory: req.RequireExistingNativeSession, ObserveMessages: req.ObserveMessages, Functions: req.FunctionTools, observeFunctions: req.ObserveToolObservations}
+	start := startRequest{Type: "start", Resume: req.AgentSessionID, RequireHistory: req.RequireExistingNativeSession, ObserveMessages: req.ObserveMessages, Functions: req.FunctionTools}
 	fail := func(reason string) (startRequest, []string, error) {
 		return startRequest{}, nil, fmt.Errorf("claudesdk: %s", reason)
 	}
@@ -64,9 +63,6 @@ func prepareConfiguration(config Config, req proto.PromptRequestPayload) (startR
 		return startRequest{}, nil, err
 	}
 	start.NativeModelOptions = compileNativeModelOptions(modelConfiguration.HarnessConfig)
-	if req.WorkspaceAuthoring {
-		return fail("requested capability is not available in the private SDK adapter")
-	}
 	if err := req.ValidateToolSearch(true); err != nil {
 		return startRequest{}, nil, err
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/preparation_test.go b/apps/daemon/internal/agent/claudesdk/preparation_test.go
index 716797389..f722d4481 100644
--- a/apps/daemon/internal/agent/claudesdk/preparation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/preparation_test.go
@@ -107,7 +107,7 @@ func TestPreparationWaitsForReceiptAndRetainsConfiguration(t *testing.T) {
 }
 
 func TestPreparationRejectsInputAndUnavailableProfilesBeforeLaunch(t *testing.T) {
-	for _, name := range []string{"run", "prompt", "conversation", "attachments", "authoring", "subagents", "workspace-missing", "none", "functions", "mcp", "controls", "old-runtime"} {
+	for _, name := range []string{"run", "prompt", "conversation", "attachments", "subagents", "workspace-missing", "none", "functions", "mcp", "controls", "old-runtime"} {
 		t.Run(name, func(t *testing.T) {
 			config := preparationFixture(t, name)
 			req := preparationRequest()
@@ -120,8 +120,6 @@ func TestPreparationRejectsInputAndUnavailableProfilesBeforeLaunch(t *testing.T)
 				req.ConversationID = "product"
 			case "attachments":
 				req.Input = proto.MessageInput{{Content: []proto.InputContent{{Type: "input_image"}}}}
-			case "authoring":
-				req.WorkspaceAuthoring = true
 			case "subagents":
 				req.ObserveSubagentIdentities = true
 			case "workspace-missing":
diff --git a/apps/daemon/internal/agent/claudesdk/readiness.go b/apps/daemon/internal/agent/claudesdk/readiness.go
index 5c9668990..a9f7f8fbf 100644
--- a/apps/daemon/internal/agent/claudesdk/readiness.go
+++ b/apps/daemon/internal/agent/claudesdk/readiness.go
@@ -73,16 +73,14 @@ func (info RuntimeInfo) supportsWorkspace() bool {
 	return slices.Contains(info.Features, "workspace_tools")
 }
 
+// Workspace execution always emits neutral command observations, so a bridge
+// without them cannot run a prepared workspace.
 func (info RuntimeInfo) supportsWorkspacePreparation() bool {
-	return info.supportsWorkspace() && slices.Contains(info.Features, "workspace_prepare")
-}
-
-func (info RuntimeInfo) supportsWorkspaceCommands() bool {
-	return info.supportsWorkspacePreparation() && slices.Contains(info.Features, "workspace_command_observations")
+	return info.supportsWorkspace() && slices.Contains(info.Features, "workspace_prepare") && slices.Contains(info.Features, "workspace_command_observations")
 }
 
 func (info RuntimeInfo) SupportsLocalRuntime() bool {
-	return info.supportsWorkspaceCommands() && slices.Contains(info.Features, "local_runtime_v2")
+	return info.supportsWorkspacePreparation() && slices.Contains(info.Features, "local_runtime_v2")
 }
 
 func (info RuntimeInfo) SupportsWorkspaceFunctions() bool {
@@ -114,10 +112,10 @@ func CheckRuntime(ctx context.Context, config Config) (RuntimeInfo, error) {
 	}
 	process, err := clirunner.Start(clirunner.StartOptions{
 		Parent: ctx, Binary: binary,
-		Args:            []string{filepath.Join(filepath.Dir(config.Entrypoint), "runtime_check.js"), config.Entrypoint},
-		Dir:             filepath.Dir(config.Entrypoint),
-		Env:             env,
-		OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond,
+		Args:        []string{filepath.Join(filepath.Dir(config.Entrypoint), "runtime_check.js"), config.Entrypoint},
+		Dir:         filepath.Dir(config.Entrypoint),
+		Env:         env,
+		KillTimeout: 250 * time.Millisecond,
 	})
 	if err != nil {
 		return RuntimeInfo{}, fmt.Errorf("claudesdk: cannot start runtime check: %w", err)
diff --git a/apps/daemon/internal/agent/claudesdk/session.go b/apps/daemon/internal/agent/claudesdk/session.go
index 311952092..7edaabb07 100644
--- a/apps/daemon/internal/agent/claudesdk/session.go
+++ b/apps/daemon/internal/agent/claudesdk/session.go
@@ -86,7 +86,7 @@ func launch(ctx context.Context, config Config, start startRequest, env []string
 	if binary == "" {
 		binary = "node"
 	}
-	process, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{config.Entrypoint}, Dir: start.Cwd, Env: env, NeedStdin: true, OwnProcessGroup: true})
+	process, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{config.Entrypoint}, Dir: start.Cwd, Env: env, NeedStdin: true})
 	if err != nil {
 		return nil, err
 	}
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go b/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go
index dfaac5162..1f310776d 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_launch_test.go
@@ -24,7 +24,7 @@ test "$ANTHROPIC_AUTH_TOKEN" = selected-provider-fixture || exit 23
 test "$TMPDIR" != "$CLAUDE_CONFIG_DIR/tmp" || exit 24
 case "$1" in
   */runtime_check.js)
-    printf '%s\n' '{"type":"runtime_ready","protocol":3,"node":"fixture","sdk":"fixture","mcp":"fixture","native":"fixture","features":["workspace_tools","workspace_prepare"]}' ;;
+    printf '%s\n' '{"type":"runtime_ready","protocol":3,"node":"fixture","sdk":"fixture","mcp":"fixture","native":"fixture","features":["workspace_tools","workspace_prepare","workspace_command_observations"]}' ;;
   *)
     IFS= read -r request
     printf '%s\n' '{"type":"executor_ready","protocol":3}'
@@ -59,7 +59,7 @@ esac
 		t.Fatal("expected one settled completion")
 	}
 	// Feature checking must reject an older bridge without starting execution.
-	script = strings.ReplaceAll(script, `"features":["workspace_tools","workspace_prepare"]`, `"features":[]`)
+	script = strings.ReplaceAll(script, `"features":["workspace_tools","workspace_prepare","workspace_command_observations"]`, `"features":[]`)
 	script = strings.ReplaceAll(script, "IFS= read -r request", "touch '"+filepath.Join(config.StateDir, "unexpected-start")+"'")
 	if err := os.WriteFile(config.Node, []byte(script), 0o700); err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
index 6a19b6e53..ceca7f844 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
@@ -104,7 +104,7 @@ func testLiveClaudeWorkspace(t *testing.T, explicitPreparation bool) {
 		out := make(chan proto.Envelope, 64)
 		req := workspaceRequest()
 		req.RunID, req.Input, req.AgentSessionID = uuid.NewString(), proto.TextInput(prompt), resume
-		req.StrictResume, req.ReleaseOnCompletion, req.ObserveMessages, req.ObserveToolObservations = true, true, true, true
+		req.ReleaseOnCompletion, req.ObserveMessages = true, true
 		req.AgentOptions = map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the exact verification instructions using the requested native tools. Preserve conversation facts. No other files, network operations or background work."}
 		proof := evidence{RunID: req.RunID}
 		var running agent.Session
diff --git a/apps/daemon/internal/agent/clirunner/process.go b/apps/daemon/internal/agent/clirunner/process.go
index e693df7f5..a9a4465bd 100644
--- a/apps/daemon/internal/agent/clirunner/process.go
+++ b/apps/daemon/internal/agent/clirunner/process.go
@@ -5,9 +5,7 @@ import (
 	"fmt"
 	"io"
 	"os/exec"
-	"runtime"
 	"sync"
-	"syscall"
 	"time"
 )
 
@@ -19,8 +17,6 @@ type StartOptions struct {
 	Env         []string
 	NeedStdin   bool
 	KillTimeout time.Duration
-	// OwnProcessGroup bounds the lifetime of subprocess descendants on Unix.
-	OwnProcessGroup bool
 }
 
 type Process struct {
@@ -29,13 +25,11 @@ type Process struct {
 	Stdout io.ReadCloser
 	Stderr io.ReadCloser
 
-	ctx       context.Context
-	cancel    context.CancelFunc
-	done      chan struct{}
-	killAfter time.Duration
+	ctx    context.Context
+	cancel context.CancelFunc
+	done   chan struct{}
 
 	cancelOnce    sync.Once
-	waitOnce      sync.Once
 	cancelProcess func() error
 	waitProcess   func() error
 }
@@ -51,54 +45,9 @@ func Start(opts StartOptions) (*Process, error) {
 		opts.KillTimeout = 3 * time.Second
 	}
 
-	if opts.OwnProcessGroup || runtime.GOOS == "windows" {
-		return startProcessGroup(opts)
-	}
-
-	ctx, cancel := context.WithCancel(opts.Parent)
-	cmd := exec.CommandContext(ctx, opts.Binary, opts.Args...)
-	cmd.Dir = opts.Dir
-	if len(opts.Env) > 0 {
-		cmd.Env = append([]string{}, opts.Env...)
-	}
-
-	var stdin io.WriteCloser
-	var err error
-	if opts.NeedStdin {
-		stdin, err = cmd.StdinPipe()
-		if err != nil {
-			cancel()
-			return nil, fmt.Errorf("clirunner: stdin pipe: %w", err)
-		}
-	}
-	stdout, err := cmd.StdoutPipe()
-	if err != nil {
-		closePipe(stdin)
-		cancel()
-		return nil, fmt.Errorf("clirunner: stdout pipe: %w", err)
-	}
-	stderr, err := cmd.StderrPipe()
-	if err != nil {
-		closePipe(stdin)
-		cancel()
-		return nil, fmt.Errorf("clirunner: stderr pipe: %w", err)
-	}
-	if err := cmd.Start(); err != nil {
-		closePipe(stdin)
-		cancel()
-		return nil, fmt.Errorf("clirunner: start %q: %w", opts.Binary, err)
-	}
-
-	return &Process{
-		Cmd:       cmd,
-		Stdin:     stdin,
-		Stdout:    stdout,
-		Stderr:    stderr,
-		ctx:       ctx,
-		cancel:    cancel,
-		done:      make(chan struct{}),
-		killAfter: opts.KillTimeout,
-	}, nil
+	// Every child owns its process group (a Job object on Windows), bounding the
+	// lifetime of its descendants.
+	return startProcessGroup(opts)
 }
 
 func (p *Process) Context() context.Context {
@@ -118,41 +67,20 @@ func (p *Process) Done() <-chan struct{} {
 }
 
 func (p *Process) Cancel() {
-	if p == nil {
+	if p == nil || p.cancelProcess == nil {
 		return
 	}
 	p.cancelOnce.Do(func() {
-		if p.cancelProcess != nil {
-			_ = p.cancelProcess()
-			p.cancel()
-			return
-		}
-		if p.Cmd != nil && p.Cmd.Process != nil {
-			_ = p.Cmd.Process.Signal(syscall.SIGTERM)
-			go func() {
-				select {
-				case <-p.done:
-				case <-time.After(p.killAfter):
-					_ = p.Cmd.Process.Signal(syscall.SIGKILL)
-				}
-			}()
-		}
-		if p.cancel != nil {
-			p.cancel()
-		}
+		_ = p.cancelProcess()
+		p.cancel()
 	})
 }
 
 func (p *Process) Wait() error {
-	if p == nil || p.Cmd == nil {
+	if p == nil || p.waitProcess == nil {
 		return nil
 	}
-	if p.waitProcess != nil {
-		return p.waitProcess()
-	}
-	err := p.Cmd.Wait()
-	p.waitOnce.Do(func() { close(p.done) })
-	return err
+	return p.waitProcess()
 }
 
 func closePipe(p io.Closer) {
diff --git a/apps/daemon/internal/agent/clirunner/process_group_other.go b/apps/daemon/internal/agent/clirunner/process_group_other.go
index d5763742b..796f8aa19 100644
--- a/apps/daemon/internal/agent/clirunner/process_group_other.go
+++ b/apps/daemon/internal/agent/clirunner/process_group_other.go
@@ -5,5 +5,5 @@ package clirunner
 import "errors"
 
 func startProcessGroup(StartOptions) (*Process, error) {
-	return nil, errors.New("clirunner: process-group ownership requires Unix")
+	return nil, errors.New("clirunner: process ownership requires Unix or Windows")
 }
diff --git a/apps/daemon/internal/agent/clirunner/process_group_unix_test.go b/apps/daemon/internal/agent/clirunner/process_group_unix_test.go
index 8a3cbf162..da3162be5 100644
--- a/apps/daemon/internal/agent/clirunner/process_group_unix_test.go
+++ b/apps/daemon/internal/agent/clirunner/process_group_unix_test.go
@@ -107,9 +107,9 @@ func startOwnedHelper(t *testing.T, ctx context.Context, mode, dir string) *Proc
 	t.Helper()
 	p, err := Start(StartOptions{
 		Parent: ctx, Binary: os.Args[0],
-		Args:            []string{"-test.run=^TestOwnedGroupHelper$", "--", "leader", mode, dir},
-		Env:             append(os.Environ(), "GO_WANT_OWNED_GROUP=1", "GORACE=atexit_sleep_ms=0"),
-		OwnProcessGroup: true, KillTimeout: 300 * time.Millisecond,
+		Args:        []string{"-test.run=^TestOwnedGroupHelper$", "--", "leader", mode, dir},
+		Env:         append(os.Environ(), "GO_WANT_OWNED_GROUP=1", "GORACE=atexit_sleep_ms=0"),
+		KillTimeout: 300 * time.Millisecond,
 	})
 	if err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/clirunner/process_group_windows_test.go b/apps/daemon/internal/agent/clirunner/process_group_windows_test.go
index b2d442b54..fee66f0f2 100644
--- a/apps/daemon/internal/agent/clirunner/process_group_windows_test.go
+++ b/apps/daemon/internal/agent/clirunner/process_group_windows_test.go
@@ -21,7 +21,7 @@ func TestWindowsOwnedTree(t *testing.T) {
 			dir := t.TempDir()
 			ctx, cancel := context.WithCancel(t.Context())
 			defer cancel()
-			p, err := Start(StartOptions{Parent: ctx, Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: append(os.Environ(), "OAC_TREE_HELPER=1"), OwnProcessGroup: true})
+			p, err := Start(StartOptions{Parent: ctx, Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: append(os.Environ(), "OAC_TREE_HELPER=1")})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -129,7 +129,7 @@ func TestWindowsTreeHelper(t *testing.T) {
 			time.Sleep(10 * time.Millisecond)
 		}
 	case "owner":
-		p, err := Start(StartOptions{Parent: context.Background(), Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: os.Environ(), OwnProcessGroup: true})
+		p, err := Start(StartOptions{Parent: context.Background(), Binary: os.Args[0], Args: []string{"-test.run=^TestWindowsTreeHelper$", "--", "leader", mode, dir}, Env: os.Environ()})
 		if err != nil {
 			os.Exit(3)
 		}
diff --git a/apps/daemon/internal/agent/codex/declaration.go b/apps/daemon/internal/agent/codex/declaration.go
index ea6bfab51..26bb61c4e 100644
--- a/apps/daemon/internal/agent/codex/declaration.go
+++ b/apps/daemon/internal/agent/codex/declaration.go
@@ -20,7 +20,6 @@ var Declaration = agent.Declaration{Info: proto.SupportedAgentKind{
 		Usage:                          proto.CapabilitySupported,
 		Resume:                         proto.CapabilitySupported,
 		NativeSessionRecovery:          proto.CapabilityUnsupported,
-		WorkspaceAuthoring:             proto.CapabilitySupported,
 		Steering:                       proto.CapabilitySupported,
 		MessageItems:                   proto.CapabilitySupported,
 		ToolObservations:               proto.CapabilitySupported,
diff --git a/apps/daemon/internal/agent/codex/declaration_test.go b/apps/daemon/internal/agent/codex/declaration_test.go
index d3a364b97..b26acf131 100644
--- a/apps/daemon/internal/agent/codex/declaration_test.go
+++ b/apps/daemon/internal/agent/codex/declaration_test.go
@@ -29,7 +29,7 @@ func TestMCPRequiredDiscoveryRequiresPinnedNative(t *testing.T) {
 
 // The declaration must retain the complete baseline capability descriptor.
 func TestDeclaredCapabilityBaseline(t *testing.T) {
-	expected := map[string]bool{"SubagentObservations": true, "Streaming": true, "Permissions": true, "Usage": true, "Resume": true, "Steering": true, "MessageItems": true, "ToolObservations": true, "EnvironmentNone": true, "ProgrammaticToolCallingDisable": true, "WebSearchControl": true, "MessageImages": true, "FunctionResultImages": true, "SubagentControl": true, "DurableInputReceipts": true, "DurableTurns": true, "FunctionTools": true, "MCPHTTPTools": true, "MCPHTTPBearerAuth": true, "WorkspaceAuthoring": true}
+	expected := map[string]bool{"SubagentObservations": true, "Streaming": true, "Permissions": true, "Usage": true, "Resume": true, "Steering": true, "MessageItems": true, "ToolObservations": true, "EnvironmentNone": true, "ProgrammaticToolCallingDisable": true, "WebSearchControl": true, "MessageImages": true, "FunctionResultImages": true, "SubagentControl": true, "DurableInputReceipts": true, "DurableTurns": true, "FunctionTools": true, "MCPHTTPTools": true, "MCPHTTPBearerAuth": true}
 	expected["ExecutionControls"], expected["TextVerbosity"] = SupportsTextVerbosity, SupportsTextVerbosity
 	value := reflect.ValueOf(Declaration.Info.Capabilities)
 	for i := 0; i < value.NumField(); i++ {
diff --git a/apps/daemon/internal/agent/codex/environment.go b/apps/daemon/internal/agent/codex/environment.go
index 51ba1f0f6..725e5ef58 100644
--- a/apps/daemon/internal/agent/codex/environment.go
+++ b/apps/daemon/internal/agent/codex/environment.go
@@ -7,8 +7,6 @@ import (
 	"fmt"
 	"os"
 	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
 // Check the native provider instead of assuming an older binary honors the flag.
@@ -40,22 +38,16 @@ func nativeEnvironmentStatus(ctx context.Context, rpc *JSONRPCClient, id string)
 }
 
 // Native still recognizes the retired transport variables. Reject them before
-// setup so inherited or operator options cannot select a separate executor.
+// setup so the inherited environment cannot select a separate executor.
 // The explicit none selector remains part of native execution isolation.
-func validateNativeTransportEnvironment(req proto.PromptRequestPayload) error {
-	options, err := buildSessionEnv(req.AgentOptions)
-	if err != nil {
-		return err
-	}
-	for _, environment := range [][]string{os.Environ(), options} {
-		for _, entry := range environment {
-			key, value, _ := strings.Cut(entry, "=")
-			if value == "" {
-				continue
-			}
-			if (key == "CODEX_EXEC_SERVER_URL" && value != "none") || strings.HasPrefix(key, "CODEX_EXEC_SERVER_NOISE_") {
-				return errors.New("codex: retired executor transport configuration is not supported")
-			}
+func validateNativeTransportEnvironment() error {
+	for _, entry := range os.Environ() {
+		key, value, _ := strings.Cut(entry, "=")
+		if value == "" {
+			continue
+		}
+		if (key == "CODEX_EXEC_SERVER_URL" && value != "none") || strings.HasPrefix(key, "CODEX_EXEC_SERVER_NOISE_") {
+			return errors.New("codex: retired executor transport configuration is not supported")
 		}
 	}
 	return nil
diff --git a/apps/daemon/internal/agent/codex/environment_retired_test.go b/apps/daemon/internal/agent/codex/environment_retired_test.go
index 08dab1f6b..f3e070843 100644
--- a/apps/daemon/internal/agent/codex/environment_retired_test.go
+++ b/apps/daemon/internal/agent/codex/environment_retired_test.go
@@ -24,33 +24,27 @@ func TestReadOnlyPreparationRejectedBeforeNativeSetup(t *testing.T) {
 	}
 }
 
-func TestRetiredNativeTransportOptionsRejectedBeforeState(t *testing.T) {
+func TestRetiredNativeTransportEnvironmentRejectedBeforeState(t *testing.T) {
 	for _, key := range []string{"CODEX_EXEC_SERVER_URL", "CODEX_EXEC_SERVER_NOISE_REGISTRY_URL", "CODEX_EXEC_SERVER_NOISE_ENVIRONMENT_ID", "CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN"} {
-		for _, source := range []string{"process", "options"} {
-			for _, none := range []bool{false, true} {
-				t.Run(key+"/"+source+"/"+map[bool]string{false: "local", true: "none"}[none], func(t *testing.T) {
-					req, cfg, root := preparationFixture(t)
-					req.DisableExecutionEnvironment = none
-					if !none {
-						req.LocalEnvironment = &proto.LocalEnvironment{ID: "local"}
-					}
-					if source == "process" {
-						t.Setenv(key, "retired-private-value")
-					} else {
-						req.AgentOptions["env"] = map[string]any{key: "retired-private-value"}
-					}
-					p, err := newPreparation(t.Context(), req, cfg)
-					if p != nil || err == nil || !strings.Contains(err.Error(), "retired executor transport") || strings.Contains(err.Error(), "retired-private-value") {
-						t.Fatal("transport override admitted or disclosed", err)
-					}
-					if len(preparationFrames(t, root)) != 0 {
-						t.Fatal("retired transport started native process")
-					}
-					if _, err := os.Stat(filepath.Join(root, "daemon", "agent-sessions")); !os.IsNotExist(err) {
-						t.Fatal("retired transport created state", err)
-					}
-				})
-			}
+		for _, none := range []bool{false, true} {
+			t.Run(key+"/"+map[bool]string{false: "local", true: "none"}[none], func(t *testing.T) {
+				req, cfg, root := preparationFixture(t)
+				req.DisableExecutionEnvironment = none
+				if !none {
+					req.LocalEnvironment = &proto.LocalEnvironment{ID: "local"}
+				}
+				t.Setenv(key, "retired-private-value")
+				p, err := newPreparation(t.Context(), req, cfg)
+				if p != nil || err == nil || !strings.Contains(err.Error(), "retired executor transport") || strings.Contains(err.Error(), "retired-private-value") {
+					t.Fatal("transport override admitted or disclosed", err)
+				}
+				if len(preparationFrames(t, root)) != 0 {
+					t.Fatal("retired transport started native process")
+				}
+				if _, err := os.Stat(filepath.Join(root, "daemon", "agent-sessions")); !os.IsNotExist(err) {
+					t.Fatal("retired transport created state", err)
+				}
+			})
 		}
 	}
 }
@@ -58,7 +52,6 @@ func TestRetiredNativeTransportOptionsRejectedBeforeState(t *testing.T) {
 func TestNativeNoneSelectorRemainsSupported(t *testing.T) {
 	req, cfg, root := preparationFixture(t)
 	t.Setenv("CODEX_EXEC_SERVER_URL", "none")
-	req.AgentOptions["env"] = map[string]any{"CODEX_EXEC_SERVER_URL": "none"}
 	p, err := newPreparation(t.Context(), req, cfg)
 	if err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/codex/executor.go b/apps/daemon/internal/agent/codex/executor.go
index 2f1e2eb09..75403c57d 100644
--- a/apps/daemon/internal/agent/codex/executor.go
+++ b/apps/daemon/internal/agent/codex/executor.go
@@ -69,8 +69,7 @@ func (e *Executor) StartTurn(ctx context.Context, runID string, input proto.Mess
 	functions := &functionCalls{definitions: base.functions.definitions, names: base.functions.names, pending: map[string]*pendingFunction{}}
 	turnCtx, cancel := context.WithCancel(base.cancelCtx)
 	s := &Session{executor: e, nativeHome: base.nativeHome,
-		functions: functions, observeMessages: base.observeMessages,
-		observeToolObservations: base.observeToolObservations, observeSubagentIdentities: base.observeSubagentIdentities,
+		functions: functions, observeMessages: base.observeMessages, observeSubagentIdentities: base.observeSubagentIdentities,
 		cfg: base.cfg, rpc: base.rpc, cancelCtx: turnCtx, cancelFn: cancel,
 		waitDone: make(chan struct{}), outputDone: make(chan struct{}), cleanup: func() {},
 		bufs: NewItemBuffers(), resolvedModel: base.resolvedModel, interactions: newPendingCodexInteractions(), runID: runID, out: out}
@@ -94,7 +93,7 @@ func (e *Executor) StartTurn(ctx context.Context, runID string, input proto.Mess
 	}
 	s.registerHandlers()
 	e.mu.Unlock()
-	req := proto.PromptRequestPayload{RunID: runID, Input: input, AgentSessionID: e.prepared.resumeID, StrictResume: e.prepared.strictResume, RequireExistingNativeSession: e.prepared.requireExistingNativeSession}
+	req := proto.PromptRequestPayload{RunID: runID, Input: input, AgentSessionID: e.prepared.resumeID, RequireExistingNativeSession: e.prepared.requireExistingNativeSession}
 	// Ownership precedes any native submission. Even an uncertain start returns the
 	// exact Turn so its caller can await settlement without replaying the input.
 	err := s.startNative(ctx, e.prepared.plan, req)
diff --git a/apps/daemon/internal/agent/codex/executor_native_test.go b/apps/daemon/internal/agent/codex/executor_native_test.go
index 227ad311c..247e6b083 100644
--- a/apps/daemon/internal/agent/codex/executor_native_test.go
+++ b/apps/daemon/internal/agent/codex/executor_native_test.go
@@ -50,7 +50,7 @@ func TestExecutorNativeReuse(t *testing.T) {
 	cfg.logger = obslog.Discard()
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "executor-native",
-		StrictResume: true, DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true,
+		DisableExecutionEnvironment: true, DisableSubagents: true, ObserveMessages: true,
 		AgentOptions:  map[string]any{"model": model, "model_provider": map[string]any{"base_url": endpoint, "protocol": "responses", "api_key": strings.TrimSpace(string(key))}},
 		FunctionTools: []proto.FunctionTool{{Name: "hold", Description: "Wait until the host supplies a result.", Parameters: json.RawMessage("{\"type\":\"object\",\"properties\":{},\"additionalProperties\":false}")}},
 	}
diff --git a/apps/daemon/internal/agent/codex/executor_test.go b/apps/daemon/internal/agent/codex/executor_test.go
index 01245f944..f864d5899 100644
--- a/apps/daemon/internal/agent/codex/executor_test.go
+++ b/apps/daemon/internal/agent/codex/executor_test.go
@@ -165,7 +165,7 @@ func TestExecutorStartErrorsRetainExactOwnership(t *testing.T) {
 }
 
 func TestExecutorCloseRetainsPlanUntilReaped(t *testing.T) {
-	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true, OwnProcessGroup: true})
+	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/codex/mcp_required_test.go b/apps/daemon/internal/agent/codex/mcp_required_test.go
index bd4bbec2b..44b106a43 100644
--- a/apps/daemon/internal/agent/codex/mcp_required_test.go
+++ b/apps/daemon/internal/agent/codex/mcp_required_test.go
@@ -17,7 +17,6 @@ func TestRequiredMCPWaitsForNativeThreadAndNeverRestartsFailedResume(t *testing.
 	for _, mode := range []string{"new ready", "new failed", "resume ready", "resume failed"} {
 		t.Run(mode, func(t *testing.T) {
 			req, cfg, root := preparationFixture(t)
-			req.StrictResume = true
 			req.AgentOptions = map[string]any{"model": "fixture-model"}
 			servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "docs", ServerURL: "https://docs.example/mcp", Required: true}}
 			req.MCPHTTPServers = &servers
diff --git a/apps/daemon/internal/agent/codex/options.go b/apps/daemon/internal/agent/codex/options.go
index 2e0457cb2..4b7b2d2d2 100644
--- a/apps/daemon/internal/agent/codex/options.go
+++ b/apps/daemon/internal/agent/codex/options.go
@@ -7,7 +7,6 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
-	"sort"
 	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
@@ -74,8 +73,6 @@ type SessionPlan struct {
 //	system_prompt   string  forwarded as developerInstructions
 //	model_provider  object  frozen upstream protocol, endpoint, credential and token limits
 //	harness_config  object  native parameters accepted by harnessconfig/codex
-//	env             object  extra env vars (KEY=string-value); the Runtime's
-//	                        authoring bridge supplies it
 //
 // Execution controls select the native web_search and model_verbosity settings.
 // The codex binary itself is resolved via PATH only.
@@ -109,11 +106,6 @@ func BuildSessionPlan(agentStateKey string, opts map[string]any, controls *proto
 	plan.Model = stringOpt(opts, "model")
 	plan.SystemPrompt = stringOpt(opts, "system_prompt")
 
-	env, err := buildSessionEnv(opts)
-	if err != nil {
-		return plan, err
-	}
-
 	codexHome, err := allocCodexHome(agentStateKey)
 	if err != nil {
 		return plan, err
@@ -121,7 +113,7 @@ func BuildSessionPlan(agentStateKey string, opts map[string]any, controls *proto
 	if err := resetGeneratedConfig(codexHome); err != nil {
 		return plan, err
 	}
-	env = append(env, "CODEX_HOME="+codexHome)
+	env := []string{"DISABLE_TELEMETRY=1", "CODEX_HOME=" + codexHome}
 
 	provider, hasProvider, err := normaliseProviderConfig(opts["model_provider"])
 	if err != nil {
@@ -203,33 +195,6 @@ func resetGeneratedConfig(codexHome string) error {
 	return nil
 }
 
-func buildSessionEnv(opts map[string]any) ([]string, error) {
-	env := []string{
-		"DISABLE_TELEMETRY=1",
-	}
-	raw, ok := opts["env"]
-	if !ok || raw == nil {
-		return env, nil
-	}
-	envMap, ok := raw.(map[string]any)
-	if !ok {
-		return nil, fmt.Errorf("codex.BuildSessionPlan: env must be object, got %T", raw)
-	}
-	keys := make([]string, 0, len(envMap))
-	for k := range envMap {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		s, ok := envMap[k].(string)
-		if !ok {
-			return nil, fmt.Errorf("codex.BuildSessionPlan: env[%q] must be string, got %T", k, envMap[k])
-		}
-		env = append(env, k+"="+s)
-	}
-	return env, nil
-}
-
 // normaliseProviderConfig validates and renders the frozen native provider.
 func normaliseProviderConfig(raw any) (providerConfig, bool, error) {
 	if raw == nil {
diff --git a/apps/daemon/internal/agent/codex/options_test.go b/apps/daemon/internal/agent/codex/options_test.go
index f5fec2fdb..b20123e2b 100644
--- a/apps/daemon/internal/agent/codex/options_test.go
+++ b/apps/daemon/internal/agent/codex/options_test.go
@@ -24,24 +24,17 @@ func TestBuildSessionPlan_DefaultsToBypass(t *testing.T) {
 }
 
 func TestBuildSessionPlan_AllocsCodexHomeAndEnv(t *testing.T) {
-	plan, err := BuildSessionPlan("conv-1/agent-1/codex", map[string]any{
-		"env": map[string]any{
-			"OPENAI_API_KEY": "sk-test",
-		},
-	}, nil)
+	plan, err := BuildSessionPlan("conv-1/agent-1/codex", nil, nil)
 	if err != nil {
 		t.Fatalf("BuildSessionPlan: %v", err)
 	}
 	defer plan.Cleanup()
 	hasCodexHome := false
-	hasOpenAI := false
 	hasTelemetry := false
 	for _, kv := range plan.Env {
 		switch {
 		case strings.HasPrefix(kv, "CODEX_HOME="):
 			hasCodexHome = true
-		case kv == "OPENAI_API_KEY=sk-test":
-			hasOpenAI = true
 		case kv == "DISABLE_TELEMETRY=1":
 			hasTelemetry = true
 		}
@@ -49,9 +42,6 @@ func TestBuildSessionPlan_AllocsCodexHomeAndEnv(t *testing.T) {
 	if !hasCodexHome {
 		t.Fatalf("env missing CODEX_HOME: %+v", plan.Env)
 	}
-	if !hasOpenAI {
-		t.Fatalf("env missing OPENAI_API_KEY: %+v", plan.Env)
-	}
 	if !hasTelemetry {
 		t.Fatalf("env missing DISABLE_TELEMETRY: %+v", plan.Env)
 	}
diff --git a/apps/daemon/internal/agent/codex/preparation.go b/apps/daemon/internal/agent/codex/preparation.go
index 663f060d2..0d3a4bdf9 100644
--- a/apps/daemon/internal/agent/codex/preparation.go
+++ b/apps/daemon/internal/agent/codex/preparation.go
@@ -25,7 +25,6 @@ func newSession(parent context.Context, req proto.PromptRequestPayload, out chan
 		return nil, errors.New("codex: nil out channel")
 	}
 	runID, prompt := req.RunID, req.Input
-	req.AgentStateKey = effectiveAgentStateKey(req)
 	req.RunID, req.Input = "", nil
 	prepared, err := newPreparation(parent, req, cfg)
 	if err != nil {
@@ -42,9 +41,6 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	if req.WorkspaceReadOnly {
 		return nil, errors.New("codex: workspace reads use the local Runtime interface")
 	}
-	if req.RequireExistingNativeSession && (!req.StrictResume || req.AgentStateKey == "" || req.WorkspaceReadOnly) {
-		return nil, errors.New("codex: native-session recovery requires strict private state")
-	}
 	if req.RunID != "" || len(req.Input) != 0 {
 		return nil, errors.New("codex: preparation does not accept a run identity or prompt")
 	}
@@ -61,8 +57,6 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	if err != nil {
 		return nil, err
 	}
-	req.AgentStateKey = effectiveAgentStateKey(req)
-
 	plan, skillRoots, err := prepareSessionPlan(parent, req, cfg)
 	if err != nil {
 		return nil, err
@@ -86,11 +80,9 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	rpc := NewJSONRPCClient(rpcCfg)
 
 	s := &Session{
-		nativeHome:      nativeHomeFromPlan(plan),
-		functions:       functions,
-		observeMessages: req.ObserveMessages,
-
-		observeToolObservations:   req.ObserveToolObservations,
+		nativeHome:                nativeHomeFromPlan(plan),
+		functions:                 functions,
+		observeMessages:           req.ObserveMessages,
 		observeSubagentIdentities: req.ObserveSubagentIdentities && !req.DisableSubagents,
 		cfg:                       cfg,
 		rpc:                       rpc,
@@ -105,7 +97,7 @@ func newPreparation(parent context.Context, req proto.PromptRequestPayload, cfg
 	plan.Cleanup = s.cleanup
 	p := &Prepared{
 		session: s, plan: plan,
-		resumeID: req.AgentSessionID, strictResume: req.StrictResume, requireExistingNativeSession: req.RequireExistingNativeSession,
+		resumeID: req.AgentSessionID, requireExistingNativeSession: req.RequireExistingNativeSession,
 		transferred: make(chan struct{}),
 	}
 
diff --git a/apps/daemon/internal/agent/codex/preparation_helpers_test.go b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
index 65625bcec..a04fe665c 100644
--- a/apps/daemon/internal/agent/codex/preparation_helpers_test.go
+++ b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
@@ -42,7 +42,7 @@ func preparationFixture(t *testing.T) (proto.PromptRequestPayload, sessionConfig
 	cfg.codexBinary = binary
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "prepared-session",
-		ReleaseOnCompletion: true, StrictResume: true,
+		ReleaseOnCompletion:         true,
 		AgentOptions:                map[string]any{"model": "fixture-model"},
 		ExecutionControls:           &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"},
 		DisableExecutionEnvironment: true,
diff --git a/apps/daemon/internal/agent/codex/prepared.go b/apps/daemon/internal/agent/codex/prepared.go
index 454b71976..1f4e049f0 100644
--- a/apps/daemon/internal/agent/codex/prepared.go
+++ b/apps/daemon/internal/agent/codex/prepared.go
@@ -17,7 +17,6 @@ type Prepared struct {
 	session                      *Session
 	plan                         SessionPlan
 	resumeID                     string
-	strictResume                 bool
 	requireExistingNativeSession bool
 	claimed                      bool
 	closed                       bool
@@ -70,7 +69,7 @@ func (p *Prepared) start(ctx context.Context, runID string, prompt proto.Message
 	p.started = true
 	close(p.transferred)
 	transferred = true
-	req := proto.PromptRequestPayload{RunID: runID, Input: prompt, AgentSessionID: p.resumeID, StrictResume: p.strictResume, RequireExistingNativeSession: p.requireExistingNativeSession}
+	req := proto.PromptRequestPayload{RunID: runID, Input: prompt, AgentSessionID: p.resumeID, RequireExistingNativeSession: p.requireExistingNativeSession}
 	go s.run(p.plan, req)
 	return s, nil
 }
diff --git a/apps/daemon/internal/agent/codex/recovery_test.go b/apps/daemon/internal/agent/codex/recovery_test.go
index da32ad87e..78aad7c16 100644
--- a/apps/daemon/internal/agent/codex/recovery_test.go
+++ b/apps/daemon/internal/agent/codex/recovery_test.go
@@ -46,7 +46,7 @@ func TestRequiredHistoryResolution(t *testing.T) {
 			case "wrong-home":
 				row["path"] = "/another/sessions/rollout.jsonl"
 			}
-			req := proto.PromptRequestPayload{StrictResume: true, RequireExistingNativeSession: true}
+			req := proto.PromptRequestPayload{RequireExistingNativeSession: true}
 			if scenario == "fresh" {
 				req.RequireExistingNativeSession = false
 			}
@@ -196,14 +196,12 @@ func TestPreparedRecoveryCannotStartWithoutExistingHistory(t *testing.T) {
 	}
 }
 
-func TestRecoveryRequiresStrictPrivateExecution(t *testing.T) {
-	for _, mode := range []string{"non-strict", "no-state", "read-only"} {
+func TestRecoveryRequiresWritableAgentState(t *testing.T) {
+	for _, mode := range []string{"no-state", "read-only"} {
 		t.Run(mode, func(t *testing.T) {
 			req, cfg, root := preparationFixture(t)
 			req.RequireExistingNativeSession = true
 			switch mode {
-			case "non-strict":
-				req.StrictResume = false
 			case "no-state":
 				req.AgentStateKey = ""
 			case "read-only":
diff --git a/apps/daemon/internal/agent/codex/resume.go b/apps/daemon/internal/agent/codex/resume.go
index 6ee852b1c..2bc3172e1 100644
--- a/apps/daemon/internal/agent/codex/resume.go
+++ b/apps/daemon/internal/agent/codex/resume.go
@@ -9,18 +9,12 @@ import (
 
 func (s *Session) resolveThread(req proto.PromptRequestPayload, plan SessionPlan) error {
 	if strings.TrimSpace(req.AgentSessionID) != "" {
-		if err := s.resumeThread(req.AgentSessionID, plan); err == nil {
-			return nil
-		} else if req.StrictResume {
+		if err := s.resumeThread(req.AgentSessionID, plan); err != nil {
 			return fmt.Errorf("codex: thread/resume: %w", err)
-		} else {
-			s.cfg.logger.Warn("codex: thread/resume failed; starting fresh", "run_id", s.runID, "thread_id", req.AgentSessionID, "err", err)
 		}
+		return nil
 	}
 	if req.RequireExistingNativeSession {
-		if !req.StrictResume {
-			return fmt.Errorf("codex: recovery requires strict resume")
-		}
 		id, err := s.recoverRoot(plan)
 		if err != nil {
 			return err
diff --git a/apps/daemon/internal/agent/codex/resume_test.go b/apps/daemon/internal/agent/codex/resume_test.go
index 1da859d76..698eb2cc7 100644
--- a/apps/daemon/internal/agent/codex/resume_test.go
+++ b/apps/daemon/internal/agent/codex/resume_test.go
@@ -10,53 +10,38 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
 )
 
-func TestStrictResumeDoesNotStartFresh(t *testing.T) {
-	for _, strict := range []bool{false, true} {
-		t.Run(map[bool]string{false: "legacy", true: "strict"}[strict], func(t *testing.T) {
-			client, server, cleanup := NewTestClient()
-			defer cleanup()
-			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-			defer cancel()
-			s := &Session{rpc: client.JSONRPCClient, cancelCtx: ctx, cfg: sessionConfig{logger: log.With("component", "resume-test")}}
-			result := make(chan error, 1)
-			go func() {
-				result <- s.resolveThread(proto.PromptRequestPayload{AgentSessionID: "existing", StrictResume: strict}, SessionPlan{})
-			}()
-			var req struct {
-				ID     string `json:"id"`
-				Method string `json:"method"`
-			}
-			decoder := json.NewDecoder(server.FromClient)
-			encoder := json.NewEncoder(server.ToClient)
-			if err := decoder.Decode(&req); err != nil {
-				t.Fatal(err)
-			}
-			if req.Method != "thread/resume" {
-				t.Fatal(req.Method)
-			}
-			if err := encoder.Encode(map[string]any{"id": req.ID, "error": map[string]any{"code": -32600, "message": "native history unavailable"}}); err != nil {
-				t.Fatal(err)
-			}
-			if !strict {
-				if err := decoder.Decode(&req); err != nil {
-					t.Fatal(err)
-				}
-				if req.Method != "thread/start" {
-					t.Fatal(req.Method)
-				}
-				if err := encoder.Encode(map[string]any{"id": req.ID, "result": map[string]any{"thread": map[string]string{"id": "fresh"}}}); err != nil {
-					t.Fatal(err)
-				}
-			}
-			select {
-			case err := <-result:
-				if (err != nil) != strict {
-					t.Fatalf("strict=%v err=%v", strict, err)
-				}
-			case <-ctx.Done():
-				t.Fatal("thread resolution did not finish")
-			}
-		})
+func TestFailedResumeDoesNotStartFresh(t *testing.T) {
+	client, server, cleanup := NewTestClient()
+	defer cleanup()
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	s := &Session{rpc: client.JSONRPCClient, cancelCtx: ctx, cfg: sessionConfig{logger: log.With("component", "resume-test")}}
+	result := make(chan error, 1)
+	go func() {
+		result <- s.resolveThread(proto.PromptRequestPayload{AgentSessionID: "existing"}, SessionPlan{})
+	}()
+	var req struct {
+		ID     string `json:"id"`
+		Method string `json:"method"`
+	}
+	decoder := json.NewDecoder(server.FromClient)
+	encoder := json.NewEncoder(server.ToClient)
+	if err := decoder.Decode(&req); err != nil {
+		t.Fatal(err)
+	}
+	if req.Method != "thread/resume" {
+		t.Fatal(req.Method)
+	}
+	if err := encoder.Encode(map[string]any{"id": req.ID, "error": map[string]any{"code": -32600, "message": "native history unavailable"}}); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-result:
+		if err == nil {
+			t.Fatal("failed resume started a fresh thread")
+		}
+	case <-ctx.Done():
+		t.Fatal("thread resolution did not finish")
 	}
 }
 
diff --git a/apps/daemon/internal/agent/codex/rpc.go b/apps/daemon/internal/agent/codex/rpc.go
index 2102eda9e..78607a12c 100644
--- a/apps/daemon/internal/agent/codex/rpc.go
+++ b/apps/daemon/internal/agent/codex/rpc.go
@@ -182,7 +182,7 @@ func (c *JSONRPCClient) Start(ctx context.Context, init InitializeParams) (Initi
 
 	process, err := clirunner.Start(clirunner.StartOptions{
 		Parent: ctx, Binary: c.cfg.Binary, Args: args, Dir: c.cfg.Cwd, Env: c.cfg.Env,
-		NeedStdin: true, OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond,
+		NeedStdin: true, KillTimeout: 250 * time.Millisecond,
 	})
 	if err != nil {
 		return InitializeResult{}, fmt.Errorf("codex rpc: spawn %q: %w", c.cfg.Binary, err)
diff --git a/apps/daemon/internal/agent/codex/rpc_close_test.go b/apps/daemon/internal/agent/codex/rpc_close_test.go
index 80e404a85..c7b345d33 100644
--- a/apps/daemon/internal/agent/codex/rpc_close_test.go
+++ b/apps/daemon/internal/agent/codex/rpc_close_test.go
@@ -15,7 +15,7 @@ import (
 )
 
 func TestJSONRPCClientCloseCanRetryUnreapedChild(t *testing.T) {
-	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true, OwnProcessGroup: true})
+	process, err := clirunner.Start(clirunner.StartOptions{Parent: t.Context(), Binary: os.Args[0], Args: []string{"-test.run=^TestJSONRPCClientFakeCodexProcess$", "--"}, Env: append(os.Environ(), "CODEX_RPC_FAKE_PROCESS=1", "GORACE=atexit_sleep_ms=0"), NeedStdin: true})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/codex/session.go b/apps/daemon/internal/agent/codex/session.go
index 9b8ce23b0..f2bc6333f 100644
--- a/apps/daemon/internal/agent/codex/session.go
+++ b/apps/daemon/internal/agent/codex/session.go
@@ -70,11 +70,10 @@ type Session struct {
 	functions                 *functionCalls
 	observeMessages           bool
 
-	observeToolObservations bool
-	runID                   string
-	cfg                     sessionConfig
-	out                     chan<- proto.Envelope
-	rpc                     *JSONRPCClient
+	runID string
+	cfg   sessionConfig
+	out   chan<- proto.Envelope
+	rpc   *JSONRPCClient
 
 	cancelCtx context.Context
 	cancelFn  context.CancelFunc
diff --git a/apps/daemon/internal/agent/codex/session_command_output.go b/apps/daemon/internal/agent/codex/session_command_output.go
index 600e4fdad..1d5cd9f92 100644
--- a/apps/daemon/internal/agent/codex/session_command_output.go
+++ b/apps/daemon/internal/agent/codex/session_command_output.go
@@ -7,9 +7,6 @@ import (
 )
 
 func (s *Session) onCommandOutput(raw json.RawMessage) {
-	if !s.observeToolObservations {
-		return
-	}
 	var p AgentMessageDeltaNotification
 	if json.Unmarshal(raw, &p) != nil || !s.isRootTurn(p.ThreadID, p.TurnID) || p.ItemID == "" || p.Delta == "" {
 		return
diff --git a/apps/daemon/internal/agent/codex/session_command_output_test.go b/apps/daemon/internal/agent/codex/session_command_output_test.go
index 4f86ccbd0..a51fb6694 100644
--- a/apps/daemon/internal/agent/codex/session_command_output_test.go
+++ b/apps/daemon/internal/agent/codex/session_command_output_test.go
@@ -8,42 +8,34 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func TestCommandOutputRequiresOptInAndRootTurn(t *testing.T) {
-	for _, enabled := range []bool{false, true} {
-		out := make(chan proto.Envelope, 10)
-		s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(), rpc: NewJSONRPCClient(JSONRPCConfig{}), observeToolObservations: enabled}
-		s.registerHandlers()
-		s.setThreadID("root")
-		s.beginRootTurn("root", "turn")
-		for _, raw := range []string{
-			`{"threadId":"child","turnId":"turn","itemId":"cmd","delta":"foreign"}`,
-			`{"threadId":"root","turnId":"old","itemId":"cmd","delta":"foreign"}`,
-			`{"threadId":"root","turnId":"turn","delta":"missing identity"}`,
-			`{"threadId":"root","turnId":"turn","itemId":"cmd","delta":null}`,
-			`{"threadId":42}`, `{}`,
-		} {
-			scopeNotification(t, s, "item/commandExecution/outputDelta", raw)
-		}
-		if len(out) != 0 {
-			t.Fatal("invalid output reached root")
+func TestCommandOutputRequiresRootTurn(t *testing.T) {
+	out := make(chan proto.Envelope, 10)
+	s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(), rpc: NewJSONRPCClient(JSONRPCConfig{})}
+	s.registerHandlers()
+	s.setThreadID("root")
+	s.beginRootTurn("root", "turn")
+	for _, raw := range []string{
+		`{"threadId":"child","turnId":"turn","itemId":"cmd","delta":"foreign"}`,
+		`{"threadId":"root","turnId":"old","itemId":"cmd","delta":"foreign"}`,
+		`{"threadId":"root","turnId":"turn","delta":"missing identity"}`,
+		`{"threadId":"root","turnId":"turn","itemId":"cmd","delta":null}`,
+		`{"threadId":42}`, `{}`,
+	} {
+		scopeNotification(t, s, "item/commandExecution/outputDelta", raw)
+	}
+	if len(out) != 0 {
+		t.Fatal("invalid output reached root")
+	}
+	for _, fragment := range []string{"same\n", "same\n", "结束\n"} {
+		raw, _ := json.Marshal(map[string]string{"threadId": "root", "turnId": "turn", "itemId": "cmd", "delta": fragment})
+		scopeNotification(t, s, "item/commandExecution/outputDelta", string(raw))
+		if len(out) != 1 {
+			t.Fatal("missing registered command notification")
 		}
-		for _, fragment := range []string{"same\n", "same\n", "结束\n"} {
-			raw, _ := json.Marshal(map[string]string{"threadId": "root", "turnId": "turn", "itemId": "cmd", "delta": fragment})
-			scopeNotification(t, s, "item/commandExecution/outputDelta", string(raw))
-			if !enabled {
-				if len(out) != 0 {
-					t.Fatal("product frame sequence changed")
-				}
-				continue
-			}
-			if len(out) != 1 {
-				t.Fatal("missing registered command notification")
-			}
-			env := <-out
-			var p proto.CommandOutputPayload
-			if env.DecodePayload(&p) != nil || env.Type != proto.TypeCommandOutput || env.ID != "run" || p.ID != "cmd" || p.Delta != fragment {
-				t.Fatal("command fragment changed", env)
-			}
+		env := <-out
+		var p proto.CommandOutputPayload
+		if env.DecodePayload(&p) != nil || env.Type != proto.TypeCommandOutput || env.ID != "run" || p.ID != "cmd" || p.Delta != fragment {
+			t.Fatal("command fragment changed", env)
 		}
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/session_notifications_test.go b/apps/daemon/internal/agent/codex/session_notifications_test.go
index 0df73e0e1..0ee2a9b94 100644
--- a/apps/daemon/internal/agent/codex/session_notifications_test.go
+++ b/apps/daemon/internal/agent/codex/session_notifications_test.go
@@ -13,8 +13,7 @@ func TestRootNotificationIsolation(t *testing.T) {
 		t.Run(map[bool]string{false: "child without thread started", true: "child thread started"}[childStarted], func(t *testing.T) {
 			out := make(chan proto.Envelope, 64)
 			s := &Session{runID: "run", out: out, cancelCtx: context.Background(), cfg: defaultSessionConfig(),
-				rpc: NewJSONRPCClient(JSONRPCConfig{}), bufs: NewItemBuffers(), observeMessages: true,
-				observeToolObservations: true}
+				rpc: NewJSONRPCClient(JSONRPCConfig{}), bufs: NewItemBuffers(), observeMessages: true}
 			s.registerHandlers()
 			s.setThreadID("root")
 			notify := func(method, params string) { t.Helper(); scopeNotification(t, s, method, params) }
diff --git a/apps/daemon/internal/agent/codex/session_plan.go b/apps/daemon/internal/agent/codex/session_plan.go
index 216b6717a..6d8ae5d67 100644
--- a/apps/daemon/internal/agent/codex/session_plan.go
+++ b/apps/daemon/internal/agent/codex/session_plan.go
@@ -10,7 +10,7 @@ import (
 )
 
 func prepareSessionPlan(ctx context.Context, req proto.PromptRequestPayload, cfg sessionConfig) (SessionPlan, []string, error) {
-	if err := validateNativeTransportEnvironment(req); err != nil {
+	if err := validateNativeTransportEnvironment(); err != nil {
 		return SessionPlan{}, nil, err
 	}
 	if err := validatePermissionProfile(req); err != nil {
diff --git a/apps/daemon/internal/agent/codex/session_tools.go b/apps/daemon/internal/agent/codex/session_tools.go
index 5a40b45c3..d1d4b4c94 100644
--- a/apps/daemon/internal/agent/codex/session_tools.go
+++ b/apps/daemon/internal/agent/codex/session_tools.go
@@ -10,13 +10,11 @@ func (s *Session) sendItemEvents(events []proto.Envelope, notification json.RawM
 	var native struct {
 		Item json.RawMessage `json:"item"`
 	}
-	if s.observeToolObservations {
-		if err := json.Unmarshal(notification, &native); err != nil {
-			return
-		}
+	if err := json.Unmarshal(notification, &native); err != nil {
+		return
 	}
 	for _, event := range events {
-		if (s.observeToolObservations) && event.Type == proto.TypeToolCall {
+		if event.Type == proto.TypeToolCall {
 			var tool proto.ToolCallPayload
 			if err := event.DecodePayload(&tool); err != nil {
 				return
diff --git a/apps/daemon/internal/agent/codex/session_tools_test.go b/apps/daemon/internal/agent/codex/session_tools_test.go
index 2eff526bb..8d4e06c8d 100644
--- a/apps/daemon/internal/agent/codex/session_tools_test.go
+++ b/apps/daemon/internal/agent/codex/session_tools_test.go
@@ -21,47 +21,39 @@ func toolSnapshotFixtures() []string {
 	}
 }
 
-func TestToolObservationsOnlyWhenRequested(t *testing.T) {
-	for _, enabled := range []bool{false, true} {
-		for _, item := range toolSnapshotFixtures() {
-			var source struct{ ID string }
-			if err := json.Unmarshal([]byte(item), &source); err != nil {
-				t.Fatal(err)
+func TestToolObservations(t *testing.T) {
+	for _, item := range toolSnapshotFixtures() {
+		var source struct{ ID string }
+		if err := json.Unmarshal([]byte(item), &source); err != nil {
+			t.Fatal(err)
+		}
+		t.Run(source.ID, func(t *testing.T) {
+			out := make(chan proto.Envelope, 4)
+			s := &Session{runID: "run", out: out, cancelCtx: context.Background(), bufs: NewItemBuffers(), cfg: defaultSessionConfig()}
+			s.setThreadID("private-thread")
+			s.onTurnStarted(json.RawMessage(`{"threadId":"private-thread","turn":{"id":"private-turn"}}`))
+			raw := json.RawMessage(`{"threadId":"private-thread","turnId":"private-turn","item":` + item + `}`)
+			s.onItemStarted(raw)
+			s.onItemCompleted(raw)
+			if len(out) != 2 {
+				t.Fatalf("tool event count changed: %d", len(out))
 			}
-			t.Run(source.ID, func(t *testing.T) {
-				out := make(chan proto.Envelope, 4)
-				s := &Session{runID: "run", observeToolObservations: enabled, out: out, cancelCtx: context.Background(), bufs: NewItemBuffers(), cfg: defaultSessionConfig()}
-				s.setThreadID("private-thread")
-				s.onTurnStarted(json.RawMessage(`{"threadId":"private-thread","turn":{"id":"private-turn"}}`))
-				raw := json.RawMessage(`{"threadId":"private-thread","turnId":"private-turn","item":` + item + `}`)
-				s.onItemStarted(raw)
-				s.onItemCompleted(raw)
-				if len(out) != 2 {
-					t.Fatalf("tool event count changed: %d", len(out))
+			for _, stage := range []string{"before", "after"} {
+				event := <-out
+				var tool proto.ToolCallPayload
+				if event.DecodePayload(&tool) != nil || event.Type != proto.TypeToolCall || tool.ID != source.ID || tool.Stage != stage {
+					t.Fatal(event)
 				}
-				for _, stage := range []string{"before", "after"} {
-					event := <-out
-					var tool proto.ToolCallPayload
-					if event.DecodePayload(&tool) != nil || event.Type != proto.TypeToolCall || tool.ID != source.ID || tool.Stage != stage {
-						t.Fatal(event)
-					}
-					if bytes.Contains(event.Payload, []byte("native_item")) {
-						t.Fatal("engine-specific snapshot escaped adapter")
-					}
-					if !enabled {
-						if tool.Observation != nil {
-							t.Fatal("unrequested observation")
-						}
-						continue
-					}
-					if tool.Observation == nil || stage == "before" && tool.Observation.Status != "in_progress" {
-						t.Fatal(tool.Observation)
-					}
-					if source.ID == "mcp" && !bytes.Contains(tool.Observation.Output, []byte("9007199254740993")) {
-						t.Fatal("structured output precision lost")
-					}
+				if bytes.Contains(event.Payload, []byte("native_item")) {
+					t.Fatal("engine-specific snapshot escaped adapter")
 				}
-			})
-		}
+				if tool.Observation == nil || stage == "before" && tool.Observation.Status != "in_progress" {
+					t.Fatal(tool.Observation)
+				}
+				if source.ID == "mcp" && !bytes.Contains(tool.Observation.Output, []byte("9007199254740993")) {
+					t.Fatal("structured output precision lost")
+				}
+			}
+		})
 	}
 }
diff --git a/apps/daemon/internal/agent/codex/skills.go b/apps/daemon/internal/agent/codex/skills.go
index 69994f5ee..f7bdfe04a 100644
--- a/apps/daemon/internal/agent/codex/skills.go
+++ b/apps/daemon/internal/agent/codex/skills.go
@@ -1,24 +1,6 @@
 package codex
 
-import (
-	"context"
-	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func effectiveAgentStateKey(req proto.PromptRequestPayload) string {
-	if strings.TrimSpace(req.AgentStateKey) != "" {
-		return req.AgentStateKey
-	}
-	if id := strings.TrimSpace(req.ConversationID); id != "" {
-		return "_legacy_conversation/" + id + "/codex"
-	}
-	if id := strings.TrimSpace(req.RunID); id != "" {
-		return "_legacy_run/" + id + "/codex"
-	}
-	return ""
-}
+import "context"
 
 func setSkillExtraRoots(ctx context.Context, rpc *JSONRPCClient, roots []string) error {
 	if len(roots) == 0 {
diff --git a/apps/daemon/internal/agent/codex/skills_test.go b/apps/daemon/internal/agent/codex/skills_test.go
index 1f90c574b..bc316eed9 100644
--- a/apps/daemon/internal/agent/codex/skills_test.go
+++ b/apps/daemon/internal/agent/codex/skills_test.go
@@ -4,8 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"testing"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
 func TestSetSkillExtraRootsUsesCodexRPC(t *testing.T) {
@@ -40,13 +38,3 @@ func TestSetSkillExtraRootsUsesCodexRPC(t *testing.T) {
 		t.Fatalf("setSkillExtraRoots: %v", err)
 	}
 }
-
-func TestEffectiveAgentStateKeyFallsBackToConversation(t *testing.T) {
-	got := effectiveAgentStateKey(proto.PromptRequestPayload{
-		ConversationID: "conv-legacy",
-		RunID:          "run-ignored",
-	})
-	if got != "_legacy_conversation/conv-legacy/codex" {
-		t.Fatalf("state key = %q", got)
-	}
-}
diff --git a/apps/daemon/internal/agent/configuration_test.go b/apps/daemon/internal/agent/configuration_test.go
index 974f06824..a186755ce 100644
--- a/apps/daemon/internal/agent/configuration_test.go
+++ b/apps/daemon/internal/agent/configuration_test.go
@@ -30,11 +30,6 @@ func TestEveryRegistryEntryPreparesTheBoundModelConfiguration(t *testing.T) {
 		return nil, expected
 	})
 	configuration.Providers[0].Protocol = "anthropic"
-	copy, err := registry.Configuration("fixture")
-	if err != nil {
-		t.Fatal(err)
-	}
-	copy.Providers[0].Protocol = "anthropic"
 	factory, _ := registry.Resolve("fixture")
 	executor, _ := registry.ResolveExecutor("fixture")
 	preparation, _ := registry.ResolvePreparation("fixture")
@@ -63,9 +58,6 @@ func TestEveryRegistryEntryPreparesTheBoundModelConfiguration(t *testing.T) {
 	if calls != 3 {
 		t.Fatal("unexpected native calls", calls)
 	}
-	if _, err := registry.Configuration("missing"); err == nil {
-		t.Fatal("undeclared configuration inferred")
-	}
 }
 
 func TestRegistryRejectsInvalidConfigurationDeclaration(t *testing.T) {
diff --git a/apps/daemon/internal/agent/harness.go b/apps/daemon/internal/agent/harness.go
index 5ca1f91e6..427a83a58 100644
--- a/apps/daemon/internal/agent/harness.go
+++ b/apps/daemon/internal/agent/harness.go
@@ -291,8 +291,7 @@ func (r *Registry) RegisterExecutor(kind string, factory ExecutorFactory) {
 	r.kinds[kind] = info
 }
 
-// RegisterPreparation installs a separate execution-only path. Product factory
-// wrappers must not add authoring side effects to it.
+// RegisterPreparation installs a separate execution-only path.
 func (r *Registry) RegisterPreparation(kind string, workspaceRead bool, prepare PreparationFactory) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
diff --git a/apps/daemon/internal/agent/installroot/probe.go b/apps/daemon/internal/agent/installroot/probe.go
index b185c31bc..21f50ed47 100644
--- a/apps/daemon/internal/agent/installroot/probe.go
+++ b/apps/daemon/internal/agent/installroot/probe.go
@@ -14,7 +14,7 @@ import (
 func Probe(parent context.Context, binary string, args, env []string, dir string) (string, error) {
 	ctx, cancel := context.WithTimeout(parent, 25*time.Second)
 	defer cancel()
-	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: args, Env: env, Dir: dir, OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond})
+	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: args, Env: env, Dir: dir, KillTimeout: 250 * time.Millisecond})
 	if err != nil {
 		return "", errors.New("native component failed to start")
 	}
diff --git a/apps/daemon/internal/agent/mcode/declaration.go b/apps/daemon/internal/agent/mcode/declaration.go
index 5a6682dbb..c97e57bea 100644
--- a/apps/daemon/internal/agent/mcode/declaration.go
+++ b/apps/daemon/internal/agent/mcode/declaration.go
@@ -18,7 +18,6 @@ var Declaration = agent.Declaration{Info: proto.SupportedAgentKind{Kind: "mcode"
 	Usage:                          proto.CapabilityUnsupported,
 	Resume:                         proto.CapabilitySupported,
 	NativeSessionRecovery:          proto.CapabilityUnsupported,
-	WorkspaceAuthoring:             proto.CapabilitySupported,
 	Steering:                       proto.CapabilityUnsupported,
 	MessageItems:                   proto.CapabilityUnsupported,
 	ToolObservations:               proto.CapabilityUnsupported,
@@ -78,7 +77,6 @@ func discoverWithCheck(parent context.Context, options agent.DiscoveryOptions, r
 		runtime.Executor = NewExecutorFactory(workspace)
 	}
 	if workspace != nil {
-		runtime.Info.Capabilities.WorkspaceAuthoring = proto.CapabilityUnsupported
 		runtime.Preparation = NewPreparationFactory(*workspace)
 		runtime.WorkspaceReadPreparation = true
 	}
diff --git a/apps/daemon/internal/agent/mcode/declaration_test.go b/apps/daemon/internal/agent/mcode/declaration_test.go
index 16ec2df71..ff2f74f16 100644
--- a/apps/daemon/internal/agent/mcode/declaration_test.go
+++ b/apps/daemon/internal/agent/mcode/declaration_test.go
@@ -35,7 +35,7 @@ func TestMCodeExecutionOptInIsVersionBound(t *testing.T) {
 
 // The declaration must retain the complete baseline capability descriptor.
 func TestDeclaredCapabilityBaseline(t *testing.T) {
-	expected := map[string]bool{"Streaming": true, "Permissions": true, "Resume": true, "WorkspaceAuthoring": true}
+	expected := map[string]bool{"Streaming": true, "Permissions": true, "Resume": true}
 	value := reflect.ValueOf(Declaration.Info.Capabilities)
 	for i := 0; i < value.NumField(); i++ {
 		name := value.Type().Field(i).Name
diff --git a/apps/daemon/internal/agent/mcode/environment_mcp_test.go b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
index d4ccae14a..aa143e5aa 100644
--- a/apps/daemon/internal/agent/mcode/environment_mcp_test.go
+++ b/apps/daemon/internal/agent/mcode/environment_mcp_test.go
@@ -109,7 +109,6 @@ func TestEnvironmentMCPCancelSettlesPendingObservationBeforeDone(t *testing.T) {
 	c, req, _ := workspaceFixture(t)
 	c.Network, req.LocalEnvironment.NetworkAccess = "enabled", "enabled"
 	req.LocalEnvironment.MCP = []proto.EnvironmentMCP{environmentMCPFixture()}
-	req.ObserveToolObservations = true
 	script, err := os.ReadFile(c.Binary)
 	if err != nil {
 		t.Fatal(err)
diff --git a/apps/daemon/internal/agent/mcode/events.go b/apps/daemon/internal/agent/mcode/events.go
index 0b04ce6dd..97bd1f8cd 100644
--- a/apps/daemon/internal/agent/mcode/events.go
+++ b/apps/daemon/internal/agent/mcode/events.go
@@ -59,7 +59,7 @@ func (s *Session) emitTool(update toolUpdate) error {
 	if update.ID == "" || s.completedTools[update.ID] {
 		return nil
 	}
-	previous, started := s.tools[update.ID]
+	previous := s.tools[update.ID]
 	if update.Name == "" {
 		update.Name = previous.Name
 	}
@@ -69,21 +69,18 @@ func (s *Session) emitTool(update toolUpdate) error {
 	if update.RawInput == nil {
 		update.RawInput = previous.RawInput
 	}
-	if s.req.ObserveToolObservations {
-		update.mcp = previous.mcp
-		if update.mcp != nil && update.Name != previous.Name {
-			return fmt.Errorf("mcode: native MCP call identity changed")
-		}
-		if update.mcp == nil {
-			var err error
-			update.mcp, err = s.environmentMCPIdentity(update.Name)
-			if err != nil {
-				return err
-			}
+	update.mcp = previous.mcp
+	if update.mcp != nil && update.Name != previous.Name {
+		return fmt.Errorf("mcode: native MCP call identity changed")
+	}
+	if update.mcp == nil {
+		var err error
+		update.mcp, err = s.environmentMCPIdentity(update.Name)
+		if err != nil {
+			return err
 		}
-		started = previous.mcp != nil || workspaceToolObservation(previous, "before") != nil
 	}
-	if !started {
+	if previous.mcp == nil && workspaceToolObservation(previous, "before") == nil {
 		if err := s.emitToolStage(update, "before"); err != nil {
 			return err
 		}
diff --git a/apps/daemon/internal/agent/mcode/execution.go b/apps/daemon/internal/agent/mcode/execution.go
index 82dd3c9f8..bcb9e3902 100644
--- a/apps/daemon/internal/agent/mcode/execution.go
+++ b/apps/daemon/internal/agent/mcode/execution.go
@@ -7,7 +7,9 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-// SupportsExecution is an operator opt-in, separate from ordinary product availability.
+// SupportsExecution reports whether the daemon advertises MiniMax Code execution:
+// the operator sets OAC_RUNTIME_MCODE_AGENTS_API=1 and the native version is the
+// qualified one. Otherwise discovery reports only availability.
 func SupportsExecution(version string) bool {
 	return os.Getenv("OAC_RUNTIME_MCODE_AGENTS_API") == "1" && version == SupportedVersion
 }
@@ -27,9 +29,6 @@ func validateExecutionRequest(req proto.PromptRequestPayload) error {
 			return err
 		}
 	}
-	if req.AgentOptions["env"] != nil {
-		return fmt.Errorf("mcode: execution cannot import an environment")
-	}
 	return nil
 }
 
@@ -45,12 +44,8 @@ func configureTextExecution(config map[string]any) {
 // Harness children use the daemon user's ordinary environment.
 func executionEnvironment() []string { return os.Environ() }
 
-// ACP commands are only recognized for a single text block. Public input must
-// remain user text; ordinary product Sessions retain their native command behavior.
-func promptContent(text string, public bool) []map[string]string {
-	blocks := []map[string]string{{"type": "text", "text": text}}
-	if public {
-		blocks = append(blocks, map[string]string{"type": "text", "text": ""})
-	}
-	return blocks
+// ACP commands are only recognized for a single text block. A second, empty
+// block keeps public input as user text.
+func promptContent(text string) []map[string]string {
+	return []map[string]string{{"type": "text", "text": text}, {"type": "text", "text": ""}}
 }
diff --git a/apps/daemon/internal/agent/mcode/execution_test.go b/apps/daemon/internal/agent/mcode/execution_test.go
index 839c594ad..9f188f97f 100644
--- a/apps/daemon/internal/agent/mcode/execution_test.go
+++ b/apps/daemon/internal/agent/mcode/execution_test.go
@@ -10,15 +10,8 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func executionRequest(t *testing.T) proto.PromptRequestPayload {
-	r := testRequest(t)
-	r.StrictResume, r.ReleaseOnCompletion, r.DisableExecutionEnvironment, r.DisableSubagents = true, true, true, true
-	r.ExecutionControls = &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}
-	return r
-}
-
 func TestExecutionOptionsInheritUserEnvironment(t *testing.T) {
-	r := executionRequest(t)
+	r := testRequest(t)
 	t.Setenv("OAC_TEST_SECRET_CANARY", "secret")
 	t.Setenv("NODE_OPTIONS", "--import=untrusted")
 	opts, err := prepareOptions(r)
@@ -52,9 +45,8 @@ func TestExecutionRejectsUnqualifiedAuthority(t *testing.T) {
 		func(r *proto.PromptRequestPayload) { r.RequireExistingNativeSession = true },
 		func(r *proto.PromptRequestPayload) { r.FunctionTools = []proto.FunctionTool{{Name: "f"}} },
 		func(r *proto.PromptRequestPayload) { r.ExecutionControls.WebSearch = "enabled" },
-		func(r *proto.PromptRequestPayload) { r.AgentOptions["env"] = map[string]any{"X": "Y"} },
 	} {
-		r := executionRequest(t)
+		r := testRequest(t)
 		change(&r)
 		if _, err := prepareOptions(r); err == nil {
 			t.Fatal("unsupported execution accepted")
@@ -64,12 +56,9 @@ func TestExecutionRejectsUnqualifiedAuthority(t *testing.T) {
 
 func TestPublicTextDoesNotInvokeACPCommands(t *testing.T) {
 	for _, text := range []string{"/model", "/compact", "hello"} {
-		blocks := promptContent(text, true)
+		blocks := promptContent(text)
 		if len(blocks) != 2 || blocks[0]["text"] != text || blocks[1]["text"] != "" {
 			t.Fatal(blocks)
 		}
-		if blocks = promptContent(text, false); len(blocks) != 1 || blocks[0]["text"] != text {
-			t.Fatal("product prompt changed")
-		}
 	}
 }
diff --git a/apps/daemon/internal/agent/mcode/executor_native_test.go b/apps/daemon/internal/agent/mcode/executor_native_test.go
index e9dd4d9a3..96cae1889 100644
--- a/apps/daemon/internal/agent/mcode/executor_native_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_native_test.go
@@ -28,7 +28,7 @@ func TestNativeMCodeExecutorReuse(t *testing.T) {
 	if err != nil {
 		t.Fatal("private provider options unavailable")
 	}
-	req := executionRequest(t)
+	req := testRequest(t)
 	req.ReleaseOnCompletion = false
 	req.RunID, req.Input, req.ConversationID = "", nil, ""
 	if json.Unmarshal(raw, &req.AgentOptions) != nil {
diff --git a/apps/daemon/internal/agent/mcode/executor_test.go b/apps/daemon/internal/agent/mcode/executor_test.go
index eeac6a0ce..fc78836d0 100644
--- a/apps/daemon/internal/agent/mcode/executor_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_test.go
@@ -28,7 +28,7 @@ func executorFixture(t *testing.T, scenario string, workspace bool) (*executor,
 	if workspace {
 		factory = NewExecutorFactory(&config)
 	} else {
-		req = executionRequest(t)
+		req = testRequest(t)
 		req.ReleaseOnCompletion = false
 		req.RunID, req.Input, req.ConversationID = "", nil, ""
 		t.Setenv("OAC_RUNTIME_MCODE_BIN", config.Binary)
diff --git a/apps/daemon/internal/agent/mcode/executor_turn.go b/apps/daemon/internal/agent/mcode/executor_turn.go
index 3bf537374..1633f5f18 100644
--- a/apps/daemon/internal/agent/mcode/executor_turn.go
+++ b/apps/daemon/internal/agent/mcode/executor_turn.go
@@ -25,7 +25,7 @@ func (s *Session) runExecutorTurn() {
 	// Written steering requests retain their original receipt owner even after
 	// prompt completion. No successor starts until all callers have settled.
 	s.operations.Wait()
-	if s.req.StrictResume && !s.req.DisableSubagents && s.subagentHistoryReady {
+	if !s.req.DisableSubagents && s.subagentHistoryReady {
 		childErr := s.settleSubagents()
 		s.mu.Lock()
 		s.subagentSettlementError = childErr
@@ -82,7 +82,7 @@ func (s *Session) runExecutorTurn() {
 }
 
 func (s *Session) captureSubagentBaseline() error {
-	if !s.req.StrictResume || s.req.DisableSubagents {
+	if s.req.DisableSubagents {
 		return nil
 	}
 	snapshot, err := s.readSubagents(s.ctx)
@@ -135,7 +135,7 @@ func (s *Session) cancelTurn(ctx context.Context) error {
 		err = s.writeContext(ctx, rpcFrame{JSONRPC: "2.0", Method: "session/cancel", Params: raw})
 	}
 	if first {
-		if err == nil && s.req.StrictResume && !s.req.DisableSubagents {
+		if err == nil && !s.req.DisableSubagents {
 			err = s.stopSubagents(ctx)
 		}
 		if err != nil {
diff --git a/apps/daemon/internal/agent/mcode/mcp_observations_test.go b/apps/daemon/internal/agent/mcode/mcp_observations_test.go
index 1c790f731..61e090a6b 100644
--- a/apps/daemon/internal/agent/mcode/mcp_observations_test.go
+++ b/apps/daemon/internal/agent/mcode/mcp_observations_test.go
@@ -15,7 +15,7 @@ func mcpObservationSession(t *testing.T) (*Session, chan proto.Envelope) {
 	t.Helper()
 	out := make(chan proto.Envelope, 16)
 	s := &Session{ctx: context.Background(), opts: launchOptions{DataDir: t.TempDir()},
-		req: proto.PromptRequestPayload{RunID: "run", ObserveToolObservations: true,
+		req: proto.PromptRequestPayload{RunID: "run",
 			LocalEnvironment: &proto.LocalEnvironment{NetworkAccess: "enabled", MCP: []proto.EnvironmentMCP{environmentMCPFixture()}}},
 		out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}, active: true, sessionID: "native-session"}
 	if err := writeMCPRegistry(s.opts.DataDir, mcpRegistryEntry("proof.server", "proof_server_2", "read.status", "read_status_2")); err != nil {
diff --git a/apps/daemon/internal/agent/mcode/native_history_test.go b/apps/daemon/internal/agent/mcode/native_history_test.go
index 0106570cc..d49061554 100644
--- a/apps/daemon/internal/agent/mcode/native_history_test.go
+++ b/apps/daemon/internal/agent/mcode/native_history_test.go
@@ -24,7 +24,7 @@ func TestNativeMCodeHistoryIsolation(t *testing.T) {
 	}
 	for name, id := range map[string]string{"foreign": foreign, "missing": "00000000-0000-4000-8000-000000000000"} {
 		t.Run(name, func(t *testing.T) {
-			req := executionRequest(t)
+			req := testRequest(t)
 			if json.Unmarshal(raw, &req.AgentOptions) != nil {
 				t.Fatal("invalid private options")
 			}
diff --git a/apps/daemon/internal/agent/mcode/options.go b/apps/daemon/internal/agent/mcode/options.go
index 5714e401f..50926a7c8 100644
--- a/apps/daemon/internal/agent/mcode/options.go
+++ b/apps/daemon/internal/agent/mcode/options.go
@@ -6,7 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
-	"strings"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
@@ -24,15 +23,13 @@ func prepareOptions(req proto.PromptRequestPayload) (launchOptions, error) {
 	if _, err := harnessconfiguration.Configuration().PrepareHarnessConfig(req.AgentOptions); err != nil {
 		return result, err
 	}
-	if req.StrictResume {
-		if err := validateExecutionRequest(req); err != nil {
-			return result, err
-		}
+	if err := validateExecutionRequest(req); err != nil {
+		return result, err
 	}
 	if req.Input.HasImages() {
 		return result, fmt.Errorf("mcode: ACP does not support attachments")
 	}
-	dataDir, err := agent.StateDir("mcode", req.AgentStateKey, req.ConversationID, req.RunID)
+	dataDir, err := agent.StateDir("mcode", req.AgentStateKey)
 	if err != nil {
 		return result, err
 	}
@@ -62,15 +59,13 @@ func prepareOptions(req proto.PromptRequestPayload) (launchOptions, error) {
 		return result, err
 	}
 	config["custom_provider"] = map[string]any{"oac": provider}
-	if req.StrictResume {
-		configureTextExecution(config)
-		if !req.DisableSubagents {
-			config["agents"] = map[string]any{"default": map[string]any{
-				"tools":        []string{"task", "task_append", "task_query", "task_output", "task_stop"},
-				"builtinTools": []string{"task", "task_append", "task_query", "task_output", "task_stop"}, "skills": []string{},
-				"features": map[string]bool{"mavis": false, "delegation": true, "webSearch": false},
-			}}
-		}
+	configureTextExecution(config)
+	if !req.DisableSubagents {
+		config["agents"] = map[string]any{"default": map[string]any{
+			"tools":        []string{"task", "task_append", "task_query", "task_output", "task_stop"},
+			"builtinTools": []string{"task", "task_append", "task_query", "task_output", "task_stop"}, "skills": []string{},
+			"features": map[string]bool{"mavis": false, "delegation": true, "webSearch": false},
+		}}
 	}
 	config["permissionMode"] = "auto"
 	data, err := json.Marshal(config)
@@ -80,36 +75,17 @@ func prepareOptions(req proto.PromptRequestPayload) (launchOptions, error) {
 	if err := os.WriteFile(filepath.Join(result.DataDir, "config.yaml"), data, 0o600); err != nil {
 		return result, err
 	}
-	result.Env = append([]string{}, os.Environ()...)
-	if req.StrictResume {
-		result.Env = append(executionEnvironment(), "OAC_RUNTIME_MCODE_TOOL_POLICY=protected-mcp-v1")
-		if err := os.WriteFile(filepath.Join(result.DataDir, "mcp.json"), []byte(`{"mcpServers":{}}`), 0o600); err != nil {
-			return result, err
-		}
-		if !req.DisableSubagents {
-			result.Env = append(result.Env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS="+strconv.Itoa(*req.MaxConcurrentSubagents))
-		} else {
-			result.Env = append(result.Env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS=0")
-		}
+	result.Env = append(executionEnvironment(), "OAC_RUNTIME_MCODE_TOOL_POLICY=protected-mcp-v1")
+	if err := os.WriteFile(filepath.Join(result.DataDir, "mcp.json"), []byte(`{"mcpServers":{}}`), 0o600); err != nil {
+		return result, err
 	}
-	if raw := opts["env"]; raw != nil && !req.StrictResume {
-		env, ok := raw.(map[string]any)
-		if !ok {
-			return result, fmt.Errorf("mcode: env must be an object")
-		}
-		for key, rawValue := range env {
-			value, ok := rawValue.(string)
-			if !ok || key == "" || strings.ContainsAny(key, "=\x00") || strings.ContainsRune(value, 0) {
-				return result, fmt.Errorf("mcode: invalid environment entry")
-			}
-			result.Env = append(result.Env, key+"="+value)
-		}
+	if !req.DisableSubagents {
+		result.Env = append(result.Env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS="+strconv.Itoa(*req.MaxConcurrentSubagents))
+	} else {
+		result.Env = append(result.Env, "OAC_RUNTIME_MCODE_MAX_SUBAGENTS=0")
 	}
 	// The adapter owns the native state location, including after cold resume.
-	result.Env = append(result.Env, "MINIMAX_DATA_DIR="+result.DataDir)
-	if req.StrictResume {
-		result.Env = append(result.Env, "HOME="+result.DataDir, "USERPROFILE="+result.DataDir)
-	}
+	result.Env = append(result.Env, "MINIMAX_DATA_DIR="+result.DataDir, "HOME="+result.DataDir, "USERPROFILE="+result.DataDir)
 	result.MCP = []map[string]any{}
 	return result, nil
 }
diff --git a/apps/daemon/internal/agent/mcode/options_test.go b/apps/daemon/internal/agent/mcode/options_test.go
index fa7fa94d2..e5d399ed1 100644
--- a/apps/daemon/internal/agent/mcode/options_test.go
+++ b/apps/daemon/internal/agent/mcode/options_test.go
@@ -11,8 +11,8 @@ import (
 )
 
 func TestOptionsRefreshManagedState(t *testing.T) {
+	t.Setenv("MINIMAX_DATA_DIR", "/wrong")
 	req := testRequest(t)
-	req.AgentOptions["env"] = map[string]any{"MINIMAX_DATA_DIR": "/wrong", "FIXTURE": "yes"}
 	opts, err := prepareOptions(req)
 	if err != nil {
 		t.Fatal(err)
@@ -20,7 +20,13 @@ func TestOptionsRefreshManagedState(t *testing.T) {
 	if !strings.HasPrefix(opts.Dir, os.Getenv("OAC_RUNTIME_HOME")+string(os.PathSeparator)) {
 		t.Fatalf("workdir escaped managed state: %s", opts.Dir)
 	}
-	if opts.Env[len(opts.Env)-1] != "MINIMAX_DATA_DIR="+opts.DataDir {
+	dataDir := ""
+	for _, entry := range opts.Env {
+		if value, ok := strings.CutPrefix(entry, "MINIMAX_DATA_DIR="); ok {
+			dataDir = value
+		}
+	}
+	if dataDir != opts.DataDir {
 		t.Fatal("state override did not win")
 	}
 	req.AgentOptions["system_prompt"] = ""
diff --git a/apps/daemon/internal/agent/mcode/preparation_test.go b/apps/daemon/internal/agent/mcode/preparation_test.go
index 93b095ee4..249129603 100644
--- a/apps/daemon/internal/agent/mcode/preparation_test.go
+++ b/apps/daemon/internal/agent/mcode/preparation_test.go
@@ -15,7 +15,7 @@ import (
 
 func workspaceFixture(t *testing.T) (WorkspaceConfig, proto.PromptRequestPayload, string) {
 	t.Helper()
-	r := executionRequest(t)
+	r := testRequest(t)
 	r.RunID, r.Input, r.ConversationID = "", nil, ""
 	r.DisableExecutionEnvironment = false
 	r.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "enabled", WorkspaceRoot: t.TempDir()}
diff --git a/apps/daemon/internal/agent/mcode/session.go b/apps/daemon/internal/agent/mcode/session.go
index cd32a2edf..741f9a3d9 100644
--- a/apps/daemon/internal/agent/mcode/session.go
+++ b/apps/daemon/internal/agent/mcode/session.go
@@ -80,7 +80,7 @@ func newSession(ctx context.Context, req proto.PromptRequestPayload, out chan<-
 }
 
 func launch(ctx context.Context, req proto.PromptRequestPayload, opts launchOptions, binary string, out chan<- proto.Envelope) (*Session, error) {
-	process, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{"acp"}, Dir: opts.Dir, Env: opts.Env, NeedStdin: true, OwnProcessGroup: req.StrictResume})
+	process, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: binary, Args: []string{"acp"}, Dir: opts.Dir, Env: opts.Env, NeedStdin: true})
 	if err != nil {
 		return nil, err
 	}
@@ -104,7 +104,7 @@ func (s *Session) run() {
 	defer close(s.finished)
 	err := s.prepareNative()
 	if err == nil {
-		if s.req.StrictResume && !s.req.DisableSubagents {
+		if !s.req.DisableSubagents {
 			var snapshot nativeSubagentSnapshot
 			snapshot, err = s.readSubagents(s.ctx)
 			s.subagentHistoryReady = err == nil
@@ -121,7 +121,7 @@ func (s *Session) run() {
 	if err == nil {
 		err = s.executePrompt()
 	}
-	if s.req.StrictResume && !s.req.DisableSubagents && s.subagentHistoryReady && s.out != nil {
+	if !s.req.DisableSubagents && s.subagentHistoryReady && s.out != nil {
 		observationErr := s.settleSubagents()
 		s.mu.Lock()
 		s.subagentSettlementError = observationErr
@@ -174,7 +174,7 @@ func (s *Session) prepareNative() error {
 	if initialized.ProtocolVersion != 1 {
 		return fmt.Errorf("mcode: unsupported ACP protocol version %d", initialized.ProtocolVersion)
 	}
-	if s.req.StrictResume && !s.req.DisableSubagents && (initialized.Meta.Subagents.Version != 1 || initialized.Meta.Subagents.WorkspaceTools != "protected-mcp-v1" || s.req.MaxConcurrentSubagents == nil || initialized.Meta.Subagents.MaxConcurrent != *s.req.MaxConcurrentSubagents) {
+	if !s.req.DisableSubagents && (initialized.Meta.Subagents.Version != 1 || initialized.Meta.Subagents.WorkspaceTools != "protected-mcp-v1" || s.req.MaxConcurrentSubagents == nil || initialized.Meta.Subagents.MaxConcurrent != *s.req.MaxConcurrentSubagents) {
 		return fmt.Errorf("mcode: native Subagent admission is unavailable")
 	}
 	params := map[string]any{"cwd": s.opts.Dir, "mcpServers": s.opts.MCP}
@@ -221,7 +221,7 @@ func (s *Session) executePrompt() error {
 	var result struct {
 		StopReason string `json:"stopReason"`
 	}
-	err = s.call("session/prompt", map[string]any{"sessionId": s.sessionID, "prompt": promptContent(prompt, s.req.StrictResume)}, &result, true)
+	err = s.call("session/prompt", map[string]any{"sessionId": s.sessionID, "prompt": promptContent(prompt)}, &result, true)
 	s.active = false
 	s.mu.Lock()
 	s.steeringReady = false
@@ -360,16 +360,13 @@ func (s *Session) Cancel(ctx context.Context) error {
 	if s.executor != nil {
 		return s.cancelTurn(ctx)
 	}
-	if s.req.StrictResume && !s.req.DisableSubagents {
+	if !s.req.DisableSubagents {
 		if err := s.cancelSubagents(ctx); err != nil {
 			s.process.Cancel()
 			return err
 		}
 	}
 	s.process.Cancel()
-	if !s.req.StrictResume {
-		return nil
-	}
 	select {
 	case <-s.exited:
 	case <-ctx.Done():
diff --git a/apps/daemon/internal/agent/mcode/session_test.go b/apps/daemon/internal/agent/mcode/session_test.go
index f2af87a50..ad506fedb 100644
--- a/apps/daemon/internal/agent/mcode/session_test.go
+++ b/apps/daemon/internal/agent/mcode/session_test.go
@@ -20,15 +20,12 @@ func testRequest(t *testing.T) proto.PromptRequestPayload {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
 	return proto.PromptRequestPayload{RunID: "run-1", ConversationID: "conversation-1", AgentStateKey: "conversation-1/agent-1/mcode", Input: proto.TextInput("Hello"), AgentOptions: map[string]any{
 		"model": "fixture", "model_provider": map[string]any{"protocol": "anthropic", "base_url": "https://provider.example/v1", "api_key": "fixture-key", "context_window": 64000, "max_output_tokens": 4096}, "system_prompt": "Current instructions",
-	}}
+	}, ReleaseOnCompletion: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
 }
 
 func helperSession(t *testing.T, scenario string, resume bool) (*Session, <-chan proto.Envelope) {
 	t.Helper()
 	req := testRequest(t)
-	if scenario == "strict-cancel" {
-		req = executionRequest(t)
-	}
 	if resume {
 		req.AgentSessionID = "native-1"
 	}
@@ -272,7 +269,7 @@ func TestMCodeProcess(t *testing.T) {
 				Prompt []map[string]string `json:"prompt"`
 			}
 			_ = json.Unmarshal(frame.Params, &input)
-			if strict := scenario == "strict-cancel" || (strings.HasPrefix(scenario, "prepared") || strings.HasPrefix(scenario, "executor")); (strict && len(input.Prompt) != 2) || (!strict && len(input.Prompt) != 1) {
+			if len(input.Prompt) != 2 {
 				os.Exit(9)
 			}
 			if strings.HasPrefix(scenario, "executor") {
@@ -286,7 +283,7 @@ func TestMCodeProcess(t *testing.T) {
 					continue
 				}
 				update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": input.Prompt[0]["text"]}})
-				update("tool_call", map[string]any{"toolCallId": "repeated-call", "name": "Read", "status": "in_progress", "rawInput": map[string]any{}})
+				update("tool_call", map[string]any{"toolCallId": "repeated-call", "name": "mcp__oac_workspace__workspace_bash", "status": "in_progress", "rawInput": map[string]any{"command": "true"}})
 				update("tool_call_update", map[string]any{"toolCallId": "repeated-call", "status": "completed"})
 				raw, _ := json.Marshal(map[string]string{"stopReason": "end_turn"})
 				send(rpcFrame{JSONRPC: "2.0", ID: frame.ID, Result: raw})
@@ -302,7 +299,7 @@ func TestMCodeProcess(t *testing.T) {
 				update("tool_call", map[string]any{"toolCallId": "native-call", "name": "mcp__proof_server__read_status", "status": "in_progress", "rawInput": map[string]any{}})
 				continue
 			}
-			if scenario == "steering" || scenario == "steer-rejected" || scenario == "steer-lost" || scenario == "strict-cancel" {
+			if scenario == "steering" || scenario == "steer-rejected" || scenario == "steer-lost" || scenario == "cancel-wait" {
 				promptID = frame.ID
 				update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "ready"}})
 				continue
@@ -325,7 +322,7 @@ func TestMCodeProcess(t *testing.T) {
 			}
 			update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "Hello "}})
 			update("agent_message_chunk", map[string]any{"content": map[string]string{"type": "text", "text": "world"}})
-			update("tool_call", map[string]any{"toolCallId": "tool-1", "name": "Read", "status": "in_progress", "rawInput": map[string]any{"path": "fixture.txt"}})
+			update("tool_call", map[string]any{"toolCallId": "tool-1", "name": "mcp__oac_workspace__workspace_bash", "status": "in_progress", "rawInput": map[string]any{"command": "cat fixture.txt"}})
 			for range 2 {
 				update("tool_call_update", map[string]any{"toolCallId": "tool-1", "status": "completed", "rawOutput": "fixture"})
 			}
diff --git a/apps/daemon/internal/agent/mcode/steering_test.go b/apps/daemon/internal/agent/mcode/steering_test.go
index 2c4cc517a..1ecdb5af1 100644
--- a/apps/daemon/internal/agent/mcode/steering_test.go
+++ b/apps/daemon/internal/agent/mcode/steering_test.go
@@ -85,7 +85,7 @@ func TestTerminalFollowsAllNativeFrames(t *testing.T) {
 }
 
 func TestExecutionCancellationWaitsForOutputAndProcess(t *testing.T) {
-	s, out := helperSession(t, "strict-cancel", false)
+	s, out := helperSession(t, "cancel-wait", false)
 	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 	defer cancel()
 	select {
diff --git a/apps/daemon/internal/agent/mcode/tool_observations.go b/apps/daemon/internal/agent/mcode/tool_observations.go
index 7f6ba9f9c..1dbd6d643 100644
--- a/apps/daemon/internal/agent/mcode/tool_observations.go
+++ b/apps/daemon/internal/agent/mcode/tool_observations.go
@@ -11,20 +11,18 @@ func (s *Session) emitToolStage(update toolUpdate, stage string) error {
 	if stage == "after" {
 		payload.Result = map[string]any{"output": update.RawOutput, "status": update.Status}
 	}
-	if s.req.ObserveToolObservations {
-		payload.Observation = workspaceToolObservation(update, stage)
-		if payload.Observation == nil {
-			var err error
-			payload.Observation, err = environmentMCPObservation(update, stage)
-			if err != nil {
-				return err
-			}
-		}
-		// Native task/skill bookkeeping has no qualified public item mapping.
-		if payload.Observation == nil {
-			return nil
+	payload.Observation = workspaceToolObservation(update, stage)
+	if payload.Observation == nil {
+		var err error
+		payload.Observation, err = environmentMCPObservation(update, stage)
+		if err != nil {
+			return err
 		}
 	}
+	// Native task/skill bookkeeping has no qualified public item mapping.
+	if payload.Observation == nil {
+		return nil
+	}
 	s.emit(proto.TypeToolCall, payload)
 	return nil
 }
diff --git a/apps/daemon/internal/agent/mcode/tool_observations_test.go b/apps/daemon/internal/agent/mcode/tool_observations_test.go
index e9011d503..c7d1fa6da 100644
--- a/apps/daemon/internal/agent/mcode/tool_observations_test.go
+++ b/apps/daemon/internal/agent/mcode/tool_observations_test.go
@@ -12,7 +12,7 @@ func TestWorkspaceCommandObservationsWaitForArgumentsAndRetainOutcome(t *testing
 	for _, status := range []string{"completed", "failed"} {
 		t.Run(status, func(t *testing.T) {
 			out := make(chan proto.Envelope, 8)
-			s := &Session{ctx: context.Background(), req: proto.PromptRequestPayload{RunID: "run", ObserveToolObservations: true}, out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}
+			s := &Session{ctx: context.Background(), req: proto.PromptRequestPayload{RunID: "run"}, out: out, tools: map[string]toolUpdate{}, completedTools: map[string]bool{}}
 			s.emitTool(toolUpdate{ID: "call", Name: "mcp__oac_workspace__workspace_bash"})
 			if len(out) != 0 {
 				t.Fatal("command item emitted before native arguments")
diff --git a/apps/daemon/internal/agent/mcode/workspace.go b/apps/daemon/internal/agent/mcode/workspace.go
index 7fdf2d3fd..5b913e4ac 100644
--- a/apps/daemon/internal/agent/mcode/workspace.go
+++ b/apps/daemon/internal/agent/mcode/workspace.go
@@ -53,7 +53,7 @@ func prepareWorkspaceOptions(c WorkspaceConfig, req proto.PromptRequestPayload)
 	if c.Network != "enabled" || len(c.AllowedDomains) != 0 {
 		return launchOptions{}, fmt.Errorf("mcode: Runtime does not implement network isolation")
 	}
-	if !req.StrictResume || req.LocalEnvironment == nil || req.LocalEnvironment.WorkspaceRoot != c.Directory || req.DisableExecutionEnvironment || !(agentnetwork.Policy{Access: c.Network, AllowedDomains: c.AllowedDomains}).Equal(agentnetwork.Policy{Access: req.LocalEnvironment.NetworkAccess, AllowedDomains: req.LocalEnvironment.AllowedDomains}) || req.WorkspaceReadOnly {
+	if req.LocalEnvironment == nil || req.LocalEnvironment.WorkspaceRoot != c.Directory || req.DisableExecutionEnvironment || !(agentnetwork.Policy{Access: c.Network, AllowedDomains: c.AllowedDomains}).Equal(agentnetwork.Policy{Access: req.LocalEnvironment.NetworkAccess, AllowedDomains: req.LocalEnvironment.AllowedDomains}) || req.WorkspaceReadOnly {
 		return launchOptions{}, fmt.Errorf("mcode: execution does not match the dedicated workspace")
 	}
 	servers, err := runtimeMCP(req)
diff --git a/apps/daemon/internal/agent/mcode/workspace_readiness.go b/apps/daemon/internal/agent/mcode/workspace_readiness.go
index b730745b4..7f44d672a 100644
--- a/apps/daemon/internal/agent/mcode/workspace_readiness.go
+++ b/apps/daemon/internal/agent/mcode/workspace_readiness.go
@@ -16,7 +16,7 @@ import (
 func CheckWorkspace(ctx context.Context, c WorkspaceConfig) error {
 	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
 	defer cancel()
-	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: c.Node, Args: []string{filepath.Join(filepath.Dir(c.Bridge), "check.mjs")}, Env: executionEnvironment(), OwnProcessGroup: true})
+	p, err := clirunner.Start(clirunner.StartOptions{Parent: ctx, Binary: c.Node, Args: []string{filepath.Join(filepath.Dir(c.Bridge), "check.mjs")}, Env: executionEnvironment()})
 	if err != nil {
 		return err
 	}
diff --git a/apps/daemon/internal/agent/registry.go b/apps/daemon/internal/agent/registry.go
index 4c6b5e815..6584fb751 100644
--- a/apps/daemon/internal/agent/registry.go
+++ b/apps/daemon/internal/agent/registry.go
@@ -107,15 +107,3 @@ func (r *Registry) ResolvePreparation(kind string) (PreparationFactory, error) {
 	}
 	return f, nil
 }
-
-// Configuration returns an owned declaration for registry wrappers. Wrappers
-// transfer it with the factory; they must not infer configuration from kind names.
-func (r *Registry) Configuration(kind string) (harnessconfig.Configuration, error) {
-	r.mu.RLock()
-	defer r.mu.RUnlock()
-	configuration, ok := r.configurations[kind]
-	if !ok {
-		return harnessconfig.Configuration{}, ErrUnsupportedKind
-	}
-	return configuration.Clone(), nil
-}
diff --git a/apps/daemon/internal/agent/runtime_paths.go b/apps/daemon/internal/agent/runtime_paths.go
index 0ad41e2f0..456231282 100644
--- a/apps/daemon/internal/agent/runtime_paths.go
+++ b/apps/daemon/internal/agent/runtime_paths.go
@@ -10,7 +10,7 @@ import (
 
 // StateDir returns an adapter-owned state directory scoped to one agent
 // state. It never derives runtime state from the subprocess cwd.
-func StateDir(agentKind, agentStateKey, conversationID, runID string) (string, error) {
+func StateDir(agentKind, agentStateKey string) (string, error) {
 	root, err := paths.Root()
 	if err != nil {
 		return "", fmt.Errorf("agent: resolve state directory: %w", err)
@@ -19,21 +19,11 @@ func StateDir(agentKind, agentStateKey, conversationID, runID string) (string, e
 	if kind == "" {
 		return "", fmt.Errorf("agent: invalid agent kind %q", agentKind)
 	}
-	base := filepath.Join(root, "runtime", kind)
-	if key := strings.TrimSpace(agentStateKey); key != "" {
-		parts := safeRuntimePathParts(key)
-		if len(parts) == 0 {
-			return "", fmt.Errorf("agent: invalid agent state key %q", agentStateKey)
-		}
-		return filepath.Join(append([]string{base, "state"}, parts...)...), nil
-	}
-	if id := safeRuntimePathPart(conversationID); id != "" {
-		return filepath.Join(base, "conv-"+id), nil
-	}
-	if id := safeRuntimePathPart(runID); id != "" {
-		return filepath.Join(base, "run-"+id), nil
+	parts := safeRuntimePathParts(agentStateKey)
+	if len(parts) == 0 {
+		return "", fmt.Errorf("agent: invalid agent state key %q", agentStateKey)
 	}
-	return "", fmt.Errorf("agent: agent state key, conversation id, or run id is required")
+	return filepath.Join(append([]string{root, "runtime", kind, "state"}, parts...)...), nil
 }
 
 func safeRuntimePathParts(value string) []string {
diff --git a/apps/daemon/internal/agent/runtime_paths_test.go b/apps/daemon/internal/agent/runtime_paths_test.go
index 2cc51981a..3e98c1792 100644
--- a/apps/daemon/internal/agent/runtime_paths_test.go
+++ b/apps/daemon/internal/agent/runtime_paths_test.go
@@ -8,7 +8,7 @@ import (
 func TestStateDirUsesStableAgentState(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", home)
-	got, err := StateDir("codex", "conv-1/agent-1/codex", "ignored", "ignored")
+	got, err := StateDir("codex", "conv-1/agent-1/codex")
 	if err != nil {
 		t.Fatalf("StateDir: %v", err)
 	}
@@ -18,15 +18,16 @@ func TestStateDirUsesStableAgentState(t *testing.T) {
 	}
 }
 
-func TestStateDirSanitizesFallback(t *testing.T) {
+func TestStateDirRequiresAgentState(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("OAC_RUNTIME_HOME", home)
-	got, err := StateDir("fake_beta", "", "../conv name", "ignored")
-	if err != nil {
-		t.Fatalf("StateDir: %v", err)
+	for _, key := range []string{"", " ", "../.."} {
+		if _, err := StateDir("codex", key); err == nil {
+			t.Fatalf("state key %q accepted", key)
+		}
 	}
-	want := filepath.Join(home, "runtime", "fake_beta", "conv-.._conv_name")
-	if got != want {
-		t.Fatalf("root = %q, want %q", got, want)
+	got, err := StateDir("codex", "../session-1/a b")
+	if want := filepath.Join(home, "runtime", "codex", "state", "session-1", "a_b"); err != nil || got != want {
+		t.Fatalf("sanitized state = %q, %v; want %q", got, err, want)
 	}
 }
diff --git a/apps/daemon/internal/authoring/bridge.go b/apps/daemon/internal/authoring/bridge.go
deleted file mode 100644
index 519165fda..000000000
--- a/apps/daemon/internal/authoring/bridge.go
+++ /dev/null
@@ -1,134 +0,0 @@
-package authoring
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"path/filepath"
-	"sync"
-	"time"
-
-	"github.com/google/uuid"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-type Sender interface {
-	Send(context.Context, proto.Envelope) error
-}
-
-type Bridge struct {
-	sender  Sender
-	mu      sync.Mutex
-	waiters map[string]waiter
-}
-
-type waiter struct {
-	runID    string
-	response chan proto.AuthoringResponsePayload
-}
-
-func New(sender Sender) *Bridge {
-	return &Bridge{sender: sender, waiters: make(map[string]waiter)}
-}
-
-// Deliver only resolves the matching request from the same active run.
-func (b *Bridge) Deliver(env proto.Envelope) {
-	var response proto.AuthoringResponsePayload
-	if env.DecodePayload(&response) != nil {
-		return
-	}
-	b.mu.Lock()
-	w, ok := b.waiters[response.RequestID]
-	b.mu.Unlock()
-	if ok && w.runID == env.ID {
-		select {
-		case w.response <- response:
-		default:
-		}
-	}
-}
-
-func (b *Bridge) request(ctx context.Context, runID string, request proto.AuthoringRequestPayload) (proto.AuthoringResponsePayload, error) {
-	request.RequestID = uuid.NewString()
-	w := waiter{runID: runID, response: make(chan proto.AuthoringResponsePayload, 1)}
-	b.mu.Lock()
-	b.waiters[request.RequestID] = w
-	b.mu.Unlock()
-	defer func() { b.mu.Lock(); delete(b.waiters, request.RequestID); b.mu.Unlock() }()
-	env, err := proto.NewEnvelope(proto.TypeAuthoringRequest, runID, request)
-	if err != nil {
-		return proto.AuthoringResponsePayload{}, err
-	}
-	if err := b.sender.Send(ctx, env); err != nil {
-		return proto.AuthoringResponsePayload{}, err
-	}
-	select {
-	case response := <-w.response:
-		return response, nil
-	case <-ctx.Done():
-		return proto.AuthoringResponsePayload{}, ctx.Err()
-	}
-}
-
-func (b *Bridge) Listen(parent context.Context, runID string) (string, func(), error) {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return "", nil, err
-	}
-	dir := filepath.Join(home, ".oac", "authoring")
-	if err := os.MkdirAll(dir, 0o700); err != nil {
-		return "", nil, err
-	}
-	path := filepath.Join(dir, uuid.NewString()[:8]+".sock")
-	listener, err := net.Listen("unix", path)
-	if err != nil {
-		return "", nil, fmt.Errorf("open daemon authoring socket: %w", err)
-	}
-	if err := os.Chmod(path, 0o600); err != nil {
-		_ = listener.Close()
-		return "", nil, err
-	}
-	ctx, cancel := context.WithCancel(parent)
-	stop := context.AfterFunc(ctx, func() { _ = listener.Close() })
-	closeListener := func() { cancel(); stop(); _ = listener.Close() }
-	go func() {
-		defer closeListener()
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-			go b.serve(ctx, runID, conn)
-		}
-	}()
-	return path, closeListener, nil
-}
-
-func (b *Bridge) serve(parent context.Context, runID string, conn net.Conn) {
-	defer func() { _ = conn.Close() }()
-	ctx, cancel := context.WithTimeout(parent, 30*time.Second)
-	defer cancel()
-	stop := context.AfterFunc(ctx, func() { _ = conn.Close() })
-	defer stop()
-	_ = conn.SetDeadline(time.Now().Add(30 * time.Second))
-	var request proto.AuthoringRequestPayload
-	decoder := json.NewDecoder(io.LimitReader(conn, proto.AuthoringMaxBytes+1))
-	decoder.DisallowUnknownFields()
-	err := decoder.Decode(&request)
-	if err == nil && decoder.InputOffset() > proto.AuthoringMaxBytes {
-		err = errors.New("authoring request is too large")
-	}
-	var response proto.AuthoringResponsePayload
-	if err == nil {
-		response, err = b.request(ctx, runID, request)
-	}
-	if err != nil {
-		response.Error = err.Error()
-	}
-	_ = json.NewEncoder(conn).Encode(response)
-}
diff --git a/apps/daemon/internal/authoring/bridge_test.go b/apps/daemon/internal/authoring/bridge_test.go
deleted file mode 100644
index 17056693d..000000000
--- a/apps/daemon/internal/authoring/bridge_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-package authoring
-
-import (
-	"context"
-	"encoding/json"
-	"net"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-type testSender struct{ frames chan proto.Envelope }
-
-func (s testSender) Send(ctx context.Context, env proto.Envelope) error {
-	select {
-	case s.frames <- env:
-		return nil
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
-func TestBridgeUsesRunAttributionAndClosesAccess(t *testing.T) {
-	home, err := os.MkdirTemp("/tmp", "pa-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(home)
-	t.Setenv("HOME", home)
-	sender := testSender{frames: make(chan proto.Envelope, 1)}
-	b := New(sender)
-	path, release, err := b.Listen(t.Context(), "run-a")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer release()
-	if filepath.Dir(path) != filepath.Join(home, ".oac", "authoring") {
-		t.Fatal("socket outside OpenAgentCore state")
-	}
-	if info, err := os.Stat(path); err != nil || info.Mode().Perm() != 0o600 {
-		t.Fatalf("socket permissions: %v %v", info, err)
-	}
-	conn, err := net.Dial("unix", path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer conn.Close()
-	_ = conn.SetDeadline(time.Now().Add(3 * time.Second))
-	if err := json.NewEncoder(conn).Encode(proto.AuthoringRequestPayload{RequestID: "client-supplied", Operation: proto.AuthoringContext}); err != nil {
-		t.Fatal(err)
-	}
-	var frame proto.Envelope
-	select {
-	case frame = <-sender.frames:
-	case <-time.After(time.Second):
-		t.Fatal("request not forwarded")
-	}
-	var request proto.AuthoringRequestPayload
-	if frame.DecodePayload(&request) != nil || frame.ID != "run-a" || request.RequestID == "client-supplied" || frame.Type != proto.TypeAuthoringRequest {
-		t.Fatalf("wrong attribution: %+v", frame)
-	}
-	wrong, _ := proto.NewEnvelope(proto.TypeAuthoringResponse, "run-b", proto.AuthoringResponsePayload{RequestID: request.RequestID, Data: json.RawMessage(`"wrong"`)})
-	b.Deliver(wrong)
-	good, _ := proto.NewEnvelope(proto.TypeAuthoringResponse, "run-a", proto.AuthoringResponsePayload{RequestID: request.RequestID, Data: json.RawMessage(`"right"`)})
-	b.Deliver(good)
-	var response proto.AuthoringResponsePayload
-	if err := json.NewDecoder(conn).Decode(&response); err != nil {
-		t.Fatal(err)
-	}
-	if string(response.Data) != `"right"` {
-		t.Fatalf("wrong response: %+v", response)
-	}
-	release()
-	if _, err := net.DialTimeout("unix", path, time.Second); err == nil {
-		t.Fatal("completed run still accepts commands")
-	}
-}
-
-func TestBridgeCancellationClearsWaiters(t *testing.T) {
-	sender := testSender{frames: make(chan proto.Envelope, 1)}
-	b := New(sender)
-	ctx, cancel := context.WithCancel(t.Context())
-	done := make(chan error, 1)
-	go func() {
-		_, err := b.request(ctx, "run", proto.AuthoringRequestPayload{Operation: proto.AuthoringSkillList})
-		done <- err
-	}()
-	<-sender.frames
-	cancel()
-	select {
-	case err := <-done:
-		if err == nil {
-			t.Fatal("cancelled request succeeded")
-		}
-	case <-time.After(time.Second):
-		t.Fatal("cancelled request remained blocked")
-	}
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	if len(b.waiters) != 0 {
-		t.Fatal("waiter retained after cancellation")
-	}
-}
diff --git a/apps/daemon/internal/cli/authoring.go b/apps/daemon/internal/cli/authoring.go
deleted file mode 100644
index 6b3b26956..000000000
--- a/apps/daemon/internal/cli/authoring.go
+++ /dev/null
@@ -1,77 +0,0 @@
-package cli
-
-import (
-	"context"
-	"maps"
-	"os"
-	"path/filepath"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/authoring"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-)
-
-func withAuthoringBridge(factory agent.Factory, bridge *authoring.Bridge) agent.Factory {
-	return func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		if !req.WorkspaceAuthoring {
-			return factory(ctx, req, out)
-		}
-		path, release, err := bridge.Listen(ctx, req.RunID)
-		if err != nil {
-			return nil, err
-		}
-		req.AgentOptions = maps.Clone(req.AgentOptions)
-		if req.AgentOptions == nil {
-			req.AgentOptions = make(map[string]any)
-		}
-		env, _ := req.AgentOptions["env"].(map[string]any)
-		env = maps.Clone(env)
-		if env == nil {
-			env = make(map[string]any)
-		}
-		env[proto.AuthoringSocketEnv] = path
-		if executable, err := os.Executable(); err == nil {
-			addCompanionCLIPath(env, filepath.Dir(executable))
-		}
-		req.AgentOptions["env"] = env
-		upstream := make(chan proto.Envelope, 64)
-		session, err := factory(ctx, req, upstream)
-		if err != nil {
-			release()
-			return nil, err
-		}
-		go func() {
-			defer close(out)
-			defer release()
-			for event := range upstream {
-				if event.Type == proto.TypeDone {
-					release()
-				}
-				out <- event
-			}
-		}()
-		return session, nil
-	}
-}
-
-func authoringRegistry(registry *agent.Registry, bridge *authoring.Bridge) *agent.Registry {
-	wrapped := agent.NewRegistry()
-	for _, info := range registry.SupportedAgentKinds() {
-		factory, _ := registry.Resolve(info.Kind)
-		if info.Capabilities.WorkspaceAuthoring.IsSupported() {
-			factory = withAuthoringBridge(factory, bridge)
-		}
-		configuration, err := registry.Configuration(info.Kind)
-		if err != nil {
-			panic(err)
-		}
-		wrapped.RegisterKind(info, configuration, factory)
-		if executor, err := registry.ResolveExecutor(info.Kind); err == nil {
-			wrapped.RegisterExecutor(info.Kind, executor)
-		}
-		if prepare, err := registry.ResolvePreparation(info.Kind); err == nil {
-			wrapped.RegisterPreparation(info.Kind, info.Capabilities.WorkspaceReadPreparation.IsSupported(), prepare)
-		}
-	}
-	return wrapped
-}
diff --git a/apps/daemon/internal/cli/authoring_test.go b/apps/daemon/internal/cli/authoring_test.go
deleted file mode 100644
index 709109256..000000000
--- a/apps/daemon/internal/cli/authoring_test.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package cli
-
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/authoring"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
-)
-
-func TestAuthoringSocketEndsWithTurnWhileSessionIsRetained(t *testing.T) {
-	home, err := os.MkdirTemp("/tmp", "pa-wrap-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(home)
-	t.Setenv("HOME", home)
-	env := map[string]any{"MODEL_KEY": "preserved"}
-	var path string
-	var events chan<- proto.Envelope
-	factory := withAuthoringBridge(func(_ context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		injected := req.AgentOptions["env"].(map[string]any)
-		path, _ = injected[proto.AuthoringSocketEnv].(string)
-		if path == "" || injected["MODEL_KEY"] != "preserved" {
-			t.Fatal("missing per-run context")
-		}
-		events = out
-		return nil, nil
-	}, authoring.New(nil))
-	out := make(chan proto.Envelope, 1)
-	_, err = factory(t.Context(), proto.PromptRequestPayload{RunID: "run", WorkspaceAuthoring: true, AgentOptions: map[string]any{"env": env}}, out)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, exists := env[proto.AuthoringSocketEnv]; exists {
-		t.Fatal("mutated caller environment")
-	}
-	if _, err := os.Stat(path); err != nil {
-		t.Fatal(err)
-	}
-	done, _ := proto.NewEnvelope(proto.TypeDone, "run", proto.DonePayload{})
-	events <- done
-	select {
-	case <-out:
-	case <-time.After(time.Second):
-		t.Fatal("terminal event blocked")
-	}
-	if conn, err := net.DialTimeout("unix", path, time.Second); err == nil {
-		_ = conn.Close()
-		t.Fatal("authoring remained available after done")
-	}
-	close(events)
-}
-
-func TestAuthoringRegistryRequiresExplicitCapability(t *testing.T) {
-	root, err := os.MkdirTemp("/tmp", "pa-opt-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(root)
-	t.Setenv("OAC_RUNTIME_HOME", root)
-	for _, optIn := range []bool{false, true} {
-		reg := agent.NewRegistry()
-		called := false
-		stop := errors.New("controlled factory stop")
-		out := make(chan proto.Envelope, 1)
-		reg.RegisterKind(proto.SupportedAgentKind{Kind: "engine", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{WorkspaceAuthoring: proto.CapabilityFromBool(optIn)})}, harnessconfig.Configuration{}, func(_ context.Context, req proto.PromptRequestPayload, events chan<- proto.Envelope) (agent.Session, error) {
-			called = true
-			env, _ := req.AgentOptions["env"].(map[string]any)
-			socket, _ := env[proto.AuthoringSocketEnv].(string)
-			if (socket != "") != optIn {
-				t.Fatal("authoring capability was not respected")
-			}
-			if optIn {
-				if _, err := os.Stat(socket); err != nil {
-					t.Fatal(err)
-				}
-			} else if events != out {
-				t.Fatal("non-product event channel was wrapped")
-			}
-			return nil, stop
-		})
-		wrapped := authoringRegistry(reg, authoring.New(nil))
-		factory, err := wrapped.Resolve("engine")
-		if err != nil {
-			t.Fatal(err)
-		}
-		_, err = factory(t.Context(), proto.PromptRequestPayload{RunID: "run", WorkspaceAuthoring: true}, out)
-		if !called || !errors.Is(err, stop) {
-			t.Fatal("registered factory was not preserved", err)
-		}
-	}
-}
diff --git a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
index 3b8a14647..43a162377 100644
--- a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
+++ b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
@@ -13,7 +13,6 @@ import (
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/authoring"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/dispatch"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/google/uuid"
@@ -73,7 +72,6 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 		t.Helper()
 		reg := agent.NewRegistry()
 		registerAgentKinds(reg, discovery)
-		reg = authoringRegistry(reg, authoring.New(nil))
 		sender := make(registeredSDKSender, 256)
 		router, err := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
 		if err != nil {
@@ -89,7 +87,7 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 		ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
 		defer cancel()
 		id := uuid.NewString()
-		request := proto.PromptRequestPayload{RunID: id, AgentKind: "claude_sdk", Input: proto.TextInput(prompt), AgentStateKey: "registered-acceptance", AgentSessionID: resume, StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, ObserveToolObservations: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": nil}}
+		request := proto.PromptRequestPayload{RunID: id, AgentKind: "claude_sdk", Input: proto.TextInput(prompt), AgentStateKey: "registered-acceptance", AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": nil}}
 		if callFunction {
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
 		}
@@ -182,7 +180,7 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 	if third.Outcome.Metadata[proto.DoneMetaAgentSessionID] != id || !strings.Contains(third.Outcome.Content, nonce) {
 		t.Fatal("registered cold continuation lost identity or history")
 	}
-	data, _ := json.MarshalIndent(map[string]any{"scope": "SDK-only readiness and production registration/authoring registry -> daemon router -> pinned SDK/native -> real MiniMax; function receipt, cancellation and cold continuation; public API admission remains separate", "descriptor": discovery[0].runtime.Info, "entrypoint": entrypoint, "verification_value": nonce, "executions": []execution{first, second, third}}, "", "  ")
+	data, _ := json.MarshalIndent(map[string]any{"scope": "SDK-only readiness and production registration -> daemon router -> pinned SDK/native -> real MiniMax; function receipt, cancellation and cold continuation; public API admission remains separate", "descriptor": discovery[0].runtime.Info, "entrypoint": entrypoint, "verification_value": nonce, "executions": []execution{first, second, third}}, "", "  ")
 	if err := os.WriteFile(filepath.Join(root, "proof.json"), data, 0o600); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/cli/companion_path.go b/apps/daemon/internal/cli/companion_path.go
deleted file mode 100644
index d83814828..000000000
--- a/apps/daemon/internal/cli/companion_path.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package cli
-
-import (
-	"os"
-	"path/filepath"
-)
-
-func addCompanionCLIPath(env map[string]any, dir string) {
-	info, err := os.Stat(filepath.Join(dir, "parsar"))
-	if err != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0o111 == 0 {
-		return
-	}
-	path, ok := env["PATH"].(string)
-	if !ok {
-		path = os.Getenv("PATH")
-	}
-	env["PATH"] = dir + string(os.PathListSeparator) + path
-}
diff --git a/apps/daemon/internal/cli/companion_path_test.go b/apps/daemon/internal/cli/companion_path_test.go
deleted file mode 100644
index 4d8b560fa..000000000
--- a/apps/daemon/internal/cli/companion_path_test.go
+++ /dev/null
@@ -1,37 +0,0 @@
-package cli
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestCompanionCLIPath(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		mode os.FileMode
-		want bool
-	}{
-		{"executable", 0o700, true},
-		{"download awaiting review", 0o600, false},
-		{"missing", 0, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			dir := t.TempDir()
-			if tc.mode != 0 {
-				if err := os.WriteFile(filepath.Join(dir, "parsar"), []byte("binary"), tc.mode); err != nil {
-					t.Fatal(err)
-				}
-			}
-			env := map[string]any{"PATH": "/existing/tools", "OTHER": "retained"}
-			addCompanionCLIPath(env, dir)
-			want := "/existing/tools"
-			if tc.want {
-				want = dir + string(os.PathListSeparator) + want
-			}
-			if env["PATH"] != want || env["OTHER"] != "retained" {
-				t.Fatalf("unexpected child environment: %v", env)
-			}
-		})
-	}
-}
diff --git a/apps/daemon/internal/cli/connect.go b/apps/daemon/internal/cli/connect.go
index ae295f0aa..32b8e885c 100644
--- a/apps/daemon/internal/cli/connect.go
+++ b/apps/daemon/internal/cli/connect.go
@@ -12,7 +12,6 @@ import (
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/auth"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/authoring"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/daemonize"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/dispatch"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
@@ -427,8 +426,6 @@ func pumpConn(parentCtx context.Context, conn *transport.Conn, registry *agent.R
 	if err != nil {
 		return err
 	}
-	bridge := authoring.New(conn)
-	registry = authoringRegistry(registry, bridge)
 	router, err := dispatch.New(dispatch.Config{
 		Registry:       registry,
 		Sender:         conn,
@@ -471,10 +468,6 @@ func pumpConn(parentCtx context.Context, conn *transport.Conn, registry *agent.R
 				obslog.Bg().Warn("pumpConn: recvCh closed", "err", conn.Err())
 				return conn.Err()
 			}
-			if env.Type == proto.TypeAuthoringResponse {
-				bridge.Deliver(env)
-				continue
-			}
 			obslog.Bg().Info("pumpConn: received envelope, calling router.Handle", "type", env.Type, "id", env.ID)
 			if err := router.Handle(parentCtx, env); err != nil {
 				obslog.Bg().Error("router.Handle failed", "type", env.Type, "id", env.ID, "err", err)
diff --git a/apps/daemon/internal/cli/connect_cleanup_test.go b/apps/daemon/internal/cli/connect_cleanup_test.go
index e8ef2d21e..c8f92a00e 100644
--- a/apps/daemon/internal/cli/connect_cleanup_test.go
+++ b/apps/daemon/internal/cli/connect_cleanup_test.go
@@ -148,7 +148,7 @@ func testDisconnectedPumpCleanup(t *testing.T, suspend bool) {
 	}
 	defer peer.Close()
 	env, err := proto.NewEnvelope(proto.TypeExecutionPrepare, "prepare", proto.ExecutionPreparePayload{SessionID: "cleanup",
-		Configuration: proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: "agents-api-cleanup", StrictResume: true, DisableExecutionEnvironment: true}})
+		Configuration: proto.PromptRequestPayload{AgentKind: "cleanup", AgentStateKey: "agents-api-cleanup", DisableExecutionEnvironment: true}})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/cli/connect_suspend.go b/apps/daemon/internal/cli/connect_suspend.go
index 5050d6e06..b1146b94d 100644
--- a/apps/daemon/internal/cli/connect_suspend.go
+++ b/apps/daemon/internal/cli/connect_suspend.go
@@ -7,7 +7,6 @@ import (
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/authoring"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/dispatch"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/localworkspace"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/transport"
@@ -34,7 +33,6 @@ func (s *reconnectSender) replace(conn *transport.Conn) { s.mu.Lock(); s.conn =
 
 type suspendedRouter struct {
 	router   *dispatch.Router
-	bridge   *authoring.Bridge
 	sender   *reconnectSender
 	registry *agent.Registry
 	local    *localworkspace.Binding
@@ -46,13 +44,11 @@ func newSuspendedRouter(conn *transport.Conn, registry *agent.Registry) (*suspen
 		return nil, err
 	}
 	sender := &reconnectSender{conn: conn}
-	bridge := authoring.New(sender)
-	wrapped := authoringRegistry(registry, bridge)
-	router, err := dispatch.New(dispatch.Config{Registry: wrapped, Sender: sender, Log: obslog.Bg(), LocalWorkspace: local})
+	router, err := dispatch.New(dispatch.Config{Registry: registry, Sender: sender, Log: obslog.Bg(), LocalWorkspace: local})
 	if err != nil {
 		return nil, err
 	}
-	return &suspendedRouter{router: router, bridge: bridge, sender: sender, registry: wrapped, local: local}, nil
+	return &suspendedRouter{router: router, sender: sender, registry: registry, local: local}, nil
 }
 
 func (s *suspendedRouter) shutdown() {
@@ -177,10 +173,6 @@ func (s *suspendedRouter) pump(ctx context.Context, conn *transport.Conn, boot *
 			if !ok {
 				return nil, conn.Err()
 			}
-			if env.Type == proto.TypeAuthoringResponse {
-				s.bridge.Deliver(env)
-				continue
-			}
 			if env.Type == proto.TypeEnvironmentResume {
 				request := rejectedResumeRequest(env)
 				code := "not_suspended"
diff --git a/apps/daemon/internal/cli/preparation_test.go b/apps/daemon/internal/cli/preparation_test.go
index df9082731..7df3223e6 100644
--- a/apps/daemon/internal/cli/preparation_test.go
+++ b/apps/daemon/internal/cli/preparation_test.go
@@ -1,19 +1,16 @@
 package cli
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
-	"errors"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/authoring"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
 )
 
-func TestPreparationRegistrationBypassesProductWrappers(t *testing.T) {
+func TestPreparationRegistrationFollowsNativeSupport(t *testing.T) {
 	for _, supported := range []bool{false, true} {
 		reg := agent.NewRegistry()
 		info := proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilityFromBool(supported)})}
@@ -33,30 +30,15 @@ func TestPreparationRegistrationBypassesProductWrappers(t *testing.T) {
 		if !supported {
 			continue
 		}
-		stop := errors.New("controlled preparation stop")
-		reg.RegisterPreparation("codex", true, func(_ context.Context, req proto.PromptRequestPayload) (agent.Prepared, error) {
-			if req.RunID != "" || req.WorkspaceAuthoring || len(req.AgentOptions) != 0 {
-				t.Error("product wrapper injected preparation context")
-			}
-			return nil, stop
-		})
-		wrapped := authoringRegistry(reg, authoring.New(nil))
-		prepare, err := wrapped.ResolvePreparation("codex")
-		if err != nil {
-			t.Fatal(err)
-		}
-		if _, err := prepare(t.Context(), proto.PromptRequestPayload{AgentKind: "codex"}); !errors.Is(err, stop) {
-			t.Fatal("raw preparation was lost or wrapped", err)
-		}
-		for _, info := range wrapped.SupportedAgentKinds() {
+		for _, info := range reg.SupportedAgentKinds() {
 			if info.Kind == "codex" && (!info.Capabilities.Preparation.IsSupported() || !info.Capabilities.WorkspaceReadPreparation.IsSupported()) {
-				t.Fatal("real heartbeat registry lost preparation")
+				t.Fatal("heartbeat registry lost preparation")
 			}
 		}
-		wrapped.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-			return nil, stop
+		reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
+			return nil, nil
 		})
-		if _, err := wrapped.ResolvePreparation("codex"); err == nil {
+		if _, err := reg.ResolvePreparation("codex"); err == nil {
 			t.Fatal("factory replacement retained stale preparation")
 		}
 	}
diff --git a/apps/daemon/internal/dispatch/executor.go b/apps/daemon/internal/dispatch/executor.go
index 4e7389cc4..7ac4223b6 100644
--- a/apps/daemon/internal/dispatch/executor.go
+++ b/apps/daemon/internal/dispatch/executor.go
@@ -45,7 +45,7 @@ func executorFingerprint(req proto.PromptRequestPayload) ([32]byte, error) {
 
 func (r *Router) handleExecutorPrepare(ctx context.Context, env proto.Envelope, input proto.ExecutionPreparePayload) error {
 	req := input.Configuration
-	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.WorkspaceAuthoring || req.AgentStateKey != "agents-api-"+input.SessionID || !req.StrictResume {
+	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.AgentStateKey != "agents-api-"+input.SessionID {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
 	caps, available := r.availableCapabilities(req.AgentKind)
diff --git a/apps/daemon/internal/dispatch/executor_handoff_test.go b/apps/daemon/internal/dispatch/executor_handoff_test.go
index b0fc793fa..60f194351 100644
--- a/apps/daemon/internal/dispatch/executor_handoff_test.go
+++ b/apps/daemon/internal/dispatch/executor_handoff_test.go
@@ -150,7 +150,7 @@ func TestPreparedDonePublishesAfterExecutorHandoff(t *testing.T) {
 					}
 				}
 			}
-			request := proto.ExecutionPreparePayload{SessionID: "session", Configuration: proto.PromptRequestPayload{AgentKind: "handoff", AgentStateKey: "agents-api-session", StrictResume: true, DisableExecutionEnvironment: true}}
+			request := proto.ExecutionPreparePayload{SessionID: "session", Configuration: proto.PromptRequestPayload{AgentKind: "handoff", AgentStateKey: "agents-api-session", DisableExecutionEnvironment: true}}
 			admit := func(id string) proto.PreparationStatusPayload {
 				t.Helper()
 				handle(proto.TypeExecutionPrepare, id, request)
diff --git a/apps/daemon/internal/dispatch/executor_test.go b/apps/daemon/internal/dispatch/executor_test.go
index c8db7c741..55686fd2a 100644
--- a/apps/daemon/internal/dispatch/executor_test.go
+++ b/apps/daemon/internal/dispatch/executor_test.go
@@ -70,7 +70,7 @@ func (t *reusableTurn) AwaitSettlement(ctx context.Context) (agent.TurnSettlemen
 }
 
 func executorRequest() proto.ExecutionPreparePayload {
-	return proto.ExecutionPreparePayload{SessionID: "session", Configuration: proto.PromptRequestPayload{AgentKind: "reusable", AgentStateKey: "agents-api-session", StrictResume: true, DisableExecutionEnvironment: true}}
+	return proto.ExecutionPreparePayload{SessionID: "session", Configuration: proto.PromptRequestPayload{AgentKind: "reusable", AgentStateKey: "agents-api-session", DisableExecutionEnvironment: true}}
 }
 func executorRouter(t *testing.T, owner *reusableExecutor, idle time.Duration) (*dispatch.Router, *recSender, *atomic.Int32) {
 	t.Helper()
diff --git a/apps/daemon/internal/dispatch/functions_native_test.go b/apps/daemon/internal/dispatch/functions_native_test.go
index 036ea1c8d..f541a43a8 100644
--- a/apps/daemon/internal/dispatch/functions_native_test.go
+++ b/apps/daemon/internal/dispatch/functions_native_test.go
@@ -138,7 +138,7 @@ func TestNativeFunctionBridge(t *testing.T) {
 	nativeID := ""
 	for index := 0; index < 3; index++ {
 		run := fmt.Sprintf("run-%d", index)
-		request := proto.PromptRequestPayload{AgentKind: "codex", Input: proto.TextInput("Look up ticket 42."), RunID: run, AgentStateKey: "native-functions", AgentSessionID: nativeID, StrictResume: true, ReleaseOnCompletion: true, DisableExecutionEnvironment: true, ObserveToolObservations: true,
+		request := proto.PromptRequestPayload{AgentKind: "codex", Input: proto.TextInput("Look up ticket 42."), RunID: run, AgentStateKey: "native-functions", AgentSessionID: nativeID, ReleaseOnCompletion: true, DisableExecutionEnvironment: true,
 			FunctionTools: []proto.FunctionTool{{Name: "lookup_ticket", Description: "Read a synthetic ticket", Parameters: json.RawMessage(`{"type":"object","properties":{"ticket":{"type":"string"}},"required":["ticket"],"additionalProperties":false}`)}},
 			AgentOptions:  map[string]any{"model": "gpt-5.5", "model_provider": map[string]any{"protocol": "responses", "base_url": model.URL + "/v1", "api_key": "synthetic-local-token"}}}
 		env, _ := proto.NewEnvelope(proto.TypePromptRequest, run, request)
diff --git a/apps/daemon/internal/dispatch/local_directory_test.go b/apps/daemon/internal/dispatch/local_directory_test.go
index b0363bf24..d06af72aa 100644
--- a/apps/daemon/internal/dispatch/local_directory_test.go
+++ b/apps/daemon/internal/dispatch/local_directory_test.go
@@ -43,7 +43,7 @@ func TestLocalDirectoryPreparationNeedsNoHarnessAndRejectsOtherOwners(t *testing
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, StrictResume: true, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
@@ -123,7 +123,7 @@ func TestLocalDirectoryKeepsNotDirectorySeparateFromFailures(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, StrictResume: true, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/dispatch/preparation.go b/apps/daemon/internal/dispatch/preparation.go
index e77761f09..36695ab7a 100644
--- a/apps/daemon/internal/dispatch/preparation.go
+++ b/apps/daemon/internal/dispatch/preparation.go
@@ -63,7 +63,7 @@ func (r *Router) handleExecutionPrepare(ctx context.Context, env proto.Envelope)
 	if req, err = r.localWorkspace.Configure(req); err != nil {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
-	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.WorkspaceAuthoring || req.EnvironmentID() == "" || strings.TrimSpace(req.AgentStateKey) == "" || !req.StrictResume || !req.ReleaseOnCompletion {
+	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.EnvironmentID() == "" || strings.TrimSpace(req.AgentStateKey) == "" || !req.ReleaseOnCompletion {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
 	if validateExecutionEnvironment(req, caps) != nil || (len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported()) {
diff --git a/apps/daemon/internal/dispatch/preparation_test.go b/apps/daemon/internal/dispatch/preparation_test.go
index 7d4a9de4e..64f85b1bf 100644
--- a/apps/daemon/internal/dispatch/preparation_test.go
+++ b/apps/daemon/internal/dispatch/preparation_test.go
@@ -113,7 +113,7 @@ func localPreparationHarness(t *testing.T) *harness {
 }
 
 func preparationRequest() proto.ExecutionPreparePayload {
-	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: "agents-api-" + preparationSessionID, StrictResume: true, ReleaseOnCompletion: true, LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, NetworkAccess: "enabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}}
+	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: "agents-api-" + preparationSessionID, ReleaseOnCompletion: true, LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, NetworkAccess: "enabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}}
 }
 
 func preparationRouter(t *testing.T, sender dispatch.Sender, timeout time.Duration, factory agent.PreparationFactory) *dispatch.Router {
@@ -372,12 +372,10 @@ func TestPreparationRejectsInputAndProductConfiguration(t *testing.T) {
 		"run":          func(p *proto.PromptRequestPayload) { p.RunID = "run" },
 		"input":        func(p *proto.PromptRequestPayload) { p.Input = proto.TextInput("input") },
 		"conversation": func(p *proto.PromptRequestPayload) { p.ConversationID = "product" },
-		"authoring":    func(p *proto.PromptRequestPayload) { p.WorkspaceAuthoring = true },
 		"attachment": func(p *proto.PromptRequestPayload) {
 			p.Input = proto.MessageInput{{Content: []proto.InputContent{{Type: "input_image"}}}}
 		},
 		"missing environment": func(p *proto.PromptRequestPayload) { p.LocalEnvironment = nil },
-		"resume":              func(p *proto.PromptRequestPayload) { p.StrictResume = false },
 	} {
 		t.Run(name, func(t *testing.T) {
 			r := preparationRouter(t, &recSender{}, time.Minute, func(context.Context, proto.PromptRequestPayload) (agent.Prepared, error) {
diff --git a/apps/daemon/internal/localworkspace/binding.go b/apps/daemon/internal/localworkspace/binding.go
index c56610270..fe8bca207 100644
--- a/apps/daemon/internal/localworkspace/binding.go
+++ b/apps/daemon/internal/localworkspace/binding.go
@@ -69,8 +69,7 @@ func (b *Binding) Configure(r proto.PromptRequestPayload) (proto.PromptRequestPa
 		return r, nil
 	}
 	if b == nil || r.LocalEnvironment == nil || r.LocalEnvironment.ID != b.environment || r.AgentStateKey != b.stateKey ||
-		r.DisableExecutionEnvironment ||
-		r.ConversationID != "" || r.WorkspaceAuthoring || !r.StrictResume {
+		r.DisableExecutionEnvironment || r.ConversationID != "" {
 		return r, errors.New("request does not match the dedicated local Environment")
 	}
 	if !r.WorkspaceReadOnly || r.LocalEnvironment.NetworkAccess != "" || len(r.LocalEnvironment.AllowedDomains) > 0 {
diff --git a/apps/daemon/internal/localworkspace/binding_test.go b/apps/daemon/internal/localworkspace/binding_test.go
index 372cc8ec7..9aad690f0 100644
--- a/apps/daemon/internal/localworkspace/binding_test.go
+++ b/apps/daemon/internal/localworkspace/binding_test.go
@@ -26,7 +26,7 @@ func testBinding(t *testing.T) (*Binding, proto.PromptRequestPayload) {
 	}
 	b.networkAccess = "disabled"
 	b.capabilityRoot = t.TempDir()
-	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: "agents-api-" + session, StrictResume: true, ReleaseOnCompletion: true}
+	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: "agents-api-" + session, ReleaseOnCompletion: true}
 }
 
 func TestBindingRejectsScopeOverrides(t *testing.T) {
@@ -40,10 +40,8 @@ func TestBindingRejectsScopeOverrides(t *testing.T) {
 		"other Environment": func(r *proto.PromptRequestPayload) {
 			r.LocalEnvironment = &proto.LocalEnvironment{ID: uuid.NewString()}
 		},
-		"other Session":     func(r *proto.PromptRequestPayload) { r.AgentStateKey = "agents-api-" + uuid.NewString() },
-		"none":              func(r *proto.PromptRequestPayload) { r.DisableExecutionEnvironment = true },
-		"product authoring": func(r *proto.PromptRequestPayload) { r.WorkspaceAuthoring = true },
-		"non-strict resume": func(r *proto.PromptRequestPayload) { r.StrictResume = false },
+		"other Session": func(r *proto.PromptRequestPayload) { r.AgentStateKey = "agents-api-" + uuid.NewString() },
+		"none":          func(r *proto.PromptRequestPayload) { r.DisableExecutionEnvironment = true },
 	} {
 		t.Run(name, func(t *testing.T) {
 			r := valid
diff --git a/apps/daemon/internal/localworkspace/runtime_initialization_process.go b/apps/daemon/internal/localworkspace/runtime_initialization_process.go
index e98dc070b..68174485d 100644
--- a/apps/daemon/internal/localworkspace/runtime_initialization_process.go
+++ b/apps/daemon/internal/localworkspace/runtime_initialization_process.go
@@ -110,7 +110,7 @@ func runInitializationProcess(ctx context.Context, binary string, args []string,
 		return &InitializationFailure{}
 	}
 	process, err := clirunner.Start(clirunner.StartOptions{Parent: operation, Binary: binary, Args: args,
-		Dir: directory, Env: env, OwnProcessGroup: true, KillTimeout: 250 * time.Millisecond})
+		Dir: directory, Env: env, KillTimeout: 250 * time.Millisecond})
 	if err != nil {
 		return ErrInitializationUnconfirmed
 	}
diff --git a/apps/daemon/testdata/onboarding/main.go b/apps/daemon/testdata/onboarding/main.go
index 8ecc4dbaf..4ead4f620 100644
--- a/apps/daemon/testdata/onboarding/main.go
+++ b/apps/daemon/testdata/onboarding/main.go
@@ -40,7 +40,7 @@ func (h *harness) prepare(_ context.Context, req proto.PromptRequestPayload) (ag
 	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" {
 		return nil, errors.New("preparation submitted fixture input")
 	}
-	if !req.StrictResume || !req.DisableExecutionEnvironment || !req.DisableSubagents || len(req.FunctionTools) > 0 || req.MCPHTTPServers != nil {
+	if !req.DisableExecutionEnvironment || !req.DisableSubagents || len(req.FunctionTools) > 0 || req.MCPHTTPServers != nil {
 		return nil, errors.New("unsupported fixture operation")
 	}
 	h.mu.Lock()
diff --git a/contracts/agents-api/harness-onboarding.md b/contracts/agents-api/harness-onboarding.md
index 0d6fba074..8d5c7459d 100644
--- a/contracts/agents-api/harness-onboarding.md
+++ b/contracts/agents-api/harness-onboarding.md
@@ -151,8 +151,6 @@ A Harness that supports the Subagent reads implements the [neutral observation c
 
 Registration is static and requires a build. Export one `agent.Declaration` from `apps/daemon/internal/agent/<kind>/declaration.go`, then add it to `harnessDeclarations` in [`cli/agent_discovery.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_discovery.go). The declaration contains the kind and complete capability descriptor, the shared model `Configuration` and a `Discover` function. Discovery receives the profile and diagnostic writers, owns native configuration and availability checks, and returns the installed `agent.Runtime` with its descriptor and session, preparation and Executor factories. Return nil when the adapter is not configured; return an unavailable descriptor with a session factory when configured prerequisites fail. Keep version gates and factory-selection conditions inside the adapter.
 
-An adapter that supports product workspace authoring declares `WorkspaceAuthoring` itself; common registration does not grant it.
-
 [`cli/agent_registration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_registration.go) iterates the discovered runtimes and calls `Registry.Register` from `agent/harness.go`. It verifies that discovery retained the declared kind and installs factories in this order:
 
 | Order | Method | Registers |
@@ -202,7 +200,7 @@ Run the `engine` and `execution` tests for omission, policy, combination and err
 
 ## Native model configuration
 
-[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) owns the shared configuration declaration and pure preparation contract. Each adapter supplies one `Configuration`, in `internal/harnessconfig/<kind>`, to Core's composition and to the Runtime's `RegisterKind`. The direct factory, preparation and Executor paths all validate through that declaration before native side effects, and Registry wrappers keep the declaration with the factory. The wire object is `proto.HarnessConfig`. [Model execution](./model-execution.md#native-model-parameters) lists each Harness's accepted fields.
+[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) owns the shared configuration declaration and pure preparation contract. Each adapter supplies one `Configuration`, in `internal/harnessconfig/<kind>`, to Core's composition and to the Runtime's `RegisterKind`. The direct factory, preparation and Executor paths all validate through that declaration before native side effects. The wire object is `proto.HarnessConfig`. [Model execution](./model-execution.md#native-model-parameters) lists each Harness's accepted fields.
 
 A supplied `model` must be a nonempty string, and an explicit `model_provider` requires it. The native-owned connection path may omit both; explicit null is invalid. An explicitly empty declaration accepts no provider or nonempty native parameters and advertises no provider support. Unknown protocol formats and duplicate protocol declarations fail at registration.
 
@@ -247,7 +245,7 @@ An adapter may supply `agent.Installation` from `installation.go` in its own pac
 
 ## Native process ownership
 
-The daemon's `clirunner` offers opt-in Unix process-group ownership for adapters whose SDK launches a native child; unsupported hosts reject this mode before launch. Explicit and parent-context cancellation share a TERM grace period (three seconds by default) and a bounded KILL escalation. An internal reaper also cleans remaining group members when the direct process exits, even if a descendant still holds stdout open; during cancellation, surviving descendants keep the remaining grace after the leader exits. The daemon's `stop` command waits up to ten seconds for confirmed shutdown, which covers that grace period and the pipe and owner cleanup after it.
+The daemon's `clirunner` starts every native child in its own Unix process group (a Job object on Windows); other hosts reject the launch. Explicit and parent-context cancellation share a TERM grace period (three seconds by default) and a bounded KILL escalation. An internal reaper also cleans remaining group members when the direct process exits, even if a descendant still holds stdout open; during cancellation, surviving descendants keep the remaining grace after the leader exits. The daemon's `stop` command waits up to ten seconds for confirmed shutdown, which covers that grace period and the pipe and owner cleanup after it.
 
 Owned output pipes stay readable after the leader exits. Consumers drain stdout and stderr before calling `Wait`, which joins the cached process result and closes the readers. `Done` reports leader reaping and group cleanup signals; it is not a native execution receipt or proof of persisted history. SDK adapters settle each Turn and drain its observations before publishing completion, and Executor close also closes the query and awaits the native child. Process groups are lifecycle supervision, not isolation or containment of descendants that leave the group.
 
diff --git a/contracts/agents-api/zh/harness-onboarding.md b/contracts/agents-api/zh/harness-onboarding.md
index b22b086bf..e5252a97d 100644
--- a/contracts/agents-api/zh/harness-onboarding.md
+++ b/contracts/agents-api/zh/harness-onboarding.md
@@ -1,7 +1,7 @@
 ---
 title: "将原生 Harness 添加到 OpenAgentCore"
 source: contracts/agents-api/harness-onboarding.md
-source_hash: 32adff66e2fb33956e96f9a453518d70a3f87056eb777e82a60e087fe4e5aa31
+source_hash: cad1a3666f3c0d4c460bb6213da4bcca89c156fc387b1355d683593b55d025a0
 ---
 
 **Harness** 是一种运行模型和工具循环的原生代理引擎（Codex、Claude Code、MiniMax Code）。**Harness 适配器**将 Runtime 的 Executor 和 Turn 契约转换到该引擎的 SDK 或协议。本文档定义 Runtime–Harness 协议：适配器接口及其生命周期义务、注册、Core 资格认定和验收。[Harness capabilities](harness-capabilities.md) 记录了当前每个 Harness 支持的功能。
@@ -153,8 +153,6 @@ MCP、公共函数、延迟函数发现、结构化输出、图像输入、详
 
 注册是静态的，并且需要构建。从 `apps/daemon/internal/agent/<kind>/declaration.go` 导出一个 `agent.Declaration`，然后将其添加到 [`cli/agent_discovery.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_discovery.go) 的 `harnessDeclarations` 中。声明包含 kind、完整能力描述符、共享模型 `Configuration` 和 `Discover` 函数。发现过程接收 profile 和诊断写入器，负责原生配置和可用性检查，并返回已安装的 `agent.Runtime` 及其描述符、session 工厂、准备工厂和 Executor 工厂。未配置适配器时返回 nil；已配置的前置条件失败时，返回不可用描述符和 session 工厂。将版本门控和工厂选择条件保留在适配器内部。
 
-支持产品工作区创作功能的适配器自行声明 `WorkspaceAuthoring`；通用注册不会授予该能力。
-
 [`cli/agent_registration.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/daemon/internal/cli/agent_registration.go) 遍历已发现的 Runtime，并调用 `agent/harness.go` 中的 `Registry.Register`。它验证发现过程是否保留了声明的 kind，并按以下顺序安装工厂：
 
 | 顺序 | 方法 | 注册内容 |
@@ -204,7 +202,7 @@ profile 是纯逻辑：它使用现有的公共类型和协议类型，声明受
 
 ## 原生模型配置 {#native-model-configuration}
 
-[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) 负责共享配置声明和纯准备契约。每个适配器在 `internal/harnessconfig/<kind>` 中提供一个 `Configuration`，供 Core 组合和 Runtime 的 `RegisterKind` 使用。直接调用工厂、准备路径和 Executor 路径都会在产生原生副作用之前通过该声明进行验证，而 Registry 包装器会将声明与工厂保留在一起。线协议对象是 `proto.HarnessConfig`。[Model execution](model-execution.md#native-model-parameters) 列出了每个 Harness 接受的字段。
+[`internal/harnessconfig/harness.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/harnessconfig/harness.go) 负责共享配置声明和纯准备契约。每个适配器在 `internal/harnessconfig/<kind>` 中提供一个 `Configuration`，供 Core 组合和 Runtime 的 `RegisterKind` 使用。直接调用工厂、准备路径和 Executor 路径都会在产生原生副作用之前通过该声明进行验证。线协议对象是 `proto.HarnessConfig`。[Model execution](model-execution.md#native-model-parameters) 列出了每个 Harness 接受的字段。
 
 提供的 `model` 必须是非空字符串，并且显式指定 `model_provider` 时必须提供它。原生所有权连接路径可以省略二者；显式 null 无效。显式为空的声明不接受任何 Provider 或非空原生参数，也不宣称支持 Provider。未知协议格式和重复协议声明会导致注册失败。
 
@@ -249,7 +247,7 @@ Environment 验收使用 `services/core/tests/official_environment_{templates,se
 
 ## 原生进程所有权 {#native-process-ownership}
 
-daemon 的 `clirunner` 为 SDK 会启动原生子进程的适配器提供可选的 Unix 进程组所有权；不支持的主机会在启动前拒绝此模式。显式取消和父上下文取消共享 TERM 宽限期（默认为三秒）以及有界的 KILL 升级过程。当直接进程退出时，内部回收器也会清理进程组的剩余成员，即使某个后代进程仍保持 stdout 打开；在取消过程中，主进程退出后，存活的后代进程仍会保留剩余宽限时间。daemon 的 `stop` 命令最多等待十秒以确认关闭，这涵盖该宽限期以及之后的管道和所有者清理。
+daemon 的 `clirunner` 让每个原生子进程在自己的 Unix 进程组中启动（Windows 上为 Job 对象）；其他主机会拒绝启动。显式取消和父上下文取消共享 TERM 宽限期（默认为三秒）以及有界的 KILL 升级过程。当直接进程退出时，内部回收器也会清理进程组的剩余成员，即使某个后代进程仍保持 stdout 打开；在取消过程中，主进程退出后，存活的后代进程仍会保留剩余宽限时间。daemon 的 `stop` 命令最多等待十秒以确认关闭，这涵盖该宽限期以及之后的管道和所有者清理。
 
 所属输出管道在主进程退出后仍可读取。消费者在调用 `Wait` 之前耗尽 stdout 和 stderr；`Wait` 会汇合缓存的进程结果并关闭读取器。`Done` 报告主进程回收和进程组清理信号；它不是原生执行回执，也不是历史已持久化的证据。SDK 适配器会结算每个 Turn，并在发布完成状态前耗尽其观察结果；Executor 关闭还会关闭 Query 并等待原生子进程。进程组用于生命周期监管，而不是隔离或遏制离开进程组的后代进程。
 
diff --git a/docs/runtime-protocol.md b/docs/runtime-protocol.md
index a0398c22a..fdd0e943b 100644
--- a/docs/runtime-protocol.md
+++ b/docs/runtime-protocol.md
@@ -51,7 +51,7 @@ A declaration describes what the Runtime can do. Core admits a public feature on
 | `message_images`, `function_result_images` | A message, or a function result, carries an image |
 | `mcp_http_tools`, `mcp_http_required`, `mcp_http_bearer_auth` | The Agent declares HTTP MCP servers; one is `required`; a Vault credential is selected for one |
 
-`permissions` gates permission decisions inside the Runtime, and `workspace_authoring` gates the daemon's authoring command. Core has no admission rule for `usage` and `resume`.
+`permissions` gates permission decisions inside the Runtime. Core has no admission rule for `usage` and `resume`.
 
 The prompt request (`prompt_request`, or the configuration of `execution_prepare`) carries the opt-ins Core sets for each Run:
 
@@ -59,17 +59,16 @@ The prompt request (`prompt_request`, or the configuration of `execution_prepare
 | --- | --- |
 | `agent_options` | Always `model` and `system_prompt` from the Agent; `model_provider` when the Session froze one; `harness_config` when the Agent sets `x_agents_core.harness_config`. Core sends no other key; the Runtime rejects any other key with `unsupported_configuration` before preparation |
 | `execution_controls` | Always: web search `disabled`, the resolved text verbosity (default `medium`), an explicit programmatic-tool-calling disable and any `json_schema` output format. Native option names belong to the adapter |
-| `observe_tool_observations` | Always. Tool-call frames then carry the engine-neutral `observation` |
 | `observe_messages` | When the Runtime declares `message_items`. Text deltas then carry the native item ID, and `output_message` frames report message start, completion, phase and the completion text |
 | `observe_subagent_identities`, `disable_subagents` | From the Agent's `multi_agent.enabled` |
 | `disable_execution_environment` | For an Environment of type `none` |
 | `local_environment` | For `openai_hosted` and `self_hosted`, with the exact Environment binding. The request carries no working directory; the Runtime checks `workspace_directory` against its binding |
-| `strict_resume`, `require_existing_native_session` | Always strict; the second when a native Session must be recovered |
+| `require_existing_native_session` | When a native Session must be recovered |
 | `durable_receipt` on `prompt_steer` | For every active input Core delivers |
 
 An execution configuration requires exactly one of `local_environment` and `disable_execution_environment`; `execution_prepare` rejects neither or both with `unsupported_configuration`.
 
-Requests without an opt-in keep the frames and fields they had without it.
+Requests without an opt-in keep the frames and fields they had without it. A `tool_call` frame carries the engine-neutral `observation` whenever the adapter maps the native tool.
 
 ## Envelope and identity
 
diff --git a/docs/zh/runtime-protocol.md b/docs/zh/runtime-protocol.md
index 050b36d91..0a13af57b 100644
--- a/docs/zh/runtime-protocol.md
+++ b/docs/zh/runtime-protocol.md
@@ -1,7 +1,7 @@
 ---
 title: "Core–Runtime 协议"
 source: docs/runtime-protocol.md
-source_hash: 13766041c9ed0c012ceb5051fe43dcc8a1738a198fe325aad15f1902fe373ee3
+source_hash: fd5bcb71c9234310a449fad97a30a899027133ca8df862e8a3306f6bd3dacae8
 ---
 
 此协议在 Runtime daemon 获取机器凭据后连接 Core 与 daemon，定义 daemon 连接上消息的含义和顺序。wire 类型、限制和验证器仅在 [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto) 中定义一次；Core 的 [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) 与参考 Runtime 的 [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch) 都使用它们，因此无需同步第二套 payload schema。签发凭据和打开连接的 HTTP 路由见[机器连接 API](../../contracts/agents-api/zh/machine-api.md)。
@@ -53,7 +53,7 @@ wire 上每个字段都是 JSON boolean，所有字段都必须出现，包括 `
 | `message_images`, `function_result_images` | 消息或 function result 携带图像 |
 | `mcp_http_tools`, `mcp_http_required`, `mcp_http_bearer_auth` | Agent 声明 HTTP MCP server；其中一个为 `required`；其中一个选用了 Vault 凭据 |
 
-`permissions` 控制 Runtime 内部权限决定，`workspace_authoring` 控制 daemon 的 authoring 命令。Core 对 `usage` 和 `resume` 没有准入规则。
+`permissions` 控制 Runtime 内部权限决定。Core 对 `usage` 和 `resume` 没有准入规则。
 
 prompt 请求（`prompt_request` 或 `execution_prepare` 的配置）携带 Core 为各 Run 设置的显式启用项：
 
@@ -61,17 +61,16 @@ prompt 请求（`prompt_request` 或 `execution_prepare` 的配置）携带 Core
 | --- | --- |
 | `agent_options` | 始终设置 Agent 的 `model` 和 `system_prompt`；Session 冻结了 model provider 时设置 `model_provider`；Agent 设置 `x_agents_core.harness_config` 时设置 `harness_config`。Core 不发送其他键；Runtime 在准备之前以 `unsupported_configuration` 拒绝任何其他键 |
 | `execution_controls` | 始终设置：web search 为 `disabled`、解析后的 text verbosity（默认 `medium`）、明确禁用 programmatic tool calling，以及任何 `json_schema` 输出格式。原生选项名称由 adapter 负责 |
-| `observe_tool_observations` | 始终设置。tool-call frame 随后携带与 engine 无关的 `observation` |
 | `observe_messages` | Runtime 声明 `message_items` 时设置。文本 delta 随后携带原生 item ID，`output_message` frame 报告消息开始、完成、phase 和完成文本 |
 | `observe_subagent_identities`, `disable_subagents` | 根据 Agent 的 `multi_agent.enabled` 设置 |
 | `disable_execution_environment` | Environment 类型为 `none` 时设置 |
 | `local_environment` | 为 `openai_hosted` 和 `self_hosted` 设置，包含精确的 Environment 绑定。请求不携带 working directory；Runtime 按自身绑定检查 `workspace_directory` |
-| `strict_resume`, `require_existing_native_session` | 始终严格；需要恢复原生 Session 时设置第二项 |
+| `require_existing_native_session` | 需要恢复原生 Session 时设置 |
 | `prompt_steer` 上的 `durable_receipt` | Core 交付的每个活动输入都设置 |
 
 执行配置必须且只能包含 `local_environment` 和 `disable_execution_environment` 之一；两者都缺失或同时存在时，`execution_prepare` 以 `unsupported_configuration` 拒绝。
 
-未携带显式启用项的请求保留未启用时的 frame 和字段。
+未携带显式启用项的请求保留未启用时的 frame 和字段。只要 adapter 映射了原生工具，`tool_call` frame 就携带与 engine 无关的 `observation`。
 
 ## Envelope 与身份 {#envelope-and-identity}
 
diff --git a/internal/agentdaemon/proto/authoring.go b/internal/agentdaemon/proto/authoring.go
deleted file mode 100644
index 338d77b5d..000000000
--- a/internal/agentdaemon/proto/authoring.go
+++ /dev/null
@@ -1,31 +0,0 @@
-package proto
-
-import "encoding/json"
-
-const (
-	TypeAuthoringRequest  = "authoring_request"
-	TypeAuthoringResponse = "authoring_response"
-	AuthoringContext      = "context"
-	AuthoringSkillList    = "skill.list"
-	AuthoringSkillRead    = "skill.read"
-	AuthoringSkillCreate  = "skill.create"
-	AuthoringSkillUpdate  = "skill.update"
-	AuthoringPromptRead   = "instructions.read"
-	AuthoringPromptWrite  = "instructions.write"
-	AuthoringMaxBytes     = 1 << 20
-	AuthoringSocketEnv    = "OAC_RUNTIME_DAEMON_SOCKET"
-)
-
-// AuthoringRequestPayload uses Envelope.ID for the active run, never a client-supplied workspace or user.
-type AuthoringRequestPayload struct {
-	RequestID    string `json:"request_id,omitempty"`
-	Operation    string `json:"operation"`
-	CapabilityID string `json:"capability_id,omitempty"`
-	Content      string `json:"content,omitempty"`
-}
-
-type AuthoringResponsePayload struct {
-	RequestID string          `json:"request_id,omitempty"`
-	Data      json.RawMessage `json:"data,omitempty"`
-	Error     string          `json:"error,omitempty"`
-}
diff --git a/internal/agentdaemon/proto/inbound.go b/internal/agentdaemon/proto/inbound.go
index bb41594c7..73a49f6a8 100644
--- a/internal/agentdaemon/proto/inbound.go
+++ b/internal/agentdaemon/proto/inbound.go
@@ -226,7 +226,6 @@ type AgentKindCapabilities struct {
 	Usage                 CapabilitySupport `json:"usage"`
 	Resume                CapabilitySupport `json:"resume"`
 	NativeSessionRecovery CapabilitySupport `json:"native_session_recovery"`
-	WorkspaceAuthoring    CapabilitySupport `json:"workspace_authoring"`
 	Steering              CapabilitySupport `json:"steering"`
 	MessageItems          CapabilitySupport `json:"message_items"`
 
diff --git a/internal/agentdaemon/proto/outbound.go b/internal/agentdaemon/proto/outbound.go
index 8f5db4e41..799d09835 100644
--- a/internal/agentdaemon/proto/outbound.go
+++ b/internal/agentdaemon/proto/outbound.go
@@ -45,8 +45,8 @@ type PromptRequestPayload struct {
 	// dispatches to.
 	AgentKind string `json:"agent_kind"`
 
-	// ConversationID lets the daemon scope per-conversation state
-	// (Claude --resume session id, scratch dir).
+	// ConversationID is the Core Session ID of a prompt_request Run. Preparation
+	// and Executor configurations leave it empty, and no adapter reads it.
 	ConversationID string `json:"conversation_id"`
 
 	// RunID is the ID of the Core Turn this prompt executes; mirrored
@@ -73,21 +73,17 @@ type PromptRequestPayload struct {
 
 	// AgentStateKey is the stable daemon-side state directory key.
 	// WorkspaceReadOnly prepares temporary native state that cannot start a Run.
-	WorkspaceReadOnly  bool   `json:"workspace_read_only,omitempty"`
-	AgentStateKey      string `json:"agent_state_key,omitempty"`
-	WorkspaceAuthoring bool   `json:"workspace_authoring,omitempty"`
+	WorkspaceReadOnly bool   `json:"workspace_read_only,omitempty"`
+	AgentStateKey     string `json:"agent_state_key,omitempty"`
 	// ReleaseOnCompletion closes the native writer before acknowledging Done.
-	ReleaseOnCompletion          bool `json:"release_on_completion,omitempty"`
-	StrictResume                 bool `json:"strict_resume,omitempty"`
-	RequireExistingNativeSession bool `json:"require_existing_native_session,omitempty"`
-	ObserveMessages              bool `json:"observe_messages,omitempty"`
-
-	ObserveToolObservations     bool           `json:"observe_tool_observations,omitempty"`
-	ObserveSubagentIdentities   bool           `json:"observe_subagent_identities,omitempty"`
-	FunctionTools               []FunctionTool `json:"function_tools,omitempty"`
-	ToolSearch                  bool           `json:"tool_search,omitempty"`
-	DisableExecutionEnvironment bool           `json:"disable_execution_environment,omitempty"`
-	DisableSubagents            bool           `json:"disable_subagents,omitempty"`
+	ReleaseOnCompletion          bool           `json:"release_on_completion,omitempty"`
+	RequireExistingNativeSession bool           `json:"require_existing_native_session,omitempty"`
+	ObserveMessages              bool           `json:"observe_messages,omitempty"`
+	ObserveSubagentIdentities    bool           `json:"observe_subagent_identities,omitempty"`
+	FunctionTools                []FunctionTool `json:"function_tools,omitempty"`
+	ToolSearch                   bool           `json:"tool_search,omitempty"`
+	DisableExecutionEnvironment  bool           `json:"disable_execution_environment,omitempty"`
+	DisableSubagents             bool           `json:"disable_subagents,omitempty"`
 }
 
 // PromptCancelPayload optionally requests an application receipt; identity is on Envelope.ID.
diff --git a/internal/agentdaemon/proto/preparation.go b/internal/agentdaemon/proto/preparation.go
index b03ba0905..99c1dba13 100644
--- a/internal/agentdaemon/proto/preparation.go
+++ b/internal/agentdaemon/proto/preparation.go
@@ -9,9 +9,9 @@ const (
 	TypePreparationStatus = "preparation_status"
 )
 
-// ExecutionPreparePayload reuses execution configuration without accepting input
-// or product authoring. SessionID identifies the immutable configuration owner;
-// each request reserves a separate Turn admission on its Runtime Executor.
+// ExecutionPreparePayload reuses execution configuration without accepting
+// input. SessionID identifies the immutable configuration owner; each request
+// reserves a separate Turn admission on its Runtime Executor.
 type ExecutionPreparePayload struct {
 	SessionID     string               `json:"session_id"`
 	Configuration PromptRequestPayload `json:"configuration"`
diff --git a/internal/agentdaemon/proto/prototest/capabilities.go b/internal/agentdaemon/proto/prototest/capabilities.go
index f40726262..f3337682f 100644
--- a/internal/agentdaemon/proto/prototest/capabilities.go
+++ b/internal/agentdaemon/proto/prototest/capabilities.go
@@ -18,7 +18,6 @@ func Capabilities(overrides proto.AgentKindCapabilities) proto.AgentKindCapabili
 		Usage:                          proto.CapabilityUnsupported,
 		Resume:                         proto.CapabilityUnsupported,
 		NativeSessionRecovery:          proto.CapabilityUnsupported,
-		WorkspaceAuthoring:             proto.CapabilityUnsupported,
 		Steering:                       proto.CapabilityUnsupported,
 		MessageItems:                   proto.CapabilityUnsupported,
 		ToolObservations:               proto.CapabilityUnsupported,
diff --git a/internal/agentdaemon/proto/prototest/wire.go b/internal/agentdaemon/proto/prototest/wire.go
index d27120aad..7833863c9 100644
--- a/internal/agentdaemon/proto/prototest/wire.go
+++ b/internal/agentdaemon/proto/prototest/wire.go
@@ -110,7 +110,7 @@ func WireScenarios() []WireScenario {
 	}
 	prepare := send(Core, proto.TypeExecutionPrepare, PreparationID, proto.ExecutionPreparePayload{
 		SessionID:     SessionID,
-		Configuration: proto.PromptRequestPayload{AgentKind: HarnessKind, AgentStateKey: StateKey, StrictResume: true, DisableExecutionEnvironment: true},
+		Configuration: proto.PromptRequestPayload{AgentKind: HarnessKind, AgentStateKey: StateKey, DisableExecutionEnvironment: true},
 	})
 	started := []Step{
 		prepare,
diff --git a/internal/agentdaemon/proto/workspace_read_preparation.go b/internal/agentdaemon/proto/workspace_read_preparation.go
index f732a329b..5869ca3b2 100644
--- a/internal/agentdaemon/proto/workspace_read_preparation.go
+++ b/internal/agentdaemon/proto/workspace_read_preparation.go
@@ -4,10 +4,10 @@ package proto
 // The native adapter supplies temporary state; this request cannot resume or start.
 func ValidWorkspaceReadPreparation(r PromptRequestPayload) bool {
 	return r.WorkspaceReadOnly && r.LocalEnvironment != nil && r.AgentStateKey != "" &&
-		r.StrictResume && r.ReleaseOnCompletion && r.RunID == "" && len(r.Input) == 0 &&
+		r.ReleaseOnCompletion && r.RunID == "" && len(r.Input) == 0 &&
 		r.ConversationID == "" && r.AgentSessionID == "" &&
-		!r.RequireExistingNativeSession && !r.WorkspaceAuthoring && !r.DisableExecutionEnvironment &&
+		!r.RequireExistingNativeSession && !r.DisableExecutionEnvironment &&
 		len(r.AgentOptions) == 0 && r.ExecutionControls == nil && r.MCPHTTPServers == nil &&
 		len(r.FunctionTools) == 0 && !r.ToolSearch && !r.ObserveMessages &&
-		!r.ObserveToolObservations && !r.ObserveSubagentIdentities
+		!r.ObserveSubagentIdentities
 }
diff --git a/packages/claude-sdk-adapter/README.md b/packages/claude-sdk-adapter/README.md
index feca4d537..4cba3ec4c 100644
--- a/packages/claude-sdk-adapter/README.md
+++ b/packages/claude-sdk-adapter/README.md
@@ -48,7 +48,7 @@ Directory requests are bounded to 8 KiB and 1,000 immediate entries, with explic
 
 ### Command observations
 
-With `ObserveToolObservations`, private workspace execution requires the packaged `workspace_command_observations` feature and emits the neutral command snapshots. Match root, current-query native Bash call/result identities after input; ignore historical replay, synthetic and child work. Preserve exact command text and the native per-call textual result, including native rendering or truncation. This is final native output, not incremental stdout/stderr or reconstructed interleaving. Native error results are failed; unambiguous structured interruption is incomplete. Missing results close as incomplete after the observation drain; query cancellation does not overwrite an already observed native failure. Do not infer an exit code from rendered text or supply cwd/duration without qualified native fields. Preparation alone emits no command. Cold continuation must not reissue historical observations. This private translation does not enable public workspace admission, Read/Edit Items or Files ownership.
+Private workspace execution requires the packaged `workspace_command_observations` feature and emits the neutral command snapshots. Match root, current-query native Bash call/result identities after input; ignore historical replay, synthetic and child work. Preserve exact command text and the native per-call textual result, including native rendering or truncation. This is final native output, not incremental stdout/stderr or reconstructed interleaving. Native error results are failed; unambiguous structured interruption is incomplete. Missing results close as incomplete after the observation drain; query cancellation does not overwrite an already observed native failure. Do not infer an exit code from rendered text or supply cwd/duration without qualified native fields. Preparation alone emits no command. Cold continuation must not reissue historical observations. This private translation does not enable public workspace admission, Read/Edit Items or Files ownership.
 
 ### HTTP MCP
 
@@ -66,11 +66,11 @@ Workspace deferred-function discovery uses native ToolSearch alongside the norma
 
 For unmanaged bootstrap, daemon `connect` optionally registers this factory as `claude_sdk` when the operator sets `OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT` to the absolute packaged `dist/main.js`. `OAC_RUNTIME_CLAUDE_SDK_NODE` selects Node (default: `node` on PATH). Discovery resolves Node once and checks that exact configuration before pairing; the SDK's bounded runtime check is independent of CLI version probes. A ready SDK alone is sufficient to start the daemon. No configuration means no SDK probe or descriptor; failed readiness reports an unavailable descriptor with a rejecting factory. Runtime checks establish local readiness, not provider authentication. Installed daemons use `start` and their verified installation manifest for adapter selection and activation; ambient activation variables cannot extend that selection. See [the native installation contract](../../deploy/README.md#native-daemon-installer).
 
-SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in pairing profiles. The daemon registers `claude_sdk` directly, without the `WorkspaceAuthoring` wrapper of its product agent kinds. It accepts no caller-supplied environment variables or business write authority.
+SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in pairing profiles. It accepts no caller-supplied environment variables or business write authority.
 
 ### Descriptor and execution profile
 
-The SDK descriptor advertises the validated daemon subset, including durable Turns/input receipts, text observations, function tools, raw usage and restrictive execution controls. It does not advertise permissions, product authoring, raw tool Items, general web-search control or text-verbosity levels. Router admission for `environment:none` uses the available engine capability, not an engine name.
+The SDK descriptor advertises the validated daemon subset, including durable Turns/input receipts, text observations, function tools, raw usage and restrictive execution controls. It does not advertise permissions, raw tool Items, general web-search control or text-verbosity levels. Router admission for `environment:none` uses the available engine capability, not an engine name.
 
 Core owns public admission for Claude: [harness selection](../../contracts/agents-api/model-execution.md#harness-selection) chooses the engine for each Session; one [engine policy](../../contracts/agents-api/harness-onboarding.md#add-the-engine-to-core) serves API admission, device selection and the final claim; the [qualified operations](../../contracts/agents-api/harness-capabilities.md) table records Claude's medium-only verbosity and object-root function schemas; [function result images](../../contracts/agents-api/message-content.md#function-results) defines which placements accept image results; and [deployment defaults](../../contracts/agents-api/model-execution.md#deployment-defaults) define the model provider Core freezes for a Session. The adapter receives that provider as the adapter-owned `model_provider`, never in public Session configuration. Without one, a `none` host uses the daemon's own provider environment. The adapter alone selects the provider environment and removes credentials from native tool environments.
 
@@ -78,7 +78,7 @@ The `none` profile accepts only text, explicit model/system instructions, manage
 
 ### Function server and results
 
-The internal SDK function-server helper uses the maintained MCP server's public request handlers and standard Tool/CallToolResult types. It snapshots definitions and forwards JSON Schema without a JSON Schema-to-Zod conversion; supplied tools are always loaded. Native call identity comes from the pinned harness's `claudecode/toolUseId` MCP metadata, independently of request IDs, names or arrival order. Missing identities and undeclared tools fail before invoking the host. Return content/error fields unchanged over MCP and forward its per-request abort signal. The private Go factory connects declared functions through this helper and reuses the daemon function-call/result interface and opt-in neutral observations. The native function-server registry must contain exactly those functions. SDK allowlisting admits only these host callbacks; the host still owns result decisions and any business permission checks. It grants no runtime-token business authority.
+The internal SDK function-server helper uses the maintained MCP server's public request handlers and standard Tool/CallToolResult types. It snapshots definitions and forwards JSON Schema without a JSON Schema-to-Zod conversion; supplied tools are always loaded. Native call identity comes from the pinned harness's `claudecode/toolUseId` MCP metadata, independently of request IDs, names or arrival order. Missing identities and undeclared tools fail before invoking the host. Return content/error fields unchanged over MCP and forward its per-request abort signal. The private Go factory connects declared functions through this helper and reuses the daemon function-call/result interface and neutral observations. The native function-server registry must contain exactly those functions. SDK allowlisting admits only these host callbacks; the host still owns result decisions and any business permission checks. It grants no runtime-token business authority.
 
 Function results remain pending after stdin/MCP delivery. A matching live, root native user tool_result confirms application only when its Session/call identity, error flag and ordered content match the submission. Text matches exactly; each submitted image position must remain a valid native base64 image. Native resizing or re-encoding may change image bytes. This acknowledges incorporation into native history, not byte/pixel fidelity or completed provider consumption. Public Items retain the original caller content; real image-dependent model responses separately qualify usability. Ignore replayed, synthetic and subagent messages. Native error text joins the submitted text parts with newlines; neutral observations retain their original order and separate failure status. Missing/mismatched receipts fail the execution; do not replay unknown delivery. Result submission waits at most ten seconds for a receipt and cancels uncertain execution on timeout. Invalid or unsupported image results fail before consuming a pending call. Function state belongs to one live Run and ends with it; the router owns receipt retry/conflict handling. This does not establish crash recovery or exactly-once effects.
 
diff --git a/scripts/name-allowlist.json b/scripts/name-allowlist.json
index 23ac631c9..0cb022c51 100644
--- a/scripts/name-allowlist.json
+++ b/scripts/name-allowlist.json
@@ -144,16 +144,6 @@
     "regex": "AGENTS_API_PUBLIC_URL",
     "reason": "Historical migration commentary records the environment name used when this migration was written."
   },
-  {
-    "path": "apps/daemon/internal/cli/companion_path.go",
-    "regex": "\\bparsar\\b",
-    "reason": "The authoring bridge puts the separate product CLI on PATH; that CLI keeps its own name."
-  },
-  {
-    "path": "apps/daemon/internal/cli/companion_path_test.go",
-    "regex": "\\bparsar\\b",
-    "reason": "The authoring bridge puts the separate product CLI on PATH; that CLI keeps its own name."
-  },
   {
     "path": "CONTRIBUTING.md",
     "regex": "apps/parsar/|Parsar owns",
diff --git a/services/core/internal/execution/delivery.go b/services/core/internal/execution/delivery.go
index b18f4f86e..3cd1e1833 100644
--- a/services/core/internal/execution/delivery.go
+++ b/services/core/internal/execution/delivery.go
@@ -256,7 +256,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 						return
 					}
 				}
-			case proto.TypePermissionRequest, proto.TypePromptForUserChoice, proto.TypeAuthoringRequest:
+			case proto.TypePermissionRequest, proto.TypePromptForUserChoice:
 				result.ErrorCode = "interaction_not_supported"
 				return
 			}
diff --git a/services/core/internal/execution/directory_preparation.go b/services/core/internal/execution/directory_preparation.go
index 427e400cb..177f98571 100644
--- a/services/core/internal/execution/directory_preparation.go
+++ b/services/core/internal/execution/directory_preparation.go
@@ -25,7 +25,7 @@ func (d *Dispatcher) readPreparedDirectory(ctx context.Context, peer *runtimegat
 }
 
 func (d *Dispatcher) withPreparedWorkspace(owner context.Context, peer *runtimegateway.Session, session sessions.Session, environment sessions.Environment, bound sessions.ExecutionDevice, consume func(context.Context, string) error) error {
-	req := proto.PromptRequestPayload{AgentKind: session.Engine, AgentStateKey: "agents-api-" + session.ID, StrictResume: true, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	req := proto.PromptRequestPayload{AgentKind: session.Engine, AgentStateKey: "agents-api-" + session.ID, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
 	if err := d.configurePreparedEnvironment(session, environment, bound, &req); err != nil {
 		return ErrExecutionUnavailable
 	}
diff --git a/services/core/internal/execution/recovery_test.go b/services/core/internal/execution/recovery_test.go
index e71df9b27..75e798208 100644
--- a/services/core/internal/execution/recovery_test.go
+++ b/services/core/internal/execution/recovery_test.go
@@ -20,7 +20,7 @@ func TestExistingSessionRecoveryRequiresVerifiedCapability(t *testing.T) {
 						}
 						continue
 					}
-					if err != nil || req.RequireExistingNativeSession != wantRecovery || req.AgentSessionID != nativeID || !req.StrictResume || req.AgentStateKey != "agents-api-session" {
+					if err != nil || req.RequireExistingNativeSession != wantRecovery || req.AgentSessionID != nativeID || req.AgentStateKey != "agents-api-session" {
 						t.Fatalf("engine=%s started=%v id=%s capability=%v request=%+v err=%v", engine, started, nativeID, capable, req, err)
 					}
 				}
diff --git a/services/core/internal/execution/request.go b/services/core/internal/execution/request.go
index 82ba8ade8..99b06d1f1 100644
--- a/services/core/internal/execution/request.go
+++ b/services/core/internal/execution/request.go
@@ -54,9 +54,8 @@ func (d *Dispatcher) executionRequest(ctx context.Context, session sessions.Sess
 	}
 	request := proto.PromptRequestPayload{AgentKind: session.Engine, FunctionTools: tools.Functions, ToolSearch: tools.Search,
 		AgentOptions: options, ExecutionControls: controls, AgentStateKey: "agents-api-" + session.ID,
-		AgentSessionID: bound.NativeSessionID, StrictResume: true,
-		RequireExistingNativeSession: recoverNativeSession,
-		ObserveMessages:              caps.MessageItems, ObserveToolObservations: true,
+		AgentSessionID: bound.NativeSessionID, RequireExistingNativeSession: recoverNativeSession,
+		ObserveMessages:           caps.MessageItems,
 		ObserveSubagentIdentities: snapshot.Agent.MultiAgent.Enabled,
 		MaxConcurrentSubagents:    snapshot.Agent.MultiAgent.MaxConcurrentSubagents,
 		DisableSubagents:          !snapshot.Agent.MultiAgent.Enabled}
diff --git a/services/core/internal/runtimedevice/state.go b/services/core/internal/runtimedevice/state.go
index 6bb39ecfa..0d0cf69a0 100644
--- a/services/core/internal/runtimedevice/state.go
+++ b/services/core/internal/runtimedevice/state.go
@@ -91,7 +91,6 @@ type KindCapabilities struct {
 	MCPHTTPBearerAuth    bool `json:"mcp_http_bearer_auth,omitempty"`
 	DurableInputReceipts bool `json:"durable_input_receipts,omitempty"`
 	DurableTurns         bool `json:"durable_turns,omitempty"`
-	WorkspaceAuthoring   bool `json:"workspace_authoring,omitempty"`
 }
 
 // SupportedAgentKind is the sanitized runtime.config view
diff --git a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
index 7a6982fca..8183f6cab 100644
--- a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
+++ b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
@@ -87,7 +87,7 @@ func TestLiveMCPBearerGatewayColdContinuation(t *testing.T) {
 		turn := &mcpBearerTurn{}
 		turns = append(turns, turn)
 		runID := uuid.NewString()
-		request := proto.PromptRequestPayload{AgentKind: "codex", ConversationID: "mcp-bearer-acceptance", RunID: runID, Input: proto.TextInput(prompt), AgentStateKey: "mcp-bearer-acceptance", AgentSessionID: resume, StrictResume: true, ReleaseOnCompletion: true, ObserveMessages: true, ObserveToolObservations: true, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, AgentOptions: map[string]any{"model": "MiniMax-M3"}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
+		request := proto.PromptRequestPayload{AgentKind: "codex", ConversationID: "mcp-bearer-acceptance", RunID: runID, Input: proto.TextInput(prompt), AgentStateKey: "mcp-bearer-acceptance", AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, AgentOptions: map[string]any{"model": "MiniMax-M3"}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
 		sub, err := peer.SubscribeDurable(runID)
 		if err != nil {
 			t.Fatal("cannot subscribe before real daemon dispatch")
diff --git a/services/core/internal/runtimegateway/session.go b/services/core/internal/runtimegateway/session.go
index cb115fedb..7d166ce87 100644
--- a/services/core/internal/runtimegateway/session.go
+++ b/services/core/internal/runtimegateway/session.go
@@ -533,7 +533,6 @@ func deviceKindsFromHeartbeat(p proto.HeartbeatPayload) []runtimedevice.Supporte
 				MCPHTTPTools:                   info.Capabilities.MCPHTTPTools.IsSupported(),
 				MCPHTTPRequired:                info.Capabilities.MCPHTTPRequired.IsSupported(),
 				MCPHTTPBearerAuth:              info.Capabilities.MCPHTTPBearerAuth.IsSupported(),
-				WorkspaceAuthoring:             info.Capabilities.WorkspaceAuthoring.IsSupported(),
 			},
 		})
 	}
diff --git a/services/core/tests/integration/execution_tools_test.go b/services/core/tests/integration/execution_tools_test.go
index d1cd4a85d..77cf4c88f 100644
--- a/services/core/tests/integration/execution_tools_test.go
+++ b/services/core/tests/integration/execution_tools_test.go
@@ -19,8 +19,8 @@ func TestExecutionNegotiatesAndPersistsToolObservations(t *testing.T) {
 	env := h.read(testExecutionRequest)
 	var request proto.PromptRequestPayload
 	_ = env.DecodePayload(&request)
-	if !request.ObserveToolObservations || request.ObserveMessages {
-		t.Fatal("advertised capability was not requested")
+	if request.ObserveMessages {
+		t.Fatal("unadvertised message items were requested")
 	}
 	start := json.RawMessage(`{"kind":"mcp","server":"reference","name":"lookup","arguments":{"key":"value"},"status":"in_progress","output":null,"error":null}`)
 	complete := json.RawMessage(`{"kind":"mcp","server":"reference","name":"lookup","arguments":{"key":"value"},"status":"completed","output":{"content":[{"type":"text","text":"answer"}],"structuredContent":{"version":9007199254740993}},"error":null}`)
diff --git a/services/core/tests/integration/harness_onboarding_test.go b/services/core/tests/integration/harness_onboarding_test.go
index b655f11cb..f60c5342a 100644
--- a/services/core/tests/integration/harness_onboarding_test.go
+++ b/services/core/tests/integration/harness_onboarding_test.go
@@ -117,7 +117,7 @@ func TestThirdHarnessPublicOnboarding(t *testing.T) {
 	}
 	request("POST", "/v1/agents/sessions/"+created.ID+"/events", `{"events":[{"type":"agent.session.input.message","input":[{"role":"user","content":[{"type":"input_text","text":"hold"}]}]}]}`, 202)
 	next := awaitOnboardingPrompt(t, started)
-	if next.RunID == first.RunID || next.AgentSessionID != bound.NativeSessionID || !next.StrictResume {
+	if next.RunID == first.RunID || next.AgentSessionID != bound.NativeSessionID {
 		t.Fatal(next)
 	}
 	request("POST", "/v1/agents/sessions/"+created.ID+"/events", `{"events":[{"type":"agent.session.input.cancel"}]}`, 202)

From 1618d4e6c29f0f348616d44a9f7daf0bdeb804f7 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 16:18:06 +0800
Subject: [PATCH 6/9] fix: make installation retries safe and predictable
 (#470)

* fix: make installation retries safe and predictable

* fix: share installation log cleanup on every retry

* fix: make retry preparation atomic and preserve running images

* fix: complete installer preparation before publishing state

* fix: publish node configuration atomically
---
 apps/web/e2e/nodes.spec.ts                    |   8 +-
 .../src/features/sandbox/NodeEnrollment.tsx   |   2 +-
 .../sandbox/enrollment-command.test.ts        |  56 ++---
 .../features/sandbox/enrollment-command.ts    |  35 ++-
 .../src/features/sandbox/node-enrollment.ts   |   4 +-
 apps/web/src/lib/locale-strings.ts            |   4 +-
 deploy/README.md                              |   2 +
 deploy/install.sh                             | 188 ++++++++++-----
 deploy/node/README.md                         |   8 +-
 deploy/node/distribution.py                   | 159 +++++--------
 deploy/node/node_generations.py               |  32 +--
 deploy/node/node_install.py                   |  78 +++---
 deploy/node/test_distribution.py              |  74 ++++--
 deploy/node/test_node_install.py              |  79 +++++++
 deploy/test_install.py                        | 222 +++++++++++++++++-
 docs/getting-started/install.md               |   8 +-
 docs/getting-started/nodes.md                 |  19 +-
 docs/getting-started/operations.md            |  13 +-
 docs/getting-started/self-hosted.md           |   2 +-
 docs/zh/getting-started/install.md            |  10 +-
 docs/zh/getting-started/nodes.md              |  19 +-
 docs/zh/getting-started/operations.md         |  15 +-
 docs/zh/getting-started/self-hosted.md        |   4 +-
 .../nativeinstaller/assets/bootstrap.ps1      |   4 +-
 .../nativeinstaller/assets/bootstrap.sh       |  11 +-
 .../bootstrap_recovery_test.go                |  61 +++++
 26 files changed, 756 insertions(+), 361 deletions(-)

diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index 721bcf6a0..f404a5de6 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -35,12 +35,12 @@ test("adds a node: host requirements, a root/sudo command, a countdown, the same
   const field = add.getByLabel("One-time enrollment command", { exact: true });
   await expect(field).toHaveValue(/enroll_fixture_/);
   // The token goes on stdin to the checked installer, run with sudo unless the shell is root.
-  await expect(field).toHaveValue(/^ \(umask 077;.*\|\| s=sudo\n/);
-  await expect(field).toHaveValue(/\| \$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$d\/node-install\.pyz" \$\{NO_COLOR\+--no-color\} --enrollment-token-stdin /);
+  await expect(field).toHaveValue(/^ \(umask 077\n/);
+  await expect(field).toHaveValue(/\| \$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$installer" \$\{NO_COLOR\+--no-color\} --enrollment-token-stdin /);
   // It downloads from, and names as its source, the public URL, not the loopback address this browser uses.
   await expect(field).toHaveValue(/curl [^\n]* 'https:\/\/core\.example\.com\/node-install\/node-install\.pyz' /);
   await expect(field).toHaveValue(/ --source-url 'https:\/\/core\.example\.com' --core-url 'https:\/\/core\.example\.com' /);
-  await expect(add.getByText("If the command is interrupted or the download stalls, run the same command again: the download resumes.")).toBeVisible();
+  await expect(add.getByText("If the command is interrupted or the download stalls, run it again: unfinished downloads restart, and verified files are reused.")).toBeVisible();
   await expect(add.getByRole("timer")).toHaveText(/^Expires in (10:00|9:\d\d)$/);
   const progress = add.getByRole("status", { name: "Registration progress" });
   await expect(progress).toHaveText(/Waiting for registration.*Connect.*Docker check/);
@@ -155,7 +155,7 @@ test("removes a node after confirmation", async ({ page, request }) => {
   await expect(page.getByRole("table", { name: "Sandbox nodes" })).not.toContainText("edge-03");
   // Removing the Core record leaves the system service for root/sudo to uninstall on its host.
   const cleanup = page.getByRole("dialog", { name: "Clean up the host" });
-  await expect(cleanup.getByLabel("Uninstall command", { exact: true })).toHaveValue(/\| s=sudo\nexport http_proxy=[^\n]+\nexport HTTP_PROXY=[^\n]+\nprintf '\\n==> Downloading node installer\.\.\.\\n' &&\ncurl [^\n]* 'https:\/\/core\.example\.com\/node-install\/node-install\.pyz' [^]*\n\$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$d\/node-install\.pyz" \$\{NO_COLOR\+--no-color\} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
+  await expect(cleanup.getByLabel("Uninstall command", { exact: true })).toHaveValue(/\| s=sudo\nexport http_proxy=[^\n]+\nexport HTTP_PROXY=[^\n]+\nprintf '\\n==> Downloading node installer\.\.\.\\n' &&\ncurl [^\n]* 'https:\/\/core\.example\.com\/node-install\/node-install\.pyz' [^]*\n\$s \$\{s:\+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY\} python3 "\$installer" \$\{NO_COLOR\+--no-color\} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f'\)$/);
   await expect(cleanup.getByText("Installed without sudo?")).toHaveCount(0);
   await expect(cleanup.getByLabel("Uninstall command without sudo", { exact: true })).toHaveCount(0);
   // Nothing to force for a node on the current address; closing leaves focus on the page, as the row is gone.
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index 2ffc21f72..8bcc30e87 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -293,7 +293,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
         {command ? <CommandBlock key={command} value={command} label={t("One-time enrollment command")} autoFocus
           extra={!registered ? <span className="sandbox-command-expiry" role="timer" title={new Date(enrollment.expires_at).toLocaleString(locale)}>{t("Expires in {{time}}", { time: formatCountdown(Date.parse(enrollment.expires_at) - now) })}</span> : null} /> : null}
         {/* The installer keeps partial downloads and exits 130 on Ctrl-C; the token lasts until the countdown ends. */}
-        {command ? <p className="sandbox-command-note">{t("If the command is interrupted or the download stalls, run the same command again: the download resumes.")}</p> : null}
+        {command ? <p className="sandbox-command-note">{t("If the command is interrupted or the download stalls, run it again: unfinished downloads restart, and verified files are reused.")}</p> : null}
         {/* One live region for the whole flow; only its contents change, so each change is announced. */}
         <div role="status" aria-label={t("Registration progress")}>
           {ready && node ? <div className="sandbox-enrollment-status connected"><span className="sandbox-status-dot" />{t("{{name}} · Connected", { name: node.name })}</div>
diff --git a/apps/web/src/features/sandbox/enrollment-command.test.ts b/apps/web/src/features/sandbox/enrollment-command.test.ts
index 180c4e1b9..d0d1a2405 100644
--- a/apps/web/src/features/sandbox/enrollment-command.test.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.test.ts
@@ -7,37 +7,12 @@ import { join } from "node:path";
 import { nodeInstallCommand, nodeLogCommand, nodeUninstallCommand } from "./enrollment-command";
 
 describe("sandbox connection and enrollment", () => {
-  const digest = "a".repeat(64);
-  const install = () => nodeInstallCommand({ token: "secret'onetime", coreUrl: "https://core.example", sourceUrl: "https://console.example", provider: "docker", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest });
-  it("creates the exact sudo command: a leading space, the checked installer run as root, the token only on stdin", () => {
-    expect(install()).toBe(` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-export http_proxy="\${http_proxy-\${HTTP_PROXY-}}" https_proxy="\${https_proxy-\${HTTPS_PROXY-}}" no_proxy="\${no_proxy-\${NO_PROXY-}}"
-export HTTP_PROXY="$http_proxy" HTTPS_PROXY="$https_proxy" NO_PROXY="$no_proxy"
-printf '\\n==> Downloading node installer...\\n' &&
-curl -fs --max-time 30 --max-filesize 1048576 'https://console.example/node-install/node-install.pyz' -o "$d/node-install.pyz" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
-printf '==> Verifying node installer...\\n' &&
-printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
-printf '%s\\n' 'secret'\\''onetime' | $s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color} --enrollment-token-stdin --source-url 'https://console.example' --core-url 'https://core.example' --provider 'docker' --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
-  });
-  it("creates the exact uninstall commands, with no token", () => {
-    const uninstall = () => nodeUninstallCommand({ sourceUrl: "https://console.example", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest });
-    expect(uninstall()).toBe(` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-export http_proxy="\${http_proxy-\${HTTP_PROXY-}}" https_proxy="\${https_proxy-\${HTTPS_PROXY-}}" no_proxy="\${no_proxy-\${NO_PROXY-}}"
-export HTTP_PROXY="$http_proxy" HTTPS_PROXY="$https_proxy" NO_PROXY="$no_proxy"
-printf '\\n==> Downloading node installer...\\n' &&
-curl -fs --max-time 30 --max-filesize 1048576 'https://console.example/node-install/node-install.pyz' -o "$d/node-install.pyz" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
-printf '==> Verifying node installer...\\n' &&
-printf '%s  %s\\n' '${digest}' "$d/node-install.pyz" | sha256sum -c --status &&
-$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f')`);
-    expect(nodeUninstallCommand({ sourceUrl: "https://console.example", installationId: "7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f", scriptDigest: digest, force: true }).split("\n").at(-1))
-      .toBe(`$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color} --uninstall --installation-id '7f3c2a90-5b1e-4c2d-9e3f-0a1b2c3d4e5f' --force)`);
-  });
   it("points at the system node journal", () => {
     expect(nodeLogCommand("7f3c2a90-fixture")).toBe("sudo journalctl -u oac-node-7f3c2a90-fixture.service");
     expect(nodeLogCommand("a b")).toBe("sudo journalctl -u 'oac-node-a b.service'");
   });
   // "as root": a root shell runs the sudo command without sudo.
-  it.each(["success", "download failure", "checksum mismatch", "installer failure", "as root", "no color", "uppercase proxy", "lowercase proxy", "empty proxy", "root proxy"])("executes safely, passes the token only on stdin and cleans private downloads after %s", (scenario) => {
+  it.each(["success", "download failure", "checksum mismatch", "installer failure", "as root", "no color", "uppercase proxy", "lowercase proxy", "empty proxy", "root proxy", "unsupported platform", "old python", "uninstall", "killed download"])("executes safely, passes the token only on stdin and cleans private downloads after %s", (scenario) => {
     const parent = join(homedir(), ".oac", "tests");
     mkdirSync(parent, { recursive: true });
     const root = mkdtempSync(join(parent, "node-command-"));
@@ -55,12 +30,15 @@ $s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,N
 if(process.env.SCENARIO==='download failure') process.exit(22);
 const args=process.argv.slice(2);
 if(args.includes('-L')||args.includes('--location')||args.includes('--insecure')) process.exit(90);
-fs.writeFileSync(args[args.indexOf('-o')+1],fs.readFileSync(process.env.FIXTURE));`);
+fs.writeFileSync(args[args.indexOf('-o')+1],fs.readFileSync(process.env.FIXTURE));
+if(process.env.SCENARIO==='killed download') process.kill(process.ppid,'SIGKILL');`);
     executable("sha256sum", `const fs=require('node:fs'), crypto=require('node:crypto');
 const line=fs.readFileSync(0,'utf8').trimEnd(), split=line.indexOf('  ');
 if(split!==64) process.exit(2);
 const actual=crypto.createHash('sha256').update(fs.readFileSync(line.slice(split+2))).digest('hex');
 process.exit(actual===line.slice(0,split)?0:1);`);
+    executable("flock", `process.exit(0);`);
+    executable("uname", `console.log(process.argv[2]==='-s'?(process.env.SCENARIO==='unsupported platform'?'Darwin':'Linux'):'x86_64');`);
     executable("id", `console.log((process.env.SCENARIO==='as root'||process.env.SCENARIO==='root proxy')?'0':'1000');`);
     // The shell's builtin printf feeds the token; an external one would put it in an argv.
     executable("printf", `require('node:fs').appendFileSync(process.env.PRINTF_REPORT,'called\\n');`);
@@ -71,19 +49,34 @@ const env={...process.env}; delete env.NO_COLOR;
 for(const key of Object.keys(env)) if(/_proxy$/i.test(key)&&!keep.includes(key)) delete env[key];
 process.exit(spawnSync(args[0],args.slice(1),{stdio:'inherit',env}).status ?? 1);`);
     executable("python3", `const fs=require('node:fs');
+if(process.argv[2]==='-c') process.exit(process.env.SCENARIO==='old python'?1:0);
 const stdin=fs.readFileSync(0,'utf8');
 fs.writeFileSync(process.env.REPORT,JSON.stringify({args:process.argv.slice(2),env:process.env,stdin,mode:fs.statSync(process.argv[2]).mode&511}));
 process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
     const digest = scenario === "checksum mismatch" ? "0".repeat(64) : createHash("sha256").update(payload).digest("hex");
     const token = "fixture'one-time";
     try {
-      const command = nodeInstallCommand({ token, coreUrl: "http://127.0.0.1:8091", sourceUrl: "http://localhost:8080", provider: "docker", installationId: "fixture-installation", scriptDigest: digest });
+      const command = scenario === "uninstall" ? nodeUninstallCommand({ sourceUrl: "http://localhost:8080", installationId: "fixture-installation", scriptDigest: digest }) : nodeInstallCommand({ token, coreUrl: "http://127.0.0.1:8091", sourceUrl: "http://localhost:8080", provider: "docker", installationId: "fixture-installation", scriptDigest: digest });
       const proxy = "http://fixture:private%20password@proxy.example:3128";
       const proxyEnv: Record<string, string | undefined> = { http_proxy: undefined, https_proxy: undefined, no_proxy: undefined, HTTP_PROXY: undefined, HTTPS_PROXY: undefined, NO_PROXY: undefined, ALL_PROXY: undefined };
       if (["uppercase proxy", "root proxy", "empty proxy"].includes(scenario)) Object.assign(proxyEnv, { HTTP_PROXY: proxy, HTTPS_PROXY: proxy, NO_PROXY: "core.example,localhost" });
       if (scenario === "lowercase proxy") Object.assign(proxyEnv, { http_proxy: proxy, https_proxy: proxy, no_proxy: "core.example,localhost", HTTP_PROXY: "http://wrong.invalid" });
       if (scenario === "empty proxy") proxyEnv.http_proxy = "";
-      const result = spawnSync("sh", ["-c", command], { env: { ...process.env, ...proxyEnv, NO_COLOR: scenario === "no color" ? "" : undefined, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report, SUDO_REPORT: sudoReport, PRINTF_REPORT: printfReport }, encoding: "utf8" });
+      const options = { env: { ...process.env, ...proxyEnv, HOME: root, NO_COLOR: scenario === "no color" ? "" : undefined, PATH: `${bin}:${process.env.PATH}`, TMPDIR: temporary, SCENARIO: scenario, FIXTURE: fixture, REPORT: report, SUDO_REPORT: sudoReport, PRINTF_REPORT: printfReport }, encoding: "utf8" as const };
+      let result = spawnSync("sh", ["-c", command], options);
+      if (scenario === "killed download") {
+        expect(result.signal === "SIGKILL" || result.status === 137).toBe(true);
+        expect(readdirSync(join(root, ".oac/node-bootstrap"))).toContain("download.partial");
+        result = spawnSync("sh", ["-c", command], { ...options, env: { ...options.env, SCENARIO: "success" } });
+      }
+      if (["unsupported platform", "old python"].includes(scenario)) {
+        expect(result.status).toBe(1);
+        expect(result.stdout).not.toContain("Downloading");
+        expect(result.stderr).toContain(scenario === "old python" ? "Python 3.9" : "Linux amd64");
+        expect(readdirSync(root)).not.toContain("report.json");
+        expect(readdirSync(temporary)).toEqual([]);
+        return;
+      }
       expect(result.status).toBe(scenario === "installer failure" ? 7 : scenario === "download failure" ? 22 : scenario === "checksum mismatch" ? 1 : 0);
       expect(result.stdout).toContain("==> Downloading node installer...");
       expect(result.stdout.includes("==> Verifying node installer...")).toBe(scenario !== "download failure");
@@ -91,6 +84,7 @@ process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
       expect(result.stdout + result.stderr).not.toContain("private%20password");
       expect(result.stdout + result.stderr).not.toContain("\u001b[");
       expect(readdirSync(temporary)).toEqual([]);
+      expect(readdirSync(join(root, ".oac/node-bootstrap"))).not.toContain("download.partial");
       expect(readdirSync(root)).not.toContain("printf.log");
       if (scenario === "download failure" || scenario === "checksum mismatch") {
         expect(readdirSync(root)).not.toContain("report.json");
@@ -106,10 +100,10 @@ process.exit(process.env.SCENARIO==='installer failure'?7:0);`);
         expect(invocation.env[key]).toBe(expected);
         expect(invocation.env[key.toUpperCase()]).toBe(expected);
       }
-      expect(invocation.stdin).toBe(`${token}\n`);
+      expect(invocation.stdin).toBe(scenario === "uninstall" ? "" : `${token}\n`);
       expect(invocation.args.some((arg) => arg.includes("one-time"))).toBe(false);
       expect(Object.values(invocation.env).some((value) => value.includes("one-time"))).toBe(false);
-      expect(invocation.args.slice(1)).toEqual([...(scenario === "no color" ? ["--no-color"] : []), "--enrollment-token-stdin", "--source-url", "http://localhost:8080", "--core-url", "http://127.0.0.1:8091", "--provider", "docker", "--installation-id", "fixture-installation"]);
+      expect(invocation.args.slice(1)).toEqual(scenario === "uninstall" ? ["--uninstall", "--installation-id", "fixture-installation"] : [...(scenario === "no color" ? ["--no-color"] : []), "--enrollment-token-stdin", "--source-url", "http://localhost:8080", "--core-url", "http://127.0.0.1:8091", "--provider", "docker", "--installation-id", "fixture-installation"]);
       expect(invocation.mode & 0o077).toBe(0);
       if (scenario === "as root" || scenario === "root proxy") {
         expect(readdirSync(root)).not.toContain("sudo.json");
diff --git a/apps/web/src/features/sandbox/enrollment-command.ts b/apps/web/src/features/sandbox/enrollment-command.ts
index f67f7d301..2663c1792 100644
--- a/apps/web/src/features/sandbox/enrollment-command.ts
+++ b/apps/web/src/features/sandbox/enrollment-command.ts
@@ -1,26 +1,41 @@
 const quote = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
 
 /**
- * The start the node commands share: a private directory removed on exit, then
- * the console's installer, checked against its digest before anything runs. The
- * leading space keeps the command out of shell history under
- * HISTCONTROL=ignorespace. In sudo mode `s` is set before the `&&` chain, so a
- * failed download or check stops the command. It ends where the installer's own
- * line begins.
+ * Download and verify into an immutable cache entry before invoking sudo.
+ * The download lock protects disposable files; verified entries remain usable
+ * by other running installers. A leading space supports HISTCONTROL=ignorespace.
  */
 function nodeInstaller(sourceUrl: string, scriptDigest: string): string {
-  return ` (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
+  if (!/^[0-9a-f]{64}$/.test(scriptDigest)) throw new Error("Invalid node installer checksum");
+  return ` (umask 077
+[ "$(uname -s)/$(uname -m)" = Linux/x86_64 ] || { printf 'Node installation requires Linux amd64. Use a Linux host for Nodes, or a self-hosted Session for this machine.\\n' >&2; exit 1; }
+for tool in curl sha256sum python3 flock; do command -v "$tool" >/dev/null || { printf 'Required command missing: %s. Install it and rerun.\\n' "$tool" >&2; exit 1; }; done
+python3 -c 'import sys; sys.exit(sys.version_info < (3, 9))' || { printf 'Python 3.9 or newer is required.\\n' >&2; exit 1; }
+[ "$(id -u)" -eq 0 ] || command -v sudo >/dev/null || { printf 'sudo is required; ask the host administrator to run this command.\\n' >&2; exit 1; }
+d="$HOME/.oac/node-bootstrap"
+[ ! -L "$d" ] && mkdir -p "$d" && [ -d "$d" ] && [ -O "$d" ] && chmod 700 "$d" || { printf 'Cannot use the private node bootstrap directory.\\n' >&2; exit 1; }
+installer="$d"/${quote(scriptDigest + ".pyz")}
+for f in "$d/download.lock" "$d/download.partial" "$installer"; do [ ! -L "$f" ] && { [ ! -e "$f" ] || { [ -f "$f" ] && [ -O "$f" ]; }; } || { printf 'Invalid node bootstrap file.\\n' >&2; exit 1; }; done
+exec 9>>"$d/download.lock"
+flock -n 9 || { printf 'Another node download is running; wait and retry.\\n' >&2; exit 1; }
+rm -f "$d/download.partial" || exit
+trap 'rm -f "$d/download.partial"' EXIT
+s=; [ "$(id -u)" -eq 0 ] || s=sudo
 export http_proxy="\${http_proxy-\${HTTP_PROXY-}}" https_proxy="\${https_proxy-\${HTTPS_PROXY-}}" no_proxy="\${no_proxy-\${NO_PROXY-}}"
 export HTTP_PROXY="$http_proxy" HTTPS_PROXY="$https_proxy" NO_PROXY="$no_proxy"
 printf '\\n==> Downloading node installer...\\n' &&
-curl -fs --max-time 30 --max-filesize 1048576 ${quote(sourceUrl + "/node-install/node-install.pyz")} -o "$d/node-install.pyz" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
+curl -fs --connect-timeout 15 --max-time 60 --retry 2 --retry-connrefused --retry-delay 1 --max-filesize 1048576 ${quote(sourceUrl + "/node-install/node-install.pyz")} -o "$d/download.partial" || { c=$?; printf 'Cannot download node installer; check the console URL, TLS and proxy settings.\\n' >&2; exit "$c"; }
 printf '==> Verifying node installer...\\n' &&
-printf '%s  %s\\n' ${quote(scriptDigest)} "$d/node-install.pyz" | sha256sum -c --status &&
+printf '%s  %s\\n' ${quote(scriptDigest)} "$d/download.partial" | sha256sum -c --status || { printf 'Node installer checksum mismatch; generate a fresh command in Web and retry.\\n' >&2; exit 1; }
+mv "$d/download.partial" "$installer" || exit
+trap - EXIT
+flock -u 9
+exec 9>&-
 `;
 }
 
 /** Runs the downloaded installer, as root in sudo mode. */
-const runInstaller = `$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$d/node-install.pyz" \${NO_COLOR+--no-color}`;
+const runInstaller = `$s \${s:+--preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY} python3 "$installer" \${NO_COLOR+--no-color}`;
 
 /**
  * Adds this host as a node. The one-time token reaches the installer only on
diff --git a/apps/web/src/features/sandbox/node-enrollment.ts b/apps/web/src/features/sandbox/node-enrollment.ts
index 49f7666e4..7e2f6678a 100644
--- a/apps/web/src/features/sandbox/node-enrollment.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.ts
@@ -18,7 +18,7 @@ export interface HostPrerequisite {
  * What a host needs for the default command, which runs the installer as root
  * and the node as the `oac-node` system service (sudo mode), as the command
  * and deploy/node/node_install.py check it:
- * - the command runs curl, sha256sum and python3 (enrollment-command.ts), and
+ * - the command runs curl, sha256sum, flock and python3 (enrollment-command.ts), and
  *   `sudo` unless the shell is root; `host_checks` needs Python 3.9+, Linux amd64,
  *   systemd as the init system, and SELinux not enforcing; `other_node` refuses a
  *   host that already runs a sudo-mode node for another installation, since
@@ -42,7 +42,7 @@ export interface HostPrerequisite {
  */
 export function hostRequirements(provider: "docker" | "microsandbox", sized: boolean): HostPrerequisite[] {
   return [
-    { label: "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo" },
+    { label: "Linux amd64 with systemd; Python 3.9+, curl, sha256sum and flock; root or sudo" },
     { label: "SELinux is not enforcing" },
     { label: "In sudo mode, one Core per host: a host already running a sudo-mode node for another Core is refused." },
     provider === "docker"
diff --git a/apps/web/src/lib/locale-strings.ts b/apps/web/src/lib/locale-strings.ts
index 8e98ba65c..a9e7a6171 100644
--- a/apps/web/src/lib/locale-strings.ts
+++ b/apps/web/src/lib/locale-strings.ts
@@ -143,10 +143,10 @@ export const chinese = {
   "Change limits": "修改上限",
   "Add another node": "添加另一个节点",
   "Host requirements": "主机要求",
-  "Linux amd64 with systemd; Python 3.9+, curl and sha256sum; root or sudo": "Linux amd64，使用 systemd；装有 Python 3.9+、curl 和 sha256sum；有 root 或 sudo 权限",
+  "Linux amd64 with systemd; Python 3.9+, curl, sha256sum and flock; root or sudo": "Linux amd64，使用 systemd；装有 Python 3.9+、curl、sha256sum 和 flock；有 root 或 sudo 权限",
   "SELinux is not enforcing": "SELinux 不是 enforcing 模式",
   "In sudo mode, one Core per host: a host already running a sudo-mode node for another Core is refused.": "sudo 模式下，每台主机只能接入一个 Core：已为其他 Core 运行 sudo 模式节点的主机会被拒绝。",
-  "If the command is interrupted or the download stalls, run the same command again: the download resumes.": "如果命令被中断或下载卡住，重新运行同一条命令即可，下载会接着进行。",
+  "If the command is interrupted or the download stalls, run it again: unfinished downloads restart, and verified files are reused.": "如果命令被中断或下载卡住，重新运行即可：未完成的下载会从头开始，已校验的完整文件会复用。",
   "Rootful Docker Engine running, its socket owned by the docker group with mode 0660, enforcing CPU and memory limits (cgroup v2)": "Docker Engine 以 rootful 模式运行，套接字属于 docker 组、权限 0660，且能限制 CPU 和内存（cgroup v2）",
   "/dev/kvm in the kvm group (hardware or nested virtualization) and the libraries microsandbox links (glibc)": "属于 kvm 组的 /dev/kvm（硬件或嵌套虚拟化），以及 microsandbox 链接的库（glibc）",
   "Copy command with --force": "复制命令（--force）",
diff --git a/deploy/README.md b/deploy/README.md
index 5324b60ee..716971334 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -11,6 +11,8 @@
 
 `install.sh` downloads its release's `compose.yaml`, checks it against `compose-sha256sums.txt`, writes `.env`, and starts Compose. Core applies database migrations when it starts. The host needs Linux amd64 and Docker Compose 2.26 or newer. [Configuration](../docs/configuration.md) owns the installation layout and settings.
 
+The Core installer validates downloads and Compose in the private sibling `<install-dir>.staging` directory, and pulls all images before publishing the installation directory. A retry clears leftover staging only when its atomically created ownership link names this installation, including after the previous process was killed. An unrecognized nonempty staging directory is preserved. The staging log moves with the configuration and is removed on normal exit. Once published, failures retain configuration, containers and data. A retry verifies and starts that saved installation without replacing its Compose file, cached images or existing containers. Missing images are downloaded explicitly; Compose never pulls images implicitly. It refuses unrelated nonempty directories. `<install-dir>.install.lock` serializes directory preparation; `.oac.lock` serializes service changes with mutating `oac` commands. Both lock files remain after exit. Download failures have bounded retries and timeouts; service startup failures print Compose status and recent logs.
+
 `oac` is a Go command (`services/core/cmd/oac`) in the Core image and the ingress image. The host copy implements `apply`, `core-key` and `rotate-core-key`; `core-key --show` runs `oac-web core-key` in the Web container. Start, stop, logs and removal are `docker compose`. `apply` runs `oac-core check-config` before recreating services. The ingress image runs data initialization as `oac init`, verifies and copies its bundled node metadata without network access, and contains no Python. No service receives a Docker socket. Initialization writes structured logs to stderr for directory preparation, lock acquisition, existing-installation verification, bundled metadata verification and publication, credential generation or reuse, and receipt persistence. Each step records its start and completion; failures identify the current step, and completion records elapsed milliseconds. Credential values and digests are never logged. View these logs with `docker compose logs --timestamps init`.
 
 Web serves the console and forwards `/v1` and `/api/v1` to Core, so it is the only published service. HTTPS is terminated by the operator's reverse proxy or hosting platform, which routes to `web:8080`; `OAC_PUBLIC_URL` records that origin.
diff --git a/deploy/install.sh b/deploy/install.sh
index f862fb282..3746122fd 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -8,7 +8,8 @@ install_dir="${OAC_INSTALL_DIR_DEFAULT:-$HOME/.oac/core}"
 public_url=""
 host_address="0.0.0.0"
 web_port="8080"
-kept=0
+stage=""
+published=0
 
 usage() {
   cat <<'EOF'
@@ -38,23 +39,76 @@ if [[ "$(uname -s)" != Linux || "$(uname -m)" != x86_64 ]]; then
   echo "Core installs on Linux amd64." >&2
   exit 1
 fi
-command -v docker >/dev/null || { echo "Docker Engine with Compose 2.26 or newer is required." >&2; exit 1; }
-command -v curl >/dev/null || { echo "curl is required." >&2; exit 1; }
+fail() { printf '%s\n' "$*" >&2; exit 1; }
+for tool in docker curl sha256sum flock readlink od sed awk grep; do
+  command -v "$tool" >/dev/null || fail "Required command missing: $tool. Install it and rerun this command. Docker needs Compose 2.26 or newer."
+done
 compose_version="$(docker compose version --short 2>/dev/null | sed 's/^v//' || true)"
 major="${compose_version%%.*}"
 minor="${compose_version#*.}"
 minor="${minor%%.*}"
 if [[ ! "$major" =~ ^[0-9]+$ || ! "$minor" =~ ^[0-9]+$ ]] || (( major < 2 || (major == 2 && minor < 26) )); then
-  echo "Docker Compose 2.26 or newer is required (found ${compose_version:-none})." >&2
-  exit 1
+  fail "Docker Compose 2.26 or newer is required (found ${compose_version:-none})."
 fi
-if [[ "$install_dir" != /* ]]; then
-  echo "--install-dir must be absolute." >&2
-  exit 1
+docker info >/dev/null 2>&1 || fail "Cannot reach Docker. Start Docker and check this account's access, then rerun."
+[[ "$install_dir" == /* && "$install_dir" != / ]] || fail "--install-dir must be an absolute directory other than /."
+# These values are written as literal dotenv strings, never shell commands.
+for value in "$install_dir" "$public_url" "$host_address" "$version"; do
+  [[ "$value" != *$'\n'* && "$value" != *$'\r'* && "$value" != *"'"* && "$value" != *\\* ]] || fail "Installation options cannot contain newlines, quotes or backslashes."
+done
+[[ "$web_port" =~ ^[0-9]{1,5}$ ]] && (( 10#$web_port >= 1 && 10#$web_port <= 65535 )) || fail "--web-port must be between 1 and 65535."
+[[ ! -L "$install_dir" ]] || fail "Installation directory must not be a symbolic link."
+[[ ! -e "$install_dir" || -d "$install_dir" ]] || fail "Installation path must be a directory."
+case "$(basename "$install_dir")" in .|..) fail "--install-dir must name the installation directory, not . or ...";; esac
+umask 077
+parent="$(dirname "$install_dir")"
+mkdir -p "$parent"
+parent="$(cd "$parent" && pwd -P)"
+install_dir="$parent/$(basename "$install_dir")"
+lock="$install_dir.install.lock"
+[[ ! -L "$lock" && ( ! -e "$lock" || ( -f "$lock" && -O "$lock" ) ) ]] || fail "Invalid installation lock: $lock"
+exec 9>>"$lock"
+flock -n 9 || fail "Another installation is using this directory. Wait for it to finish and rerun."
+stage="$install_dir.staging"
+[[ ! -L "$stage" && ( ! -e "$stage" || ( -d "$stage" && -O "$stage" ) ) ]] || fail "Invalid installation staging directory: $stage"
+if [[ -d "$stage" && -n "$(ls -A "$stage")" ]]; then
+  [[ -L "$stage/.oac-installer" && "$(readlink "$stage/.oac-installer")" == "$install_dir" ]] || fail "Unrecognized staging directory; preserve it and choose another --install-dir: $stage"
 fi
-if [[ -e "$install_dir" ]] && [[ -n "$(ls -A "$install_dir" 2>/dev/null || true)" ]]; then
-  echo "Installation directory is not empty: $install_dir" >&2
-  exit 1
+rm -rf "$stage"
+mkdir "$stage"
+ln -s "$install_dir" "$stage/.oac-installer"
+log="$stage/install.log"
+: >"$log"
+cleanup() {
+  local status=$?
+  trap - EXIT
+  if [[ "$status" != 0 && "$published" == 1 ]]; then
+    printf '\nInstallation and data retained at %s.\n' "$install_dir" >&2
+    (cd "$install_dir" && docker compose ps --all && docker compose logs --no-color --tail 50) >&2 || true
+    printf 'Fix the reported problem, then rerun install.sh --install-dir %q.\n' "$install_dir" >&2
+  fi
+  [[ -z "$stage" ]] || rm -rf "$stage"
+  rm -f "$log"
+  exit "$status"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM HUP
+
+# step DESCRIPTION COMMAND... prints the command's output only when it fails.
+step() {
+  printf '%s... ' "$1"
+  shift
+  if "$@" >"$log" 2>&1; then echo done; else echo failed; cat "$log" >&2; return 1; fi
+}
+
+resume=0
+if [[ -e "$install_dir" && -n "$(ls -A "$install_dir")" ]]; then
+  for file in compose.yaml compose-sha256sums.txt .env; do
+    [[ -f "$install_dir/$file" && ! -L "$install_dir/$file" ]] || fail "Directory is not a complete Core installation: $install_dir. Preserve it and choose another directory."
+  done
+  resume=1
+  published=1
 fi
 
 port_busy() {
@@ -67,37 +121,15 @@ port_busy() {
   fi
   (echo >/dev/tcp/127.0.0.1/"$port") >/dev/null 2>&1
 }
-if port_busy "$web_port"; then echo "Port $web_port is already in use." >&2; exit 1; fi
+if [[ "$resume" == 0 ]] && port_busy "$web_port"; then fail "Port $web_port is already in use. Choose another with --web-port."; fi
 asset_base="https://github.com/${repository}/releases/latest/download"
 if [[ "$version" != latest ]]; then
   asset_base="https://github.com/${repository}/releases/download/${version}"
 fi
 
-log="$(mktemp)"
-cleanup() {
-  if [[ "$kept" != 1 && -d "$install_dir" ]]; then
-    (
-      cd "$install_dir"
-      docker compose logs --no-color --tail 50 >&2 || true
-      docker compose down --remove-orphans
-      # Containers own data/; remove it from a container as well.
-      if [[ -d data ]]; then docker compose run --rm --no-deps --volume "$install_dir/data:/data" --entrypoint find database /data -mindepth 1 -delete; fi
-    ) >/dev/null 2>&1 || true
-    rm -rf "$install_dir"
-  fi
-  rm -f "$log"
-}
-trap cleanup EXIT
-
-# step DESCRIPTION COMMAND... prints the command's output only when it fails.
-step() {
-  printf '%s... ' "$1"
-  shift
-  if "$@" >"$log" 2>&1; then echo done; else echo failed; cat "$log" >&2; return 1; fi
-}
-
 # The source address of this host's default route, when it is a private one.
 private_address() {
+  command -v ip >/dev/null || return 0
   ip -4 route get 1.1.1.1 2>/dev/null | sed -n 's/.* src \([0-9.]*\).*/\1/p' |
     grep -E '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' || true
 }
@@ -108,30 +140,70 @@ if [[ -z "$public_url" && "$host_address" == 0.0.0.0 ]]; then
 fi
 if [[ -z "$public_url" ]]; then public_url="http://localhost:$web_port"; local_only=1; fi
 
-mkdir -p "$install_dir"
-chmod 700 "$install_dir"
-curl --fail --silent --show-error --location "$asset_base/compose-sha256sums.txt" --output "$install_dir/compose-sha256sums.txt"
-curl --fail --silent --show-error --location "$asset_base/compose.yaml" --output "$install_dir/compose.yaml"
-(cd "$install_dir" && sha256sum --check --quiet compose-sha256sums.txt)
+if [[ "$resume" == 0 ]]; then
+  # Prepare configuration privately until downloads and image pulls succeed.
+  # Before publication only this invocation's private staging directory is removed.
+  download() {
+    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
+      --connect-timeout 15 --max-time 120 --retry 2 --retry-connrefused --retry-delay 1 \
+      --max-filesize 1048576 "$asset_base/$1" --output "$stage/$1"
+  }
+  step "Downloading release checksums" download compose-sha256sums.txt
+  step "Downloading Compose configuration" download compose.yaml
+  {
+    echo "COMPOSE_PROJECT_NAME=oac-$(od -An -N5 -tx1 /dev/urandom | tr -d ' \n')"
+    printf "OAC_INSTALL_DIR='%s'\nOAC_HOST='%s'\nOAC_WEB_PORT='%s'\nOAC_PUBLIC_URL='%s'\n" "$install_dir" "$host_address" "$web_port" "$public_url"
+  } >"$stage/.env"
+fi
 
-umask 077
-{
-  echo "COMPOSE_PROJECT_NAME=oac-$(od -An -N5 -tx1 /dev/urandom | tr -d ' \n')"
-  echo "OAC_INSTALL_DIR=$install_dir"
-  echo "OAC_HOST=$host_address"
-  echo "OAC_WEB_PORT=$web_port"
-  echo "OAC_PUBLIC_URL=$public_url"
-} >"$install_dir/.env"
-
-cd "$install_dir"
-copy_cli() { docker compose create core && docker compose cp core:/usr/local/bin/oac ./oac; }
-step "Pulling images" docker compose pull
-step "Installing the oac command" copy_cli
-step "Starting services" docker compose up -d --wait
-key="$(./oac core-key --show)"
-kept=1
-trap - EXIT
-rm -f "$log"
+if [[ "$resume" == 0 ]]; then cd "$stage"; else cd "$install_dir"; fi
+[[ ! -L .oac.lock && ( ! -e .oac.lock || ( -f .oac.lock && -O .oac.lock ) ) ]] || fail "Invalid installation lock: $install_dir/.oac.lock"
+exec 8>>.oac.lock
+flock -n 8 || fail "Another oac command is using this installation. Wait for it to finish and rerun."
+[[ ! -L install.log && ( ! -e install.log || ( -f install.log && -O install.log ) ) ]] || fail "Invalid installation log: $install_dir/install.log"
+log="$PWD/install.log"
+: >"$log"
+step "Verifying saved configuration" sha256sum --check --quiet compose-sha256sums.txt
+step "Checking Compose configuration" docker compose config --quiet
+if [[ "$resume" == 1 ]]; then
+  printf 'Using saved settings from .env; installation flags only apply to new directories. Existing data is preserved.\n'
+fi
+public_url="$(docker compose config --environment | sed -n 's/^OAC_PUBLIC_URL=//p')"
+local_only=0
+[[ "$public_url" != http://localhost:* && "$public_url" != http://127.0.0.1:* ]] || local_only=1
+pull_images() {
+  local images image
+  images="$(docker compose config --images)" || return
+  while IFS= read -r image; do
+    [[ -n "$image" ]] || continue
+    if [[ "$resume" == 0 ]] || ! docker image inspect "$image" >/dev/null 2>&1; then
+      docker pull --platform linux/amd64 "$image" || return
+    fi
+  done <<<"$images"
+}
+step "Checking and downloading images" pull_images
+if [[ "$resume" == 0 ]]; then
+  # An existing empty directory may be replaced, never a directory with user data.
+  if [[ -e "$install_dir" ]]; then rmdir "$install_dir"; fi
+  mv "$stage" "$install_dir"
+  stage=""
+  cd "$install_dir"
+  log="$install_dir/install.log"
+  published=1
+fi
+rm -f .oac-installer
+copy_cli() (
+  [[ ! -L ./oac.download ]] || fail "Temporary oac command must not be a symbolic link."
+  trap 'rm -f ./oac.download' EXIT
+  docker compose create --pull never --no-recreate core &&
+    docker compose cp core:/usr/local/bin/oac ./oac.download &&
+    mv ./oac.download ./oac
+)
+if [[ ! -x ./oac ]]; then step "Installing the oac command" copy_cli; fi
+step "Starting services" docker compose up -d --wait --wait-timeout 180 --pull never --no-recreate
+if ! key="$(./oac core-key --show)"; then
+  fail "Services started, but the Core key could not be read. Inspect Web's logs and retry; data is preserved."
+fi
 
 sudo=""
 if [[ "$EUID" == 0 && -n "${SUDO_USER:-}" ]]; then sudo="sudo "; fi
diff --git a/deploy/node/README.md b/deploy/node/README.md
index 0cd68fb95..74814031c 100644
--- a/deploy/node/README.md
+++ b/deploy/node/README.md
@@ -5,7 +5,7 @@ These modules are packaged as `node-install.pyz`, which Web serves at `/node-ins
 | Module | Role |
 | --- | --- |
 | `node_install.py`, `node_spec.py`, `node_generations.py` | Node installer and generation helper. `node_spec.py` is generated by `go run ./services/core/cmd/specification-contract -write` |
-| `distribution.py` | Checksums, release metadata and Docker image identity |
+| `distribution.py` | Verified artifacts, private temporary files, release metadata and Docker image identity |
 | `install_display.py`, `node_output.py` | Terminal output |
 | `provider_assets.py` | Node provider artifact names, generated by `go run ./services/core/cmd/provider-artifacts` |
 | `node_payload.py` | Publish a release's node files without replacing bytes already installed |
@@ -27,12 +27,16 @@ The node installer runs as root and prepares the host for one node per installat
 
 ## Download contract
 
+The generated command uses `~/.oac/node-bootstrap` in the invoking account's home. Under `download.lock`, it discards an unfinished `download.partial`, downloads and verifies the bootstrap, then publishes `<sha256>.pyz`. The lock is released before invoking sudo; verified files stay available to running installers. Node file writes share `distribution.temporary_file`: under the caller's installation lock, remove the previous temporary file, write privately, and publish atomically. The same lifecycle covers payloads, extraction, helpers, settings and enrollment tokens. Registration tokens are removed even when a rerun finds the node already registered.
+
+Configuration files are published only after their complete contents are written; a retry preserves an existing matching file and refuses conflicting contents. Generation leases are durable locks, not disposable temporary files: interruption between creating a lease and recording its inode identity requires operator inspection. A retry refuses that unrecorded lease instead of replacing an inode that a Runtime helper could still hold.
+
 The distribution manifest is the one download contract for nodes: flat versioned file names, and the compressed and unpacked size and SHA-256 of the Runtime.
 
 - A Compose installation keeps only the node metadata from its release archive; Core's image never acquires execution-only payloads.
 - A node obtains bootstrap metadata from the console that generated its command. Web serves artifacts it has locally and redirects missing declared execution artifacts to the versioned HTTPS release base in the verified manifest. Web never downloads or caches those bytes.
 - Only artifact requests may follow HTTPS redirects, and only without credentials or cookies. Metadata and enrollment requests stay on the configured console. The console publishes only fixed non-secret files and declared artifact names.
-- Download into private temporary files, verify size and SHA-256 before an atomic rename, resume interrupted transfers, and reuse only verified cache entries or exact image identities. Never select a release other than the pinned one.
+- Download into private temporary files, verify size and SHA-256 before an atomic rename, clear leftover temporary downloads and extracted files before retrying, and reuse only verified cache entries or exact image identities. Never select a release other than the pinned one.
 - Release downloads are anonymous. Never add repository credentials to installed node or Runtime configuration.
 - Manual builds use the `build-<full SHA>` release tag and tag builds the `v*` tag. The manifest's download base must match the release tag; artifact file names and source provenance keep the full source SHA.
 
diff --git a/deploy/node/distribution.py b/deploy/node/distribution.py
index 553177b2c..1aec341c4 100644
--- a/deploy/node/distribution.py
+++ b/deploy/node/distribution.py
@@ -9,7 +9,7 @@
 import socket
 import stat
 import subprocess
-import tempfile
+from contextlib import contextmanager
 import time
 import urllib.error
 import urllib.request
@@ -114,11 +114,8 @@ def redirect_request(self, request, fp, code, msg, headers, newurl):
         safe_url(newurl)
         if urlsplit(newurl).scheme != 'https' or request.get_method() not in ('GET', 'HEAD'):
             raise ArtifactError('Artifact redirects require HTTPS')
-        # Carry resume headers, never credentials or cookies, to a release/CDN host.
-        forwarded = {name: value for name, value in request.header_items()
-                     if name.lower() in ('range', 'if-range')}
-        return urllib.request.Request(newurl, headers=forwarded,
-                                      method=request.get_method(), unverifiable=True)
+        # Artifact redirects carry no credentials, cookies or custom headers.
+        return urllib.request.Request(newurl, method=request.get_method(), unverifiable=True)
 
 
 class NoRedirect(urllib.request.HTTPRedirectHandler):
@@ -162,47 +159,42 @@ def obtain_artifact(manifest, logical_path, destination, offline_root=None):
     if not isinstance(base, str) or not base or urlsplit(base).query:
         raise ArtifactError('No downloadable artifact source; use the matching offline bundle')
     url = safe_url(base.rstrip('/') + '/' + entry['filename'])
-    # A private partial file survives interruptions and reruns; the next attempt asks
-    # for the missing bytes only. The complete file is still verified as a whole.
-    partial = target.with_name('.' + target.name + '.partial')
-    for attempt in range(3):
-        try:
-            download_partial(url, partial, entry, logical_path)
-            break
-        except urllib.error.HTTPError as error:
-            if error.code == 416:
-                discard_partial(partial)
-            elif error.code not in (408, 429, 500, 502, 503, 504) or attempt == 2:
-                raise ArtifactError(f'Artifact download failed (HTTP {error.code}): {logical_path}. Check the console and retry.') from None
-        except (urllib.error.URLError, socket.timeout, ConnectionError, http.client.HTTPException):
-            if attempt == 2:
-                raise ArtifactError('Artifact transfer interrupted: ' + logical_path + '. Check network access and rerun; '
-                                        'the download resumes where it stopped.') from None
-        time.sleep(attempt + 1)
-    else:
-        raise ArtifactError('Artifact download did not complete')
-    if digest(partial) != entry['sha256']:
-        discard_partial(partial)
-        raise ArtifactError('Artifact checksum mismatch: ' + logical_path)
-    os.chmod(partial, 0o700 if logical_path.startswith('native/') else 0o600)
-    os.replace(partial, target)
-    validator_path(partial).unlink(missing_ok=True)
-    return target
-
-
-def validator_path(partial):
-    return partial.with_name(partial.name + '.validator')
+    with temporary_file(target) as partial:
+        for attempt in range(3):
+            try:
+                download_artifact(url, partial, entry, logical_path)
+                break
+            except urllib.error.HTTPError as error:
+                if error.code not in (408, 429, 500, 502, 503, 504) or attempt == 2:
+                    raise ArtifactError(f'Artifact download failed (HTTP {error.code}): {logical_path}. Check the console and retry.') from None
+            except (urllib.error.URLError, socket.timeout, ConnectionError, http.client.HTTPException):
+                if attempt == 2:
+                    raise ArtifactError('Artifact transfer interrupted: ' + logical_path + '. Check network access and rerun.') from None
+            time.sleep(attempt + 1)
+        if digest(partial) != entry['sha256']:
+            raise ArtifactError('Artifact checksum mismatch: ' + logical_path)
+        os.chmod(partial, 0o700 if logical_path.startswith('native/') else 0o600)
+        os.replace(partial, target)
+        return target
 
 
-def discard_partial(partial):
+@contextmanager
+def temporary_file(target):
+    """Clear unfinished work under the caller's installation lock."""
+    partial = target.with_name('.' + target.name + '.partial')
+    if partial.is_symlink() or (partial.exists() and
+            (not partial.is_file() or partial.stat().st_uid != os.getuid())):
+        raise DistributionError('Temporary file must be an owned regular file: ' + str(target))
     partial.unlink(missing_ok=True)
-    validator_path(partial).unlink(missing_ok=True)
+    try:
+        yield partial
+    finally:
+        partial.unlink(missing_ok=True)
 
 
 def copy_artifact(source, target, entry, logical_path):
-    fd, temporary = tempfile.mkstemp(prefix='.artifact-', dir=target.parent)
-    try:
-        with os.fdopen(fd, 'wb') as output, source.open('rb') as stream:
+    with temporary_file(target) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), 'wb') as output, source.open('rb') as stream:
             count = 0
             for block in iter(lambda: stream.read(1024 * 1024), b''):
                 count += len(block)
@@ -214,52 +206,20 @@ def copy_artifact(source, target, entry, logical_path):
         os.chmod(temporary, 0o700 if logical_path.startswith('native/') else 0o600)
         os.replace(temporary, target)
         return target
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
 
 
-# A download that brings fewer bytes than this in a window stops; a rerun resumes it.
+# Stop downloads that bring fewer bytes than this in a window.
 SLOW_SECONDS, SLOW_BYTES = 60, 64 * 1024
 
 
-def download_partial(url, partial, entry, logical_path):
-    """Complete the partial file, asking only for the bytes it is missing."""
+def download_artifact(url, partial, entry, logical_path):
+    """Download a complete artifact into a disposable file."""
     size = entry['size']
-    offset = 0
-    if partial.is_symlink() or (partial.exists() and not partial.is_file()):
-        raise DistributionError('Partial download must be a regular file: ' + logical_path)
-    if partial.exists():
-        info = partial.stat()
-        if info.st_uid != os.getuid():
-            raise DistributionError('Partial download must be owned by this user: ' + logical_path)
-        offset = info.st_size if info.st_size <= size else 0
-    if offset == size:
-        return
-    headers = {}
-    if offset:
-        headers['Range'] = f'bytes={offset}-'
-        # If-Range makes a server whose file changed since the partial began send it whole.
-        try:
-            validator = validator_path(partial).read_text().strip()
-        except OSError:
-            validator = ''
-        if validator:
-            headers['If-Range'] = validator
-    request = urllib.request.Request(url, headers=headers)
-    with urllib.request.build_opener(ArtifactRedirect()).open(request, timeout=30) as stream:
-        if offset and (stream.status != 206 or not stream.headers.get('Content-Range', '').startswith(f'bytes {offset}-')):
-            offset = 0  # The server sent the whole file; start over.
-        if not offset:
-            validator = stream.headers.get('ETag') or stream.headers.get('Last-Modified') or ''
-            if validator and all(32 <= ord(c) < 127 for c in validator) and len(validator) < 200:
-                with os.fdopen(os.open(validator_path(partial), os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600), 'w') as note:
-                    note.write(validator)
-            else:
-                validator_path(partial).unlink(missing_ok=True)
-        flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | (os.O_APPEND if offset else os.O_TRUNC)
-        with os.fdopen(os.open(partial, flags, 0o600), 'ab' if offset else 'wb') as output:
-            count, reported = offset, offset * 10 // size
+    opener = urllib.request.build_opener(ArtifactRedirect())
+    with opener.open(url, timeout=60) as stream:
+        flags = os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_TRUNC
+        with os.fdopen(os.open(partial, flags, 0o600), 'wb') as output:
+            count, reported = 0, 0
             window, window_count = time.monotonic(), 0
             while True:
                 block = stream.read1(1024 * 1024)
@@ -267,16 +227,13 @@ def download_partial(url, partial, entry, logical_path):
                     break
                 count += len(block)
                 if count > size:
-                    output.close()
-                    discard_partial(partial)
                     raise ArtifactError('Artifact exceeds published size: ' + logical_path)
                 output.write(block)
                 window_count += len(block)
                 if time.monotonic() - window >= SLOW_SECONDS:
                     if window_count < SLOW_BYTES:
                         raise ArtifactError(f'Artifact download stalled (under {SLOW_BYTES // 1024} KiB in {SLOW_SECONDS} s): '
-                                                f'{logical_path}. The downloaded part is kept; check the network, then rerun '
-                                                'the command to resume.')
+                                                f'{logical_path}. Check the network, then rerun the command.')
                     window, window_count = time.monotonic(), 0
                 if size >= 50 * 1024 * 1024 and count * 10 // size > reported:
                     reported = count * 10 // size
@@ -303,23 +260,21 @@ def runtime_archive(manifest, cache_root, offline_root=None):
             raise ArtifactError('Cached Runtime archive differs; preserve state and inspect it')
         return target
     archive = obtain_artifact(manifest, 'images/runtime.tar.gz', root / 'images/runtime.tar.gz', offline_root)
-    fd, temporary = tempfile.mkstemp(prefix='.runtime-', dir=target.parent)
-    try:
-        with os.fdopen(fd, 'wb') as output, gzip.open(archive, 'rb') as stream:
-            count = 0
-            for block in iter(lambda: stream.read(1024 * 1024), b''):
-                count += len(block)
-                if count > expanded['size']:
-                    raise ArtifactError('Runtime archive exceeds published unpacked size')
-                output.write(block)
-        if not matches(Path(temporary), expanded):
-            raise ArtifactError('Unpacked Runtime checksum mismatch')
-        os.replace(temporary, target)
-    except (gzip.BadGzipFile, EOFError):
-        raise ArtifactError('Invalid compressed Runtime archive') from None
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
+    with temporary_file(target) as temporary:
+        try:
+            with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), 'wb') as output, gzip.open(archive, 'rb') as stream:
+                count = 0
+                for block in iter(lambda: stream.read(1024 * 1024), b''):
+                    count += len(block)
+                    if count > expanded['size']:
+                        raise ArtifactError('Runtime archive exceeds published unpacked size')
+                    output.write(block)
+            if not matches(temporary, expanded):
+                raise ArtifactError('Unpacked Runtime checksum mismatch')
+            os.replace(temporary, target)
+        except (gzip.BadGzipFile, EOFError):
+            raise ArtifactError('Invalid compressed Runtime archive') from None
+
     return target
 
 
diff --git a/deploy/node/node_generations.py b/deploy/node/node_generations.py
index 738c9b765..158eaf827 100644
--- a/deploy/node/node_generations.py
+++ b/deploy/node/node_generations.py
@@ -12,14 +12,14 @@
 import shutil
 import subprocess
 import sys
-import tempfile
-import zipapp
+import zipfile
+
+from distribution import temporary_file
 
 
 def atomic_json(path, value):
-    descriptor, temporary = tempfile.mkstemp(prefix=".generation-", dir=path.parent)
-    try:
-        with os.fdopen(descriptor, "w") as stream:
+    with temporary_file(path) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as stream:
             json.dump(value, stream, sort_keys=True)
             stream.write("\n")
             stream.flush()
@@ -30,9 +30,6 @@ def atomic_json(path, value):
             os.fsync(descriptor)
         finally:
             os.close(descriptor)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
 
 
 def helper_archive(args, installer):
@@ -42,14 +39,12 @@ def helper_archive(args, installer):
         source = args.bundle / "node-install.pyz"
     if source.suffix == ".pyz" and source.is_file() and not source.is_symlink():
         return source.read_bytes()
-    with tempfile.TemporaryDirectory() as directory:
-        package = Path(directory)
-        source_dir = Path(installer.__file__).parent
+    archive = io.BytesIO()
+    source_dir = Path(installer.__file__).parent
+    with zipfile.ZipFile(archive, "w", compression=zipfile.ZIP_DEFLATED) as package:
         for name in ("node_install.py", "node_spec.py", "distribution.py", "node_generations.py", "install_display.py", "node_output.py", "provider_assets.py"):
-            shutil.copyfile(source_dir / name, package / ("__main__.py" if name == "node_install.py" else name))
-        archive = io.BytesIO()
-        zipapp.create_archive(package, archive, compressed=True)
-        return archive.getvalue()
+            package.write(source_dir / name, "__main__.py" if name == "node_install.py" else name)
+    return archive.getvalue()
 
 
 def install_helper(root, args, installer, archive=None):
@@ -62,10 +57,9 @@ def install_helper(root, args, installer, archive=None):
     installer.existing_file(target)
     if archive is None:
         archive = helper_archive(args, installer)
-    with tempfile.TemporaryDirectory(dir=root) as directory:
-        staged = Path(directory) / "helper.pyz"
-        staged.write_bytes(archive)
-        os.chmod(staged, 0o600)
+    with temporary_file(target) as staged:
+        with os.fdopen(os.open(staged, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb") as output:
+            output.write(archive)
         os.replace(staged, target)
     atomic_json(settings, value)
 
diff --git a/deploy/node/node_install.py b/deploy/node/node_install.py
index cc3f6a211..7944db376 100644
--- a/deploy/node/node_install.py
+++ b/deploy/node/node_install.py
@@ -24,7 +24,6 @@
 import stat
 import subprocess
 import sys
-import tempfile
 import time
 import urllib.error
 import urllib.request
@@ -229,13 +228,18 @@ def existing_file(path):
 
 
 def write_once(path, value):
-    if existing_file(path):
-        if path.read_text() != value:
-            raise InstallError("Existing node configuration differs; preserve its state and use the upgrade guide")
-        return
-    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
-    with os.fdopen(descriptor, "w") as stream:
-        stream.write(value)
+    # Callers hold the installation lock through comparison and publication.
+    with distribution.temporary_file(path) as temporary:
+        if existing_file(path):
+            if path.read_text() != value:
+                raise InstallError("Existing node configuration differs; preserve its state and use the upgrade guide")
+            return
+        descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
+        with os.fdopen(descriptor, "w") as stream:
+            stream.write(value)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, path)
 
 
 def json_text(value):
@@ -257,17 +261,13 @@ def download(source, name, root, expected, prefix=""):
         if file_digest(target) != expected:
             raise RuntimeDownloadError("Installed node payload differs; refusing to overwrite it")
         return
-    descriptor, temporary = tempfile.mkstemp(prefix=".download-", dir=target.parent)
-    try:
-        with os.fdopen(descriptor, "wb") as output, fetch(source, prefix + name) as response:
+    with distribution.temporary_file(target) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "wb") as output, fetch(source, prefix + name) as response:
             for block in iter(lambda: response.read(1024 * 1024), b""):
                 output.write(block)
         if file_digest(Path(temporary)) != expected:
             raise RuntimeDownloadError("Node payload checksum mismatch: " + name)
         os.replace(temporary, target)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
     if name.startswith("native/"):
         os.chmod(target, 0o700)
 
@@ -343,10 +343,8 @@ def unit_name(installation_id):
     return "oac-node-" + installation_id + ".service"
 
 
-def open_node(args, token):
-    """Read the Core specification and check the host; returns the node's state directory."""
-    root = Path.home() / ".oac/nodes" / args.installation_id
-    safe_directory(root)
+def configure_node(root, args, token):
+    """Read the Core specification and check the host under the installation lock."""
     identity_file = root / "state/node/identity.json"
     retained = json.loads(identity_file.read_text()) if existing_file(identity_file) else None
     args.configuration = node_spec.fetch(args, token, retained, open_request, allow_enrollment=not (root / "registered.json").exists())
@@ -359,7 +357,6 @@ def open_node(args, token):
         if not owner.exists() and any(runtime_home.iterdir()):
             raise InstallError("Microsandbox home contains unowned state; refusing to adopt it")
         write_once(owner, json_text({"installation_id": args.installation_id}))
-    return root
 
 
 @contextlib.contextmanager
@@ -373,7 +370,7 @@ def install_lock(root):
         yield
 
 
-def register_node(root, args, token, helper_archive=None):
+def register_node(root, args, token, helper_archive=None, *, secret_path):
     """Download and verify the payload, prepare the Runtime and register; not the service."""
     install_display.step("Downloading and verifying node files")
     program_manifest, program_sums = metadata(args.source_url, getattr(args, "bundle", None))
@@ -426,31 +423,28 @@ def register_node(root, args, token, helper_archive=None):
     marker = root / "registered.json"
     if not existing_file(marker):
         # The one-time credential is never passed through process arguments or service environments.
-        descriptor, secret_path = tempfile.mkstemp(prefix=".enrollment-", dir=root)
+        with os.fdopen(os.open(secret_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as secret:
+            secret.write(token)
+        install_display.step("Registering this node with Core")
         try:
-            with os.fdopen(descriptor, "w") as secret:
-                secret.write(token)
-            install_display.step("Registering this node with Core")
-            try:
-                checked([str(root / provider_assets.artifacts(args.provider, ("node",))[0]), "register", "--config", str(root / "provider.json"), "--state-dir", str(root / "state/node"),
-                         "--core-url", args.core_url, "--name", socket.gethostname(),
-                         "--enrollment-token-file", secret_path], REGISTRATION_UNCONFIRMED, explain=registration_failure)
-            except AddressChanged:
-                discard_unregistered(root)
-                raise
-            write_once(marker, json_text(state))
-        finally:
-            if os.path.exists(secret_path):
-                os.unlink(secret_path)
+            checked([str(root / provider_assets.artifacts(args.provider, ("node",))[0]), "register", "--config", str(root / "provider.json"), "--state-dir", str(root / "state/node"),
+                     "--core-url", args.core_url, "--name", socket.gethostname(),
+                     "--enrollment-token-file", str(secret_path)], REGISTRATION_UNCONFIRMED, explain=registration_failure)
+        except AddressChanged:
+            discard_unregistered(root)
+            raise
+        write_once(marker, json_text(state))
     elif marker.read_text() != json_text(state):
         raise InstallError("Registered node identity differs; refusing to replace it")
 
 
 def prepare_service_node(args, token, helper_archive):
     """Sudo mode, as the service user: everything but the root-owned system unit."""
-    root = open_node(args, token)
-    with install_lock(root):
-        register_node(root, args, token, helper_archive)
+    root = Path.home() / ".oac/nodes" / args.installation_id
+    safe_directory(root)
+    with install_lock(root), distribution.temporary_file(root / "enrollment-token") as secret_path:
+        configure_node(root, args, token)
+        register_node(root, args, token, helper_archive, secret_path=secret_path)
 
 
 # Sudo mode -----------------------------------------------------------------
@@ -727,15 +721,11 @@ def root_file(path, content, replace=False):
         # Set the root-owned unit and record mode independently of the caller's umask.
         path.parent.mkdir(parents=True, mode=0o755)
         os.chmod(path.parent, 0o755)
-    descriptor, temporary = tempfile.mkstemp(prefix=".oac-node-", dir=path.parent)
-    try:
-        with os.fdopen(descriptor, "w") as stream:
+    with distribution.temporary_file(path) as temporary:
+        with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w") as stream:
             stream.write(content)
         os.chmod(temporary, 0o644)
         os.replace(temporary, path)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
 
 
 def read_root_json(path):
diff --git a/deploy/node/test_distribution.py b/deploy/node/test_distribution.py
index d10ea6d70..bee168ab9 100644
--- a/deploy/node/test_distribution.py
+++ b/deploy/node/test_distribution.py
@@ -8,6 +8,7 @@
 import tempfile
 import ssl
 import subprocess
+import sys
 import threading
 from types import SimpleNamespace
 import unittest
@@ -29,15 +30,15 @@ def setUp(self):
         self.if_ranges = []
         self.status = 200
         self.redirect_target = 'https://elsewhere.example'
-        self.resumable = False
+        self.interrupted_once = False
         test = self
         class Handler(http.server.BaseHTTPRequestHandler):
             def do_GET(self):
                 test.requests.append(self.path)
                 test.ranges.append(self.headers.get('Range'))
                 test.if_ranges.append(self.headers.get('If-Range'))
-                if test.resumable:
-                    # The first response breaks off halfway; a Range request gets the rest.
+                if test.interrupted_once and len(test.requests) == 1:
+                    # The first response breaks off halfway; the retry starts over.
                     start = int(self.headers['Range'][6:-1]) if self.headers.get('Range') else 0
                     self.send_response(206 if start else 200)
                     self.send_header('Last-Modified', 'Sat, 26 Sep 2026 00:00:00 GMT')
@@ -109,28 +110,26 @@ def test_truncated_transfer_can_be_rerun(self):
         self.data = self.data[:20]
         with patch.object(distribution.time, 'sleep'), self.assertRaisesRegex(distribution.DistributionError, 'interrupted'):
             distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
-        # Only the private partial file stays, for the rerun to continue.
-        self.assertEqual([path.name for path in self.root.iterdir()], ['.node.partial'])
+        self.assertEqual(list(self.root.iterdir()), [])
         self.data = b'prebuilt artifact' * 1000
         distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
         self.assertEqual([path.name for path in self.root.iterdir()], ['node'])
 
-    def test_interrupted_download_resumes_with_the_missing_bytes(self):
-        self.resumable = True
+    def test_interrupted_download_restarts_with_a_clean_file(self):
+        self.interrupted_once = True
         with patch.object(distribution.time, 'sleep'):
             distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
         self.assertEqual((self.root / 'node').read_bytes(), self.data)
-        self.assertEqual(self.ranges, [None, f'bytes={len(self.data) // 2}-'])
-        # If-Range: a file that changed since the partial began comes back whole instead of mixed.
-        self.assertEqual(self.if_ranges, [None, 'Sat, 26 Sep 2026 00:00:00 GMT'])
+        self.assertEqual(self.ranges, [None, None])
+        self.assertEqual(self.if_ranges, [None, None])
         self.assertEqual([path.name for path in self.root.iterdir()], ['node'])
 
-    def test_a_stalled_download_stops_and_keeps_its_part(self):
+    def test_a_stalled_download_stops_and_removes_its_part(self):
         with patch.object(distribution, 'SLOW_SECONDS', 0), \
-                self.assertRaisesRegex(distribution.DistributionError, 'stalled.*rerun the command to resume'):
+                self.assertRaisesRegex(distribution.DistributionError, 'stalled.*rerun the command'):
             distribution.obtain_artifact(self.manifest, 'native/bin/node', self.root / 'node')
         self.assertEqual(len(self.requests), 1)  # Not retried as a network error.
-        self.assertEqual([path.name for path in self.root.iterdir()], ['.node.partial'])
+        self.assertEqual(list(self.root.iterdir()), [])
 
     def test_offline_and_runtime_expansion_are_verified(self):
         raw = b'synthetic tar contents' * 1000
@@ -148,6 +147,43 @@ def test_offline_and_runtime_expansion_are_verified(self):
         with self.assertRaisesRegex(distribution.DistributionError, 'differs'):
             distribution.runtime_archive(self.manifest, self.root / 'cache')
 
+    def test_retry_after_sigkill_discards_unfinished_artifact(self):
+        target = self.root / 'node'
+        script = """import os, signal, sys
+from pathlib import Path
+import distribution
+with distribution.temporary_file(Path(sys.argv[1])) as partial:
+    partial.write_bytes(b'unfinished bytes')
+    os.kill(os.getpid(), signal.SIGKILL)
+"""
+        killed = subprocess.run([sys.executable, '-c', script, str(target)],
+                                cwd=Path(distribution.__file__).parent)
+        self.assertEqual(killed.returncode, -9)
+        partial = target.with_name('.node.partial')
+        self.assertTrue(partial.exists())
+        distribution.obtain_artifact(self.manifest, 'native/bin/node', target)
+        self.assertEqual(target.read_bytes(), self.data)
+        self.assertFalse(partial.exists())
+        self.assertEqual(self.ranges, [None])
+
+    def test_expansion_discards_stale_temporary_and_preserves_verified_archive(self):
+        raw = b'complete runtime image' * 1000
+        self.data = gzip.compress(raw)
+        entry = self.entry('images/runtime.tar.gz', self.data)
+        entry.update(unpacked_size=len(raw), unpacked_sha256='0' * 64)
+        cache = self.root / 'images'
+        cache.mkdir()
+        partial = cache / '.runtime.tar.partial'
+        partial.write_bytes(b'interrupted expansion')
+        with self.assertRaisesRegex(distribution.ArtifactError, 'Unpacked Runtime checksum'):
+            distribution.runtime_archive(self.manifest, self.root)
+        self.assertFalse(partial.exists())
+        self.assertFalse((cache / 'runtime.tar').exists())
+        self.assertEqual((cache / 'runtime.tar.gz').read_bytes(), self.data)
+        entry['unpacked_sha256'] = hashlib.sha256(raw).hexdigest()
+        self.assertEqual(distribution.runtime_archive(self.manifest, self.root).read_bytes(), raw)
+        self.assertEqual(len(self.requests), 1)
+
     def test_url_and_path_boundaries(self):
         self.assertEqual(distribution.safe_url('http://core.example:8080/a'), 'http://core.example:8080/a')
         for value in ('ftp://example.com/a', 'https://user:secret@example.com/a', 'file:///tmp/a'):
@@ -173,7 +209,7 @@ def test_artifact_downgrades_and_metadata_redirects_are_refused(self):
         self.assertEqual(list(self.root.iterdir()), [])
 
 
-    def test_https_redirect_resumes_and_verifies_on_the_node(self):
+    def test_https_redirect_discards_stale_partial_and_verifies_on_the_node(self):
         certificate, key = self.root / 'cert.pem', self.root / 'key.pem'
         subprocess.run(['openssl', 'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
                         '-keyout', str(key), '-out', str(certificate), '-days', '1',
@@ -203,7 +239,6 @@ def log_message(self, *args):
             self.redirect_target = f'https://localhost:{release.server_port}'
             target = self.root / 'node'
             target.with_name('.node.partial').write_bytes(self.data[:7])
-            target.with_name('.node.partial.validator').write_text('resume-etag')
             opener = distribution.urllib.request.build_opener
             trusted = distribution.urllib.request.HTTPSHandler(context=ssl.create_default_context(cafile=str(certificate)))
             with patch.object(distribution.urllib.request, 'build_opener', side_effect=lambda *handlers: opener(*handlers, trusted)):
@@ -211,14 +246,15 @@ def log_message(self, *args):
                 distribution.obtain_artifact(self.manifest, 'native/bin/node', target)
             self.assertEqual(target.read_bytes(), self.data)
             self.assertEqual(len(received), 1)
-            self.assertEqual(received[0]['Range'], 'bytes=7-')
-            self.assertEqual(received[0]['If-Range'], 'resume-etag')
+            self.assertNotIn('Range', received[0])
+            self.assertNotIn('If-Range', received[0])
+            self.assertFalse(target.with_name('.node.partial').exists())
         finally:
             release.shutdown()
             release.server_close()
             thread.join()
 
-    def test_artifact_redirect_preserves_resume_without_credentials(self):
+    def test_artifact_redirect_strips_credentials_and_custom_headers(self):
         request = distribution.urllib.request.Request('https://console.example/artifact', headers={
             'Range': 'bytes=123-', 'If-Range': 'etag', 'Authorization': 'Bearer secret',
             'Cookie': 'session=secret', 'X-Core-Key': 'secret'})
@@ -227,7 +263,7 @@ def test_artifact_redirect_preserves_resume_without_credentials(self):
         forwarded = redirect.redirect_request(request, None, 307, '', {}, target)
         self.assertEqual(forwarded.full_url, target)
         self.assertEqual(dict((k.lower(), v) for k, v in forwarded.header_items()),
-                         {'range': 'bytes=123-', 'if-range': 'etag'})
+                         {})
         for invalid in ('http://release.example/file', 'file:///tmp/file', 'https://user:secret@release.example/file'):
             with self.subTest(invalid=invalid), self.assertRaises(distribution.ArtifactError):
                 redirect.redirect_request(request, None, 302, '', {}, invalid)
diff --git a/deploy/node/test_node_install.py b/deploy/node/test_node_install.py
index 306588b6c..b17d6fd80 100644
--- a/deploy/node/test_node_install.py
+++ b/deploy/node/test_node_install.py
@@ -509,6 +509,85 @@ def test_repeat_preserves_registration_and_recovers_service_start_failure(self):
         self.assertFalse(any("register" in call for call, _ in self.calls))
         self.assertFalse(any("load" in call for call, _ in self.calls))
 
+    def test_policy_download_after_sigkill_starts_clean(self):
+        root = self.home / "policy"
+        payload = self.payloads["runtime/seccomp.json"]
+        expected = hashlib.sha256(payload).hexdigest()
+        class Interrupted(io.BytesIO):
+            def read(self, size=-1):
+                if self.tell():
+                    os.kill(os.getpid(), signal.SIGKILL)
+                return super().read(1)
+        child = os.fork()
+        if child == 0:
+            with mock.patch.object(installer, "fetch", return_value=Interrupted(payload)):
+                installer.download(self.args.source_url, "runtime/seccomp.json", root, expected)
+            os._exit(1)
+        _, status = os.waitpid(child, 0)
+        self.assertEqual(os.waitstatus_to_exitcode(status), -signal.SIGKILL)
+        partial = root / "runtime/.seccomp.json.partial"
+        self.assertTrue(partial.exists())
+        installer.download(self.args.source_url, "runtime/seccomp.json", root, expected)
+        self.assertFalse(partial.exists())
+        self.assertEqual((root / "runtime/seccomp.json").read_bytes(), payload)
+
+    def test_retry_after_configuration_write_sigkill_publishes_complete_files(self):
+        for name in ("installation.json", "provider.json", "registered.json"):
+            with self.subTest(name=name):
+                self.args.installation_id = name.replace(".json", "")
+                self.root = self.home / ".oac/nodes" / self.args.installation_id
+                partial = self.root / ("." + name + ".partial")
+                original_open = os.open
+                def interrupted_open(path, *args, **kwargs):
+                    descriptor = original_open(path, *args, **kwargs)
+                    if path == partial:
+                        os.write(descriptor, b'{')
+                        os.kill(os.getpid(), signal.SIGKILL)
+                    return descriptor
+                child = os.fork()
+                if child == 0:
+                    with mock.patch.object(installer.os, "open", side_effect=interrupted_open):
+                        self.install()
+                    os._exit(1)
+                _, status = os.waitpid(child, 0)
+                self.assertEqual(os.waitstatus_to_exitcode(status), -signal.SIGKILL)
+                self.assertTrue(partial.exists())
+                self.assertFalse((self.root / name).exists())
+                self.install()
+                self.assertFalse(partial.exists())
+                for target in ("installation.json", "provider.json", "registered.json"):
+                    self.assertEqual(json.loads((self.root / target).read_text())["installation_id"], self.args.installation_id)
+
+    def test_retry_after_registration_sigkill_removes_secret_and_helper_staging(self):
+        write_once = installer.write_once
+        def killed_after_registration(path, value):
+            write_once(path, value)
+            if path.name == "registered.json":
+                os.kill(os.getpid(), signal.SIGKILL)
+        child = os.fork()
+        if child == 0:
+            with mock.patch.object(installer, "write_once", side_effect=killed_after_registration):
+                self.install()
+            os._exit(1)
+        _, status = os.waitpid(child, 0)
+        self.assertEqual(os.waitstatus_to_exitcode(status), -signal.SIGKILL)
+        partial = self.root / ".enrollment-token.partial"
+        self.assertTrue(partial.exists())
+        identity = (self.root / "state/node/identity.json").read_bytes()
+        with mock.patch.object(installer.node_spec, "fetch", side_effect=installer.InstallError("Core unavailable")):
+            with self.assertRaisesRegex(installer.InstallError, "Core unavailable"):
+                self.install()
+        self.assertFalse(partial.exists())
+        self.assertEqual((self.root / "state/node/identity.json").read_bytes(), identity)
+        helper = self.root / ".generation-preparer.pyz.partial"
+        helper.write_bytes(b'unfinished helper')
+        helper.chmod(0o600)
+        self.install()
+        self.assertFalse(partial.exists())
+        self.assertFalse(helper.exists())
+        self.assertEqual((self.root / "state/node/identity.json").read_bytes(), identity)
+        self.assertFalse(any("register" in call for call, _ in self.calls))
+
     def test_unconfirmed_registration_retains_state_removes_token_and_does_not_start(self):
         self.fail_registration = True
         with self.assertRaisesRegex(installer.InstallError, "not confirmed"):
diff --git a/deploy/test_install.py b/deploy/test_install.py
index 6393b28fa..f4bb80cdd 100644
--- a/deploy/test_install.py
+++ b/deploy/test_install.py
@@ -1,5 +1,7 @@
 """install.sh writes .env and starts Compose without host Python."""
 import os
+import fcntl
+import sys
 from pathlib import Path
 import stat
 import subprocess
@@ -13,43 +15,60 @@
 
 
 class InstallScriptTests(unittest.TestCase):
-    def install(self, root, *args, compose_up=0, route="1.1.1.1 via 10.0.0.1 dev eth0 src 10.0.0.5 uid 0"):
+    def install(self, root, *args, compose_up=0, docker_info=0, key_status=0, download_status=0, kill_download=False, kill_start=False, pull_status=0, kill_pull=False, file_limit=False, missing_image="", route="1.1.1.1 via 10.0.0.1 dev eth0 src 10.0.0.5 uid 0"):
         bin_dir = root / "bin"
         bin_dir.mkdir(exist_ok=True)
         log = root / "docker.log"
         self.write_executable(bin_dir / "docker", textwrap.dedent(f"""\
             #!/bin/sh
-            printf '%s\\n' "$*" >> {log}
+            [ {1 if file_limit else 0} -eq 1 ] || printf '%s\\n' "$*" >> {log}
+            if [ "$1" = info ]; then exit {docker_info}; fi
+            if [ "$1" = pull ]; then {'kill -KILL "$PPID"' if kill_pull else ':'}; exit {pull_status}; fi
+            if [ "$1" = image ] && [ "$2" = inspect ] && [ "$3" = "{missing_image}" ]; then exit 1; fi
+            if [ "$1" = compose ] && [ "$2" = config ] && [ "$3" = --images ]; then printf 'fixture-core:latest\\nfixture-web:latest\\n'; fi
+            if [ "$1" = compose ] && [ "$2" = logs ]; then echo service-diagnostic >&2; fi
+            if [ "$1" = compose ] && [ "$2" = config ] && [ "$3" = --environment ]; then sed "s/'//g" .env; fi
             if [ "$1" = compose ] && [ "$2" = version ]; then printf 'v2.29.1\\n'; exit 0; fi
-            if [ "$1" = compose ] && [ "$2" = cp ]; then printf '#!/bin/sh\\necho oac_core_fixture\\n' > ./oac; chmod +x ./oac; exit 0; fi
-            if [ "$1" = compose ] && [ "$2" = up ]; then exit {compose_up}; fi
+            if [ "$1" = compose ] && [ "$2" = cp ]; then printf '#!/bin/sh\\necho oac_core_fixture\\nexit {key_status}\\n' > ./oac.download; chmod +x ./oac.download; exit 0; fi
+            if [ "$1" = compose ] && [ "$2" = up ]; then {'kill -KILL "$PPID"' if kill_start else ':'}; exit {compose_up}; fi
             exit 0
             """))
-        self.write_executable(bin_dir / "curl", textwrap.dedent("""\
+        self.write_executable(bin_dir / "curl", textwrap.dedent(f"""\
             #!/bin/sh
+            exit_status={download_status}
+            [ "$exit_status" = 0 ] || exit "$exit_status"
             output=""
             while [ $# -gt 0 ]; do
               if [ "$1" = --output ]; then output="$2"; shift 2; continue; fi
               shift
             done
             printf 'fixture\\n' > "$output"
+            {'kill -KILL "$PPID"' if kill_download else ':'}
             """))
         self.write_executable(bin_dir / "sha256sum", "#!/bin/sh\nexit 0\n")
+        self.write_executable(bin_dir / "uname", '#!/bin/sh\ncase "$1" in -s) echo Linux;; -m) echo x86_64;; esac\n')
+        self.write_executable(bin_dir / "flock", f'#!{sys.executable}\nimport fcntl, sys\ntry: fcntl.flock(int(sys.argv[-1]), fcntl.LOCK_EX | fcntl.LOCK_NB)\nexcept BlockingIOError: sys.exit(1)\n')
         self.write_executable(bin_dir / "ss", "#!/bin/sh\nexit 0\n")
         self.write_executable(bin_dir / "ip", f"#!/bin/sh\nprintf '%s\\n' '{route}'\n")
         env = dict(os.environ, PATH=str(bin_dir) + os.pathsep + os.environ["PATH"], HOME=str(root))
-        completed = subprocess.run(["bash", str(INSTALL), "--install-dir", str(root / "oac"), *args],
+        command = ["bash", str(INSTALL), "--install-dir", str(root / "oac"), *args]
+        if file_limit:
+            command = ["bash", "-c", 'ulimit -f 0; exec "$@"', "--", *command]
+        completed = subprocess.run(command,
                                    env=env, capture_output=True, text=True)
         return completed, log.read_text() if log.exists() else ""
 
-    def test_a_failed_first_start_stops_and_removes_the_directory(self):
+    def test_a_failed_start_preserves_configuration_and_reports_service_logs(self):
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
             completed, recorded = self.install(root, "--host", "127.0.0.1", "--web-port", "59991",
                                                "--public-url", "https://core.example", compose_up=1)
             self.assertNotEqual(completed.returncode, 0, completed.stderr)
-            self.assertFalse((root / "oac").exists(), "a failed first start must remove the directory")
-            self.assertIn("compose pull", recorded)
+            self.assertTrue((root / "oac/.env").exists())
+            self.assertNotIn("compose down", recorded)
+            self.assertIn("service-diagnostic", completed.stderr)
+            self.assertIn("data retained", completed.stderr)
+            self.assertIn("pull --platform linux/amd64 fixture-core:latest", recorded)
             self.assertIn("compose up -d --wait", recorded)
             self.assertIn("compose logs", recorded, "a failed start must show the services' logs")
 
@@ -58,7 +77,7 @@ def test_the_private_address_is_the_default_public_url(self):
             root = Path(temporary)
             completed, _ = self.install(root)
             self.assertEqual(completed.returncode, 0, completed.stderr)
-            self.assertIn("OAC_PUBLIC_URL=http://10.0.0.5:8080\n", (root / "oac/.env").read_text())
+            self.assertIn("OAC_PUBLIC_URL='http://10.0.0.5:8080'\n", (root / "oac/.env").read_text())
             self.assertIn("Console   http://10.0.0.5:8080", completed.stdout)
             self.assertIn("Core key  oac_core_fixture", completed.stdout)
             self.assertNotIn("Only this host", completed.stdout)
@@ -70,7 +89,7 @@ def test_without_a_private_address_only_this_host_reaches_web(self):
                 root = Path(temporary)
                 completed, _ = self.install(root, *args, route=route)
                 self.assertEqual(completed.returncode, 0, completed.stderr)
-                self.assertIn("OAC_PUBLIC_URL=http://localhost:59992\n", (root / "oac/.env").read_text())
+                self.assertIn("OAC_PUBLIC_URL='http://localhost:59992'\n", (root / "oac/.env").read_text())
                 self.assertIn("Only this host can open the console", completed.stdout)
 
     def test_env_holds_only_the_installation_choices(self):
@@ -78,10 +97,189 @@ def test_env_holds_only_the_installation_choices(self):
             root = Path(temporary)
             completed, _ = self.install(root, "--public-url", "https://core.example")
             self.assertEqual(completed.returncode, 0, completed.stderr)
-            env = dict(line.split("=", 1) for line in (root / "oac/.env").read_text().splitlines())
+            env = dict((lambda pair: (pair[0], pair[1].strip("'")))(line.split("=", 1)) for line in (root / "oac/.env").read_text().splitlines())
             self.assertEqual(env["OAC_PUBLIC_URL"], "https://core.example")
             self.assertEqual(sorted(env), ["COMPOSE_PROJECT_NAME", "OAC_HOST", "OAC_INSTALL_DIR", "OAC_PUBLIC_URL", "OAC_WEB_PORT"])
 
+    def test_key_failure_never_removes_a_started_installation(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, recorded = self.install(root, key_status=1)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertTrue((root / "oac/.env").exists())
+            self.assertNotIn("compose down", recorded)
+            self.assertIn("Core key could not be read", completed.stderr)
+
+    def test_retry_reuses_saved_settings_and_keeps_data(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            failed, _ = self.install(root, "--public-url", "https://core.example", compose_up=1)
+            self.assertNotEqual(failed.returncode, 0)
+            configuration = (root / "oac/.env").read_bytes()
+            data = root / "oac/data"
+            data.mkdir()
+            (data / "keep").write_text("user data")
+            (root / "docker.log").unlink()
+            completed, recorded = self.install(root, download_status=22)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertEqual((root / "oac/.env").read_bytes(), configuration)
+            self.assertEqual((data / "keep").read_text(), "user data")
+            self.assertIn("Console   https://core.example", completed.stdout)
+            self.assertNotIn("pull --platform", recorded)
+            self.assertNotIn("Only this host", completed.stdout)
+
+    def test_retry_downloads_only_missing_images_and_prevents_implicit_updates(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            failed, _ = self.install(root, compose_up=1)
+            self.assertNotEqual(failed.returncode, 0)
+            (root / "docker.log").unlink()
+            (root / "oac/oac").unlink()
+            completed, recorded = self.install(root, missing_image="fixture-web:latest")
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertNotIn("pull --platform linux/amd64 fixture-core:latest", recorded)
+            self.assertIn("pull --platform linux/amd64 fixture-web:latest", recorded)
+            for line in recorded.splitlines():
+                if line.startswith(("compose create", "compose up")):
+                    self.assertIn("--pull never", line)
+                    self.assertIn("--no-recreate", line)
+
+    def test_retry_after_file_size_limit_recovers_staging(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            failed, _ = self.install(root, file_limit=True)
+            self.assertNotEqual(failed.returncode, 0)
+            self.assertIn("Downloading release checksums", failed.stdout)
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse((root / "oac.staging").exists())
+
+    def test_failed_initial_pull_never_adopts_old_cached_images_on_retry(self):
+        for kill in (False, True):
+            with self.subTest(kill=kill), tempfile.TemporaryDirectory() as temporary:
+                root = Path(temporary)
+                failed, _ = self.install(root, pull_status=1, kill_pull=kill)
+                self.assertNotEqual(failed.returncode, 0)
+                self.assertFalse((root / "oac").exists())
+                (root / "docker.log").unlink()
+                # Every image inspect succeeds: another installation cached old tags.
+                completed, recorded = self.install(root)
+                self.assertEqual(completed.returncode, 0, completed.stderr)
+                for image in ("fixture-core:latest", "fixture-web:latest"):
+                    self.assertIn("pull --platform linux/amd64 " + image, recorded)
+                self.assertFalse((root / "oac.staging").exists())
+
+    def test_invalid_port_and_unavailable_docker_fail_before_installation(self):
+        for args, status in [(["--web-port", "0"], 0), (["--web-port", "70000"], 0), ([], 1)]:
+            with self.subTest(args=args, status=status), tempfile.TemporaryDirectory() as temporary:
+                root = Path(temporary)
+                completed, recorded = self.install(root, *args, docker_info=status)
+                self.assertNotEqual(completed.returncode, 0)
+                self.assertFalse((root / "oac").exists())
+                self.assertNotIn("pull --platform", recorded)
+
+    def test_failed_download_leaves_no_installation_or_staging(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, recorded = self.install(root, download_status=22)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertFalse((root / "oac").exists())
+            self.assertFalse((root / "oac.staging").exists())
+            self.assertNotIn("compose down", recorded)
+
+    def test_retry_after_sigkill_cleans_unfinished_download(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            killed, _ = self.install(root, kill_download=True)
+            self.assertEqual(killed.returncode, -9, killed.stderr)
+            self.assertTrue((root / "oac.staging").exists())
+            self.assertFalse((root / "oac").exists())
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse((root / "oac.staging").exists())
+            self.assertTrue((root / "oac/oac").exists())
+
+    def test_retry_after_start_sigkill_cleans_published_log(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            killed, _ = self.install(root, kill_start=True)
+            self.assertEqual(killed.returncode, -9, killed.stderr)
+            self.assertTrue((root / "oac/install.log").exists())
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse((root / "oac/install.log").exists())
+            self.assertFalse((root / "oac.staging").exists())
+
+    def test_retry_clears_staging_from_an_interrupted_process(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            staging = root / "oac.staging"
+            staging.mkdir()
+            (staging / ".oac-installer").symlink_to((root / "oac").resolve())
+            (staging / "partial").write_text("unfinished download")
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse(staging.exists())
+            self.assertFalse((root / "oac/partial").exists())
+
+    def test_unrecognized_staging_directory_is_never_deleted(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            staging = root / "oac.staging"
+            staging.mkdir()
+            (staging / "keep").write_text("user data")
+            completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertIn("Unrecognized staging", completed.stderr)
+            self.assertEqual((staging / "keep").read_text(), "user data")
+            self.assertNotIn("compose up", recorded)
+
+    def test_existing_unrelated_directory_is_never_deleted(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            (root / "oac").mkdir()
+            (root / "oac/keep").write_text("user data")
+            completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertEqual((root / "oac/keep").read_text(), "user data")
+            self.assertNotIn("compose down", recorded)
+
+    def test_another_installation_holds_the_lock(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            with (root / "oac.install.lock").open("w") as lock:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertIn("Another installation", completed.stderr)
+            self.assertFalse((root / "oac").exists())
+            self.assertNotIn("pull --platform", recorded)
+
+    def test_retry_does_not_overlap_an_oac_mutation(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            (root / "docker.log").unlink()
+            with (root / "oac/.oac.lock").open("r+") as lock:
+                fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                completed, recorded = self.install(root)
+            self.assertNotEqual(completed.returncode, 0)
+            self.assertIn("Another oac command", completed.stderr)
+            self.assertNotIn("compose up", recorded)
+
+    def test_rerun_does_not_silently_replace_settings(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, _ = self.install(root)
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            before = (root / "oac/.env").read_bytes()
+            completed, _ = self.install(root, "--web-port", "9000")
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            self.assertIn("Using saved settings", completed.stdout)
+            self.assertIn("only apply to new directories", completed.stdout)
+            self.assertEqual((root / "oac/.env").read_bytes(), before)
+
     def test_help_does_not_need_docker(self):
         help_text = subprocess.run(["bash", str(INSTALL), "--help"], capture_output=True, text=True, check=True)
         self.assertIn("--web-port", help_text.stdout)
diff --git a/docs/getting-started/install.md b/docs/getting-started/install.md
index a4849fd8d..acf59bd48 100644
--- a/docs/getting-started/install.md
+++ b/docs/getting-started/install.md
@@ -44,7 +44,13 @@ The script downloads that release's Compose files, checks their SHA-256, and:
 
 It saves no sandbox backend, adds no node, creates no Project or key and makes no model request. It ends by printing the console address and the Core key.
 
-If installation fails before the services become healthy, the installer removes the directory it created. Fix the reported cause and rerun the same command. Once the services have started, a later failure keeps the installation and its data. A new release is a new directory; see [version policy](./operations.md#installation-version-policy).
+Downloads and configuration checks happen before the installation directory is published. After that, failures preserve the configuration and data and show the service logs. Fix the reported cause and rerun the same command, or specify the installation directory:
+
+```bash
+curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash -s -- --install-dir "$HOME/.oac/core"
+```
+
+Use your chosen directory if it differs. A rerun uses the saved Compose file and settings; installation flags only apply to new directories. Existing images and containers are reused; missing images are downloaded. To change settings, edit `.env` and run `oac apply`. A new release needs a new directory; see [version policy](./operations.md#installation-version-policy).
 
 For insufficient space or quota, free space on the filesystem named by the error. Image-loading failures can also require space in Docker's storage, which may be on a different filesystem.
 
diff --git a/docs/getting-started/nodes.md b/docs/getting-started/nodes.md
index 7847678a1..fd99451cd 100644
--- a/docs/getting-started/nodes.md
+++ b/docs/getting-started/nodes.md
@@ -27,18 +27,9 @@ Node installation and removal require root. Web's command uses `sudo` unless the
 
 ### The command
 
-This is the command Web generates, with this installation's values:
-
-```sh
- (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-printf '\n==> Downloading node installer...\n' &&
-curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
-printf '==> Verifying node installer...\n' &&
-printf '%s  %s\n' '<installer-sha256>' "$d/node-install.pyz" | sha256sum -c --status &&
-printf '%s\n' '<enrollment-token>' | $s python3 "$d/node-install.pyz" ${NO_COLOR+--no-color} --enrollment-token-stdin --source-url 'https://core.example' --core-url 'https://core.example' --provider 'docker' --installation-id '<installation-id>')
-```
-
-- It downloads the installer into a private temporary directory, checks its SHA-256, and runs it with `sudo`, or directly in a root shell.
+Copy the current command from **Nodes → Add node**. It includes this installation's address, checksum and enrollment token. Before downloading, it checks Linux amd64, Python 3.9+ and the required tools. Temporary download failures retry up to three attempts. If checksum verification fails, copy a fresh command from Web and retry.
+
+- It downloads into the invoking account's private `~/.oac/node-bootstrap` directory, checks SHA-256, and runs with `sudo`, or directly in a root shell. Each retry clears the unfinished download while holding a lock; verified `<sha256>.pyz` files remain available to installers.
 - The token reaches the installer on standard input, so it never appears in a process argument, an environment variable or sudo's log.
 - The leading space keeps the command out of the shell history where `HISTCONTROL` ignores such lines (the Debian and Ubuntu default).
 
@@ -46,7 +37,7 @@ The installer shows each phase as it runs and, once Core confirms the node, a su
 
 ### Host requirements
 
-- Linux amd64 with systemd; Python 3.9+, `curl` and `sha256sum`; root or sudo.
+- Linux amd64 with systemd; Python 3.9+, `curl`, `sha256sum` and `flock`; root or sudo.
 - SELinux not enforcing. The installer does not support hosts with enforcing SELinux.
 - Docker: rootful Docker Engine running, its socket `/var/run/docker.sock` owned by the `docker` group with mode `0660`, enforcing CPU and memory limits (cgroup v2).
 - microsandbox: `/dev/kvm` in the `kvm` group (hardware or nested virtualization), and the libraries microsandbox links (glibc).
@@ -88,7 +79,7 @@ Root only prepares the account, the group and the unit; everything else, the Doc
 - Rerunning the same command is safe. Once the node is registered, a rerun uses the node's own credential, changes nothing that already matches and needs no token. It refuses, without changing anything, when the node's retained identity belongs to another Core address or installation.
 - A command that already expired, or was used on another host, fails at once with `Core rejected the node configuration read (HTTP 401)`: generate a new command and run it within 10 minutes.
 - If the command expires during a slow download, registration fails with `The enrollment command expired or was already used`. The downloaded files are kept: generate a new command in Web and run it.
-- Downloads resume where they stopped. A download that brings less than 64 KiB in a minute stops, keeping what it has; run the command again.
+- Failed or interrupted downloads discard their temporary files. A rerun downloads missing files from the beginning and reuses verified complete files. A transfer that brings less than 64 KiB in a minute stops; check the network and retry.
 - The Docker Runtime image is about 500 MB. On a slow link, load it first: copy the release's `oac-<commit>-linux-amd64-runtime.tar.gz` asset to the host and run `sudo docker load -i` on it. The installer then finds the exact image and skips the download.
 - Interrupting the installer, or closing its terminal, stops it; run the command again to continue.
 
diff --git a/docs/getting-started/operations.md b/docs/getting-started/operations.md
index ad027bc0e..83e63c196 100644
--- a/docs/getting-started/operations.md
+++ b/docs/getting-started/operations.md
@@ -161,24 +161,19 @@ An installation runs one release for its whole life. In-place version upgrades a
 
 To move to a new release, install it into a new, empty directory, with its own database, Core key and nodes, and add nodes from its Web. Keep the old installation, its data and its nodes until their work is finished. Nodes run the program of the console that added them and are never upgraded in place; Core accepts only nodes that speak its own node protocol.
 
-`install.sh` refuses a directory that is not empty. If the first start fails, it deletes the directory it created, and the same command can be run again. An installation that has already started is left in place.
+An interrupted installation can [resume with its saved configuration](./install.md#install). An unrelated nonempty directory is refused.
 
-Mutating `oac` commands hold `.oac.lock`. If another command holds it, retry after that command finishes. Never delete `.oac.lock` to get past a busy installation.
+The installer and mutating `oac` commands hold `.oac.lock`. The installer also holds a sibling `<install-dir>.install.lock` while preparing the directory. If another command holds either lock, retry after it finishes. Never delete a lock file to get past a busy installation.
 
 ## Troubleshooting
 
 | Symptom | Cause and fix |
 | --- | --- |
-| `Core installation requires Linux amd64 with Docker access` | Use Linux amd64 and an account with Docker access; root and ordinary users are supported |
-| `Installation failed: inspect prerequisites and private deployment files` | A prerequisite failed without its own message, most often Docker: check that `docker info` and `docker compose version` work for this user |
-| `Docker Compose 2.26.0 or newer is required …` | Update the Docker Compose plugin |
 | `Port N is already in use.` | Another program holds that port. Stop it, or choose another `--web-port`. The installer does not move to a different port |
-| `Installation directory is not empty` | Use an empty `--install-dir`, or [uninstall](#uninstall) the existing installation first |
+| `Directory is not a complete Core installation` | Preserve the directory and choose another `--install-dir` |
 | `configuration check failed; no service was changed` | `.env` has a value Core rejects. The message names the variable and not the value. Fix `.env` and run `oac apply` again |
 | `Docker Compose 2.26 or newer is required` | Update the Docker Compose plugin |
-| `The services did not start: …` | A new installation's first start failed, and the installer [removed what it created](./install.md#install). Compose's or Core's error is printed above it; fix the cause and run the same command again |
-| `Removal did not finish. Left: …` | A failed first start could not remove everything. Run the printed commands to remove what is left, or fix the cause and run the same command again |
-| `This installation did not finish installing …` | The installer stopped before reporting that the services were running. Rerun the installer command, which [removes what is left](./install.md#install) and installs again, or [uninstall](#uninstall) it |
+| `Installation and data retained at …` | Read the service logs above it, fix the cause, then [resume installation](./install.md#install); keep the data |
 | Web answers 403 `Forbidden` | The browser host is not `OAC_PUBLIC_URL`. Open that origin; a reverse proxy must pass the original Host |
 | Web shows that Core is unavailable (502) | Core is stopped or failing: `docker compose ps`, then Core's log |
 | Session creation returns 400 `model_provider_required` | No model provider: set a [default model](../configuration.md#default-models) for the harness, or pass one; self-hosted Sessions always pass their own |
diff --git a/docs/getting-started/self-hosted.md b/docs/getting-started/self-hosted.md
index 426ab539e..828d884e2 100644
--- a/docs/getting-started/self-hosted.md
+++ b/docs/getting-started/self-hosted.md
@@ -25,7 +25,7 @@ The machine needs:
 - Python and pip when the Session's packages need them;
 - any system packages your setup needs. The daemon never runs apt, sudo or another elevation command, so install them through the host's normal administration.
 
-No administrator privileges or Docker are needed. The Unix download command also uses `curl`, `tar`, `gzip`, a SHA-256 tool and the system file-lock command (`flock` on Linux, `lockf` on macOS).
+No administrator privileges or Docker are needed. The Unix download command also uses `curl`, `tar`, `gzip`, a SHA-256 tool and the system file-lock command (`flock` on Linux, `lockf` on macOS). Windows needs its system `tar.exe`; the command checks for it before downloading. The Runtime home must allow executable files to run. On a Unix `noexec` mount, choose another absolute directory with `OAC_RUNTIME_HOME` before running the command.
 
 ## Connect a machine
 
diff --git a/docs/zh/getting-started/install.md b/docs/zh/getting-started/install.md
index 55e711e89..da6dbe184 100644
--- a/docs/zh/getting-started/install.md
+++ b/docs/zh/getting-started/install.md
@@ -1,7 +1,7 @@
 ---
 title: "安装 Core 和 Web"
 source: docs/getting-started/install.md
-source_hash: b588dc9d68ba909fe9fadc440ee3f6fda9b79ebe0f14f6011d8bab603e17c710
+source_hash: d034ab565564ae9447c6e8b31b3d13d8868cae738f623a7471ba56ba517d67c8
 ---
 
 一条命令即可在 Linux 主机上安装 Core、Web 控制台和 PostgreSQL。用 Core 密钥登录 Web，设置默认模型并签发 Project API 密钥。应用使用这些密钥调用 Core。Session 在你添加的节点上的沙箱中运行，也可以在 E2B 上运行。
@@ -46,7 +46,13 @@ curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/
 
 安装程序不保存沙箱后端，不添加节点，不创建 Project 或密钥，也不发起模型请求。完成后输出控制台地址和 Core 密钥。
 
-如果服务进入健康状态之前安装失败，安装程序会删除它创建的目录。修复报告的问题后，重新运行同一命令。服务已经启动之后，后续失败会保留安装和数据。新发布版使用新目录；见[版本策略](operations.md#installation-version-policy)。
+安装目录就位前，先完成下载和配置检查。之后的失败会保留配置与数据，并显示服务日志。修复报错后，重新执行同一命令，或指定安装目录即可继续：
+
+```bash
+curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash -s -- --install-dir "$HOME/.oac/core"
+```
+
+如果使用了其他目录，请替换路径。重新执行时沿用已保存的 Compose 文件和设置；安装参数只对新目录生效。已有镜像和容器直接复用，缺失镜像会重新下载。修改设置请编辑 `.env` 并运行 `oac apply`。新发布版使用新目录；见[版本策略](operations.md#installation-version-policy)。
 
 空间或配额不足时，请释放错误信息所指文件系统的空间。加载镜像失败还可能需要释放 Docker 存储空间，该存储可能位于另一个文件系统。
 
diff --git a/docs/zh/getting-started/nodes.md b/docs/zh/getting-started/nodes.md
index c0097dc89..ec1e69d0b 100644
--- a/docs/zh/getting-started/nodes.md
+++ b/docs/zh/getting-started/nodes.md
@@ -1,7 +1,7 @@
 ---
 title: "添加和管理节点"
 source: docs/getting-started/nodes.md
-source_hash: 863ce05f8cfbc5da7c9f05c35c361ebd15a99fc3cebc952e2c8076810ff3fe3b
+source_hash: f5bec50bf81ebf1d08faaa54432da6a9c6e3ddbf88d93e33244276546c74aaab
 ---
 
 节点是一台 Linux 主机，在沙箱后端为 Docker 或 microsandbox 时，为 Core 托管 Session 运行沙箱。Core 将新 Session 分配给有空余容量的节点；节点创建沙箱，沙箱回连 Core。E2B 不需要节点。应用为自己的 Session 连接的机器是[自托管执行器](self-hosted.md)，而不是节点。
@@ -29,18 +29,9 @@ Core 主机与其他主机一样加入：要在它上面运行沙箱，将它添
 
 ### 命令 {#the-command}
 
-Web 生成如下命令，填入本安装的值：
+从 **Nodes → Add node** 复制当前命令，其中已填入本安装的地址、校验和与注册令牌。命令先检查 Linux amd64、Python 3.9+ 和必要工具，再下载文件；临时网络故障最多尝试三次。校验失败时，从 Web 复制新命令重试。
 
-```sh
- (umask 077; d=$(mktemp -d) || exit; trap 'rm -rf "$d"' EXIT; s=; [ "$(id -u)" -eq 0 ] || s=sudo
-printf '\n==> Downloading node installer...\n' &&
-curl -fsS --max-time 30 --max-filesize 1048576 'https://core.example/node-install/node-install.pyz' -o "$d/node-install.pyz" &&
-printf '==> Verifying node installer...\n' &&
-printf '%s  %s\n' '<installer-sha256>' "$d/node-install.pyz" | sha256sum -c --status &&
-printf '%s\n' '<enrollment-token>' | $s python3 "$d/node-install.pyz" ${NO_COLOR+--no-color} --enrollment-token-stdin --source-url 'https://core.example' --core-url 'https://core.example' --provider 'docker' --installation-id '<installation-id>')
-```
-
-- 下载到私有临时目录、检查 SHA-256，再通过 `sudo` 执行；root shell 中则直接执行。
+- 下载到当前账号的私有 `~/.oac/node-bootstrap` 目录，检查 SHA-256，再通过 `sudo` 执行；root shell 中则直接执行。每次持锁清理下载残片后重试，已验证的 `<sha256>.pyz` 保留供安装程序使用。
 - 令牌通过标准输入传给安装程序，不出现在进程参数、环境变量或 sudo 日志中。
 - 当 `HISTCONTROL` 忽略以空格开头的行时（Debian 和 Ubuntu 默认如此），前导空格能避免命令进入 shell 历史。
 
@@ -48,7 +39,7 @@ printf '%s\n' '<enrollment-token>' | $s python3 "$d/node-install.pyz" ${NO_COLOR
 
 ### 主机要求 {#host-requirements}
 
-- Linux amd64 和 systemd；Python 3.9+、`curl` 和 `sha256sum`；root 或 sudo。
+- Linux amd64 和 systemd；Python 3.9+、`curl`、`sha256sum` 和 `flock`；root 或 sudo。
 - SELinux 不处于 enforcing 模式。安装程序不支持 enforcing SELinux 主机。
 - Docker：正在运行的 rootful Docker Engine，其 `/var/run/docker.sock` 套接字属于 `docker` 组，权限为 `0660`，并强制执行 CPU 和内存限制（cgroup v2）。
 - microsandbox：`/dev/kvm` 属于 `kvm` 组（硬件或嵌套虚拟化），并具有 microsandbox 链接的库（glibc）。
@@ -90,7 +81,7 @@ root 只准备账号、组和服务单元；其他操作（包括 Docker 网络
 - 重新执行同一命令是安全的。节点注册后，重新运行使用节点自身凭据，不改变已匹配的内容，也无需令牌。保留的节点身份属于其他 Core 地址或安装时，程序拒绝且不修改任何内容。
 - 已过期或已在其他主机使用的命令立即失败，显示 `Core rejected the node configuration read (HTTP 401)`：生成新命令并在 10 分钟内执行。
 - 慢速下载期间命令过期时，注册失败并显示 `The enrollment command expired or was already used`。下载文件保留：在 Web 生成新命令后执行。
-- 下载从断点继续。每分钟下载不足 64 KiB 时会停止并保留已有内容；重新执行命令即可。
+- 失败或中断时删除下载残片；重新执行时从头下载缺失文件，复用已校验的完整文件。每分钟下载不足 64 KiB 时会停止，请检查网络后重试。
 - Docker Runtime 镜像约 500 MB。网络较慢时可提前加载：将发行资产 `oac-<commit>-linux-amd64-runtime.tar.gz` 复制到主机并运行 `sudo docker load -i`。安装程序发现精确匹配的镜像后跳过下载。
 - 中断安装程序或关闭终端会停止程序；重新执行命令继续。
 
diff --git a/docs/zh/getting-started/operations.md b/docs/zh/getting-started/operations.md
index 41ee66157..9a2a87cc0 100644
--- a/docs/zh/getting-started/operations.md
+++ b/docs/zh/getting-started/operations.md
@@ -1,7 +1,7 @@
 ---
 title: "管理你的安装"
 source: docs/getting-started/operations.md
-source_hash: 5ac3e57f943b8bb3fadbf9cda0a72399317ad101416ec28ca4037eea07703a82
+source_hash: 8b5ec8893b3e844a2c4173a4122cee17bf08350cd1ea2d5128e9a6c72f590907
 ---
 
 安装运维人员负责 Core 主机、存储和可用性。节点主机运行各自的服务；参阅[节点](nodes.md)。设置见[配置参考](../configuration.md)。
@@ -164,24 +164,19 @@ cd && rm -rf ~/.oac/core
 
 迁移到新版本时，安装到全新的空目录，使用独立数据库、Core 密钥和节点，并从新 Web 添加节点。保留旧安装、数据和节点，直到工作完成。节点运行添加它的控制台所提供的程序，不原地升级；Core 仅接受使用自身节点协议的节点。
 
-`install.sh` 拒绝非空目录。首次启动失败时，它删除自己创建的目录，同一命令可以再运行。已经启动的安装会保留。
+中断的安装可以[沿用已保存配置继续](install.md#install)。与本安装无关的非空目录会被拒绝。
 
-会修改状态的 `oac` 命令持有 `.oac.lock`。其他命令持有锁时，等待其结束后重试。不要删除 `.oac.lock` 来绕过忙碌安装。
+安装程序和修改状态的 `oac` 命令持有 `.oac.lock`。安装程序准备目录时还持有同级的 `<install-dir>.install.lock`。其他命令持有锁时，等待其结束后重试。不要删除锁文件来绕过忙碌安装。
 
 ## 问题排查 {#troubleshooting}
 
 | 症状 | 原因与解决方法 |
 | --- | --- |
-| `Core installation requires Linux amd64 with Docker access` | 使用 Linux amd64 和有 Docker 访问权限的账号；支持 root 和普通用户 |
-| `Installation failed: inspect prerequisites and private deployment files` | 前置条件失败但未单独报告，通常是 Docker：检查此用户能运行 `docker info` 和 `docker compose version` |
-| `Docker Compose 2.26.0 or newer is required …` | 更新 Docker Compose 插件 |
 | `Port N is already in use.` | 其他程序占用该端口。停止它，或另选 `--web-port`。安装程序不会改用其他端口 |
-| `Installation directory is not empty` | 使用空的 `--install-dir`，或先[卸载](#uninstall)现有安装 |
+| `Directory is not a complete Core installation` | 保留目录内容，选择另一个 `--install-dir` |
 | `configuration check failed; no service was changed` | `.env` 中有 Core 拒绝的值。消息只包含变量名。修正 `.env` 后再次运行 `oac apply` |
 | `Docker Compose 2.26 or newer is required` | 更新 Docker Compose 插件 |
-| `The services did not start: …` | 新安装首次启动失败，安装程序[删除了所创建内容](install.md#install)。上方输出 Compose 或 Core 错误；修复后执行同一命令 |
-| `Removal did not finish. Left: …` | 首次启动失败后没能删干净。执行输出的命令移除残留，或修复原因后重新执行原命令 |
-| `This installation did not finish installing …` | 安装程序在报告服务运行前停止。重新执行安装命令，[清理残留](install.md#install)后重新安装，或[卸载](#uninstall) |
+| `Installation and data retained at …` | 查看上方服务日志，修复原因，再[继续安装](install.md#install)；不要删除数据 |
 | Web 返回 403 `Forbidden` | 浏览器主机名不是 `OAC_PUBLIC_URL`。打开该源地址；反向代理必须传递原始 Host |
 | Web 显示 Core 不可用（502） | Core 停止或失败：先 `docker compose ps`，再查看 Core 日志 |
 | 创建 Session 返回 400 `model_provider_required` | 缺少模型提供商：为 Harness 设置[默认模型](../configuration.md#default-models)，或显式提供；自托管 Session 始终自带提供商 |
diff --git a/docs/zh/getting-started/self-hosted.md b/docs/zh/getting-started/self-hosted.md
index 7765a1739..9a075178b 100644
--- a/docs/zh/getting-started/self-hosted.md
+++ b/docs/zh/getting-started/self-hosted.md
@@ -1,7 +1,7 @@
 ---
 title: "自托管执行器"
 source: docs/getting-started/self-hosted.md
-source_hash: 800b3eb891c20d34215344c0ea147dbb79b5921d25d6f2405bcfe5edccd88038
+source_hash: c42a64b5e59406594143866c503817525c55ea844d858f25119c8fa54993134c
 ---
 
 `self_hosted` Session 在应用拥有的机器上运行：工作站、虚拟机或你管理的沙箱。应用通过 `/v1` 创建 Session，并获得安装 `oac-daemon`、启动它并连接 Core 的命令。Web 在 Session 页面展示同一命令；Web 是可选的。Core 不创建、停止或回收这台机器。
@@ -27,7 +27,7 @@ Session 自带模型提供商；安装默认模型不适用（[原因](../../../
 - Session 的软件包需要时，安装 Python 和 pip；
 - 环境设置所需的系统软件包。守护进程不运行 apt、sudo 或其他提权命令，请通过主机的常规管理方式安装。
 
-不需要管理员权限或 Docker。Unix 下载命令还使用 `curl`、`tar`、`gzip`、SHA-256 工具和系统文件锁命令（Linux 为 `flock`，macOS 为 `lockf`）。
+不需要管理员权限或 Docker。Unix 下载命令还使用 `curl`、`tar`、`gzip`、SHA-256 工具和系统文件锁命令（Linux 为 `flock`，macOS 为 `lockf`）。Windows 需要系统自带的 `tar.exe`，命令会在下载前检查。Runtime 主目录必须允许执行文件。如果 Unix 挂载点设为 `noexec`，请先用 `OAC_RUNTIME_HOME` 指定另一个允许执行的绝对目录，再运行命令。
 
 ## 连接机器 {#connect-a-machine}
 
diff --git a/services/core/internal/nativeinstaller/assets/bootstrap.ps1 b/services/core/internal/nativeinstaller/assets/bootstrap.ps1
index 92c0b8094..3a8cae90c 100644
--- a/services/core/internal/nativeinstaller/assets/bootstrap.ps1
+++ b/services/core/internal/nativeinstaller/assets/bootstrap.ps1
@@ -4,6 +4,8 @@ param(
   [Parameter(ValueFromRemainingArguments=$true)][string[]]$InstallArguments
 )
 $ErrorActionPreference = 'Stop'
+$tar = Join-Path $env:SystemRoot 'System32\tar.exe'
+if (!(Test-Path -LiteralPath $tar -PathType Leaf)) { throw 'Windows tar.exe is required. Install the Windows archive tools, then rerun this command.' }
 Add-Type -AssemblyName System.Net.Http
 if (!("OacNativeDownloadSpace" -as [type])) {
   Add-Type -TypeDefinition @'
@@ -158,7 +160,7 @@ try {
   $bundle = Join-Path $work 'bundle'
   [IO.Directory]::CreateDirectory($bundle) | Out-Null
   Write-Host 'Extracting the installer...'
-  & (Join-Path $env:SystemRoot 'System32\tar.exe') -xzf $archive -C $bundle
+  & $tar -xzf $archive -C $bundle
   if ($LASTEXITCODE -ne 0) { throw 'Installer extraction failed. Check disk space, quota and filesystem permissions.' }
   $endpoint = $Base -replace '/install/[^/]+$', '/installation'
   Write-Host 'Starting installation...'
diff --git a/services/core/internal/nativeinstaller/assets/bootstrap.sh b/services/core/internal/nativeinstaller/assets/bootstrap.sh
index e14d88759..c4bf10c9f 100644
--- a/services/core/internal/nativeinstaller/assets/bootstrap.sh
+++ b/services/core/internal/nativeinstaller/assets/bootstrap.sh
@@ -90,4 +90,13 @@ space "$unpacked"
 printf 'Extracting the installer...\n'
 mkdir "$work/bundle"
 run tar -xzf "$work/bundle.tar.gz" -C "$work/bundle" || fail 'Installer extraction failed. Check disk space, quota and filesystem permissions.'
-run "$work/bundle/oac-daemon" install --onboard-url "${base%/install/*}/installation" --authorization "$authorization" "$@"
+[ -x "$work/bundle/oac-daemon" ] || fail 'Cannot start the native installer. Check executable permissions and use a Runtime home that permits execution.'
+if run "$work/bundle/oac-daemon" install --onboard-url "${base%/install/*}/installation" --authorization "$authorization" "$@"; then
+  exit 0
+else
+  code=$?
+  case "$code" in
+    126|127) fail 'Cannot start the native installer. Check that the Runtime home permits execution (not a noexec mount) and that this host has the required native libraries.';;
+    *) exit "$code";;
+  esac
+fi
diff --git a/services/core/internal/nativeinstaller/bootstrap_recovery_test.go b/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
index a0d112925..441e0d3c6 100644
--- a/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
+++ b/services/core/internal/nativeinstaller/bootstrap_recovery_test.go
@@ -163,3 +163,64 @@ func TestBootstrapRejectsLowSpaceBeforeNetwork(t *testing.T) {
 		t.Fatal("low-space failure left staging")
 	}
 }
+
+func TestBootstrapExplainsUnexecutableInstaller(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX executable permissions")
+	}
+	var buffer bytes.Buffer
+	z := gzip.NewWriter(&buffer)
+	tw := tar.NewWriter(z)
+	data := []byte("#!/bin/sh\nexit 0\n")
+	if err := tw.WriteHeader(&tar.Header{Name: "oac-daemon", Mode: 0600, Size: int64(len(data))}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tw.Write(data); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := z.Close(); err != nil {
+		t.Fatal(err)
+	}
+	archive := buffer.Bytes()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, ".sha256") {
+			fmt.Fprintf(w, "%x\n", sha256.Sum256(archive))
+			return
+		}
+		w.Write(archive)
+	}))
+	defer server.Close()
+	home := t.TempDir()
+	output, err := bootstrapCommand(t, server.URL, home).CombinedOutput()
+	if err == nil || !bytes.Contains(output, []byte("Cannot start the native installer")) {
+		t.Fatalf("%v: %s", err, output)
+	}
+	if _, err := os.Stat(filepath.Join(home, "native-download", "staging")); !os.IsNotExist(err) {
+		t.Fatal("staging remains")
+	}
+}
+
+func TestWindowsBootstrapChecksArchiveToolBeforeDownload(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("Windows archive prerequisite")
+	}
+	var requests atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { requests.Add(1); w.WriteHeader(500) }))
+	defer server.Close()
+	home := filepath.Join(t.TempDir(), "runtime")
+	command := bootstrapCommand(t, server.URL, home)
+	quote := func(value string) string { return "'" + strings.ReplaceAll(value, "'", "''") + "'" }
+	// Keep the real SystemRoot while PowerShell itself loads.
+	command.Args = []string{command.Path, "-NoProfile", "-NonInteractive", "-Command",
+		"$env:SystemRoot = " + quote(t.TempDir()) + "; & './assets/bootstrap.ps1' -Base " + quote(server.URL) + " -Authorization 'fixture-grant'"}
+	output, err := command.CombinedOutput()
+	if err == nil || !bytes.Contains(output, []byte("tar.exe is required")) || requests.Load() != 0 {
+		t.Fatalf("%v: %s", err, output)
+	}
+	if _, err := os.Stat(home); !os.IsNotExist(err) {
+		t.Fatal("home created before prerequisite check")
+	}
+}

From c178f4438007fb11de7b485d7ad96581d014ecee Mon Sep 17 00:00:00 2001
From: RyanLee <33855278+RyanLee-Dev@users.noreply.github.com>
Date: Wed, 7 Oct 2026 16:26:04 +0800
Subject: [PATCH 7/9] Remove the unserved daemon pairing path and unused
 helpers (#363)

* Remove the unserved daemon pairing path and runtimecrypto

`oac-daemon connect --url --token` posted to /api/v1/runtimes/pair, which
Core does not serve and no contract documents, so the path always failed.
Its envelope encryption was never wired: Core never stored or used
runner_public_key, and SealForRuntime had no caller outside its fixture
generator.

Daemon credentials come from a Provider bootstrap file, self-hosted
Environment enrollment or the oac-core-device profile, all unchanged.

- Delete pair.go, the inline pairing flags, their environment handoff and
  their tests.
- Delete internal/runtimecrypto; golang.org/x/crypto is no longer required.
- auth: drop the pairing-only Profile fields and Save, which no longer has
  a production caller; the not-found error points to oac-core-device.
- daemonize: drop ReExecOptions.ExtraEnv, which only carried the pairing
  token to the background child.
- paths: drop EnsureProfileDir, whose only caller was auth.Save.
- Reword comments and docs that described pairing.

* Remove obsolete Parsar integration naming guidance

* docs: sync bootstrap translation after pairing removal

---------

Co-authored-by: saladday <1203511142@qq.com>
---
 CONTRIBUTING.md                               |   2 +-
 apps/daemon/cmd/oac-daemon/main.go            |   4 +-
 apps/daemon/internal/auth/store.go            |  66 +-------
 apps/daemon/internal/auth/store_test.go       | 133 +++++-----------
 apps/daemon/internal/cli/connect.go           | 146 +++---------------
 apps/daemon/internal/cli/connect_bootstrap.go |   2 +-
 .../internal/cli/connect_bootstrap_test.go    |  18 ++-
 .../internal/cli/connect_environment.go       |   2 +-
 .../internal/cli/connect_environment_test.go  |  11 --
 apps/daemon/internal/cli/connect_test.go      |  60 -------
 .../internal/cli/native_install_test.go       |   3 +-
 apps/daemon/internal/cli/pair.go              | 145 -----------------
 apps/daemon/internal/cli/pair_test.go         |  95 ------------
 apps/daemon/internal/cli/root.go              |   4 +-
 apps/daemon/internal/cli/status.go            |   8 +-
 apps/daemon/internal/daemonize/fork.go        |   5 -
 apps/daemon/internal/daemonize/fork_test.go   |   6 +-
 .../daemon/internal/daemonize/pidfile_test.go |   3 +-
 apps/daemon/internal/paths/paths.go           |  19 +--
 apps/daemon/internal/paths/paths_test.go      |  31 ----
 apps/daemon/internal/transport/ws.go          |   2 +-
 docs/runtime-bootstrap.md                     |   2 +-
 docs/zh/runtime-bootstrap.md                  |   4 +-
 go.mod                                        |   1 -
 go.sum                                        |   2 -
 .../runtimecrypto/cmd/emit-fixture/main.go    |  76 ---------
 internal/runtimecrypto/runtime_seal.go        | 110 -------------
 internal/runtimecrypto/runtime_seal_test.go   | 135 ----------------
 .../runtimecrypto/runtime_seal_wire_test.go   |  56 -------
 internal/runtimecrypto/testdata/wire_v1.json  |   8 -
 packages/claude-sdk-adapter/README.md         |   4 +-
 services/core/internal/runtimegateway/auth.go |   2 +-
 .../core/internal/runtimegateway/handler.go   |  10 +-
 .../core/internal/runtimegateway/routes.go    |   4 +-
 34 files changed, 114 insertions(+), 1065 deletions(-)
 delete mode 100644 apps/daemon/internal/cli/connect_test.go
 delete mode 100644 apps/daemon/internal/cli/pair.go
 delete mode 100644 apps/daemon/internal/cli/pair_test.go
 delete mode 100644 internal/runtimecrypto/cmd/emit-fixture/main.go
 delete mode 100644 internal/runtimecrypto/runtime_seal.go
 delete mode 100644 internal/runtimecrypto/runtime_seal_test.go
 delete mode 100644 internal/runtimecrypto/runtime_seal_wire_test.go
 delete mode 100644 internal/runtimecrypto/testdata/wire_v1.json

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 04cbec682..95a989fe2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -142,7 +142,7 @@ Native adapter changes require their build/check targets and live provider accep
 | Provider ownership labels | `io.oac.*` |
 | E2B metadata | `oac_*` |
 
-Provider bootstrap, Runtime images and Harness adapters must agree on these names. The separate Parsar product integration settings keep their own names.
+Provider bootstrap, Runtime images and Harness adapters must agree on these names.
 
 The [installation version policy](docs/getting-started/operations.md#installation-version-policy) owns release changes and preservation of installed data and resources.
 
diff --git a/apps/daemon/cmd/oac-daemon/main.go b/apps/daemon/cmd/oac-daemon/main.go
index 368943517..464f72f9d 100644
--- a/apps/daemon/cmd/oac-daemon/main.go
+++ b/apps/daemon/cmd/oac-daemon/main.go
@@ -1,5 +1,5 @@
-// Command oac-daemon is the reverse-WebSocket worker that pairs a user
-// machine with a OpenAgentCore server and exposes a local agent CLI
+// Command oac-daemon is the reverse-WebSocket worker that connects a
+// machine to an OpenAgentCore server and exposes a local agent CLI
 // subprocess as a connector_type=agent_daemon target. See
 // apps/daemon/README.md for the subcommand spec.
 package main
diff --git a/apps/daemon/internal/auth/store.go b/apps/daemon/internal/auth/store.go
index 3a69123e8..ec636f67e 100644
--- a/apps/daemon/internal/auth/store.go
+++ b/apps/daemon/internal/auth/store.go
@@ -1,9 +1,7 @@
-// Package auth persists the credential bundle from
-// /api/v1/runtimes/pair: server URL, runtime row id (= device_id), and
-// the long-lived runner_credential. Stored as JSON per-profile at
-// ~/.oac/daemon/<profile>/auth.json (0o600), written via
-// atomic rename so a half-flushed pair never leaves the daemon paired
-// with garbage state.
+// Package auth reads the daemon credential profile written by
+// oac-core-device: server URL, runtime row id (= device_id), and the
+// long-lived runner_credential. Stored as JSON per-profile at
+// ~/.oac/daemon/<profile>/auth.json (0o600).
 package auth
 
 import (
@@ -11,21 +9,19 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
 )
 
-// Profile is the on-disk representation of one paired credential.
+// Profile is the on-disk representation of one daemon credential.
 type Profile struct {
 	// ServerURL is the absolute base URL the daemon dials (no
 	// trailing slash). The daemon joins this with paths like
 	// /agent-daemon/bootstrap.
 	ServerURL string `json:"server_url"`
 
-	// RuntimeID is the runtimes row id minted at pair time. The
-	// gateway uses it verbatim as device_id on WS upgrade.
+	// RuntimeID is the runtimes row id. The gateway uses it verbatim
+	// as device_id on WS upgrade.
 	RuntimeID string `json:"runtime_id"`
 
 	// RunnerCredential is the bearer presented on every
@@ -35,57 +31,11 @@ type Profile struct {
 	RunnerCredential string `json:"runner_credential"`
 
 	DeviceName string `json:"device_name,omitempty"`
-
-	Hostname string `json:"hostname,omitempty"`
-
-	// PairedAt is when the credential was minted. `omitzero` because
-	// `omitempty` doesn't elide zero structs like time.Time.
-	PairedAt time.Time `json:"paired_at,omitzero"`
-
-	// RunnerPublicKey is the base64 X25519 public half generated at
-	// pair time. Server stores the matching value in
-	// runtimes.config.runner_public_key for SealAnonymous addressed
-	// to this daemon.
-	RunnerPublicKey string `json:"runner_public_key,omitempty"`
-
-	// RunnerPrivateKey is the base64 X25519 private half — used by
-	// runtimecrypto.OpenSeal to decrypt incoming sealed payloads.
-	// MUST NEVER appear in logs or leave the box.
-	RunnerPrivateKey string `json:"runner_private_key,omitempty"`
 }
 
 // ErrNotPaired is returned by Load when no auth.json exists for the
 // requested profile.
-var ErrNotPaired = errors.New("auth: not paired — use `oac-daemon connect --url ... --token ...`")
-
-// Save writes p atomically to the profile's auth.json (0o600 even if
-// the previous file was world-readable).
-func Save(profile string, p Profile) error {
-	if profile == "" {
-		return fmt.Errorf("auth: profile name required")
-	}
-	dir, err := paths.EnsureProfileDir(profile)
-	if err != nil {
-		return err
-	}
-	raw, err := json.MarshalIndent(p, "", "  ")
-	if err != nil {
-		return errors.New("auth: could not encode profile")
-	}
-	if err = runtimefs.EnsurePrivateDir(dir); err != nil {
-		return errors.New("auth: private profile unavailable")
-	}
-	held, err := os.OpenRoot(dir)
-	if err != nil {
-		return errors.New("auth: private profile unavailable")
-	}
-	defer held.Close()
-	if err = runtimefs.WritePrivateAtomic(held, "auth.json", raw); err != nil {
-		return errors.New("auth: private profile write failed")
-	}
-
-	return nil
-}
+var ErrNotPaired = errors.New("auth: no daemon credential profile — create one with oac-core-device")
 
 // Load reads the profile's auth.json. Returns ErrNotPaired wrapping
 // fs.ErrNotExist when the file is missing.
diff --git a/apps/daemon/internal/auth/store_test.go b/apps/daemon/internal/auth/store_test.go
index 1d76ad1b7..1d3bfffcc 100644
--- a/apps/daemon/internal/auth/store_test.go
+++ b/apps/daemon/internal/auth/store_test.go
@@ -1,16 +1,16 @@
 package auth_test
 
 import (
+	"encoding/json"
 	"errors"
 	"io/fs"
 	"os"
 	"path/filepath"
-	"runtime"
 	"testing"
-	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/auth"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
 )
 
 func withTempHome(t *testing.T) string {
@@ -20,105 +20,62 @@ func withTempHome(t *testing.T) string {
 	return dir
 }
 
-func TestSaveLoadRoundTrip(t *testing.T) {
-	_ = withTempHome(t)
-	now := time.Date(2026, 6, 4, 12, 0, 0, 0, time.UTC)
-	want := auth.Profile{
-		ServerURL:        "https://core.example.com",
-		RuntimeID:        "rt_abc123",
-		RunnerCredential: "secret-credential",
-		DeviceName:       "alice-mac",
-		Hostname:         "alice-mac.local",
-		PairedAt:         now,
-	}
-	if err := auth.Save("test", want); err != nil {
-		t.Fatalf("Save: %v", err)
-	}
-	got, err := auth.Load("test")
+func profileDir(t *testing.T, profile string) string {
+	t.Helper()
+	dir, err := paths.ProfileDir(profile)
 	if err != nil {
-		t.Fatalf("Load: %v", err)
+		t.Fatalf("ProfileDir: %v", err)
 	}
-	if got.ServerURL != want.ServerURL ||
-		got.RuntimeID != want.RuntimeID ||
-		got.RunnerCredential != want.RunnerCredential ||
-		got.DeviceName != want.DeviceName ||
-		got.Hostname != want.Hostname ||
-		!got.PairedAt.Equal(want.PairedAt) {
-		t.Fatalf("Load round-trip mismatch:\n got=%+v\nwant=%+v", got, want)
+	if err := runtimefs.EnsurePrivateDir(dir); err != nil {
+		t.Fatalf("EnsurePrivateDir: %v", err)
 	}
+	return dir
 }
 
-func TestSaveSetsRestrictivePerms(t *testing.T) {
-	_ = withTempHome(t)
-	if err := auth.Save("default", auth.Profile{ServerURL: "https://x", RuntimeID: "rt", RunnerCredential: "c"}); err != nil {
-		t.Fatalf("Save: %v", err)
-	}
-	authPath, err := paths.AuthFile("default")
-	if err != nil {
-		t.Fatalf("AuthFile: %v", err)
-	}
-	info, err := os.Stat(authPath)
+func writeProfile(t *testing.T, profile string, p auth.Profile) {
+	t.Helper()
+	dir := profileDir(t, profile)
+	raw, err := json.Marshal(p)
 	if err != nil {
-		t.Fatalf("stat auth.json: %v", err)
+		t.Fatalf("marshal profile: %v", err)
 	}
-	// Unix stores credentials with 0600; Windows uses normal account ACLs,
-	// which are not represented by Go permission bits.
-	if mode := info.Mode().Perm(); runtime.GOOS != "windows" && mode != 0o600 {
-		t.Errorf("auth.json perm = %o, want 0600", mode)
+	if err := os.WriteFile(filepath.Join(dir, "auth.json"), raw, 0o600); err != nil {
+		t.Fatalf("write auth.json: %v", err)
 	}
 }
 
-func TestSaveIsAtomicNoStrayTempFile(t *testing.T) {
+func TestLoadReadsProfile(t *testing.T) {
 	_ = withTempHome(t)
-	if err := auth.Save("default", auth.Profile{ServerURL: "https://x", RuntimeID: "rt", RunnerCredential: "c"}); err != nil {
-		t.Fatalf("Save: %v", err)
-	}
-	authPath, err := paths.AuthFile("default")
-	if err != nil {
-		t.Fatalf("AuthFile: %v", err)
+	want := auth.Profile{
+		ServerURL:        "https://core.example.com",
+		RuntimeID:        "rt_abc123",
+		RunnerCredential: "secret-credential",
+		DeviceName:       "alice-mac",
 	}
-	// Writes to auth.json.tmp then renames — no stray .tmp on success.
-	entries, err := os.ReadDir(filepath.Dir(authPath))
+	writeProfile(t, "test", want)
+	got, err := auth.Load("test")
 	if err != nil {
-		t.Fatalf("ReadDir: %v", err)
+		t.Fatalf("Load: %v", err)
 	}
-	for _, e := range entries {
-		if filepath.Ext(e.Name()) == ".tmp" {
-			t.Fatalf("found stray temp file after Save: %s", e.Name())
-		}
+	if got != want {
+		t.Fatalf("Load mismatch:\n got=%+v\nwant=%+v", got, want)
 	}
 }
 
-func TestSaveOverwritesAndHealsPerms(t *testing.T) {
+func TestLoadIgnoresLegacyProfileFields(t *testing.T) {
 	_ = withTempHome(t)
-	if err := auth.Save("default", auth.Profile{ServerURL: "https://x", RuntimeID: "rt1", RunnerCredential: "c1"}); err != nil {
-		t.Fatalf("Save first: %v", err)
-	}
-	authPath, err := paths.AuthFile("default")
-	if err != nil {
-		t.Fatalf("AuthFile: %v", err)
-	}
-	// Simulate a previously-world-readable file (user chmod'd it);
-	// atomic-rename Save must re-establish 0600 on the new inode.
-	if err := os.Chmod(authPath, 0o644); err != nil {
-		t.Fatalf("chmod loose perms: %v", err)
-	}
-	if err := auth.Save("default", auth.Profile{ServerURL: "https://x", RuntimeID: "rt2", RunnerCredential: "c2"}); err != nil {
-		t.Fatalf("Save second: %v", err)
-	}
-	info, err := os.Stat(authPath)
-	if err != nil {
-		t.Fatalf("stat: %v", err)
-	}
-	if mode := info.Mode().Perm(); runtime.GOOS != "windows" && mode != 0o600 {
-		t.Errorf("perm after re-save = %o, want 0600 (healing failed)", mode)
+	raw := `{"server_url":"https://core.example.com/api/v1","runtime_id":"rt","runner_credential":"c","device_name":"d",` +
+		`"hostname":"h","paired_at":"2026-06-04T12:00:00Z","runner_public_key":"pub","runner_private_key":"priv"}`
+	if err := os.WriteFile(filepath.Join(profileDir(t, "legacy"), "auth.json"), []byte(raw), 0o600); err != nil {
+		t.Fatalf("write auth.json: %v", err)
 	}
-	got, err := auth.Load("default")
+	got, err := auth.Load("legacy")
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
-	if got.RuntimeID != "rt2" || got.RunnerCredential != "c2" {
-		t.Errorf("overwrite did not take effect: %+v", got)
+	want := auth.Profile{ServerURL: "https://core.example.com/api/v1", RuntimeID: "rt", RunnerCredential: "c", DeviceName: "d"}
+	if got != want {
+		t.Fatalf("Load = %+v, want %+v", got, want)
 	}
 }
 
@@ -137,14 +94,11 @@ func TestLoadMissingReturnsErrNotPaired(t *testing.T) {
 
 func TestLoadCorruptJSONReturnsError(t *testing.T) {
 	_ = withTempHome(t)
-	dir, err := paths.EnsureProfileDir("default")
-	if err != nil {
-		t.Fatalf("EnsureProfileDir: %v", err)
-	}
+	dir := profileDir(t, "default")
 	if err := os.WriteFile(filepath.Join(dir, "auth.json"), []byte("{not valid json"), 0o600); err != nil {
 		t.Fatalf("seed corrupt file: %v", err)
 	}
-	_, err = auth.Load("default")
+	_, err := auth.Load("default")
 	if err == nil {
 		t.Fatal("Load returned nil error on corrupt JSON")
 	}
@@ -158,9 +112,7 @@ func TestDeleteIsIdempotent(t *testing.T) {
 	if err := auth.Delete("default"); err != nil {
 		t.Fatalf("Delete on missing profile returned %v, want nil (idempotent)", err)
 	}
-	if err := auth.Save("default", auth.Profile{ServerURL: "https://x", RuntimeID: "rt", RunnerCredential: "c"}); err != nil {
-		t.Fatalf("Save: %v", err)
-	}
+	writeProfile(t, "default", auth.Profile{ServerURL: "https://x", RuntimeID: "rt", RunnerCredential: "c"})
 	if err := auth.Delete("default"); err != nil {
 		t.Fatalf("Delete: %v", err)
 	}
@@ -172,10 +124,3 @@ func TestDeleteIsIdempotent(t *testing.T) {
 		t.Fatalf("Delete second call = %v, want nil", err)
 	}
 }
-
-func TestSaveRejectsEmptyProfile(t *testing.T) {
-	_ = withTempHome(t)
-	if err := auth.Save("", auth.Profile{ServerURL: "https://x", RuntimeID: "rt", RunnerCredential: "c"}); err == nil {
-		t.Fatal("Save with empty profile should error")
-	}
-}
diff --git a/apps/daemon/internal/cli/connect.go b/apps/daemon/internal/cli/connect.go
index 32b8e885c..a0d6abed1 100644
--- a/apps/daemon/internal/cli/connect.go
+++ b/apps/daemon/internal/cli/connect.go
@@ -7,7 +7,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
@@ -27,36 +26,25 @@ const (
 
 	// Allow the native process grace period and subsequent owner/pipe cleanup.
 	stopTimeout = 10 * time.Second
-
-	connectInlineURLEnv        = "OAC_RUNTIME_DAEMON_CONNECT_URL"
-	connectInlineTokenEnv      = "OAC_RUNTIME_DAEMON_CONNECT_TOKEN"
-	connectInlineDeviceNameEnv = "OAC_RUNTIME_DAEMON_CONNECT_DEVICE_NAME"
 )
 
 // runConnect dials /agent-daemon/bootstrap, opens /agent-daemon/ws,
 // wires the dispatch router, and routes Envelope traffic both ways
 // until either SIGINT/SIGTERM or a permanent credential rejection.
 //
-// `connect --url --token` folds one-shot pairing into the connect step:
-// the daemon consumes the pairing token, persists the returned runner
-// credential to auth.json, and connects. Subsequent `connect -b`
-// invocations reload the persisted profile.
+// The daemon credential comes from a Provider bootstrap file
+// (--bootstrap-file), self-hosted Environment enrollment
+// (--remote/--environment-id/--credential-file) or the saved profile
+// written by oac-core-device.
 //
 // -b re-execs the binary in the background with stdio redirected to
 // connect.log and the child PID written to connect.pid. The child
-// re-enters runConnect via BackgroundSentinelEnv. When --token is
-// supplied, the parent forks before pairing so the one-shot token is
-// consumed by the long-lived child. Inline pairing flags are scrubbed
-// from child argv and passed via environment to keep the token out of
-// process listings.
+// re-enters runConnect via BackgroundSentinelEnv.
 func runConnect(ctx *runContext, args []string) error {
 	fs := newFlagSet("connect")
 	var (
-		profile        = fs.String("profile", paths.DefaultProfile, "profile name for paired credentials and pid/log files")
+		profile        = fs.String("profile", paths.DefaultProfile, "profile name for daemon credentials and pid/log files")
 		background     = fs.Bool("b", false, "fork into the background; writes connect.pid + connect.log")
-		serverURL      = fs.String("url", "", "Core server base URL; with --token, pair inline before connecting")
-		token          = fs.String("token", "", "pairing token; with --url, connect consumes it without writing auth.json")
-		deviceName     = fs.String("device-name", "", "human label for inline pairing (defaults to hostname)")
 		remote         = fs.String("remote", "", "self-hosted Environment remote_url, unchanged")
 		environment    = fs.String("environment-id", "", "self-hosted Environment ID")
 		bootstrapFile  = fs.String("bootstrap-file", "", "absolute path to Provider-to-Runtime connection JSON")
@@ -74,21 +62,13 @@ func runConnect(ctx *runContext, args []string) error {
 	} else if !errors.Is(err, os.ErrNotExist) {
 		return errors.New("connect: cannot inspect native installation; use oac-daemon start")
 	}
-	// Hydrate inline pairing inputs from env in BOTH parent and the
-	// re-execed background child. Server-spawned sandboxes pass the
-	// token via OAC_RUNTIME_DAEMON_CONNECT_TOKEN/URL env rather than --url
-	// /--token flags; without this hydration before the pre-fork
-	// auth.json check below, the parent would take the "rely on
-	// auth.json" branch and bail with "not paired". Idempotent —
-	// fills only empty flags and unsets the env after consuming.
-	loadInlineConnectEnv(serverURL, token, deviceName)
 	if err := paths.ValidateProfile(*profile); err != nil {
 		return fmt.Errorf("connect: %w", err)
 	}
 	var bootstrapped *auth.Profile
 	if *bootstrapFile != "" {
-		if *serverURL != "" || *token != "" || *deviceName != "" || *remote != "" || *environment != "" || *credentialFile != "" || fs.NArg() != 0 {
-			return errors.New("connect: bootstrap input cannot be combined with enrollment or pairing options")
+		if *remote != "" || *environment != "" || *credentialFile != "" || fs.NArg() != 0 {
+			return errors.New("connect: bootstrap input cannot be combined with enrollment options")
 		}
 		bootstrapped, err = bootstrapProfile(*bootstrapFile)
 		if err != nil {
@@ -96,47 +76,30 @@ func runConnect(ctx *runContext, args []string) error {
 		}
 	}
 	if *remote != "" || *environment != "" || *credentialFile != "" {
-		if *serverURL != "" || *token != "" || *deviceName != "" || fs.NArg() != 0 {
-			return errors.New("connect: Environment enrollment cannot use pairing options or positional arguments")
+		if fs.NArg() != 0 {
+			return errors.New("connect: Environment enrollment cannot use positional arguments")
 		}
 		connectCtx, stop := daemonize.NotifyContext(context.Background())
 		defer stop()
 		return runEnvironmentConnect(connectCtx, ctx, *profile, *background, *remote, *environment, *credentialFile)
 	}
 
-	inlinePair := strings.TrimSpace(*serverURL) != "" || strings.TrimSpace(*token) != ""
-	if inlinePair {
-		if strings.TrimSpace(*serverURL) == "" {
-			return fmt.Errorf("connect: --url is required when --token is supplied")
-		}
-		if strings.TrimSpace(*token) == "" {
-			return fmt.Errorf("connect: --token is required when --url is supplied")
-		}
-	}
-
 	// -b mode: parent forks, child re-enters with sentinel env set
-	// and skips this branch. Fork before inline pairing so the
-	// one-shot token is consumed by the child that owns the WS loop.
+	// and skips this branch.
 	if *background && !daemonize.IsBackgroundChild() {
 		// Validate auth.json exists before forking so the error
 		// surfaces in the user's terminal instead of the background
 		// child's log.
-		if !inlinePair && bootstrapped == nil {
+		if bootstrapped == nil {
 			if _, err := auth.Load(*profile); err != nil {
 				return fmt.Errorf("connect: %w", err)
 			}
 		}
-		argv := os.Args
-		extraEnv := []string(nil)
-		if inlinePair {
-			argv = scrubInlineConnectArgs(os.Args)
-			extraEnv = inlineConnectEnv(*serverURL, *token, *deviceName)
-		}
-		return spawnBackground(context.Background(), ctx, *profile, argv, extraEnv)
+		return spawnBackground(context.Background(), ctx, *profile, os.Args)
 	}
 
-	// Self-check before pairing/loading credentials so a machine with
-	// no supported agent CLI fails before consuming a one-shot token.
+	// Self-check before loading credentials so a machine with no
+	// supported agent CLI fails fast.
 	agentCLIs, err := preflightAgentCLIs(context.Background(), ctx, *profile)
 	if err != nil {
 		return err
@@ -146,84 +109,20 @@ func runConnect(ctx *runContext, args []string) error {
 	if bootstrapped != nil {
 		prof = *bootstrapped
 	} else {
-		prof, err = resolveConnectProfile(*profile, *serverURL, *token, *deviceName)
+		prof, err = auth.Load(*profile)
 		if err != nil {
-			return err
+			return fmt.Errorf("connect: %w", err)
 		}
 	}
 
 	return mainLoop(ctx, *profile, prof, agentCLIs)
 }
 
-func loadInlineConnectEnv(serverURL, token, deviceName *string) {
-	if strings.TrimSpace(*serverURL) == "" {
-		*serverURL = os.Getenv(connectInlineURLEnv)
-	}
-	if strings.TrimSpace(*token) == "" {
-		*token = os.Getenv(connectInlineTokenEnv)
-	}
-	if strings.TrimSpace(*deviceName) == "" {
-		*deviceName = os.Getenv(connectInlineDeviceNameEnv)
-	}
-	_ = os.Unsetenv(connectInlineURLEnv)
-	_ = os.Unsetenv(connectInlineTokenEnv)
-	_ = os.Unsetenv(connectInlineDeviceNameEnv)
-}
-
-func inlineConnectEnv(serverURL, token, deviceName string) []string {
-	out := []string{
-		connectInlineURLEnv + "=" + serverURL,
-		connectInlineTokenEnv + "=" + token,
-	}
-	if strings.TrimSpace(deviceName) != "" {
-		out = append(out, connectInlineDeviceNameEnv+"="+deviceName)
-	}
-	return out
-}
-
-func scrubInlineConnectArgs(argv []string) []string {
-	out := make([]string, 0, len(argv))
-	for i := 0; i < len(argv); i++ {
-		arg := argv[i]
-		switch {
-		case arg == "--url" || arg == "--token" || arg == "--device-name":
-			i++
-			continue
-		case strings.HasPrefix(arg, "--url=") || strings.HasPrefix(arg, "--token=") || strings.HasPrefix(arg, "--device-name="):
-			continue
-		default:
-			out = append(out, arg)
-		}
-	}
-	return out
-}
-
-func resolveConnectProfile(profile, serverURL, token, deviceName string) (auth.Profile, error) {
-	if strings.TrimSpace(serverURL) == "" && strings.TrimSpace(token) == "" {
-		prof, err := auth.Load(profile)
-		if err != nil {
-			return auth.Profile{}, fmt.Errorf("connect: %w", err)
-		}
-		return prof, nil
-	}
-
-	pairCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-	prof, _, err := pairProfile(pairCtx, serverURL, token, deviceName)
-	if err != nil {
-		return auth.Profile{}, fmt.Errorf("connect: pair with server: %w", err)
-	}
-	if err := auth.Save(profile, prof); err != nil {
-		return auth.Profile{}, fmt.Errorf("connect: save auth profile: %w", err)
-	}
-	return prof, nil
-}
-
 // spawnBackground forks the daemon into the background. Parent
 // returns after printing the child PID; child re-enters runConnect
 // with BackgroundSentinelEnv set so the same mainLoop runs in either
 // mode.
-func spawnBackground(ctx context.Context, rc *runContext, profile string, argv []string, extraEnv []string) error {
+func spawnBackground(ctx context.Context, rc *runContext, profile string, argv []string) error {
 	logPath, err := paths.LogFile(profile)
 	if err != nil {
 		return fmt.Errorf("connect: %w", err)
@@ -263,9 +162,8 @@ func spawnBackground(ctx context.Context, rc *runContext, profile string, argv [
 		return err
 	}
 	pid, err := daemonize.Spawn(argv, daemonize.ReExecOptions{
-		LogPath:  logPath,
-		PIDPath:  pidPath,
-		ExtraEnv: extraEnv,
+		LogPath: logPath,
+		PIDPath: pidPath,
 	})
 	if err != nil {
 		return fmt.Errorf("connect: spawn background: %w", err)
@@ -384,7 +282,7 @@ func mainLoopRemote(parent context.Context, rc *runContext, profile string, prof
 				return nil
 			}
 			if errors.Is(err, transport.ErrPermanent) {
-				return fmt.Errorf("connect: permanent error (re-pair the daemon): %w", err)
+				return fmt.Errorf("connect: permanent error (reissue the daemon credential): %w", err)
 			}
 			return fmt.Errorf("connect: dial: %w", err)
 		}
@@ -409,7 +307,7 @@ func mainLoopRemote(parent context.Context, rc *runContext, profile string, prof
 		// Permanent error (e.g. runtime deleted) → exit instead of
 		// reconnecting.
 		if pumpErr != nil && errors.Is(pumpErr, transport.ErrPermanent) {
-			return fmt.Errorf("connect: runtime deleted (re-pair the daemon): %w", pumpErr)
+			return fmt.Errorf("connect: runtime deleted (reissue the daemon credential): %w", pumpErr)
 		}
 		// Small breather before redialing so a flapping server doesn't
 		// get a tight loop of upgrade requests.
diff --git a/apps/daemon/internal/cli/connect_bootstrap.go b/apps/daemon/internal/cli/connect_bootstrap.go
index 4092479dc..1e7848808 100644
--- a/apps/daemon/internal/cli/connect_bootstrap.go
+++ b/apps/daemon/internal/cli/connect_bootstrap.go
@@ -8,7 +8,7 @@ import (
 )
 
 // The launch file is the sole credential source for this connection. Reopening
-// it on process restart neither pairs again nor overwrites an auth profile.
+// it on process restart never reads or overwrites an auth profile.
 func bootstrapProfile(path string) (*auth.Profile, error) {
 	raw, err := runtimefs.ReadPrivatePath(path, runtimebootstrap.MaxBytes)
 	if err != nil {
diff --git a/apps/daemon/internal/cli/connect_bootstrap_test.go b/apps/daemon/internal/cli/connect_bootstrap_test.go
index c3fc68a4d..7f510d699 100644
--- a/apps/daemon/internal/cli/connect_bootstrap_test.go
+++ b/apps/daemon/internal/cli/connect_bootstrap_test.go
@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"encoding/json"
 	"io"
 	"os"
 	"path/filepath"
@@ -10,12 +11,24 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/auth"
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/paths"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimebootstrap"
+	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
 )
 
 func TestBootstrapConnectionDoesNotReadOrOverwritePrivateProfile(t *testing.T) {
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
 	prior := auth.Profile{ServerURL: "https://other.example/api/v1", RuntimeID: "retained", RunnerCredential: "retained-secret"}
-	if err := auth.Save("default", prior); err != nil {
+	profileDir, err := paths.ProfileDir("default")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = runtimefs.EnsurePrivateDir(profileDir); err != nil {
+		t.Fatal(err)
+	}
+	priorRaw, err := json.Marshal(prior)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = os.WriteFile(filepath.Join(profileDir, "auth.json"), priorRaw, 0600); err != nil {
 		t.Fatal(err)
 	}
 	input := runtimebootstrap.Connection{Version: runtimebootstrap.Version, CoreURL: "https://core.example/api/v1", DeviceID: "da912024-1543-4242-a2c1-5f4f7ebbc6c7", Credential: "bootstrap-secret"}
@@ -55,13 +68,12 @@ func TestConnectBootstrapRejectsOtherCredentialSourcesBeforeSideEffects(t *testi
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
 	ctx := &runContext{stdin: strings.NewReader(""), stdout: io.Discard, stderr: io.Discard}
 	for _, args := range [][]string{
-		{"--url", "https://core.example", "--token", "private-token"},
 		{"--remote", "wss://core.example/api/v1/agent-daemon/ws"},
 		{"--credential-file", "/credential.json"},
 		{"--environment-id", "foreign"}, {"unexpected"},
 	} {
 		err := runConnect(ctx, append([]string{"--bootstrap-file", "/not-present"}, args...))
-		if err == nil || !strings.Contains(err.Error(), "cannot be combined") || strings.Contains(err.Error(), "private-token") {
+		if err == nil || !strings.Contains(err.Error(), "cannot be combined") {
 			t.Fatal("mixed startup source accepted", err)
 		}
 	}
diff --git a/apps/daemon/internal/cli/connect_environment.go b/apps/daemon/internal/cli/connect_environment.go
index ec8ab6592..0b1c3b4b1 100644
--- a/apps/daemon/internal/cli/connect_environment.go
+++ b/apps/daemon/internal/cli/connect_environment.go
@@ -161,7 +161,7 @@ func runEnvironmentConnect(parent context.Context, rc *runContext, profile strin
 		return err
 	}
 	if background && !daemonize.IsBackgroundChild() {
-		return spawnBackground(parent, rc, profile, os.Args, nil)
+		return spawnBackground(parent, rc, profile, os.Args)
 	}
 	// Discovery consumes the immutable Runtime binding; it must follow enrollment.
 	discovery, err := preflightAgentCLIs(parent, rc, profile)
diff --git a/apps/daemon/internal/cli/connect_environment_test.go b/apps/daemon/internal/cli/connect_environment_test.go
index dc9bd3811..8d398b59b 100644
--- a/apps/daemon/internal/cli/connect_environment_test.go
+++ b/apps/daemon/internal/cli/connect_environment_test.go
@@ -243,17 +243,6 @@ func TestEnvironmentEnrollmentRejectsWrongIdentityAndWorkspace(t *testing.T) {
 	}
 }
 
-func TestEnvironmentConnectRejectsPairing(t *testing.T) {
-	t.Setenv(connectInlineURLEnv, "")
-	t.Setenv(connectInlineTokenEnv, "")
-	t.Setenv(connectInlineDeviceNameEnv, "")
-	rc := &runContext{stdout: &strings.Builder{}, stderr: &strings.Builder{}}
-	err := runConnect(rc, []string{"--remote", "wss://core/api/v1/agent-daemon/ws", "--environment-id", uuid.NewString(), "--credential-file", "/unused", "--token", "private-pairing-canary"})
-	if err == nil || strings.Contains(err.Error(), "private-pairing-canary") {
-		t.Fatal("pairing accepted or leaked")
-	}
-}
-
 func TestEnvironmentEnrollmentAcceptsPhysicalWorkspaceSelection(t *testing.T) {
 	environment := uuid.NewString()
 	want := environmentEnrollment{uuid.NewString(), uuid.NewString(), environment, "/srv/runtime/workspace"}
diff --git a/apps/daemon/internal/cli/connect_test.go b/apps/daemon/internal/cli/connect_test.go
deleted file mode 100644
index 8a5daeb03..000000000
--- a/apps/daemon/internal/cli/connect_test.go
+++ /dev/null
@@ -1,60 +0,0 @@
-package cli
-
-import (
-	"os"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-func TestScrubInlineConnectArgsRemovesTokenURLAndDeviceName(t *testing.T) {
-	got := scrubInlineConnectArgs([]string{
-		"oac-daemon", "connect",
-		"--url", "https://core.example.com",
-		"--token=rtk_secret",
-		"--device-name", "dev-1",
-		"-b",
-		"--profile", "sandbox",
-	})
-	want := []string{"oac-daemon", "connect", "-b", "--profile", "sandbox"}
-	if !reflect.DeepEqual(got, want) {
-		t.Fatalf("scrubInlineConnectArgs() = %#v, want %#v", got, want)
-	}
-}
-
-func TestLoadInlineConnectEnvFillsMissingValuesAndUnsets(t *testing.T) {
-	t.Setenv(connectInlineURLEnv, "https://core.example.com")
-	t.Setenv(connectInlineTokenEnv, "rtk_secret")
-	t.Setenv(connectInlineDeviceNameEnv, "dev-1")
-
-	serverURL, token, deviceName := "", "", ""
-	loadInlineConnectEnv(&serverURL, &token, &deviceName)
-
-	if serverURL != "https://core.example.com" || token != "rtk_secret" || deviceName != "dev-1" {
-		t.Fatalf("loaded values = (%q, %q, %q)", serverURL, token, deviceName)
-	}
-	if got := inlineConnectEnvValue(connectInlineTokenEnv); got != "" {
-		t.Fatalf("%s still set to %q", connectInlineTokenEnv, got)
-	}
-}
-
-func inlineConnectEnvValue(key string) string { return os.Getenv(key) }
-
-// Regression: pre-fork auth.json check used to run BEFORE env-to-flag
-// hydration, so sandboxes passing the token via env bailed with
-// "not paired". loadInlineConnectEnv now runs first.
-func TestLoadInlineConnectEnvHydratesParentProcessFlags(t *testing.T) {
-	t.Setenv(connectInlineURLEnv, "https://core.example.com")
-	t.Setenv(connectInlineTokenEnv, "rtk_secret")
-
-	serverURL, token, deviceName := "", "", ""
-
-	loadInlineConnectEnv(&serverURL, &token, &deviceName)
-
-	// Same predicate runConnect uses to decide whether to skip the
-	// pre-fork auth.json check.
-	inlinePair := strings.TrimSpace(serverURL) != "" || strings.TrimSpace(token) != ""
-	if !inlinePair {
-		t.Fatalf("inlinePair=false after env hydration; serverURL=%q token=%q", serverURL, token)
-	}
-}
diff --git a/apps/daemon/internal/cli/native_install_test.go b/apps/daemon/internal/cli/native_install_test.go
index 0deb2f5b2..2a8453d1f 100644
--- a/apps/daemon/internal/cli/native_install_test.go
+++ b/apps/daemon/internal/cli/native_install_test.go
@@ -257,10 +257,9 @@ func TestNativeInstallationConnectCannotBypassValidation(t *testing.T) {
 			for _, connection := range [][]string{
 				nil,
 				{"--remote", "ws://127.0.0.1:1/api/v1/agent-daemon/ws"},
-				{"--url", "http://127.0.0.1:1", "--token", "private-test-token"},
 			} {
 				err := runConnect(rc, connection)
-				if err == nil || !strings.Contains(err.Error(), "use oac-daemon start") || strings.Contains(err.Error(), "private-test-token") {
+				if err == nil || !strings.Contains(err.Error(), "use oac-daemon start") {
 					t.Fatal("connect bypassed native installation validation", err)
 				}
 			}
diff --git a/apps/daemon/internal/cli/pair.go b/apps/daemon/internal/cli/pair.go
deleted file mode 100644
index c5b65cee4..000000000
--- a/apps/daemon/internal/cli/pair.go
+++ /dev/null
@@ -1,145 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"strings"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/auth"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimecrypto"
-)
-
-func pairProfile(ctx context.Context, serverURL, token, deviceName string) (auth.Profile, *pairResponse, error) {
-	base, err := normalizeServerURL(serverURL)
-	if err != nil {
-		return auth.Profile{}, nil, err
-	}
-
-	host, err := os.Hostname()
-	if err != nil {
-		// Stripped-down sandboxes can fail os.Hostname; "unknown"
-		// keeps the request well-formed (it's only a label).
-		host = "unknown"
-	}
-	if strings.TrimSpace(deviceName) == "" {
-		deviceName = host
-	}
-
-	// Generate a fresh X25519 keypair before pairing. Public half is
-	// persisted server-side under runtimes.config.runner_public_key so
-	// SealForRuntime can encrypt payloads to this daemon; private half
-	// stays in auth.Profile (0o600) and is required to OpenSeal on
-	// receive. Every successful pair binds a brand-new pair.
-	pubB64, privB64, err := runtimecrypto.GenerateRuntimeKeypair()
-	if err != nil {
-		return auth.Profile{}, nil, fmt.Errorf("generate runner keypair: %w", err)
-	}
-
-	pair, err := pairWithServer(ctx, base, pairRequest{
-		PairingToken:    token,
-		Hostname:        host,
-		Version:         Version,
-		RunnerPublicKey: pubB64,
-	})
-	if err != nil {
-		return auth.Profile{}, nil, err
-	}
-
-	prof := auth.Profile{
-		ServerURL:        base,
-		RuntimeID:        pair.Runtime.ID,
-		RunnerCredential: pair.RunnerCredential,
-		DeviceName:       deviceName,
-		Hostname:         host,
-		PairedAt:         time.Now().UTC(),
-		RunnerPublicKey:  pubB64,
-		RunnerPrivateKey: privB64,
-	}
-	return prof, pair, nil
-}
-
-// pairRequest mirrors the wire shape of server/internal/api/runtime.
-// Re-declared here so the daemon doesn't import a server-internal
-// package — keeps the wire schema as the only coupling.
-type pairRequest struct {
-	PairingToken    string `json:"pairing_token"`
-	Hostname        string `json:"hostname"`
-	Version         string `json:"version"`
-	RunnerPublicKey string `json:"runner_public_key,omitempty"`
-}
-
-type pairRuntime struct {
-	ID       string `json:"id"`
-	Type     string `json:"type"`
-	Name     string `json:"name"`
-	Liveness string `json:"liveness"`
-}
-
-type pairResponse struct {
-	Runtime          pairRuntime `json:"runtime"`
-	RunnerCredential string      `json:"runner_credential"`
-}
-
-// pairWithServer issues POST /api/v1/runtimes/pair. Returns the parsed
-// response on success; on non-2xx, returns an error containing the
-// server's error code + message when present.
-func pairWithServer(ctx context.Context, base string, req pairRequest) (*pairResponse, error) {
-	body, err := json.Marshal(req)
-	if err != nil {
-		return nil, fmt.Errorf("marshal pair request: %w", err)
-	}
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, base+"/api/v1/runtimes/pair", bytes.NewReader(body))
-	if err != nil {
-		return nil, fmt.Errorf("build request: %w", err)
-	}
-	httpReq.Header.Set("Content-Type", "application/json")
-	httpReq.Header.Set("User-Agent", "oac-daemon/"+Version)
-	resp, err := http.DefaultClient.Do(httpReq)
-	if err != nil {
-		return nil, fmt.Errorf("post: %w", err)
-	}
-	defer resp.Body.Close()
-	respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
-	if resp.StatusCode/100 != 2 {
-		return nil, fmt.Errorf("server returned %s: %s", resp.Status, strings.TrimSpace(string(respBody)))
-	}
-	var out pairResponse
-	if err := json.Unmarshal(respBody, &out); err != nil {
-		return nil, fmt.Errorf("decode pair response: %w", err)
-	}
-	if out.Runtime.ID == "" || out.RunnerCredential == "" {
-		return nil, fmt.Errorf("pair response missing runtime.id or runner_credential")
-	}
-	if out.Runtime.Type != "" && out.Runtime.Type != "agent_daemon" {
-		// Refuse rather than take over the wrong runtime row if the
-		// user pasted a non-agent_daemon pairing token by accident.
-		return nil, fmt.Errorf("pair response runtime.type=%q, expected agent_daemon (was the token issued under the Agent Daemon tab?)", out.Runtime.Type)
-	}
-	return &out, nil
-}
-
-// normalizeServerURL rejects junk inputs and strips a trailing slash so
-// concatenating "/api/v1/..." paths never produces "//".
-func normalizeServerURL(raw string) (string, error) {
-	u, err := url.Parse(strings.TrimSpace(raw))
-	if err != nil {
-		return "", fmt.Errorf("parse --url: %w", err)
-	}
-	if u.Scheme != "http" && u.Scheme != "https" {
-		return "", fmt.Errorf("--url must use http or https (got %q)", u.Scheme)
-	}
-	if u.Host == "" {
-		return "", fmt.Errorf("--url is missing a host")
-	}
-	u.Path = strings.TrimRight(u.Path, "/")
-	u.RawQuery = ""
-	u.Fragment = ""
-	return u.String(), nil
-}
diff --git a/apps/daemon/internal/cli/pair_test.go b/apps/daemon/internal/cli/pair_test.go
deleted file mode 100644
index 620b5ed67..000000000
--- a/apps/daemon/internal/cli/pair_test.go
+++ /dev/null
@@ -1,95 +0,0 @@
-package cli
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimecrypto"
-)
-
-// Regression for the "runner_public_key required" pair failure: the
-// daemon used to never populate that field on the wire, so server-side
-// pairing rejected with HTTP 400. Asserts the request carries a
-// base64(stdEncoding) X25519 pubkey AND the resulting Profile retains
-// the matching privkey for later OpenSeal.
-func TestPairProfileGeneratesAndSendsRunnerPublicKey(t *testing.T) {
-	var sentPubKey string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/api/v1/runtimes/pair" {
-			http.Error(w, "unexpected path", http.StatusNotFound)
-			return
-		}
-		var body pairRequest
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-			http.Error(w, "bad json", http.StatusBadRequest)
-			return
-		}
-		sentPubKey = body.RunnerPublicKey
-		_ = json.NewEncoder(w).Encode(pairResponse{
-			Runtime: pairRuntime{
-				ID:   "rt_test_123",
-				Type: "agent_daemon",
-				Name: "test-device",
-			},
-			RunnerCredential: "rc_test_secret",
-		})
-	}))
-	defer srv.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	prof, _, err := pairProfile(ctx, srv.URL, "pairing-token", "test-device")
-	if err != nil {
-		t.Fatalf("pairProfile: %v", err)
-	}
-
-	// Server must have received a non-empty key.
-	if sentPubKey == "" {
-		t.Fatal("server did not receive runner_public_key on the wire")
-	}
-	// And it must be a valid X25519 pubkey.
-	if _, err := runtimecrypto.DecodeKey(sentPubKey); err != nil {
-		t.Fatalf("server received invalid pubkey %q: %v", sentPubKey, err)
-	}
-
-	// Profile must carry both halves.
-	if prof.RunnerPublicKey != sentPubKey {
-		t.Errorf("Profile.RunnerPublicKey = %q, want sent %q", prof.RunnerPublicKey, sentPubKey)
-	}
-	if prof.RunnerPrivateKey == "" {
-		t.Fatal("Profile.RunnerPrivateKey is empty")
-	}
-	if _, err := runtimecrypto.DecodeKey(prof.RunnerPrivateKey); err != nil {
-		t.Errorf("Profile.RunnerPrivateKey is not a valid X25519 key: %v", err)
-	}
-
-	// Sanity-check the rest of the Profile so a future refactor that
-	// drops one of these fields fails loudly.
-	if prof.RuntimeID != "rt_test_123" {
-		t.Errorf("RuntimeID = %q, want rt_test_123", prof.RuntimeID)
-	}
-	if prof.RunnerCredential != "rc_test_secret" {
-		t.Errorf("RunnerCredential = %q, want rc_test_secret", prof.RunnerCredential)
-	}
-}
-
-// Pair-error pass-through must still surface a 400 when the server
-// fails the pair for any reason (reused token, device limit, etc.).
-func TestPairProfileSurfacesServerPairFailure(t *testing.T) {
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusBadRequest)
-		_, _ = w.Write([]byte(`{"error":"pair_failed","message":"token reused"}`))
-	}))
-	defer srv.Close()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-	_, _, err := pairProfile(ctx, srv.URL, "pairing-token", "test-device")
-	if err == nil {
-		t.Fatal("pairProfile succeeded against a 400 server response, want error")
-	}
-}
diff --git a/apps/daemon/internal/cli/root.go b/apps/daemon/internal/cli/root.go
index 18a94b421..cd77a7d2b 100644
--- a/apps/daemon/internal/cli/root.go
+++ b/apps/daemon/internal/cli/root.go
@@ -40,8 +40,8 @@ var commands = []command{
 	{name: "resume", summary: "Wake one planned hosted suspension", run: runResume},
 	{name: "runtime-mcp-exec", summary: "Execute an installed MCP server", run: runRuntimeMCP},
 	{name: "placement", summary: "Enroll or retire an explicitly managed local execution placement", run: runPlacement},
-	{name: "connect", summary: "Pair, open the reverse WebSocket, and start serving prompts", run: runConnect},
-	{name: "status", summary: "Print the paired profile and daemon state", run: runStatus},
+	{name: "connect", summary: "Open the reverse WebSocket and start serving prompts", run: runConnect},
+	{name: "status", summary: "Print the credential profile and daemon state", run: runStatus},
 	{name: "stop", summary: "Stop a background `connect -b` daemon", run: runStop},
 	{name: "logs", summary: "Tail the background daemon's log file", run: runLogs},
 	{name: "logout", summary: "Forget the credential for a profile", run: runLogout},
diff --git a/apps/daemon/internal/cli/status.go b/apps/daemon/internal/cli/status.go
index d02019d45..beb9e444d 100644
--- a/apps/daemon/internal/cli/status.go
+++ b/apps/daemon/internal/cli/status.go
@@ -32,7 +32,7 @@ func runStatus(ctx *runContext, args []string) error {
 	prof, err := auth.Load(*profile)
 	switch {
 	case errors.Is(err, auth.ErrNotPaired):
-		fmt.Fprintln(ctx.stdout, "paired       : no saved pairing profile; check Host connection in Core for a self-hosted Runtime")
+		fmt.Fprintln(ctx.stdout, "paired       : no saved credential profile; check Host connection in Core for a self-hosted Runtime")
 	case err != nil:
 		fmt.Fprintf(ctx.stdout, "paired       : ERROR — %v\n", err)
 	default:
@@ -42,12 +42,6 @@ func runStatus(ctx *runContext, args []string) error {
 		if prof.DeviceName != "" {
 			fmt.Fprintf(ctx.stdout, "device_name  : %s\n", prof.DeviceName)
 		}
-		if prof.Hostname != "" {
-			fmt.Fprintf(ctx.stdout, "hostname     : %s\n", prof.Hostname)
-		}
-		if !prof.PairedAt.IsZero() {
-			fmt.Fprintf(ctx.stdout, "paired_at    : %s\n", prof.PairedAt.Format("2006-01-02 15:04:05 MST"))
-		}
 	}
 
 	// connect.pid existence is the cheap signal; the full liveness
diff --git a/apps/daemon/internal/daemonize/fork.go b/apps/daemon/internal/daemonize/fork.go
index 8803c7ee1..120e7dd75 100644
--- a/apps/daemon/internal/daemonize/fork.go
+++ b/apps/daemon/internal/daemonize/fork.go
@@ -42,10 +42,6 @@ type ReExecOptions struct {
 	// child identity here before returning; existing files are replaced
 	// atomically.
 	PIDPath string
-
-	// ExtraEnv is appended to the child's environment in addition to
-	// parent environ + BackgroundSentinelEnv.
-	ExtraEnv []string
 }
 
 // Spawn re-execs the current binary in the background. argv is the
@@ -89,7 +85,6 @@ func Spawn(argv []string, opts ReExecOptions) (int, error) {
 
 	env := append([]string(nil), os.Environ()...)
 	env = append(env, BackgroundSentinelEnv+"=1")
-	env = append(env, opts.ExtraEnv...)
 
 	cmd := exec.Command(exe, argv[1:]...)
 	cmd.Env = env
diff --git a/apps/daemon/internal/daemonize/fork_test.go b/apps/daemon/internal/daemonize/fork_test.go
index 7ad546605..a8f4fc5a6 100644
--- a/apps/daemon/internal/daemonize/fork_test.go
+++ b/apps/daemon/internal/daemonize/fork_test.go
@@ -12,6 +12,7 @@ func TestSpawnReExecsWithSentinelAndPIDFile(t *testing.T) {
 	dir := privateTempDir(t)
 	logPath := filepath.Join(dir, "child.log")
 	pidPath := filepath.Join(dir, "child.pid")
+	t.Setenv(spawnTestChildEnv, "1")
 
 	// argv[0] is ignored (Spawn uses os.Executable()); argv[1:]
 	// becomes child args. Placeholder subcommand so flag parsing
@@ -19,9 +20,8 @@ func TestSpawnReExecsWithSentinelAndPIDFile(t *testing.T) {
 	pid, err := Spawn(
 		[]string{"oac-daemon", "child-mode"},
 		ReExecOptions{
-			LogPath:  logPath,
-			PIDPath:  pidPath,
-			ExtraEnv: []string{spawnTestChildEnv + "=1"},
+			LogPath: logPath,
+			PIDPath: pidPath,
 		},
 	)
 	if err != nil {
diff --git a/apps/daemon/internal/daemonize/pidfile_test.go b/apps/daemon/internal/daemonize/pidfile_test.go
index f390a7837..4aec5a769 100644
--- a/apps/daemon/internal/daemonize/pidfile_test.go
+++ b/apps/daemon/internal/daemonize/pidfile_test.go
@@ -66,7 +66,8 @@ func TestProcessRecordRejectsOldAndMalformed(t *testing.T) {
 func TestStopTimeoutRetainsProcessRecord(t *testing.T) {
 	dir := privateTempDir(t)
 	path := filepath.Join(dir, "connect.pid")
-	pid, err := Spawn([]string{"daemon", "child"}, ReExecOptions{LogPath: filepath.Join(dir, "log"), PIDPath: path, ExtraEnv: []string{spawnTestChildEnv + "=ignore"}})
+	t.Setenv(spawnTestChildEnv, "ignore")
+	pid, err := Spawn([]string{"daemon", "child"}, ReExecOptions{LogPath: filepath.Join(dir, "log"), PIDPath: path})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/paths/paths.go b/apps/daemon/internal/paths/paths.go
index fb4bcec94..6c835ae3d 100644
--- a/apps/daemon/internal/paths/paths.go
+++ b/apps/daemon/internal/paths/paths.go
@@ -1,6 +1,6 @@
 // Package paths resolves on-disk locations for oac-daemon state under
 // ~/.oac/daemon/<profile>/ — one subdir per profile so "test"
-// and "prod" servers can be paired in parallel without colliding.
+// and "prod" servers can be connected in parallel without colliding.
 //
 // Files are 0o600, parent dir 0o700. These functions only resolve
 // paths — callers do the I/O.
@@ -8,7 +8,6 @@ package paths
 
 import (
 	"fmt"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/runtimefs"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -51,8 +50,7 @@ func Root() (string, error) {
 	return filepath.Join(home, ".oac"), nil
 }
 
-// ProfileDir returns ~/.oac/daemon/<profile>. NOT created;
-// use EnsureProfileDir.
+// ProfileDir returns ~/.oac/daemon/<profile>. It is not created here.
 func ProfileDir(profile string) (string, error) {
 	if err := ValidateProfile(profile); err != nil {
 		return "", err
@@ -64,19 +62,6 @@ func ProfileDir(profile string) (string, error) {
 	return filepath.Join(root, "daemon", profile), nil
 }
 
-// EnsureProfileDir mkdirs the profile dir at mode 0o700 and returns
-// its path. Idempotent.
-func EnsureProfileDir(profile string) (string, error) {
-	dir, err := ProfileDir(profile)
-	if err != nil {
-		return "", err
-	}
-	if err := runtimefs.EnsurePrivateDir(dir); err != nil {
-		return "", fmt.Errorf("create profile dir %s: %w", dir, err)
-	}
-	return dir, nil
-}
-
 // AuthFile returns the absolute path to auth.json for a profile.
 func AuthFile(profile string) (string, error) {
 	dir, err := ProfileDir(profile)
diff --git a/apps/daemon/internal/paths/paths_test.go b/apps/daemon/internal/paths/paths_test.go
index fc151033e..7f4d8fa9e 100644
--- a/apps/daemon/internal/paths/paths_test.go
+++ b/apps/daemon/internal/paths/paths_test.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
 
@@ -93,33 +92,6 @@ func TestProfileDirAndFiles(t *testing.T) {
 	}
 }
 
-func TestEnsureProfileDirCreates0700(t *testing.T) {
-	_ = withTempHome(t)
-	dir, err := paths.EnsureProfileDir("default")
-	if err != nil {
-		t.Fatalf("EnsureProfileDir: %v", err)
-	}
-	info, err := os.Stat(dir)
-	if err != nil {
-		t.Fatalf("stat after EnsureProfileDir: %v", err)
-	}
-	if !info.IsDir() {
-		t.Fatalf("EnsureProfileDir returned %q which is not a directory", dir)
-	}
-	if mode := info.Mode().Perm(); runtime.GOOS != "windows" && mode != 0o700 {
-		t.Errorf("EnsureProfileDir mode = %o, want 0700", mode)
-	}
-
-	// Idempotent (mkdir -p semantics).
-	dir2, err := paths.EnsureProfileDir("default")
-	if err != nil {
-		t.Fatalf("EnsureProfileDir (second call): %v", err)
-	}
-	if dir2 != dir {
-		t.Fatalf("EnsureProfileDir second call returned %q, want %q", dir2, dir)
-	}
-}
-
 func TestInvalidProfileShortCircuits(t *testing.T) {
 	_ = withTempHome(t)
 	if _, err := paths.ProfileDir("bad/profile"); err == nil {
@@ -128,9 +100,6 @@ func TestInvalidProfileShortCircuits(t *testing.T) {
 	if _, err := paths.AuthFile("bad/profile"); err == nil {
 		t.Fatal("AuthFile accepted invalid profile name")
 	}
-	if _, err := paths.EnsureProfileDir("bad/profile"); err == nil {
-		t.Fatal("EnsureProfileDir accepted invalid profile name")
-	}
 }
 
 func TestRootRejectsRelativeOverride(t *testing.T) {
diff --git a/apps/daemon/internal/transport/ws.go b/apps/daemon/internal/transport/ws.go
index feeb2a7a5..e39411074 100644
--- a/apps/daemon/internal/transport/ws.go
+++ b/apps/daemon/internal/transport/ws.go
@@ -24,7 +24,7 @@ type DialOptions struct {
 	// WSURL is the absolute ws://... or wss://... URL.
 	WSURL string
 
-	// DeviceID is the runtime row id stamped at pair time. Sent as
+	// DeviceID is the runtime row id from the daemon credential. Sent as
 	// device_id query param; the gateway uses it as the session key.
 	DeviceID string
 
diff --git a/docs/runtime-bootstrap.md b/docs/runtime-bootstrap.md
index f9a3ced84..7397e07fa 100644
--- a/docs/runtime-bootstrap.md
+++ b/docs/runtime-bootstrap.md
@@ -21,7 +21,7 @@ oac-daemon connect --bootstrap-file /home/runtime/runtime-bootstrap.json
 
 The decoder rejects unknown, duplicate, missing and case-aliased fields, other versions and documents larger than `runtimebootstrap.MaxBytes` (16 KiB). Errors never include submitted values. A missing or malformed file fails before the daemon connects.
 
-The file is the only authentication input for this launch: the daemon refuses to combine it with pairing or self-hosted enrollment options, and reads the credential into memory without saving it to a stored profile. Credentials never go in command arguments, environment variables or receipts. The provider keeps the file for process restarts and removes it only during explicit cleanup of the resources it owns.
+The file is the only authentication input for this launch: the daemon refuses to combine it with self-hosted enrollment options, and reads the credential into memory without saving it to a stored profile. Credentials never go in command arguments, environment variables or receipts. The provider keeps the file for process restarts and removes it only during explicit cleanup of the resources it owns.
 
 ## Responsibilities and readiness
 
diff --git a/docs/zh/runtime-bootstrap.md b/docs/zh/runtime-bootstrap.md
index 1edb83450..d3338fa61 100644
--- a/docs/zh/runtime-bootstrap.md
+++ b/docs/zh/runtime-bootstrap.md
@@ -1,7 +1,7 @@
 ---
 title: "Runtime 引导"
 source: docs/runtime-bootstrap.md
-source_hash: ba7de54c4533b7aa4dc66e3e04aa3687d964faef7c2158740b930e4758567fc1
+source_hash: f7e9275feee79ac1fb1299227e148b85c26efc8b8af5ca0e8f498126c563d182
 ---
 
 Sandbox Provider 通过交付一个引导文件来启动托管 Runtime。本文负责 Provider 到 Runtime 的启动输入。类型与验证器位于 [`internal/runtimebootstrap`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/runtimebootstrap/bootstrap.go)；Go provider 使用 [`runtime_bootstrap.go`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/internal/sandbox/runtime_bootstrap.go) 中的 `sandbox.Bootstrap.RuntimeConnection()` 构造输入，SDK helper 原样转发序列化对象。provider 不读取或写入 Runtime 的私有认证存储。
@@ -23,7 +23,7 @@ oac-daemon connect --bootstrap-file /home/runtime/runtime-bootstrap.json
 
 解码器拒绝未知、重复、缺失和大小写别名字段，拒绝其他版本及超过 `runtimebootstrap.MaxBytes`（16 KiB）的文档。错误不包含提交的值。文件缺失或格式错误时，daemon 在连接前失败。
 
-该文件是此次启动唯一的认证输入：daemon 拒绝将其与配对或自托管注册选项组合使用，并将凭据读入内存而不保存到存储的 profile。凭据不进入命令参数、环境变量或回执。provider 为进程重启保留该文件，仅在明确清理自己拥有的资源时删除。
+该文件是此次启动唯一的认证输入：daemon 拒绝将其与自托管注册选项组合使用，并将凭据读入内存而不保存到存储的 profile。凭据不进入命令参数、环境变量或回执。provider 为进程重启保留该文件，仅在明确清理自己拥有的资源时删除。
 
 ## 职责与就绪状态 {#responsibilities-and-readiness}
 
diff --git a/go.mod b/go.mod
index 9146030d1..e851cd189 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,6 @@ require (
 	go.opentelemetry.io/otel/sdk v1.44.0
 	go.opentelemetry.io/otel/sdk/metric v1.44.0
 	go.opentelemetry.io/proto/otlp v1.10.0
-	golang.org/x/crypto v0.55.0
 	golang.org/x/net v0.58.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/sys v0.47.0
diff --git a/go.sum b/go.sum
index 07c9f1f70..3ed07c81a 100644
--- a/go.sum
+++ b/go.sum
@@ -127,8 +127,6 @@ go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpu
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
 golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
diff --git a/internal/runtimecrypto/cmd/emit-fixture/main.go b/internal/runtimecrypto/cmd/emit-fixture/main.go
deleted file mode 100644
index 9f9572fd3..000000000
--- a/internal/runtimecrypto/cmd/emit-fixture/main.go
+++ /dev/null
@@ -1,76 +0,0 @@
-// One-shot generator for the cross-language wire-format fixture. Run
-// by hand:
-//
-//	go run ./internal/runtimecrypto/cmd/emit-fixture > internal/runtimecrypto/testdata/wire_v1.json
-//
-// The output is COMMITTED and read-only at test time. `//go:build
-// ignore` keeps this invisible to `go build ./...` / `go test ./...`,
-// and the stderr WARNING forces the operator to notice they are about
-// to mutate a wire-locked artefact. A *_test.go that wrote the file
-// would silently green-light protocol drift on every CI run.
-
-//go:build ignore
-
-package main
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"os"
-
-	runtimecrypto "github.com/MiniMax-AI/OpenAgentCore/internal/runtimecrypto"
-	"golang.org/x/crypto/nacl/box"
-)
-
-type fixture struct {
-	Description      string `json:"description"`
-	WireFormat       string `json:"wire_format"`
-	RecipientPubB64  string `json:"recipient_public_key_b64"`
-	RecipientPrivB64 string `json:"recipient_private_key_b64"`
-	CipherB64        string `json:"cipher_b64"`
-	PlaintextUTF8    string `json:"plaintext_utf8"`
-}
-
-func main() {
-	fmt.Fprintln(os.Stderr,
-		"WARNING: this regenerates internal/runtimecrypto/testdata/wire_v1.json.")
-	fmt.Fprintln(os.Stderr,
-		"  Only commit the new bytes if you intentionally bumped the wire protocol version.")
-	fmt.Fprintln(os.Stderr,
-		"  Re-generating without a version bump silently breaks the protocol-version lock.")
-
-	pub, priv, err := box.GenerateKey(rand.Reader)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "keygen: %v\n", err)
-		os.Exit(1)
-	}
-	pubB64 := base64.StdEncoding.EncodeToString(pub[:])
-	privB64 := base64.StdEncoding.EncodeToString(priv[:])
-
-	plaintext := `{"api_key":"sk-wire-fixture","provider":"anthropic"}`
-	cipherB64, err := runtimecrypto.SealForRuntime([]byte(plaintext), pubB64)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "seal: %v\n", err)
-		os.Exit(1)
-	}
-
-	out := fixture{
-		Description: "Wire fixture for the Runtime credential envelope. " +
-			"Recipient keypair is committed for test reproducibility. DO NOT use these " +
-			"keys in any other context. Wire format: NaCl SealAnonymous (X25519 + " +
-			"XSalsa20-Poly1305), nonce = BLAKE2b-24(ephPub || recipientPub).",
-		WireFormat:       "nacl_sealed_box_v1",
-		RecipientPubB64:  pubB64,
-		RecipientPrivB64: privB64,
-		CipherB64:        cipherB64,
-		PlaintextUTF8:    plaintext,
-	}
-	enc := json.NewEncoder(os.Stdout)
-	enc.SetIndent("", "  ")
-	if err := enc.Encode(out); err != nil {
-		fmt.Fprintf(os.Stderr, "encode: %v\n", err)
-		os.Exit(1)
-	}
-}
diff --git a/internal/runtimecrypto/runtime_seal.go b/internal/runtimecrypto/runtime_seal.go
deleted file mode 100644
index f8d6c3894..000000000
--- a/internal/runtimecrypto/runtime_seal.go
+++ /dev/null
@@ -1,110 +0,0 @@
-// Package runtimecrypto implements envelope-encryption for shipping
-// sensitive payloads (model API keys, per-run secrets) from the
-// OpenAgentCore server to a paired Agent Daemon without putting plaintext
-// on the wire.
-//
-// Algorithm: NaCl sealed box (X25519 + XSalsa20-Poly1305) via
-// box.SealAnonymous. Nonce = BLAKE2b-24(ephPub || recipientPub).
-// Wire format: base64(stdEncoding) so it travels safely inside JSON.
-// The committed static fixture (testdata/wire_v1.json) keeps the wire
-// format locked across refactors.
-//
-// Threat model:
-//   - Server logs / debug dumps / DB middlewares see ciphertext only.
-//   - Daemon-machine compromise is OUT of scope (private key lives
-//     there and the host is trusted by definition).
-//   - Server compromise is OUT of scope (a malicious server could
-//     skip encryption entirely).
-package runtimecrypto
-
-import (
-	"crypto/rand"
-	"encoding/base64"
-	"errors"
-	"fmt"
-
-	"golang.org/x/crypto/nacl/box"
-)
-
-// PublicKeySize / PrivateKeySize match nacl/box (32 bytes Curve25519).
-const (
-	PublicKeySize  = 32
-	PrivateKeySize = 32
-)
-
-// ErrInvalidPublicKey wraps any reason the recipient public key is
-// unusable (wrong length, bad base64). API layer returns 400.
-var ErrInvalidPublicKey = errors.New("runtime crypto: invalid public key")
-
-// ErrDecryptFailed is returned when ciphertext fails authentication
-// (tampered, wrong recipient key, malformed envelope). Generic by
-// design — exposing the specific reason helps attackers.
-var ErrDecryptFailed = errors.New("runtime crypto: decrypt failed")
-
-// SealForRuntime encrypts plaintext for the runtime identified by its
-// base64-encoded X25519 public key (as stored in
-// runtimes.config.runner_public_key).
-//
-// Output is base64(stdEncoding) of an anonymous sealed box: each call
-// generates a fresh ephemeral keypair and embeds the public half in
-// the envelope. Receiver derives the shared key from that and its own
-// private key.
-func SealForRuntime(plaintext []byte, runnerPublicKeyB64 string) (string, error) {
-	pub, err := decodePublicKey(runnerPublicKeyB64)
-	if err != nil {
-		return "", err
-	}
-	sealed, err := box.SealAnonymous(nil, plaintext, &pub, rand.Reader)
-	if err != nil {
-		return "", fmt.Errorf("runtime crypto: seal: %w", err)
-	}
-	return base64.StdEncoding.EncodeToString(sealed), nil
-}
-
-// OpenSeal decrypts a SealForRuntime output using the recipient's
-// keypair. Kept here for round-trip tests and to lock the wire format
-// down in one place.
-func OpenSeal(cipherB64 string, publicKey, privateKey [32]byte) ([]byte, error) {
-	sealed, err := base64.StdEncoding.DecodeString(cipherB64)
-	if err != nil {
-		return nil, ErrDecryptFailed
-	}
-	out, ok := box.OpenAnonymous(nil, sealed, &publicKey, &privateKey)
-	if !ok {
-		return nil, ErrDecryptFailed
-	}
-	return out, nil
-}
-
-// GenerateRuntimeKeypair returns a fresh (publicKey, privateKey) pair
-// as base64. Caller MUST persist the private key with mode 0600 and
-// never log it.
-func GenerateRuntimeKeypair() (publicKeyB64, privateKeyB64 string, err error) {
-	pub, priv, err := box.GenerateKey(rand.Reader)
-	if err != nil {
-		return "", "", fmt.Errorf("runtime crypto: keygen: %w", err)
-	}
-	return base64.StdEncoding.EncodeToString(pub[:]),
-		base64.StdEncoding.EncodeToString(priv[:]),
-		nil
-}
-
-// DecodeKey turns a base64-encoded 32-byte key into a [32]byte so
-// daemon code and the API layer share one parser instead of inlining
-// base64 + length checks at every caller.
-func DecodeKey(b64 string) ([32]byte, error) {
-	var out [32]byte
-	raw, err := base64.StdEncoding.DecodeString(b64)
-	if err != nil {
-		return out, ErrInvalidPublicKey
-	}
-	if len(raw) != PublicKeySize {
-		return out, ErrInvalidPublicKey
-	}
-	copy(out[:], raw)
-	return out, nil
-}
-
-func decodePublicKey(b64 string) ([32]byte, error) {
-	return DecodeKey(b64)
-}
diff --git a/internal/runtimecrypto/runtime_seal_test.go b/internal/runtimecrypto/runtime_seal_test.go
deleted file mode 100644
index 5852a5a4d..000000000
--- a/internal/runtimecrypto/runtime_seal_test.go
+++ /dev/null
@@ -1,135 +0,0 @@
-package runtimecrypto
-
-import (
-	"bytes"
-	"crypto/rand"
-	"encoding/base64"
-	"testing"
-)
-
-func TestSealOpenRoundTrip(t *testing.T) {
-	pub, priv, err := GenerateRuntimeKeypair()
-	if err != nil {
-		t.Fatalf("keygen: %v", err)
-	}
-	pubArr, err := DecodeKey(pub)
-	if err != nil {
-		t.Fatalf("decode pub: %v", err)
-	}
-	privArr, err := DecodeKey(priv)
-	if err != nil {
-		t.Fatalf("decode priv: %v", err)
-	}
-
-	plain := []byte(`{"api_key":"sk-secret","provider":"anthropic"}`)
-	cipher, err := SealForRuntime(plain, pub)
-	if err != nil {
-		t.Fatalf("seal: %v", err)
-	}
-	if cipher == "" {
-		t.Fatal("empty cipher")
-	}
-	if bytes.Contains([]byte(cipher), []byte("sk-secret")) {
-		t.Fatal("ciphertext leaks plaintext")
-	}
-	got, err := OpenSeal(cipher, pubArr, privArr)
-	if err != nil {
-		t.Fatalf("open: %v", err)
-	}
-	if !bytes.Equal(got, plain) {
-		t.Errorf("decrypt mismatch:\n  got  %q\n  want %q", got, plain)
-	}
-}
-
-// Each call uses a fresh ephemeral keypair so the same plaintext
-// yields different ciphertexts.
-func TestSealNonDeterministic(t *testing.T) {
-	pub, _, err := GenerateRuntimeKeypair()
-	if err != nil {
-		t.Fatalf("keygen: %v", err)
-	}
-	c1, _ := SealForRuntime([]byte("hello"), pub)
-	c2, _ := SealForRuntime([]byte("hello"), pub)
-	if c1 == c2 {
-		t.Errorf("two seals of same plaintext should differ; got identical")
-	}
-}
-
-// Tampered ciphertext must fail open (Poly1305 authenticator).
-func TestOpenTamperedFails(t *testing.T) {
-	pub, priv, _ := GenerateRuntimeKeypair()
-	pubArr, _ := DecodeKey(pub)
-	privArr, _ := DecodeKey(priv)
-	cipher, _ := SealForRuntime([]byte("payload"), pub)
-
-	raw, _ := base64.StdEncoding.DecodeString(cipher)
-	raw[len(raw)/2] ^= 0xFF
-	tampered := base64.StdEncoding.EncodeToString(raw)
-	if _, err := OpenSeal(tampered, pubArr, privArr); err != ErrDecryptFailed {
-		t.Errorf("tampered ciphertext: got err=%v, want ErrDecryptFailed", err)
-	}
-}
-
-// Wrong recipient private key must fail open.
-func TestOpenWrongKeyFails(t *testing.T) {
-	pub, _, _ := GenerateRuntimeKeypair()
-	cipher, _ := SealForRuntime([]byte("payload"), pub)
-
-	otherPub, otherPriv, _ := GenerateRuntimeKeypair()
-	otherPubArr, _ := DecodeKey(otherPub)
-	otherPrivArr, _ := DecodeKey(otherPriv)
-	if _, err := OpenSeal(cipher, otherPubArr, otherPrivArr); err != ErrDecryptFailed {
-		t.Errorf("wrong key: got err=%v, want ErrDecryptFailed", err)
-	}
-}
-
-// Bad public key (wrong length / non-base64) must error, not panic.
-func TestSealRejectsBadPublicKey(t *testing.T) {
-	cases := []string{
-		"",
-		"not-base64-!!!",
-		base64.StdEncoding.EncodeToString([]byte("short")),
-	}
-	for _, k := range cases {
-		if _, err := SealForRuntime([]byte("x"), k); err != ErrInvalidPublicKey {
-			t.Errorf("SealForRuntime(%q): got err=%v, want ErrInvalidPublicKey", k, err)
-		}
-	}
-}
-
-func TestKeypairUnique(t *testing.T) {
-	seen := map[string]bool{}
-	for i := 0; i < 16; i++ {
-		pub, priv, _ := GenerateRuntimeKeypair()
-		if seen[pub] {
-			t.Fatalf("duplicate pub at i=%d", i)
-		}
-		if seen[priv] {
-			t.Fatalf("duplicate priv at i=%d", i)
-		}
-		seen[pub] = true
-		seen[priv] = true
-	}
-}
-
-// Guard against a zero/empty-ciphertext regression if crypto/rand is
-// not wired into the build.
-func TestSealNotEmptyEvenForEmptyPlaintext(t *testing.T) {
-	pub, _, _ := GenerateRuntimeKeypair()
-	cipher, err := SealForRuntime([]byte{}, pub)
-	if err != nil {
-		t.Fatalf("seal empty: %v", err)
-	}
-	// nacl sealed-box overhead = 32 (ephemeral pub) + 16 (poly1305) = 48
-	raw, _ := base64.StdEncoding.DecodeString(cipher)
-	if len(raw) < 48 {
-		t.Errorf("ciphertext too short: %d bytes, want >= 48", len(raw))
-	}
-}
-
-func TestRandomReaderAvailable(t *testing.T) {
-	var b [16]byte
-	if _, err := rand.Read(b[:]); err != nil {
-		t.Fatalf("crypto/rand unavailable: %v", err)
-	}
-}
diff --git a/internal/runtimecrypto/runtime_seal_wire_test.go b/internal/runtimecrypto/runtime_seal_wire_test.go
deleted file mode 100644
index 1f439cb11..000000000
--- a/internal/runtimecrypto/runtime_seal_wire_test.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package runtimecrypto
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-// wireFixture matches the JSON shape emitted by cmd/emit-fixture and
-// committed to testdata/wire_v1.json. Explicit fields so a future
-// schema bump (wire_format != nacl_sealed_box_v1) breaks decoding
-// instead of silently passing.
-type wireFixture struct {
-	Description      string `json:"description"`
-	WireFormat       string `json:"wire_format"`
-	RecipientPubB64  string `json:"recipient_public_key_b64"`
-	RecipientPrivB64 string `json:"recipient_private_key_b64"`
-	CipherB64        string `json:"cipher_b64"`
-	PlaintextUTF8    string `json:"plaintext_utf8"`
-}
-
-// TestOpenStaticWireFixture decrypts the committed wire vector via
-// the production OpenSeal path. Canonical regression guard for
-// cross-language protocol drift — if either side's algorithm
-// (Go nacl/box, Node tweetnacl + @noble/hashes) changes, this fails
-// on the first commit after the drift.
-func TestOpenStaticWireFixture(t *testing.T) {
-	path := filepath.Join("testdata", "wire_v1.json")
-	raw, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read fixture: %v", err)
-	}
-	var f wireFixture
-	if err := json.Unmarshal(raw, &f); err != nil {
-		t.Fatalf("parse fixture: %v", err)
-	}
-	if f.WireFormat != "nacl_sealed_box_v1" {
-		t.Fatalf("wire_format=%q, want nacl_sealed_box_v1 (test is locked to v1)", f.WireFormat)
-	}
-	pub, err := DecodeKey(f.RecipientPubB64)
-	if err != nil {
-		t.Fatalf("decode pub: %v", err)
-	}
-	priv, err := DecodeKey(f.RecipientPrivB64)
-	if err != nil {
-		t.Fatalf("decode priv: %v", err)
-	}
-	got, err := OpenSeal(f.CipherB64, pub, priv)
-	if err != nil {
-		t.Fatalf("open static fixture: %v", err)
-	}
-	if string(got) != f.PlaintextUTF8 {
-		t.Errorf("plaintext mismatch:\n  got  %q\n  want %q", got, f.PlaintextUTF8)
-	}
-}
diff --git a/internal/runtimecrypto/testdata/wire_v1.json b/internal/runtimecrypto/testdata/wire_v1.json
deleted file mode 100644
index ff34f4bc0..000000000
--- a/internal/runtimecrypto/testdata/wire_v1.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "description": "Wire fixture for the Runtime credential envelope. Recipient keypair is committed for test reproducibility. DO NOT use these keys in any other context. Wire format: NaCl SealAnonymous (X25519 + XSalsa20-Poly1305), nonce = BLAKE2b-24(ephPub || recipientPub).",
-  "wire_format": "nacl_sealed_box_v1",
-  "recipient_public_key_b64": "kxmWMYeGYw4zwKGkoXBQUh3Ac6CCD0jUechNvXEwRSk=",
-  "recipient_private_key_b64": "6b/6ZGaX77mlq1Q/ZUZd/T67wNc9orIpSslluBMYXz8=",
-  "cipher_b64": "+xJ0WbN+YwxXhccjZDMJfkRNdICegZpBkkDg2lS1gEpqVXh3ABfYWtz0vxR9zOf9JpeD0z6yprJyDdWkhn8lHbf3Mp+0Z1sMAp9BHoHO61FCGB3DdnZiHp7dTI4NAKM62Zs+LQ==",
-  "plaintext_utf8": "{\"api_key\":\"sk-wire-fixture\",\"provider\":\"anthropic\"}"
-}
diff --git a/packages/claude-sdk-adapter/README.md b/packages/claude-sdk-adapter/README.md
index 4cba3ec4c..e124b3dad 100644
--- a/packages/claude-sdk-adapter/README.md
+++ b/packages/claude-sdk-adapter/README.md
@@ -64,9 +64,9 @@ Workspace deferred-function discovery uses native ToolSearch alongside the norma
 
 ### Registration and state
 
-For unmanaged bootstrap, daemon `connect` optionally registers this factory as `claude_sdk` when the operator sets `OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT` to the absolute packaged `dist/main.js`. `OAC_RUNTIME_CLAUDE_SDK_NODE` selects Node (default: `node` on PATH). Discovery resolves Node once and checks that exact configuration before pairing; the SDK's bounded runtime check is independent of CLI version probes. A ready SDK alone is sufficient to start the daemon. No configuration means no SDK probe or descriptor; failed readiness reports an unavailable descriptor with a rejecting factory. Runtime checks establish local readiness, not provider authentication. Installed daemons use `start` and their verified installation manifest for adapter selection and activation; ambient activation variables cannot extend that selection. See [the native installation contract](../../deploy/README.md#native-daemon-installer).
+For unmanaged bootstrap, daemon `connect` optionally registers this factory as `claude_sdk` when the operator sets `OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT` to the absolute packaged `dist/main.js`. `OAC_RUNTIME_CLAUDE_SDK_NODE` selects Node (default: `node` on PATH). Discovery resolves Node once and checks that exact configuration before connecting; the SDK's bounded runtime check is independent of CLI version probes. A ready SDK alone is sufficient to start the daemon. No configuration means no SDK probe or descriptor; failed readiness reports an unavailable descriptor with a rejecting factory. Runtime checks establish local readiness, not provider authentication. Installed daemons use `start` and their verified installation manifest for adapter selection and activation; ambient activation variables cannot extend that selection. See [the native installation contract](../../deploy/README.md#native-daemon-installer).
 
-SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in pairing profiles. It accepts no caller-supplied environment variables or business write authority.
+SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in credential profiles. It accepts no caller-supplied environment variables or business write authority.
 
 ### Descriptor and execution profile
 
diff --git a/services/core/internal/runtimegateway/auth.go b/services/core/internal/runtimegateway/auth.go
index 4d7fadea2..40fa443f5 100644
--- a/services/core/internal/runtimegateway/auth.go
+++ b/services/core/internal/runtimegateway/auth.go
@@ -71,7 +71,7 @@ func (a *Authenticator) AuthenticateBearer(ctx context.Context, deviceID, bearer
 	}
 	storedHash := rt.CredentialHash
 	if storedHash == "" {
-		// Pairing never completed, or someone wiped the credential
+		// No credential was issued, or someone wiped it
 		// out-of-band. Fail closed.
 		return AuthenticatedRuntime{}, ErrAuthBadCredential
 	}
diff --git a/services/core/internal/runtimegateway/handler.go b/services/core/internal/runtimegateway/handler.go
index 85a62d55e..a22d6df2d 100644
--- a/services/core/internal/runtimegateway/handler.go
+++ b/services/core/internal/runtimegateway/handler.go
@@ -15,8 +15,8 @@ import (
 )
 
 // HeartbeatTouch is the persistence interface the gateway uses to
-// bump last_heartbeat_at / promote pending_pairing -> online when a
-// daemon connects.
+// bump last_heartbeat_at and mark the runtime online when a daemon
+// connects.
 type HeartbeatTouch interface {
 	TouchRuntimeHeartbeat(ctx context.Context, runtimeID string) (runtimedevice.HeartbeatStatus, error)
 	TouchAgentDaemonHeartbeat(ctx context.Context, input runtimedevice.Heartbeat) (runtimedevice.HeartbeatStatus, error)
@@ -32,7 +32,7 @@ type HandlerConfig struct {
 
 	Registry *Registry
 
-	// Heartbeat flips pending_pairing -> online and keeps
+	// Heartbeat marks the runtime online and keeps
 	// last_heartbeat_at fresh. nil tracks liveness in-process only.
 	Heartbeat HeartbeatTouch
 
@@ -133,7 +133,7 @@ func (h *Handler) WS(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if h.cfg.Heartbeat != nil {
-		// First inbound action — promote pending_pairing -> online.
+		// First inbound action — mark the runtime online.
 		// Best-effort; a transient DB blip shouldn't refuse the
 		// upgrade since we already accepted the credential.
 		if _, hbErr := h.cfg.Heartbeat.TouchRuntimeHeartbeat(r.Context(), auth.DeviceID); hbErr != nil {
@@ -179,7 +179,7 @@ func (h *Handler) WS(w http.ResponseWriter, r *http.Request) {
 	sess.Start()
 }
 
-// Bootstrap is the daemon's first HTTP call after pairing. Validating
+// Bootstrap is the daemon's first HTTP call with its credential. Validating
 // the bearer in a separate HTTP step (rather than folded into the WS
 // upgrade) lets the daemon fail fast on credential problems with a
 // real HTTP status rather than the opaque WS close code.
diff --git a/services/core/internal/runtimegateway/routes.go b/services/core/internal/runtimegateway/routes.go
index c7bf72429..d0c098c1e 100644
--- a/services/core/internal/runtimegateway/routes.go
+++ b/services/core/internal/runtimegateway/routes.go
@@ -11,8 +11,8 @@ import (
 //	POST /agent-daemon/bootstrap     — daemon first-call to fetch wsUrl + heartbeat cadence
 //	GET  /agent-daemon/device-status — daemon self-check
 //
-// All three accept the runtime credential issued via the
-// runtimes/pairings flow with type='agent_daemon'.
+// All three accept the daemon credential described in
+// contracts/agents-api/machine-api.md.
 func RegisterRoutes(r chi.Router, h *Handler) {
 	if h == nil {
 		panic("agentdaemon gateway: RegisterRoutes called with nil handler")

From e60d8ffe89b32ba3fa0f7f4df4ab3244729b0011 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 16:35:26 +0800
Subject: [PATCH 8/9] Delete the unprepared prompt request (#473)

Core starts every Run through execution_prepare and execution_start, so
the prompt_request frame, its daemon path and Core's unprepared delivery
branch had no caller.

- Delete proto.TypePromptRequest and its protocol rows; the daemon drops
  the frame as an unknown type. PromptRequestPayload stays as the
  execution_prepare configuration.
- Delete the daemon prompt path (prompt.go, output.go, the retained idle
  session pool, the completion barrier and the unprepared cancel and
  shutdown branches). A Run's session is now an agent.Turn, so durable
  steering support is enforced by type.
- Core deliver takes the prepared handle, Run ID and input explicitly.
- Delete ConversationID and ReleaseOnCompletion; WorkspaceReadOnly alone
  marks a read-only preparation.
- validateExecutionEnvironment owns the exactly-one local_environment /
  disable_execution_environment rule.
- Port the dispatch tests that cover behavior execution_start keeps to
  shared execution_prepare/execution_start helpers.
---
 .../claudesdk/cancellation_live_linux_test.go |   2 +-
 .../internal/agent/claudesdk/executor.go      |   2 +-
 .../agent/claudesdk/live_linux_test.go        |   2 +-
 .../agent/claudesdk/preparation_test.go       |   4 +-
 .../internal/agent/claudesdk/session.go       |   2 +-
 .../claudesdk/workspace_live_linux_test.go    |   2 +-
 .../agent/codex/preparation_helpers_test.go   |   1 -
 apps/daemon/internal/agent/codex/session.go   |   5 +-
 apps/daemon/internal/agent/harness.go         |  15 +-
 apps/daemon/internal/agent/mcode/executor.go  |   2 +-
 .../agent/mcode/executor_native_test.go       |   3 +-
 .../internal/agent/mcode/executor_test.go     |   5 +-
 .../internal/agent/mcode/preparation_test.go  |   2 +-
 .../internal/agent/mcode/session_test.go      |   4 +-
 .../cli/claude_sdk_live_linux_test.go         |  31 ++-
 apps/daemon/internal/dispatch/cancellation.go |  49 +---
 .../internal/dispatch/cancellation_test.go    | 102 ++++----
 .../dispatch/capability_admission_test.go     |  27 +-
 apps/daemon/internal/dispatch/environment.go  |   5 +-
 .../internal/dispatch/environment_test.go     |  77 +++---
 apps/daemon/internal/dispatch/executor.go     |  34 +--
 .../daemon/internal/dispatch/executor_test.go |  20 +-
 apps/daemon/internal/dispatch/export_test.go  |   8 +
 .../dispatch/functions_native_test.go         |  58 +++--
 .../internal/dispatch/functions_test.go       |  56 +++--
 .../dispatch/interaction_decisions.go         |   2 +-
 .../internal/dispatch/local_directory_test.go |   4 +-
 .../daemon/internal/dispatch/mcp_http_test.go |  53 ++--
 .../dispatch/optional_interactions_test.go    |  12 +-
 apps/daemon/internal/dispatch/output.go       | 103 --------
 apps/daemon/internal/dispatch/preparation.go  |   5 +-
 .../internal/dispatch/preparation_start.go    |   2 +-
 .../internal/dispatch/preparation_test.go     |   7 +-
 .../internal/dispatch/prepared_handoff.go     |  14 +-
 apps/daemon/internal/dispatch/prompt.go       | 149 ------------
 .../internal/dispatch/receipt_order_test.go   |  34 ++-
 .../dispatch/receipt_shutdown_test.go         |  12 +-
 apps/daemon/internal/dispatch/router.go       | 134 ++--------
 apps/daemon/internal/dispatch/router_test.go  | 230 +++++-------------
 .../internal/dispatch/runtime_preparation.go  |   2 +-
 .../dispatch/runtime_preparation_test.go      |   5 +-
 apps/daemon/internal/dispatch/shutdown.go     |  94 ++-----
 apps/daemon/internal/dispatch/steering.go     |  32 +--
 .../internal/dispatch/steering_lifetime.go    |   4 +-
 .../dispatch/steering_lifetime_test.go        |  60 +----
 .../daemon/internal/dispatch/steering_test.go |  47 ++--
 apps/daemon/internal/dispatch/suspend.go      |  21 --
 apps/daemon/internal/dispatch/suspend_test.go |  38 +--
 .../internal/dispatch/workspace_write.go      |   2 +-
 .../daemon/internal/localworkspace/binding.go |   2 +-
 .../internal/localworkspace/binding_test.go   |  10 +-
 apps/daemon/internal/transport/ws_test.go     |   8 +-
 .../internal/wireconformance/wire_test.go     |   2 +-
 apps/daemon/testdata/onboarding/main.go       |   2 +-
 docs/runtime-protocol.md                      |  10 +-
 docs/zh/runtime-protocol.md                   |  12 +-
 internal/agentdaemon/proto/envelope.go        |   2 +-
 internal/agentdaemon/proto/outbound.go        |  26 +-
 .../proto/workspace_read_preparation.go       |   3 +-
 scripts/name-allowlist.json                   |  10 +
 services/core/internal/execution/delivery.go  |  38 ++-
 .../execution/directory_preparation.go        |   2 +-
 .../core/internal/execution/dispatcher.go     |   5 +-
 .../execution/executor_preparation.go         |   1 -
 .../core/internal/execution/preparation.go    |   4 +-
 .../internal/execution/prepared_dispatch.go   |  13 +-
 .../runtimegateway/cancellation_test.go       |   2 +-
 .../mcp_bearer_live_linux_test.go             |  35 ++-
 .../mcp_bearer_process_linux_test.go          |   2 +-
 .../core/internal/runtimegateway/session.go   |   2 +-
 .../internal/runtimegateway/session_test.go   |   9 +-
 .../deployment_model_providers_http_test.go   |   2 +-
 .../core/tests/integration/dispatch_test.go   |   2 +-
 .../integration/executor_fixture_test.go      |   2 +-
 .../integration/harness_onboarding_test.go    |   2 +-
 .../integration/prepared_dispatch_test.go     |   2 +-
 76 files changed, 607 insertions(+), 1187 deletions(-)
 delete mode 100644 apps/daemon/internal/dispatch/output.go
 delete mode 100644 apps/daemon/internal/dispatch/prompt.go

diff --git a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
index bc5cec8bd..7a958ed72 100644
--- a/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/cancellation_live_linux_test.go
@@ -65,7 +65,7 @@ func TestLiveClaudeSDKCancelResume(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 		defer cancel()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the user's requested format. Preserve the exact verification value in conversation history. Use no tools."}}
 		running, err := NewFactory(config)(ctx, request, out)
 		if err != nil {
 			t.Fatal(err)
diff --git a/apps/daemon/internal/agent/claudesdk/executor.go b/apps/daemon/internal/agent/claudesdk/executor.go
index 55eed30a5..5b99aed4f 100644
--- a/apps/daemon/internal/agent/claudesdk/executor.go
+++ b/apps/daemon/internal/agent/claudesdk/executor.go
@@ -36,7 +36,7 @@ func NewExecutorFactory(config Config) agent.ExecutorFactory {
 		if ctx == nil {
 			ctx = context.Background()
 		}
-		if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" {
+		if req.RunID != "" || len(req.Input) != 0 {
 			return nil, errors.New("claudesdk: Executor preparation cannot submit input")
 		}
 		start, env, err := prepareConfiguration(config, req)
diff --git a/apps/daemon/internal/agent/claudesdk/live_linux_test.go b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
index ba2f7ca9d..72aff690d 100644
--- a/apps/daemon/internal/agent/claudesdk/live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/live_linux_test.go
@@ -137,7 +137,7 @@ func TestLiveClaudeSDKTextResume(t *testing.T) {
 		requestStart := len(requests)
 		mu.Unlock()
 		out := make(chan proto.Envelope, 64)
-		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}}
+		request := proto.PromptRequestPayload{RunID: uuid.NewString(), Input: proto.TextInput(prompt), AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": "Answer briefly and preserve the exact verification value in the conversation. Use no tools."}}
 		if success != nil {
 			request.AgentOptions["system_prompt"] = "Call lookup exactly once as requested, then report both result parts and any prior verification value. Never retry a failed tool."
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a synthetic verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
diff --git a/apps/daemon/internal/agent/claudesdk/preparation_test.go b/apps/daemon/internal/agent/claudesdk/preparation_test.go
index f722d4481..f6c868640 100644
--- a/apps/daemon/internal/agent/claudesdk/preparation_test.go
+++ b/apps/daemon/internal/agent/claudesdk/preparation_test.go
@@ -107,7 +107,7 @@ func TestPreparationWaitsForReceiptAndRetainsConfiguration(t *testing.T) {
 }
 
 func TestPreparationRejectsInputAndUnavailableProfilesBeforeLaunch(t *testing.T) {
-	for _, name := range []string{"run", "prompt", "conversation", "attachments", "subagents", "workspace-missing", "none", "functions", "mcp", "controls", "old-runtime"} {
+	for _, name := range []string{"run", "prompt", "attachments", "subagents", "workspace-missing", "none", "functions", "mcp", "controls", "old-runtime"} {
 		t.Run(name, func(t *testing.T) {
 			config := preparationFixture(t, name)
 			req := preparationRequest()
@@ -116,8 +116,6 @@ func TestPreparationRejectsInputAndUnavailableProfilesBeforeLaunch(t *testing.T)
 				req.RunID = "unexpected"
 			case "prompt":
 				req.Input = proto.TextInput("unexpected")
-			case "conversation":
-				req.ConversationID = "product"
 			case "attachments":
 				req.Input = proto.MessageInput{{Content: []proto.InputContent{{Type: "input_image"}}}}
 			case "subagents":
diff --git a/apps/daemon/internal/agent/claudesdk/session.go b/apps/daemon/internal/agent/claudesdk/session.go
index 7edaabb07..e6dba3fde 100644
--- a/apps/daemon/internal/agent/claudesdk/session.go
+++ b/apps/daemon/internal/agent/claudesdk/session.go
@@ -37,7 +37,7 @@ func NewFactory(config Config) agent.Factory {
 	prepareExecutor := NewExecutorFactory(config)
 	return func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
 		run, input := req.RunID, req.Input
-		req.RunID, req.ConversationID, req.Input = "", "", nil
+		req.RunID, req.Input = "", nil
 		resource, err := prepareExecutor(ctx, req)
 		if err != nil {
 			return nil, err
diff --git a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
index ceca7f844..3acd44b81 100644
--- a/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
+++ b/apps/daemon/internal/agent/claudesdk/workspace_live_linux_test.go
@@ -104,7 +104,7 @@ func testLiveClaudeWorkspace(t *testing.T, explicitPreparation bool) {
 		out := make(chan proto.Envelope, 64)
 		req := workspaceRequest()
 		req.RunID, req.Input, req.AgentSessionID = uuid.NewString(), proto.TextInput(prompt), resume
-		req.ReleaseOnCompletion, req.ObserveMessages = true, true
+		req.ObserveMessages = true
 		req.AgentOptions = map[string]any{"model": "MiniMax-M3", "system_prompt": "Follow the exact verification instructions using the requested native tools. Preserve conversation facts. No other files, network operations or background work."}
 		proof := evidence{RunID: req.RunID}
 		var running agent.Session
diff --git a/apps/daemon/internal/agent/codex/preparation_helpers_test.go b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
index a04fe665c..52c5f07ea 100644
--- a/apps/daemon/internal/agent/codex/preparation_helpers_test.go
+++ b/apps/daemon/internal/agent/codex/preparation_helpers_test.go
@@ -42,7 +42,6 @@ func preparationFixture(t *testing.T) (proto.PromptRequestPayload, sessionConfig
 	cfg.codexBinary = binary
 	req := proto.PromptRequestPayload{
 		AgentKind: "codex", AgentStateKey: "prepared-session",
-		ReleaseOnCompletion:         true,
 		AgentOptions:                map[string]any{"model": "fixture-model"},
 		ExecutionControls:           &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"},
 		DisableExecutionEnvironment: true,
diff --git a/apps/daemon/internal/agent/codex/session.go b/apps/daemon/internal/agent/codex/session.go
index f2bc6333f..6c72ec886 100644
--- a/apps/daemon/internal/agent/codex/session.go
+++ b/apps/daemon/internal/agent/codex/session.go
@@ -37,9 +37,8 @@ func defaultSessionConfig() sessionConfig {
 }
 
 // Factory implements agent.Factory for agent_kind="codex". Spawns one
-// codex app-server child per prompt. The run stream closes when the turn
-// completes; the router retains the child until the conversation's idle
-// window expires or cancellation shuts it down sooner.
+// codex app-server child for one Turn. The run stream closes when the turn
+// completes; the child remains until the caller cancels the Session.
 func Factory(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
 	return newSession(ctx, req, out, defaultSessionConfig())
 }
diff --git a/apps/daemon/internal/agent/harness.go b/apps/daemon/internal/agent/harness.go
index 427a83a58..d199aa71f 100644
--- a/apps/daemon/internal/agent/harness.go
+++ b/apps/daemon/internal/agent/harness.go
@@ -119,8 +119,8 @@ type TurnSettlement struct {
 	Reason   string
 }
 
-// Session is the cancellation and outcome surface shared by direct prompt runs
-// and Turns. Every owner exposes observed state, including direct-call sessions.
+// Session is the cancellation and outcome surface shared by direct-call
+// sessions and Turns. Every owner exposes observed state.
 // For Executor-owned Turns, AwaitSettlement and Executor.Close define settlement
 // and resource retirement; Cancel alone does not transfer resource ownership.
 type Session interface {
@@ -199,7 +199,7 @@ type WorkspaceWriter interface {
 	WriteWorkspaceFile(context.Context, string, []byte) (WorkspaceWriteResult, error)
 }
 
-// Separate preparation for qualified workspace access and direct-call paths.
+// Separate preparation for qualified workspace access.
 
 // Prepared owns native resources until Start returns a non-nil Session. The
 // preparation owner context spans the eventual Session; Start's context is local
@@ -227,11 +227,12 @@ type PreparedCancellation interface {
 // cleanup remains unconfirmed. The caller must retain and close that resource.
 type PreparationFactory func(context.Context, proto.PromptRequestPayload) (Prepared, error)
 
-// Direct-call factory and registration. These use the existing Registry behavior.
+// Kind registration and the direct-call factory.
 
-// Factory builds a Session for one prompt_request. out is the upstream
-// channel the agent writes into and closes exactly once after terminal output.
-// ctx is cancelled by the router to wind the session down.
+// Factory builds a Session that runs req.Input as req.RunID without an
+// Executor; the router starts every Run through RegisterExecutor instead. out
+// is the channel the agent writes into and closes exactly once after terminal
+// output. ctx is cancelled to wind the session down.
 type Factory func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (Session, error)
 
 // RegisterKind installs f and the heartbeat descriptor for an
diff --git a/apps/daemon/internal/agent/mcode/executor.go b/apps/daemon/internal/agent/mcode/executor.go
index c63473397..1f9ecf907 100644
--- a/apps/daemon/internal/agent/mcode/executor.go
+++ b/apps/daemon/internal/agent/mcode/executor.go
@@ -39,7 +39,7 @@ func NewExecutorFactory(config *WorkspaceConfig) agent.ExecutorFactory {
 		if ctx == nil {
 			ctx = context.Background()
 		}
-		if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" {
+		if req.RunID != "" || len(req.Input) != 0 {
 			return nil, fmt.Errorf("mcode: Executor configuration cannot contain Turn input")
 		}
 		var err error
diff --git a/apps/daemon/internal/agent/mcode/executor_native_test.go b/apps/daemon/internal/agent/mcode/executor_native_test.go
index 96cae1889..d2c40d507 100644
--- a/apps/daemon/internal/agent/mcode/executor_native_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_native_test.go
@@ -29,8 +29,7 @@ func TestNativeMCodeExecutorReuse(t *testing.T) {
 		t.Fatal("private provider options unavailable")
 	}
 	req := testRequest(t)
-	req.ReleaseOnCompletion = false
-	req.RunID, req.Input, req.ConversationID = "", nil, ""
+	req.RunID, req.Input = "", nil
 	if json.Unmarshal(raw, &req.AgentOptions) != nil {
 		t.Fatal("invalid private provider options")
 	}
diff --git a/apps/daemon/internal/agent/mcode/executor_test.go b/apps/daemon/internal/agent/mcode/executor_test.go
index fc78836d0..52d7bdbd5 100644
--- a/apps/daemon/internal/agent/mcode/executor_test.go
+++ b/apps/daemon/internal/agent/mcode/executor_test.go
@@ -16,7 +16,6 @@ import (
 func executorFixture(t *testing.T, scenario string, workspace bool) (*executor, string) {
 	t.Helper()
 	config, req, record := workspaceFixture(t)
-	req.ReleaseOnCompletion = false
 	script, err := os.ReadFile(config.Binary)
 	if err != nil {
 		t.Fatal(err)
@@ -29,8 +28,7 @@ func executorFixture(t *testing.T, scenario string, workspace bool) (*executor,
 		factory = NewExecutorFactory(&config)
 	} else {
 		req = testRequest(t)
-		req.ReleaseOnCompletion = false
-		req.RunID, req.Input, req.ConversationID = "", nil, ""
+		req.RunID, req.Input = "", nil
 		t.Setenv("OAC_RUNTIME_MCODE_BIN", config.Binary)
 		factory = NewExecutorFactory(nil)
 	}
@@ -263,7 +261,6 @@ func TestExecutorCloseRetainsOwnerAfterDeadline(t *testing.T) {
 
 func TestExecutorFactoryPreparationFailureHasNoTypedNilOwner(t *testing.T) {
 	config, req, _ := workspaceFixture(t)
-	req.ReleaseOnCompletion = false
 	if err := os.WriteFile(config.Binary, []byte("#!/bin/sh\nexit 1\n"), 0700); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/agent/mcode/preparation_test.go b/apps/daemon/internal/agent/mcode/preparation_test.go
index 249129603..3f0a42502 100644
--- a/apps/daemon/internal/agent/mcode/preparation_test.go
+++ b/apps/daemon/internal/agent/mcode/preparation_test.go
@@ -16,7 +16,7 @@ import (
 func workspaceFixture(t *testing.T) (WorkspaceConfig, proto.PromptRequestPayload, string) {
 	t.Helper()
 	r := testRequest(t)
-	r.RunID, r.Input, r.ConversationID = "", nil, ""
+	r.RunID, r.Input = "", nil
 	r.DisableExecutionEnvironment = false
 	r.LocalEnvironment = &proto.LocalEnvironment{ID: "environment", NetworkAccess: "enabled", WorkspaceRoot: t.TempDir()}
 	record := filepath.Join(t.TempDir(), "calls")
diff --git a/apps/daemon/internal/agent/mcode/session_test.go b/apps/daemon/internal/agent/mcode/session_test.go
index ad506fedb..5012b1268 100644
--- a/apps/daemon/internal/agent/mcode/session_test.go
+++ b/apps/daemon/internal/agent/mcode/session_test.go
@@ -18,9 +18,9 @@ import (
 func testRequest(t *testing.T) proto.PromptRequestPayload {
 	t.Helper()
 	t.Setenv("OAC_RUNTIME_HOME", t.TempDir())
-	return proto.PromptRequestPayload{RunID: "run-1", ConversationID: "conversation-1", AgentStateKey: "conversation-1/agent-1/mcode", Input: proto.TextInput("Hello"), AgentOptions: map[string]any{
+	return proto.PromptRequestPayload{RunID: "run-1", AgentStateKey: "conversation-1/agent-1/mcode", Input: proto.TextInput("Hello"), AgentOptions: map[string]any{
 		"model": "fixture", "model_provider": map[string]any{"protocol": "anthropic", "base_url": "https://provider.example/v1", "api_key": "fixture-key", "context_window": 64000, "max_output_tokens": 4096}, "system_prompt": "Current instructions",
-	}, ReleaseOnCompletion: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
+	}, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
 }
 
 func helperSession(t *testing.T, scenario string, resume bool) (*Session, <-chan proto.Envelope) {
diff --git a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
index 43a162377..283a34291 100644
--- a/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
+++ b/apps/daemon/internal/cli/claude_sdk_live_linux_test.go
@@ -86,14 +86,14 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 		}()
 		ctx, cancel := context.WithTimeout(t.Context(), 120*time.Second)
 		defer cancel()
-		id := uuid.NewString()
-		request := proto.PromptRequestPayload{RunID: id, AgentKind: "claude_sdk", Input: proto.TextInput(prompt), AgentStateKey: "registered-acceptance", AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": nil}}
+		id, prepare := uuid.NewString(), uuid.NewString()
+		request := proto.PromptRequestPayload{AgentKind: "claude_sdk", AgentStateKey: "agents-api-registered-acceptance", AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}, AgentOptions: map[string]any{"model": "MiniMax-M3", "system_prompt": nil}}
 		if callFunction {
 			request.FunctionTools = []proto.FunctionTool{{Name: "lookup", Description: "Return a verification value.", Parameters: json.RawMessage(`{"type":"object","properties":{"id":{"type":"string"}},"required":["id"],"additionalProperties":false}`)}}
 		}
-		handle := func(kind string, payload any) {
+		send := func(kind, envelopeID string, payload any) {
 			t.Helper()
-			env, err := proto.NewEnvelope(kind, id, payload)
+			env, err := proto.NewEnvelope(kind, envelopeID, payload)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -101,7 +101,21 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 				t.Fatal("registered router request failed", err)
 			}
 		}
-		handle(proto.TypePromptRequest, request)
+		handle := func(kind string, payload any) { send(kind, id, payload) }
+		send(proto.TypeExecutionPrepare, prepare, proto.ExecutionPreparePayload{SessionID: "registered-acceptance", Configuration: request})
+		var ready proto.PreparationStatusPayload
+		for ready.State != "ready" {
+			var event proto.Envelope
+			select {
+			case event = <-sender:
+			case <-ctx.Done():
+				t.Fatal("registered preparation timed out", ctx.Err())
+			}
+			if event.Type != proto.TypePreparationStatus || event.ID != prepare || event.DecodePayload(&ready) != nil || ready.State != "preparing" && ready.State != "ready" {
+				t.Fatalf("registered preparation failed: %s", event.Payload)
+			}
+		}
+		send(proto.TypeExecutionStart, prepare, proto.ExecutionStartPayload{Handle: ready.Handle, ExecutorID: ready.ExecutorID, RunID: id, Input: proto.TextInput(prompt)})
 		proof := execution{}
 		defer func() {
 			data, _ := json.MarshalIndent(proof, "", "  ")
@@ -117,6 +131,13 @@ func TestLiveRegisteredClaudeSDK(t *testing.T) {
 			case <-ctx.Done():
 				t.Fatal("registered execution timed out", ctx.Err())
 			}
+			if event.Type == proto.TypePreparationStatus && event.ID == prepare {
+				var status proto.PreparationStatusPayload
+				if event.DecodePayload(&status) != nil || status.RunID != id || status.State != "starting" && status.State != "started" {
+					t.Fatalf("registered start failed: %s", event.Payload)
+				}
+				continue
+			}
 			if event.ID != id {
 				t.Fatal("event identity changed")
 			}
diff --git a/apps/daemon/internal/dispatch/cancellation.go b/apps/daemon/internal/dispatch/cancellation.go
index 5dffa4532..d255c6f1e 100644
--- a/apps/daemon/internal/dispatch/cancellation.go
+++ b/apps/daemon/internal/dispatch/cancellation.go
@@ -2,22 +2,10 @@ package dispatch
 
 import (
 	"context"
-	"errors"
 
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func (r *Router) releaseCompletedSession(state *sessionState) error {
-	r.mu.Lock()
-	state.retain = false
-	r.mu.Unlock()
-	receiptErr := r.finishSteering(state)
-	err := state.session.Cancel(context.Background())
-	state.ctxCancel()
-	return errors.Join(receiptErr, err)
-}
-
 func (r *Router) handlePromptCancel(ctx context.Context, env proto.Envelope) error {
 	var request proto.PromptCancelPayload
 	if err := env.DecodePayload(&request); err != nil {
@@ -29,39 +17,18 @@ func (r *Router) handlePromptCancel(ctx context.Context, env proto.Envelope) err
 		return ErrRouterClosed
 	}
 	state := r.sessions[env.ID]
-	if state != nil {
-		state.retain = false
-	}
-	var owner agent.Session
-	if state != nil && state.preparedHandoff != nil {
-		handoff := state.preparedHandoff
-		release, attempt := r.claimPreparedReleaseLocked(state, true, "", true)
-		if request.DeliveryID != "" {
-			r.shutdownWG.Add(1)
-			go r.sendPreparedCancellation(state, handoff, release, attempt, env, request.DeliveryID)
-		}
+	if state == nil {
 		r.mu.Unlock()
-		return nil
+		return r.sendCancellationAck(ctx, env, proto.InteractionDecisionAckPayload{DeliveryID: request.DeliveryID, ErrorCode: "run_inactive"})
 	}
-	if state != nil && state.session != nil {
-		owner = state.session
+	handoff := state.preparedHandoff
+	release, attempt := r.claimPreparedReleaseLocked(state, true, "", true)
+	if request.DeliveryID != "" {
+		r.shutdownWG.Add(1)
+		go r.sendPreparedCancellation(state, handoff, release, attempt, env, request.DeliveryID)
 	}
 	r.mu.Unlock()
-	ack := proto.InteractionDecisionAckPayload{DeliveryID: request.DeliveryID, ErrorCode: "run_inactive"}
-	if state != nil && owner == nil {
-		ack.ErrorCode = "not_ready"
-	} else if owner != nil {
-		if err := owner.Cancel(ctx); err != nil {
-			r.log.WarnContext(ctx, "session.Cancel failed", "run_id", env.ID, "err", err)
-			ack.ErrorCode = "cancel_failed"
-		} else {
-			ack.Applied, ack.ErrorCode = true, ""
-			outcome := owner.CancellationOutcome()
-			ack.Outcome = &outcome
-		}
-		state.ctxCancel()
-	}
-	return r.sendCancellationAck(ctx, env, ack)
+	return nil
 }
 
 func (r *Router) sendCancellationAck(ctx context.Context, env proto.Envelope, ack proto.InteractionDecisionAckPayload) error {
diff --git a/apps/daemon/internal/dispatch/cancellation_test.go b/apps/daemon/internal/dispatch/cancellation_test.go
index f4273d5ef..d43722800 100644
--- a/apps/daemon/internal/dispatch/cancellation_test.go
+++ b/apps/daemon/internal/dispatch/cancellation_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"errors"
@@ -25,40 +23,41 @@ func (s *cancelReceiptSession) CancellationOutcome() proto.DonePayload {
 	return s.outcome
 }
 
+func (s *cancelReceiptSession) Cancel(ctx context.Context) error {
+	if s.entered != nil {
+		close(s.entered)
+		<-s.release
+		s.entered = nil
+	}
+	_ = s.fakeSession.Cancel(ctx)
+	return s.err
+}
+
+func registerCancelReceiptKind(h *harness, sess *cancelReceiptSession) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+		sess.fakeSession = &fakeSession{out: out, closeOutOnCancel: true}
+		return sess, nil
+	}))
+}
+
 func TestCompletionWaitsForNativeWriterRelease(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 	sess := &cancelReceiptSession{entered: make(chan struct{}), release: make(chan struct{})}
-	h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		sess.fakeSession = &fakeSession{out: out, closeOutOnCancel: true}
-		return sess, nil
-	})
-	if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "release", proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: "stable", ReleaseOnCompletion: true})); err != nil {
-		t.Fatal(err)
-	}
+	registerCancelReceiptKind(h, sess)
+	startRun(t, h.router, h.sender, "release", proto.PromptRequestPayload{AgentKind: "codex"})
 	sess.out <- mustEnv(t, proto.TypeDone, "release", proto.DonePayload{Content: "Finished"})
 	<-sess.entered
-	if len(h.sender.snapshot()) != 0 {
+	if len(h.sender.typesFor("release")) != 0 {
 		t.Fatal("completion acknowledged before native writer was released")
 	}
 	close(sess.release)
-	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "release completion")
-	frames := h.sender.snapshot()
-	if len(frames) != 1 || frames[0].Type != proto.TypeDone || sess.cancels() != 1 {
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypeDone, "release") }, "release completion")
+	if frames := h.sender.typesFor("release"); len(frames) != 1 || frames[0] != proto.TypeDone || sess.cancels() != 1 {
 		t.Fatal("completion or native release missing")
 	}
 }
 
-func (s *cancelReceiptSession) Cancel(ctx context.Context) error {
-	if s.entered != nil {
-		close(s.entered)
-		<-s.release
-		s.entered = nil
-	}
-	_ = s.fakeSession.Cancel(ctx)
-	return s.err
-}
-
 func TestCancellationReceiptFollowsAdapterOutcome(t *testing.T) {
 	observed := proto.DonePayload{Content: "partial output", Metadata: map[string]any{proto.DoneMetaAgentSessionID: "native-cancelled"}}
 	for _, test := range []struct {
@@ -76,47 +75,31 @@ func TestCancellationReceiptFollowsAdapterOutcome(t *testing.T) {
 			h := newHarness(t)
 			defer h.router.Shutdown(context.Background())
 			sess := &cancelReceiptSession{entered: make(chan struct{}), release: make(chan struct{}), outcome: test.outcome, err: test.err}
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-				sess.fakeSession = &fakeSession{out: out, closeOutOnCancel: true}
-				return sess, nil
-			})
-			if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "run", proto.PromptRequestPayload{AgentKind: "codex"})); err != nil {
+			registerCancelReceiptKind(h, sess)
+			startRun(t, h.router, h.sender, "run", proto.PromptRequestPayload{AgentKind: "codex"})
+			if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptCancel, "run", proto.PromptCancelPayload{DeliveryID: "cancel-1"})); err != nil {
 				t.Fatal(err)
 			}
-			done := make(chan error, 1)
-			go func() {
-				done <- h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptCancel, "run", proto.PromptCancelPayload{DeliveryID: "cancel-1"}))
-			}()
 			<-sess.entered
-			for _, env := range h.sender.snapshot() {
-				if env.Type == proto.TypeInteractionDecisionAck {
-					t.Fatal("cancellation acknowledged before adapter returned")
-				}
+			if len(cancellationAcks(h.sender)) != 0 {
+				t.Fatal("cancellation acknowledged before adapter returned")
 			}
 			close(sess.release)
-			if err := <-done; err != nil {
-				t.Fatal(err)
+			waitFor(t, func() bool { return len(cancellationAcks(h.sender)) != 0 }, "cancellation receipt")
+			acks := cancellationAcks(h.sender)
+			if len(acks) != 1 {
+				t.Fatalf("cancellation receipts: %+v", acks)
 			}
-			found := false
-			for _, env := range h.sender.snapshot() {
-				if env.Type == proto.TypeInteractionDecisionAck {
-					found = true
-					var ack proto.InteractionDecisionAckPayload
-					_ = env.DecodePayload(&ack)
-					if ack.Applied != (test.err == nil) || ack.DeliveryID != "cancel-1" {
-						t.Fatalf("wrong receipt: %+v", ack)
-					}
-					if test.err == nil {
-						if ack.ErrorCode != "" || ack.Outcome == nil || !reflect.DeepEqual(*ack.Outcome, test.outcome) {
-							t.Fatalf("cancellation receipt changed observed evidence: %+v", ack)
-						}
-					} else if ack.ErrorCode != "cancel_failed" || ack.Outcome != nil {
-						t.Fatalf("failed cancellation supplied a success outcome: %+v", ack)
-					}
-				}
+			ack := acks[0]
+			if ack.Applied != (test.err == nil) || ack.DeliveryID != "cancel-1" {
+				t.Fatalf("wrong receipt: %+v", ack)
 			}
-			if !found {
-				t.Fatal("missing cancellation receipt")
+			if test.err == nil {
+				if ack.ErrorCode != "" || ack.Outcome == nil || !reflect.DeepEqual(*ack.Outcome, test.outcome) {
+					t.Fatalf("cancellation receipt changed observed evidence: %+v", ack)
+				}
+			} else if ack.ErrorCode != "cancel_failed" || ack.Outcome != nil {
+				t.Fatalf("failed cancellation supplied a success outcome: %+v", ack)
 			}
 		})
 	}
@@ -125,14 +108,13 @@ func TestCancellationReceiptFollowsAdapterOutcome(t *testing.T) {
 func TestLegacyCancellationDoesNotEmitNewFrames(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
-	if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "legacy", proto.PromptRequestPayload{AgentKind: "fake_alpha"})); err != nil {
-		t.Fatal(err)
-	}
+	startRun(t, h.router, h.sender, "legacy", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 	sess.closeOutOnCancel = true
 	if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptCancel, "legacy", proto.PromptCancelPayload{})); err != nil {
 		t.Fatal(err)
 	}
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypeDone, "legacy") }, "cancellation settlement")
 	for _, env := range h.sender.snapshot() {
 		if env.Type == proto.TypeInteractionDecisionAck {
 			t.Fatal("legacy cancellation emitted new receipt")
diff --git a/apps/daemon/internal/dispatch/capability_admission_test.go b/apps/daemon/internal/dispatch/capability_admission_test.go
index 0a9fde120..744d60ff6 100644
--- a/apps/daemon/internal/dispatch/capability_admission_test.go
+++ b/apps/daemon/internal/dispatch/capability_admission_test.go
@@ -9,7 +9,6 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
 )
 
 func TestSteeringUsesAdmittedDeclarationAndDoesNotReplayUnsupportedImplementation(t *testing.T) {
@@ -18,20 +17,18 @@ func TestSteeringUsesAdmittedDeclarationAndDoesNotReplayUnsupportedImplementatio
 			h := newHarness(t)
 			defer h.router.Shutdown(context.Background())
 			var calls atomic.Int32
-			factory := func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+			factory := sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				return &steeringSession{fakeSession: &fakeSession{out: out, closeOutOnCancel: true}, steer: func(context.Context, proto.PromptSteerPayload) error {
 					calls.Add(1)
 					return fmt.Errorf("%w: fixture has no active input", agent.ErrUnsupportedOperation)
 				}}, nil
-			}
-			info := proto.SupportedAgentKind{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilityFromBool(supported)})}
-			h.reg.RegisterKind(info, harnessconfig.Configuration{}, factory)
-			if err := h.router.Handle(t.Context(), mustEnv(t, proto.TypePromptRequest, "run", proto.PromptRequestPayload{AgentKind: "fixture"})); err != nil {
-				t.Fatal(err)
-			}
+			})
+			info := proto.SupportedAgentKind{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilityFromBool(supported)})}
+			registerExecutorKind(h.reg, info, factory)
+			startRun(t, h.router, h.sender, "run", proto.PromptRequestPayload{AgentKind: "fixture"})
 			// A new registration cannot rewrite the already admitted owner's contract.
 			info.Capabilities.Steering = proto.CapabilityFromBool(!supported)
-			h.reg.RegisterKind(info, harnessconfig.Configuration{}, factory)
+			registerExecutorKind(h.reg, info, factory)
 			for range 2 {
 				if err := handleSteeringAndWait(t, h, mustEnv(t, proto.TypePromptSteer, "run", proto.PromptSteerPayload{InputID: "input", Input: proto.TextInput("hello")})); err != nil {
 					t.Fatal(err)
@@ -63,14 +60,12 @@ func TestInteractionDeclarationPrecedesResponderMethods(t *testing.T) {
 				h := newHarness(t)
 				defer h.router.Shutdown(context.Background())
 				var session *fakeSession
-				info := proto.SupportedAgentKind{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Permissions: proto.CapabilityFromBool(supported)})}
-				h.reg.RegisterKind(info, harnessconfig.Configuration{}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+				info := proto.SupportedAgentKind{Kind: "fixture", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Permissions: proto.CapabilityFromBool(supported)})}
+				registerExecutorKind(h.reg, info, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 					session = &fakeSession{out: out, closeOutOnCancel: true, submitErr: agent.ErrUnsupportedOperation, askErr: agent.ErrUnsupportedOperation}
 					return session, nil
-				})
-				if err := h.router.Handle(t.Context(), mustEnv(t, proto.TypePromptRequest, "run", proto.PromptRequestPayload{AgentKind: "fixture"})); err != nil {
-					t.Fatal(err)
-				}
+				}))
+				startRun(t, h.router, h.sender, "run", proto.PromptRequestPayload{AgentKind: "fixture"})
 				event := mustEnv(t, proto.TypePermissionRequest, "run", proto.PermissionRequestPayload{RequestID: "interaction", Tool: "fixture"})
 				decision := mustEnv(t, proto.TypePermissionDecision, "interaction", proto.PermissionDecisionPayload{DeliveryID: "decision", Approved: true})
 				if ask {
@@ -78,7 +73,7 @@ func TestInteractionDeclarationPrecedesResponderMethods(t *testing.T) {
 					decision = mustEnv(t, proto.TypePromptForUserChoiceDecision, "interaction", proto.PromptForUserChoiceDecisionPayload{DeliveryID: "decision"})
 				}
 				session.out <- event
-				waitFor(t, func() bool { return len(h.sender.snapshot()) > 0 }, "interaction indexed")
+				waitFor(t, func() bool { return hasFrame(h.sender, event.Type, "run") }, "interaction indexed")
 				if err := h.router.Handle(t.Context(), decision); err != nil {
 					t.Fatal(err)
 				}
diff --git a/apps/daemon/internal/dispatch/environment.go b/apps/daemon/internal/dispatch/environment.go
index 932ad7649..74de20411 100644
--- a/apps/daemon/internal/dispatch/environment.go
+++ b/apps/daemon/internal/dispatch/environment.go
@@ -7,6 +7,9 @@ import (
 )
 
 func validateExecutionEnvironment(req proto.PromptRequestPayload, caps proto.AgentKindCapabilities) error {
+	if (req.LocalEnvironment != nil) == req.DisableExecutionEnvironment {
+		return errors.New("execution requires exactly one of local_environment and disable_execution_environment")
+	}
 	if err := req.ValidateAgentOptions(); err != nil {
 		return err
 	}
@@ -16,7 +19,7 @@ func validateExecutionEnvironment(req proto.PromptRequestPayload, caps proto.Age
 	if err := req.ValidateToolSearch(caps.ToolSearch.IsSupported()); err != nil {
 		return err
 	}
-	if req.LocalEnvironment != nil && (req.DisableExecutionEnvironment || !caps.LocalEnvironment.IsSupported()) {
+	if req.LocalEnvironment != nil && !caps.LocalEnvironment.IsSupported() {
 		return errors.New("engine does not support this local Environment configuration")
 	}
 	if req.DisableExecutionEnvironment && !caps.EnvironmentNone.IsSupported() {
diff --git a/apps/daemon/internal/dispatch/environment_test.go b/apps/daemon/internal/dispatch/environment_test.go
index 0e72f9020..c021ec3cb 100644
--- a/apps/daemon/internal/dispatch/environment_test.go
+++ b/apps/daemon/internal/dispatch/environment_test.go
@@ -1,10 +1,9 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"errors"
+	"sync/atomic"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
@@ -12,21 +11,36 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
 )
 
+// assertPreparationOutcome waits for the terminal admission status of id. An
+// admitted request fails in the controlled factory; a rejected one sends only
+// its rejection.
+func assertPreparationOutcome(t *testing.T, sender *recSender, id string, admitted bool) proto.PreparationStatusPayload {
+	t.Helper()
+	state, frames := "rejected", 1
+	if admitted {
+		state, frames = "failed", 2
+	}
+	status := waitPreparationStatus(t, sender, id, state, "")
+	if got := sender.typesFor(id); len(got) != frames {
+		t.Fatalf("preparation %s frames = %v, want %d status frames", id, got, frames)
+	}
+	return status
+}
+
 func TestNoEnvironmentRejectsOtherEngineBeforeFactory(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
-	called := false
-	h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "fake_alpha", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-		called = true
-		return nil, nil
+	var called atomic.Bool
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "fake_alpha", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+		called.Store(true)
+		return nil, errors.New("controlled factory stop")
 	})
-	err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "none", proto.PromptRequestPayload{AgentKind: "fake_alpha", DisableExecutionEnvironment: true}))
-	if err == nil || called {
-		t.Fatal("unsupported engine was started", err)
+	err := h.router.Handle(context.Background(), mustEnv(t, proto.TypeExecutionPrepare, "none", noEnvironmentPreparation("none", proto.PromptRequestPayload{AgentKind: "fake_alpha"})))
+	if err == nil {
+		t.Fatal("unsupported engine was admitted")
 	}
-	frames := h.sender.snapshot()
-	if len(frames) != 2 || frames[0].Type != proto.TypeError || frames[1].Type != proto.TypeDone {
-		t.Fatal(frames)
+	if status := assertPreparationOutcome(t, h.sender, "none", false); status.ErrorCode != "unsupported_configuration" || called.Load() {
+		t.Fatalf("unsupported engine was started: status=%+v called=%t", status, called.Load())
 	}
 }
 
@@ -34,14 +48,15 @@ func TestNoEnvironmentUsesAvailableCapability(t *testing.T) {
 	for _, available := range []bool{false, true} {
 		h := newHarness(t)
 		defer h.router.Shutdown(context.Background())
-		called := false
-		h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "claude_sdk", Available: available, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-			called = true
+		var called atomic.Bool
+		registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "claude_sdk", Available: available, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+			called.Store(true)
 			return nil, errors.New("controlled factory stop")
 		})
-		_ = h.router.Handle(t.Context(), mustEnv(t, proto.TypePromptRequest, "sdk", proto.PromptRequestPayload{AgentKind: "claude_sdk", DisableExecutionEnvironment: true}))
-		if called != available {
-			t.Fatalf("factory called=%t, available=%t", called, available)
+		_ = h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "sdk", noEnvironmentPreparation("sdk", proto.PromptRequestPayload{AgentKind: "claude_sdk"})))
+		assertPreparationOutcome(t, h.sender, "sdk", available)
+		if called.Load() != available {
+			t.Fatalf("factory called=%t, available=%t", called.Load(), available)
 		}
 	}
 }
@@ -51,26 +66,26 @@ func TestLocalEnvironmentRequiresAvailableCapability(t *testing.T) {
 		t.Run(mode, func(t *testing.T) {
 			h := localPreparationHarness(t)
 			defer h.router.Shutdown(context.Background())
-			called := false
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: mode != "unavailable",
+			var called atomic.Bool
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: mode != "unavailable",
 				Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{LocalEnvironment: proto.CapabilityFromBool(mode != "unsupported")})},
-				harnessconfig.Configuration{}, func(_ context.Context, req proto.PromptRequestPayload, _ chan<- proto.Envelope) (agent.Session, error) {
-					called = true
+				func(_ context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
+					called.Store(true)
 					if req.LocalEnvironment == nil || req.LocalEnvironment.ID != preparationEnvironmentID {
 						t.Error("local descriptor lost before factory")
 					}
 					return nil, errors.New("controlled factory stop")
 				})
-			req := preparationRequest().Configuration
-			req.AgentKind = "codex"
-			req.DisableExecutionEnvironment = mode == "none conflict"
-			_ = h.router.Handle(t.Context(), mustEnv(t, proto.TypePromptRequest, "local", req))
-			if called != (mode == "supported") {
-				t.Fatalf("unexpected factory call for %s", mode)
+			req := preparationRequest()
+			req.Configuration.AgentKind = "codex"
+			req.Configuration.DisableExecutionEnvironment = mode == "none conflict"
+			err := h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "local", req))
+			if (err == nil) != (mode == "supported") {
+				t.Fatalf("wrong admission for %s: %v", mode, err)
 			}
-			frames := h.sender.snapshot()
-			if len(frames) != 2 || frames[0].Type != proto.TypeError || frames[1].Type != proto.TypeDone {
-				t.Fatal("missing terminal error frames")
+			assertPreparationOutcome(t, h.sender, "local", mode == "supported")
+			if called.Load() != (mode == "supported") {
+				t.Fatalf("unexpected factory call for %s", mode)
 			}
 		})
 	}
diff --git a/apps/daemon/internal/dispatch/executor.go b/apps/daemon/internal/dispatch/executor.go
index 7ac4223b6..38de76298 100644
--- a/apps/daemon/internal/dispatch/executor.go
+++ b/apps/daemon/internal/dispatch/executor.go
@@ -38,14 +38,13 @@ func executorFingerprint(req proto.PromptRequestPayload) ([32]byte, error) {
 	req.RunID, req.Input = "", nil
 	req.AgentSessionID = ""
 	req.RequireExistingNativeSession = false
-	req.ReleaseOnCompletion = false
 	data, err := json.Marshal(req)
 	return sha256.Sum256(data), err
 }
 
 func (r *Router) handleExecutorPrepare(ctx context.Context, env proto.Envelope, input proto.ExecutionPreparePayload) error {
 	req := input.Configuration
-	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.AgentStateKey != "agents-api-"+input.SessionID {
+	if strings.TrimSpace(input.SessionID) == "" || req.RunID != "" || len(req.Input) != 0 || req.AgentStateKey != "agents-api-"+input.SessionID {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
 	caps, available := r.availableCapabilities(req.AgentKind)
@@ -60,7 +59,7 @@ func (r *Router) handleExecutorPrepare(ctx context.Context, env proto.Envelope,
 	if err != nil {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
-	if (req.LocalEnvironment != nil) == req.DisableExecutionEnvironment || validateExecutionEnvironment(req, caps) != nil || len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported() {
+	if validateExecutionEnvironment(req, caps) != nil || len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported() {
 		return r.rejectPreparation(env, "unsupported_configuration")
 	}
 	fingerprint, err := executorFingerprint(req)
@@ -146,7 +145,7 @@ func (r *Router) handleExecutorPrepare(ctx context.Context, env proto.Envelope,
 		r.log.Info("executor owner_created", "executor_id", owner.id, "session_id", owner.sessionID)
 	}
 	operation, cancel := context.WithCancel(context.WithoutCancel(ctx))
-	p := &preparationState{capabilities: owner.capabilities, requestID: env.ID, trace: env.Trace, fingerprint: requestFingerprint, ctx: operation, cancel: cancel, stateKey: req.AgentStateKey, environmentID: req.EnvironmentID(), executor: owner, owns: true, busy: !reused, deadline: time.Now().Add(r.preparationTimeout)}
+	p := &preparationState{capabilities: owner.capabilities, requestID: env.ID, trace: env.Trace, fingerprint: requestFingerprint, ctx: operation, cancel: cancel, environmentID: req.EnvironmentID(), executor: owner, owns: true, busy: !reused, deadline: time.Now().Add(r.preparationTimeout)}
 	state := "preparing"
 	if reused {
 		state = "ready"
@@ -276,19 +275,22 @@ func (r *Router) scheduleExecutorIdleLocked(owner *executorState) {
 	owner.idleLease++
 	lease := owner.idleLease
 	r.log.Info("executor owner_idle", "executor_id", owner.id, "session_id", owner.sessionID)
-	owner.timer = time.AfterFunc(r.idleTimeout, func() {
-		r.mu.Lock()
-		if r.executors[owner.sessionID] != owner || owner.idleLease != lease || owner.run != nil || owner.admission != nil || owner.invalid {
-			r.mu.Unlock()
-			return
-		}
-		owner.invalid = true
-		owner.closeReason = "idle_expired"
-		r.shutdownWG.Add(1)
+	owner.timer = time.AfterFunc(r.idleTimeout, func() { r.expireIdleExecutor(owner, lease) })
+}
+
+// expireIdleExecutor closes owner only while lease is its current idle lease.
+func (r *Router) expireIdleExecutor(owner *executorState, lease uint64) {
+	r.mu.Lock()
+	if r.executors[owner.sessionID] != owner || owner.idleLease != lease || owner.run != nil || owner.admission != nil || owner.invalid {
 		r.mu.Unlock()
-		defer r.shutdownWG.Done()
-		_ = r.closeExecutor(owner)
-	})
+		return
+	}
+	owner.invalid = true
+	owner.closeReason = "idle_expired"
+	r.shutdownWG.Add(1)
+	r.mu.Unlock()
+	defer r.shutdownWG.Done()
+	_ = r.closeExecutor(owner)
 }
 
 // Close failures keep the exact owner; a later call retries only settled failures.
diff --git a/apps/daemon/internal/dispatch/executor_test.go b/apps/daemon/internal/dispatch/executor_test.go
index 55686fd2a..211c2201d 100644
--- a/apps/daemon/internal/dispatch/executor_test.go
+++ b/apps/daemon/internal/dispatch/executor_test.go
@@ -69,17 +69,27 @@ func (t *reusableTurn) AwaitSettlement(ctx context.Context) (agent.TurnSettlemen
 	}
 }
 
+// noEnvironmentPreparation prepares config for session without an execution environment.
+func noEnvironmentPreparation(session string, config proto.PromptRequestPayload) proto.ExecutionPreparePayload {
+	config.AgentStateKey, config.DisableExecutionEnvironment = "agents-api-"+session, true
+	return proto.ExecutionPreparePayload{SessionID: session, Configuration: config}
+}
 func executorRequest() proto.ExecutionPreparePayload {
-	return proto.ExecutionPreparePayload{SessionID: "session", Configuration: proto.PromptRequestPayload{AgentKind: "reusable", AgentStateKey: "agents-api-session", DisableExecutionEnvironment: true}}
+	return noEnvironmentPreparation("session", proto.PromptRequestPayload{AgentKind: "reusable"})
+}
+
+// registerExecutorKind registers info for prepared execution only.
+func registerExecutorKind(reg *agent.Registry, info proto.SupportedAgentKind, factory agent.ExecutorFactory) {
+	reg.RegisterKind(info, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
+		return nil, errors.New("prepared execution must not use the direct Session factory")
+	})
+	reg.RegisterExecutor(info.Kind, factory)
 }
 func executorRouter(t *testing.T, owner *reusableExecutor, idle time.Duration) (*dispatch.Router, *recSender, *atomic.Int32) {
 	t.Helper()
 	calls := &atomic.Int32{}
 	reg := agent.NewRegistry()
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: "reusable", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-		return nil, errors.New("ordinary factory is forbidden")
-	})
-	reg.RegisterExecutor("reusable", func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: "reusable", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
 		calls.Add(1)
 		return owner, nil
 	})
diff --git a/apps/daemon/internal/dispatch/export_test.go b/apps/daemon/internal/dispatch/export_test.go
index 4c5e2a361..05d7011d7 100644
--- a/apps/daemon/internal/dispatch/export_test.go
+++ b/apps/daemon/internal/dispatch/export_test.go
@@ -36,3 +36,11 @@ func (r *Router) SteeringClosedForTest(runID string) bool {
 	state := r.sessions[runID]
 	return state != nil && state.steeringClosed
 }
+
+// RunStartedForTest reports whether runID's Turn accepts operations.
+func (r *Router) RunStartedForTest(runID string) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	state := r.sessions[runID]
+	return state != nil && state.session != nil
+}
diff --git a/apps/daemon/internal/dispatch/functions_native_test.go b/apps/daemon/internal/dispatch/functions_native_test.go
index f541a43a8..f8fe3879b 100644
--- a/apps/daemon/internal/dispatch/functions_native_test.go
+++ b/apps/daemon/internal/dispatch/functions_native_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"encoding/json"
@@ -110,13 +108,8 @@ func TestNativeFunctionBridge(t *testing.T) {
 	}))
 	defer model.Close()
 	reg := agent.NewRegistry()
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{FunctionTools: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported})}, harnessconfig.Configuration{}, codex.Factory)
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{FunctionTools: proto.CapabilitySupported, EnvironmentNone: proto.CapabilitySupported})}, codex.NewExecutorFactory())
 	sender := make(nativeFunctionSender, 256)
-	router, err := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer router.Shutdown(context.Background())
 	ctx, cancel := context.WithTimeout(t.Context(), 60*time.Second)
 	defer cancel()
 	await := func(kind string) proto.Envelope {
@@ -135,14 +128,48 @@ func TestNativeFunctionBridge(t *testing.T) {
 			}
 		}
 	}
+	awaitReady := func(id string) proto.PreparationStatusPayload {
+		t.Helper()
+		for {
+			env := await(proto.TypePreparationStatus)
+			var status proto.PreparationStatusPayload
+			if env.ID != id {
+				continue
+			}
+			if err := env.DecodePayload(&status); err != nil {
+				t.Fatal(env, err)
+			}
+			if status.State == "ready" {
+				return status
+			}
+			if status.State != "preparing" {
+				t.Fatalf("preparation %s: %+v", id, status)
+			}
+		}
+	}
 	nativeID := ""
-	for index := 0; index < 3; index++ {
+	// Each Run owns a fresh Router, so every resume starts a new native process.
+	run := func(index int) {
+		router, err := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer func() {
+			if err := router.Shutdown(ctx); err != nil {
+				t.Error(err)
+			}
+		}()
 		run := fmt.Sprintf("run-%d", index)
-		request := proto.PromptRequestPayload{AgentKind: "codex", Input: proto.TextInput("Look up ticket 42."), RunID: run, AgentStateKey: "native-functions", AgentSessionID: nativeID, ReleaseOnCompletion: true, DisableExecutionEnvironment: true,
+		request := noEnvironmentPreparation("native-functions", proto.PromptRequestPayload{AgentKind: "codex", AgentSessionID: nativeID,
 			FunctionTools: []proto.FunctionTool{{Name: "lookup_ticket", Description: "Read a synthetic ticket", Parameters: json.RawMessage(`{"type":"object","properties":{"ticket":{"type":"string"}},"required":["ticket"],"additionalProperties":false}`)}},
-			AgentOptions:  map[string]any{"model": "gpt-5.5", "model_provider": map[string]any{"protocol": "responses", "base_url": model.URL + "/v1", "api_key": "synthetic-local-token"}}}
-		env, _ := proto.NewEnvelope(proto.TypePromptRequest, run, request)
-		if err := router.Handle(ctx, env); err != nil {
+			AgentOptions:  map[string]any{"model": "gpt-5.5", "model_provider": map[string]any{"protocol": "responses", "base_url": model.URL + "/v1", "api_key": "synthetic-local-token"}}})
+		prepare, _ := proto.NewEnvelope(proto.TypeExecutionPrepare, run, request)
+		if err := router.Handle(ctx, prepare); err != nil {
+			t.Fatal(err)
+		}
+		ready := awaitReady(run)
+		start, _ := proto.NewEnvelope(proto.TypeExecutionStart, run, proto.ExecutionStartPayload{Handle: ready.Handle, ExecutorID: ready.ExecutorID, RunID: run, Input: proto.TextInput("Look up ticket 42.")})
+		if err := router.Handle(ctx, start); err != nil {
 			t.Fatal(err)
 		}
 		call := await(proto.TypeFunctionCall)
@@ -169,7 +196,7 @@ func TestNativeFunctionBridge(t *testing.T) {
 			if receipt.Applied || receipt.ErrorCode != "not_pending" {
 				t.Fatal(receipt)
 			}
-			break
+			return
 		}
 		result, _ := proto.NewEnvelope(proto.TypeFunctionResult, run, proto.FunctionResultPayload{CallID: payload.CallID, Success: index == 0, Content: functionResultContent("TICKET-RESULT"), DeliveryID: "result"})
 		if err := router.Handle(ctx, result); err != nil {
@@ -190,5 +217,8 @@ func TestNativeFunctionBridge(t *testing.T) {
 		}
 		nativeID = id
 	}
+	for index := range 3 {
+		run(index)
+	}
 	t.Logf("Native function success/failure, fresh-process resume, cancellation and late-result rejection passed; evidence %s", home)
 }
diff --git a/apps/daemon/internal/dispatch/functions_test.go b/apps/daemon/internal/dispatch/functions_test.go
index 59be84409..db0bc5d56 100644
--- a/apps/daemon/internal/dispatch/functions_test.go
+++ b/apps/daemon/internal/dispatch/functions_test.go
@@ -1,16 +1,17 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"image"
 	"image/color"
 	"image/png"
 	"sync"
+	"sync/atomic"
 	"testing"
 
 	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
@@ -38,21 +39,18 @@ func TestFunctionReceiptsScopeRetriesAndConflicts(t *testing.T) {
 	reg := agent.NewRegistry()
 	sender := &recSender{}
 	sessions := map[string]*functionSession{}
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: "function-test", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{FunctionTools: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, p proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		s := &functionSession{fakeSession: &fakeSession{out: out, ctx: ctx, closeOutOnCancel: true}}
-		sessions[p.RunID] = s
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: "function-test", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, runID string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+		s := &functionSession{fakeSession: &fakeSession{out: out, closeOutOnCancel: true}}
+		sessions[runID] = s
 		return s, nil
-	})
+	}))
 	router, err := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer router.Shutdown(context.Background())
 	for _, id := range []string{"one", "two"} {
-		env, _ := proto.NewEnvelope(proto.TypePromptRequest, id, proto.PromptRequestPayload{AgentKind: "function-test", Input: proto.TextInput("lookup"), FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{}`)}}})
-		if err := router.Handle(t.Context(), env); err != nil {
-			t.Fatal(err)
-		}
+		startRun(t, router, sender, id, proto.PromptRequestPayload{AgentKind: "function-test", FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{}`)}}})
 	}
 	submit := func(run, call, text, delivery string) proto.InteractionDecisionAckPayload {
 		t.Helper()
@@ -137,17 +135,20 @@ func TestFunctionReceiptsScopeRetriesAndConflicts(t *testing.T) {
 
 func TestFunctionToolsRequireAdvertisedSupport(t *testing.T) {
 	reg := agent.NewRegistry()
-	called := false
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: "unsupported", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-		called = true
-		return nil, nil
+	var called atomic.Bool
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: "unsupported", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+		called.Store(true)
+		return nil, errors.New("unexpected executor preparation")
 	})
 	sender := &recSender{}
 	router, _ := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
 	defer router.Shutdown(context.Background())
-	env, _ := proto.NewEnvelope(proto.TypePromptRequest, "run", proto.PromptRequestPayload{AgentKind: "unsupported", FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{}`)}}})
-	if err := router.Handle(t.Context(), env); err == nil || called {
-		t.Fatal("unsupported engine silently ignored tools", err)
+	env, _ := proto.NewEnvelope(proto.TypeExecutionPrepare, "run", noEnvironmentPreparation("session", proto.PromptRequestPayload{AgentKind: "unsupported", FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{}`)}}}))
+	if err := router.Handle(t.Context(), env); err == nil {
+		t.Fatal("unsupported engine silently ignored tools")
+	}
+	if status := waitPreparationStatus(t, sender, "run", "rejected", ""); status.ErrorCode != "unsupported_configuration" || called.Load() {
+		t.Fatalf("status=%+v executor called=%t", status, called.Load())
 	}
 }
 
@@ -165,17 +166,22 @@ func functionResultContent(text string) []proto.InputContent {
 
 func TestDiscoveryCannotReachAnEagerOnlyAdapter(t *testing.T) {
 	reg := agent.NewRegistry()
-	called := false
-	reg.RegisterKind(proto.SupportedAgentKind{Kind: "eager-only", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{FunctionTools: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-		called = true
-		return nil, nil
+	var called atomic.Bool
+	registerExecutorKind(reg, proto.SupportedAgentKind{Kind: "eager-only", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, FunctionTools: proto.CapabilitySupported})}, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
+		called.Store(true)
+		return nil, errors.New("unexpected executor preparation")
 	})
-	router, _ := dispatch.New(dispatch.Config{Registry: reg, Sender: &recSender{}})
+	sender := &recSender{}
+	router, _ := dispatch.New(dispatch.Config{Registry: reg, Sender: sender})
 	defer router.Shutdown(context.Background())
 	for _, search := range []bool{false, true} {
-		env, _ := proto.NewEnvelope(proto.TypePromptRequest, "discovery", proto.PromptRequestPayload{AgentKind: "eager-only", ToolSearch: search, FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object"}`), DeferLoading: true}}})
-		if err := router.Handle(t.Context(), env); err == nil || called {
-			t.Fatal("deferred definitions reached an eager-only adapter", err)
+		id := fmt.Sprint("discovery-", search)
+		env, _ := proto.NewEnvelope(proto.TypeExecutionPrepare, id, noEnvironmentPreparation("session", proto.PromptRequestPayload{AgentKind: "eager-only", ToolSearch: search, FunctionTools: []proto.FunctionTool{{Name: "lookup", Parameters: json.RawMessage(`{"type":"object"}`), DeferLoading: true}}}))
+		if err := router.Handle(t.Context(), env); err == nil {
+			t.Fatal("deferred definitions reached an eager-only adapter")
+		}
+		if status := waitPreparationStatus(t, sender, id, "rejected", ""); status.ErrorCode != "unsupported_configuration" || called.Load() {
+			t.Fatalf("status=%+v executor called=%t", status, called.Load())
 		}
 	}
 }
diff --git a/apps/daemon/internal/dispatch/interaction_decisions.go b/apps/daemon/internal/dispatch/interaction_decisions.go
index 77ed0fd8c..1c4c4abb7 100644
--- a/apps/daemon/internal/dispatch/interaction_decisions.go
+++ b/apps/daemon/internal/dispatch/interaction_decisions.go
@@ -101,7 +101,7 @@ func (r *Router) dropPermission(s *sessionState, permissionID string) {
 // those entries linger until cleanupSession — acceptable because they
 // can't double-fire (the session's own pendingAskTable.Take already
 // guards that); cleanupSession removes the routing entry when the run
-// stream closes, even if the underlying CLI remains in the idle pool.
+// stream closes.
 func (r *Router) handlePromptForUserChoiceDecision(ctx context.Context, env proto.Envelope) error {
 	if env.ID == "" {
 		return errors.New("dispatch: prompt_for_user_choice_decision missing ask id (Envelope.ID empty)")
diff --git a/apps/daemon/internal/dispatch/local_directory_test.go b/apps/daemon/internal/dispatch/local_directory_test.go
index d06af72aa..3f1692b07 100644
--- a/apps/daemon/internal/dispatch/local_directory_test.go
+++ b/apps/daemon/internal/dispatch/local_directory_test.go
@@ -43,7 +43,7 @@ func TestLocalDirectoryPreparationNeedsNoHarnessAndRejectsOtherOwners(t *testing
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
@@ -123,7 +123,7 @@ func TestLocalDirectoryKeepsNotDirectorySeparateFromFailures(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(func() { _ = r.Shutdown(context.Background()) })
-	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	request := proto.PromptRequestPayload{AgentKind: "native", LocalEnvironment: &proto.LocalEnvironment{ID: environment}, AgentStateKey: "agents-api-" + session, WorkspaceReadOnly: true}
 	if err := r.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "idle", proto.ExecutionPreparePayload{Configuration: request})); err != nil {
 		t.Fatal(err)
 	}
diff --git a/apps/daemon/internal/dispatch/mcp_http_test.go b/apps/daemon/internal/dispatch/mcp_http_test.go
index 45ae2fe80..794b596ec 100644
--- a/apps/daemon/internal/dispatch/mcp_http_test.go
+++ b/apps/daemon/internal/dispatch/mcp_http_test.go
@@ -7,6 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -16,33 +17,38 @@ import (
 )
 
 func TestMCPHTTPBearerRejectsUnsupportedRequestsBeforeFactory(t *testing.T) {
-	for _, mode := range []string{"supported", "claude", "claude old peer", "claude local", "no bearer capability", "no MCP capability", "unavailable", "no none capability", "local", "other engine", "HTTP", "credential-free", "product", "required", "required old peer", "optional old peer"} {
+	for _, mode := range []string{"supported", "claude", "claude old peer", "claude local", "no bearer capability", "no MCP capability", "unavailable", "no none capability", "local", "other engine", "HTTP", "credential-free", "no declaration", "required", "required old peer", "optional old peer"} {
 		t.Run(mode, func(t *testing.T) {
-			h := newHarness(t)
+			// Service-origin servers need a service execution host, never a local Environment.
+			var h *harness
+			prepare := noEnvironmentPreparation("mcp-bearer", proto.PromptRequestPayload{AgentKind: "codex"})
+			if strings.HasSuffix(mode, "local") {
+				h = localPreparationHarness(t)
+				prepare = preparationRequest()
+				prepare.Configuration.AgentKind = "codex"
+			} else {
+				h = newHarness(t)
+			}
 			defer h.router.Shutdown(context.Background())
 			token := "synthetic-private-token"
 			servers := []proto.MCPHTTPServer{{ConnectionOrigin: "service", ServerLabel: "tools", ServerURL: "https://tools.example/mcp", BearerToken: &token}}
-			req := proto.PromptRequestPayload{AgentKind: "codex", DisableExecutionEnvironment: true, MCPHTTPServers: &servers}
-			caps := prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilitySupported, MCPHTTPBearerAuth: proto.CapabilitySupported})
+			req := &prepare.Configuration
+			req.MCPHTTPServers = &servers
+			caps := prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, LocalEnvironment: proto.CapabilitySupported, MCPHTTPTools: proto.CapabilitySupported, MCPHTTPBearerAuth: proto.CapabilitySupported})
 			switch mode {
 			case "claude", "claude old peer", "claude local":
 				req.AgentKind = "claude_sdk"
 				caps.MCPHTTPBearerAuth = proto.CapabilityFromBool(mode != "claude old peer")
-				if mode == "claude local" {
-					req.DisableExecutionEnvironment = false
-				}
 			case "required", "required old peer", "optional old peer":
 				servers[0].Required = mode != "optional old peer"
 				servers[0].BearerToken = nil
 				caps.MCPHTTPRequired = proto.CapabilityFromBool(mode == "required")
-			case "no bearer capability", "credential-free", "product":
+			case "no bearer capability", "credential-free", "no declaration":
 				caps.MCPHTTPBearerAuth = proto.CapabilityUnsupported
 			case "no MCP capability":
 				caps.MCPHTTPTools = proto.CapabilityUnsupported
 			case "no none capability":
 				caps.EnvironmentNone = proto.CapabilityUnsupported
-			case "local":
-				req.DisableExecutionEnvironment = false
 			case "other engine":
 				req.AgentKind = "other"
 			case "HTTP":
@@ -51,13 +57,13 @@ func TestMCPHTTPBearerRejectsUnsupportedRequestsBeforeFactory(t *testing.T) {
 			if mode == "credential-free" {
 				servers[0].BearerToken = nil
 			}
-			if mode == "product" {
-				req.MCPHTTPServers, req.DisableExecutionEnvironment = nil, false
+			if mode == "no declaration" {
+				req.MCPHTTPServers = nil
 			}
-			called := false
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: req.AgentKind, Available: mode != "unavailable", Capabilities: caps},
-				harnessconfig.Configuration{}, func(_ context.Context, got proto.PromptRequestPayload, _ chan<- proto.Envelope) (agent.Session, error) {
-					called = true
+			var called atomic.Bool
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: req.AgentKind, Available: mode != "unavailable", Capabilities: caps},
+				func(_ context.Context, got proto.PromptRequestPayload) (agent.Executor, error) {
+					called.Store(true)
 					if mode == "required" && !(*got.MCPHTTPServers)[0].Required {
 						t.Error("required initialization lost before adapter")
 					}
@@ -66,14 +72,15 @@ func TestMCPHTTPBearerRejectsUnsupportedRequestsBeforeFactory(t *testing.T) {
 					}
 					return nil, errors.New("controlled factory stop")
 				})
-			err := h.router.Handle(t.Context(), mustEnv(t, proto.TypePromptRequest, "mcp-bearer", req))
-			if called != (mode == "supported" || mode == "claude" || mode == "other engine" || mode == "credential-free" || mode == "product" || mode == "required" || mode == "optional old peer") {
-				t.Fatal("wrong factory admission")
+			err := h.router.Handle(t.Context(), mustEnv(t, proto.TypeExecutionPrepare, "mcp-bearer", prepare))
+			admitted := mode == "supported" || mode == "claude" || mode == "other engine" || mode == "credential-free" || mode == "no declaration" || mode == "required" || mode == "optional old peer"
+			assertPreparationOutcome(t, h.sender, "mcp-bearer", admitted)
+			if called.Load() != admitted || (err == nil) != admitted {
+				t.Fatal("wrong factory admission", err)
 			}
-			frames := h.sender.snapshot()
-			raw, _ := json.Marshal(frames)
-			if err == nil || strings.Contains(err.Error(), token) || strings.Contains(string(raw), token) || len(frames) != 2 || frames[0].Type != proto.TypeError || frames[1].Type != proto.TypeDone {
-				t.Fatal("terminal rejection missing or exposed credential")
+			raw, _ := json.Marshal(h.sender.snapshot())
+			if err != nil && strings.Contains(err.Error(), token) || strings.Contains(string(raw), token) {
+				t.Fatal("terminal status exposed credential")
 			}
 		})
 	}
diff --git a/apps/daemon/internal/dispatch/optional_interactions_test.go b/apps/daemon/internal/dispatch/optional_interactions_test.go
index dc63be1eb..37d22eaae 100644
--- a/apps/daemon/internal/dispatch/optional_interactions_test.go
+++ b/apps/daemon/internal/dispatch/optional_interactions_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"testing"
@@ -20,14 +18,12 @@ func TestOptionalInteractionResponders(t *testing.T) {
 			h := newHarness(t)
 			defer h.router.Shutdown(context.Background())
 			var output chan<- proto.Envelope
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "minimal", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{})}, harnessconfig.Configuration{}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "minimal", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				output = out
 				s := &fakeSession{out: out, closeOutOnCancel: true}
 				return lifecycleOnly{Session: s}, nil
-			})
-			if err := h.router.Handle(t.Context(), mustEnv(t, proto.TypePromptRequest, "run", proto.PromptRequestPayload{AgentKind: "minimal"})); err != nil {
-				t.Fatal(err)
-			}
+			}))
+			startRun(t, h.router, h.sender, "run", proto.PromptRequestPayload{AgentKind: "minimal"})
 			event := mustEnv(t, proto.TypePermissionRequest, "run", proto.PermissionRequestPayload{RequestID: "interaction", Tool: "fixture"})
 			decision := mustEnv(t, proto.TypePermissionDecision, "interaction", proto.PermissionDecisionPayload{DeliveryID: "decision", Approved: true})
 			if ask {
@@ -37,7 +33,7 @@ func TestOptionalInteractionResponders(t *testing.T) {
 			// An inconsistent adapter emitted an interaction it cannot answer: reject it,
 			// never acknowledge application or call a fabricated responder.
 			output <- event
-			waitFor(t, func() bool { return len(h.sender.snapshot()) > 0 }, "interaction indexed")
+			waitFor(t, func() bool { return hasFrame(h.sender, event.Type, "run") }, "interaction indexed")
 			if err := h.router.Handle(t.Context(), decision); err != nil {
 				t.Fatal(err)
 			}
diff --git a/apps/daemon/internal/dispatch/output.go b/apps/daemon/internal/dispatch/output.go
deleted file mode 100644
index e0e96dca9..000000000
--- a/apps/daemon/internal/dispatch/output.go
+++ /dev/null
@@ -1,103 +0,0 @@
-package dispatch
-
-import (
-	"context"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	obslog "github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
-)
-
-// pump forwards every Envelope the session writes onto out to the
-// upstream sender, then cleans up when the session closes out.
-func (r *Router) pump(s *sessionState) {
-	defer r.shutdownWG.Done()
-	defer r.cleanupSession(s)
-	_ = r.forwardSessionOutput(s, true)
-}
-
-// wait is false only after a failed Start and its cancellation have returned:
-// no Session owns the output sink, so only already queued frames can be read.
-func (r *Router) forwardSessionOutput(s *sessionState, wait bool) error {
-	// Logging-only ctx carrying the run's trace; sends use their own
-	// ctx tied to shutdownCh.
-	pumpCtx := context.Background()
-	if s.traceparent != "" {
-		if carrier, err := obslog.ParseTraceparent(s.traceparent); err == nil {
-			pumpCtx = obslog.WithTrace(pumpCtx, carrier)
-		}
-	}
-	r.log.InfoContext(pumpCtx, "pump: started", "run_id", s.runID)
-
-	// Long-lived send ctx — must keep forwarding even after the
-	// session's ctx is cancelled (session might emit a final "done"
-	// in response to cancel). Stops on out close or router shutdown.
-	for {
-		if !wait && len(s.out) == 0 {
-			return nil
-		}
-		select {
-		case env, ok := <-s.out:
-			if !ok {
-				r.log.InfoContext(pumpCtx, "pump: out channel closed", "run_id", s.runID)
-				return nil
-			}
-			if s.session != nil {
-				r.indexPermissionFrame(s, env)
-			}
-			if env.Type == proto.TypeDone && s.releaseOnCompletion {
-				if err := r.releaseCompletedSession(s); err != nil {
-					sendCtx, stop := r.shutdownContext(pumpCtx)
-					r.emitTerminalError(sendCtx, s.runID, "failed to release completed executor")
-					stop()
-					continue
-				}
-			}
-			r.log.InfoContext(pumpCtx, "pump: forwarding envelope", "run_id", s.runID, "type", env.Type, "env_id", env.ID)
-			// Stamp the run's trace onto outbound frames so the
-			// gateway attributes daemon-emitted lines to the same
-			// trace_id as the original prompt_request.
-			if env.Trace == "" && s.traceparent != "" {
-				env.Trace = s.traceparent
-			}
-			// Short-ish send ctx that respects router shutdown — if
-			// the transport is wedged we don't want to block forever.
-			sendCtx, cancel := context.WithCancel(context.Background())
-			stopOnShutdown := make(chan struct{})
-			go func() {
-				select {
-				case <-r.shutdownCh:
-					cancel()
-				case <-stopOnShutdown:
-				}
-			}()
-			err := r.sender.Send(sendCtx, env)
-			close(stopOnShutdown)
-			cancel()
-			if err != nil {
-				// Sender failed — log, ask the session to wind down,
-				// but KEEP draining out so the agent's goroutines
-				// don't block on a full channel.
-				r.log.ErrorContext(pumpCtx, "send envelope failed", "type", env.Type, "run_id", env.ID, "err", err)
-				r.mu.Lock()
-				s.retain = false
-				r.mu.Unlock()
-				s.ctxCancel()
-				if wait {
-					r.drain(s.out)
-				}
-				return err
-			}
-		case <-r.shutdownCh:
-			// Router shutdown — cancel + drain so the session's
-			// goroutines unblock and close out cleanly.
-			r.mu.Lock()
-			s.retain = false
-			r.mu.Unlock()
-			s.ctxCancel()
-			if wait {
-				r.drain(s.out)
-			}
-			return ErrRouterClosed
-		}
-	}
-}
diff --git a/apps/daemon/internal/dispatch/preparation.go b/apps/daemon/internal/dispatch/preparation.go
index 36695ab7a..e705953ee 100644
--- a/apps/daemon/internal/dispatch/preparation.go
+++ b/apps/daemon/internal/dispatch/preparation.go
@@ -31,7 +31,6 @@ type preparationState struct {
 	ctx               context.Context
 	cancel            context.CancelFunc
 	prepared          agent.Prepared
-	stateKey          string
 	environmentID     string
 	busy              bool
 	owns              bool
@@ -63,7 +62,7 @@ func (r *Router) handleExecutionPrepare(ctx context.Context, env proto.Envelope)
 	if req, err = r.localWorkspace.Configure(req); err != nil {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
-	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" || req.EnvironmentID() == "" || strings.TrimSpace(req.AgentStateKey) == "" || !req.ReleaseOnCompletion {
+	if req.RunID != "" || len(req.Input) != 0 || req.EnvironmentID() == "" || strings.TrimSpace(req.AgentStateKey) == "" {
 		return r.rejectPreparation(env, "invalid_configuration")
 	}
 	if validateExecutionEnvironment(req, caps) != nil || (len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported()) {
@@ -108,7 +107,7 @@ func (r *Router) handleExecutionPrepare(ctx context.Context, env proto.Envelope)
 		return r.rejectPreparation(env, "preparation_capacity")
 	}
 	owner, cancel := context.WithCancel(context.WithoutCancel(ctx))
-	p := &preparationState{capabilities: caps, requestID: env.ID, trace: env.Trace, fingerprint: fingerprint, ctx: owner, cancel: cancel, stateKey: req.AgentStateKey, environmentID: req.EnvironmentID(), workspaceReadOnly: req.WorkspaceReadOnly, busy: true, owns: true, deadline: time.Now().Add(r.preparationTimeout)}
+	p := &preparationState{capabilities: caps, requestID: env.ID, trace: env.Trace, fingerprint: fingerprint, ctx: owner, cancel: cancel, environmentID: req.EnvironmentID(), workspaceReadOnly: req.WorkspaceReadOnly, busy: true, owns: true, deadline: time.Now().Add(r.preparationTimeout)}
 	p.status = proto.PreparationStatusPayload{Handle: uuid.NewString(), Revision: 1, State: "preparing", ExpiresAt: p.deadline.UnixMilli()}
 	r.preparations[p.status.Handle], r.preparationRequests[p.requestID] = p, p
 	p.timer = time.AfterFunc(r.preparationTimeout, func() { r.releasePreparation(p, "expired", "", true, true) })
diff --git a/apps/daemon/internal/dispatch/preparation_start.go b/apps/daemon/internal/dispatch/preparation_start.go
index fac37084c..af330553a 100644
--- a/apps/daemon/internal/dispatch/preparation_start.go
+++ b/apps/daemon/internal/dispatch/preparation_start.go
@@ -70,7 +70,7 @@ func (r *Router) handleExecutionStart(_ context.Context, env proto.Envelope) err
 	}
 	p.status.State, p.status.RunID, p.status.Revision = "starting", input.RunID, p.status.Revision+1
 	p.startFingerprint, p.busy = fingerprint, true
-	state := &sessionState{capabilities: p.capabilities, runID: input.RunID, stateKey: p.stateKey, environmentID: p.environmentID, out: make(chan proto.Envelope, 64), ctx: p.ctx, ctxCancel: p.cancel, pendingIDs: make(map[string]struct{}), pendingAsks: make(map[string]struct{}), traceparent: env.Trace}
+	state := &sessionState{capabilities: p.capabilities, runID: input.RunID, environmentID: p.environmentID, out: make(chan proto.Envelope, 64), ctx: p.ctx, pendingIDs: make(map[string]struct{}), pendingAsks: make(map[string]struct{}), traceparent: env.Trace}
 	state.preparedHandoff = newPreparedHandoff(p, owner.native)
 	p.handoff, owner.run = state.preparedHandoff, state
 	r.sessions[input.RunID] = state
diff --git a/apps/daemon/internal/dispatch/preparation_test.go b/apps/daemon/internal/dispatch/preparation_test.go
index 64f85b1bf..57312e3b2 100644
--- a/apps/daemon/internal/dispatch/preparation_test.go
+++ b/apps/daemon/internal/dispatch/preparation_test.go
@@ -113,7 +113,7 @@ func localPreparationHarness(t *testing.T) *harness {
 }
 
 func preparationRequest() proto.ExecutionPreparePayload {
-	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: "agents-api-" + preparationSessionID, ReleaseOnCompletion: true, LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, NetworkAccess: "enabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}}
+	return proto.ExecutionPreparePayload{SessionID: preparationSessionID, Configuration: proto.PromptRequestPayload{AgentKind: "prepared", AgentStateKey: "agents-api-" + preparationSessionID, LocalEnvironment: &proto.LocalEnvironment{ID: preparationEnvironmentID, NetworkAccess: "enabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}}}
 }
 
 func preparationRouter(t *testing.T, sender dispatch.Sender, timeout time.Duration, factory agent.PreparationFactory) *dispatch.Router {
@@ -369,9 +369,8 @@ func TestPreparationFailedReadyDeliveryAbandonsAdmission(t *testing.T) {
 
 func TestPreparationRejectsInputAndProductConfiguration(t *testing.T) {
 	for name, change := range map[string]func(*proto.PromptRequestPayload){
-		"run":          func(p *proto.PromptRequestPayload) { p.RunID = "run" },
-		"input":        func(p *proto.PromptRequestPayload) { p.Input = proto.TextInput("input") },
-		"conversation": func(p *proto.PromptRequestPayload) { p.ConversationID = "product" },
+		"run":   func(p *proto.PromptRequestPayload) { p.RunID = "run" },
+		"input": func(p *proto.PromptRequestPayload) { p.Input = proto.TextInput("input") },
 		"attachment": func(p *proto.PromptRequestPayload) {
 			p.Input = proto.MessageInput{{Content: []proto.InputContent{{Type: "input_image"}}}}
 		},
diff --git a/apps/daemon/internal/dispatch/prepared_handoff.go b/apps/daemon/internal/dispatch/prepared_handoff.go
index 8bdd11834..23377efe7 100644
--- a/apps/daemon/internal/dispatch/prepared_handoff.go
+++ b/apps/daemon/internal/dispatch/prepared_handoff.go
@@ -77,14 +77,11 @@ func newPreparedHandoff(p *preparationState, target agent.Executor) *preparedHan
 // preparedOperationLocked admits one mutation at the same linearization point
 // used by release. The returned function must run after the native call, replay
 // bookkeeping and receipt send have all finished. Router.mu must be held.
-func (r *Router) preparedOperationLocked(state *sessionState) (agent.Session, func(), bool) {
+func (r *Router) preparedOperationLocked(state *sessionState) (agent.Turn, func(), bool) {
 	if state == nil || state.session == nil || state.steeringClosed {
 		return nil, nil, false
 	}
 	handoff := state.preparedHandoff
-	if handoff == nil {
-		return state.session, func() {}, true
-	}
 	if handoff.release != nil {
 		return nil, nil, false
 	}
@@ -93,13 +90,7 @@ func (r *Router) preparedOperationLocked(state *sessionState) (agent.Session, fu
 }
 
 func (r *Router) interactionRouteOpenLocked(state *sessionState) bool {
-	if state == nil || r.closed || state.ctx.Err() != nil || state.steeringClosed {
-		return false
-	}
-	if handoff := state.preparedHandoff; handoff != nil {
-		return handoff.release == nil
-	}
-	return state.session != nil
+	return state != nil && !r.closed && state.ctx.Err() == nil && !state.steeringClosed && state.preparedHandoff.release == nil
 }
 
 // claimPreparedReleaseLocked closes admission permanently and returns the
@@ -111,7 +102,6 @@ func (r *Router) claimPreparedReleaseLocked(state *sessionState, abort bool, fai
 	if release == nil {
 		release = &preparedRelease{abort: make(chan struct{}), failure: failure, settled: make(chan struct{})}
 		handoff.release = release
-		state.retain = false
 		state.steeringClosed = true
 		state.session = nil
 		r.clearInteractionRoutesLocked(state)
diff --git a/apps/daemon/internal/dispatch/prompt.go b/apps/daemon/internal/dispatch/prompt.go
deleted file mode 100644
index 2a8d45908..000000000
--- a/apps/daemon/internal/dispatch/prompt.go
+++ /dev/null
@@ -1,149 +0,0 @@
-package dispatch
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
-	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
-	obslog "github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
-)
-
-func (r *Router) handlePromptRequest(callerCtx context.Context, env proto.Envelope) error {
-	r.log.InfoContext(callerCtx, "handlePromptRequest: decoding payload", "env_id", env.ID, "env_type", env.Type)
-	var req proto.PromptRequestPayload
-	if err := env.DecodePayload(&req); err != nil {
-		r.log.ErrorContext(callerCtx, "handlePromptRequest: decode failed", "env_id", env.ID, "err", err)
-		return fmt.Errorf("dispatch: decode prompt_request: %w", err)
-	}
-	// Envelope.ID is the run id; payload mirrors it but envelope wins.
-	runID := env.ID
-	if runID == "" {
-		runID = req.RunID
-	}
-	if runID == "" {
-		r.log.ErrorContext(callerCtx, "handlePromptRequest: missing run id")
-		return errors.New("dispatch: prompt_request missing run id (Envelope.ID and Payload.RunID both empty)")
-	}
-	req.RunID = runID
-	var err error
-	if req, err = r.localWorkspace.Configure(req); err != nil {
-		r.emitTerminalError(callerCtx, runID, err.Error())
-		return err
-	}
-	if req.AgentKind == "" {
-		r.log.ErrorContext(callerCtx, "handlePromptRequest: missing agent_kind", "run_id", runID)
-		return errors.New("dispatch: prompt_request missing agent_kind")
-	}
-	if req.WorkspaceReadOnly {
-		err := errors.New("read-only preparation cannot accept a prompt")
-		r.emitTerminalError(callerCtx, runID, err.Error())
-		return err
-	}
-	caps, available := r.availableCapabilities(req.AgentKind)
-	if !available {
-		_, err := r.registry.Resolve(req.AgentKind)
-		if err == nil {
-			err = errors.New("engine is unavailable on this runtime")
-		}
-		r.emitTerminalError(callerCtx, runID, err.Error())
-		return err
-	}
-	if len(req.FunctionTools) > 0 && !caps.FunctionTools.IsSupported() {
-		err := errors.New("engine does not support function tools")
-		r.emitTerminalError(callerCtx, runID, err.Error())
-		return err
-	}
-	if err := validateExecutionEnvironment(req, caps); err != nil {
-		r.emitTerminalError(callerCtx, runID, err.Error())
-		return err
-	}
-	r.log.InfoContext(callerCtx, "handlePromptRequest: decoded",
-		"run_id", runID, "agent_kind", req.AgentKind,
-		"message_count", len(req.Input),
-		"has_agent_options", req.AgentOptions != nil,
-		"agent_session_id", req.AgentSessionID,
-		"agent_state_key", req.AgentStateKey)
-
-	factory, err := r.registry.Resolve(req.AgentKind)
-	if err != nil {
-		r.log.ErrorContext(callerCtx, "handlePromptRequest: registry.Resolve failed", "run_id", runID, "agent_kind", req.AgentKind, "err", err)
-		// Synthesize error+done so the server-side stream closes
-		// cleanly instead of waiting for a done that never comes.
-		r.emitTerminalError(callerCtx, runID, fmt.Sprintf("unsupported agent_kind %q on this daemon", req.AgentKind))
-		return err
-	}
-	r.log.InfoContext(callerCtx, "handlePromptRequest: factory resolved", "run_id", runID, "agent_kind", req.AgentKind)
-
-	// Lock-protect duplicate-run check + insert so two prompt_requests
-	// with the same RunID can't both start sessions.
-	r.mu.Lock()
-	if r.closed {
-		r.mu.Unlock()
-		r.log.ErrorContext(callerCtx, "handlePromptRequest: router closed", "run_id", runID)
-		return ErrRouterClosed
-	}
-	if r.runtimePreparation != nil || r.workspaceWrite != nil || r.workspaceExport != nil {
-		r.mu.Unlock()
-		err := errors.New("local workspace has an unsettled write")
-		r.emitTerminalError(callerCtx, runID, err.Error())
-		return err
-	}
-	if _, dup := r.sessions[runID]; dup {
-		r.mu.Unlock()
-		r.log.WarnContext(callerCtx, "ignoring duplicate prompt_request", "run_id", runID)
-		return nil
-	}
-	stateKey := sessionStateKey(req)
-	r.touchIdleLocked(stateKey)
-	sessionCtx, sessionCancel := context.WithCancel(context.Background())
-	// Re-attach the inbound trace so every log under this run shows
-	// the same trace_id as the prompt_request that started it.
-	if carrier, ok := obslog.TraceFromContext(callerCtx); ok {
-		sessionCtx = obslog.WithTrace(sessionCtx, carrier)
-	}
-	out := make(chan proto.Envelope, 64)
-	state := &sessionState{
-		runID:               runID,
-		capabilities:        caps,
-		environmentID:       req.EnvironmentID(),
-		stateKey:            stateKey,
-		out:                 out,
-		ctx:                 sessionCtx,
-		ctxCancel:           sessionCancel,
-		pendingIDs:          make(map[string]struct{}),
-		pendingAsks:         make(map[string]struct{}),
-		traceparent:         env.Trace,
-		retain:              stateKey != "",
-		releaseOnCompletion: req.ReleaseOnCompletion,
-	}
-	r.sessions[runID] = state
-	r.mu.Unlock()
-
-	r.log.InfoContext(callerCtx, "handlePromptRequest: calling factory", "run_id", runID)
-	req, err = r.localWorkspace.Prepare(sessionCtx, req)
-	var sess agent.Session
-	if err == nil {
-		sess, err = factory(sessionCtx, req, out)
-	}
-	if err != nil {
-		r.log.ErrorContext(callerCtx, "handlePromptRequest: factory call failed", "run_id", runID, "agent_kind", req.AgentKind, "err", err)
-		// Roll back the registration, cancel ctx, surface error+done
-		// so the server doesn't hang on a phantom run.
-		r.mu.Lock()
-		delete(r.sessions, runID)
-		r.mu.Unlock()
-		sessionCancel()
-		r.emitTerminalError(callerCtx, runID, fmt.Sprintf("agent factory failed: %v", err))
-		return fmt.Errorf("dispatch: factory %q: %w", req.AgentKind, err)
-	}
-	r.log.InfoContext(callerCtx, "handlePromptRequest: session created, starting pump", "run_id", runID)
-	r.mu.Lock()
-	state.session = sess
-	r.mu.Unlock()
-
-	r.shutdownWG.Add(1)
-	go r.pump(state)
-	return nil
-}
diff --git a/apps/daemon/internal/dispatch/receipt_order_test.go b/apps/daemon/internal/dispatch/receipt_order_test.go
index 8fb22b4c4..898889a4b 100644
--- a/apps/daemon/internal/dispatch/receipt_order_test.go
+++ b/apps/daemon/internal/dispatch/receipt_order_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"errors"
@@ -52,7 +50,7 @@ func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
 			registry := agent.NewRegistry()
 			var session *fakeSession
 			var calls atomic.Int32
-			registry.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				session = &fakeSession{out: out, closeOutOnCancel: true}
 				return &steeringSession{fakeSession: session, steer: func(context.Context, proto.PromptSteerPayload) error {
 					calls.Add(1)
@@ -61,7 +59,7 @@ func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
 					}
 					return nil
 				}}, nil
-			})
+			}))
 			router, err := dispatch.New(dispatch.Config{Registry: registry, Sender: sender})
 			if err != nil {
 				t.Fatal(err)
@@ -75,18 +73,20 @@ func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
 					t.Fatal(err)
 				}
 			}
-			handle(proto.TypePromptRequest, proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: "stable", ReleaseOnCompletion: true})
+			startRun(t, router, &sender.recSender, "ordered", proto.PromptRequestPayload{AgentKind: "codex"})
+			base := len(sender.snapshot())
 			input := proto.PromptSteerPayload{InputID: "input-1", Input: proto.TextInput("original")}
 			handle(proto.TypePromptSteer, input)
 			<-sender.entered
 			session.out <- mustEnv(t, proto.TypeDone, "ordered", proto.DonePayload{Content: "finished"})
 			waitFor(t, func() bool { return router.SteeringClosedForTest("ordered") }, "closed steering admission")
-			if session.cancels() != 0 || len(sender.snapshot()) != 0 {
-				t.Fatal("native release or Done overtook receipt")
+			// Native settlement precedes the receipt join; TestPreparedHandoffReleaseWaitsForMutationReceipt asserts that order.
+			if len(sender.snapshot()) != base {
+				t.Fatal("Done overtook receipt")
 			}
 			if mode != "send_failure" {
 				handle(proto.TypePromptSteer, input)
-				frames := sender.snapshot()
+				frames := sender.snapshot()[base:]
 				var ack proto.PromptSteerAckPayload
 				if len(frames) != 1 || frames[0].DecodePayload(&ack) != nil || ack.Accepted != (mode == "consumed") {
 					t.Fatalf("cached receipt lost: %+v", ack)
@@ -98,7 +98,7 @@ func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
 				handle(proto.TypePromptSteer, input)
 				input.InputID = "new"
 				handle(proto.TypePromptSteer, input)
-				frames = sender.snapshot()
+				frames = sender.snapshot()[base:]
 				for i, want := range []string{"input_conflict", "run_inactive"} {
 					if frames[i+1].DecodePayload(&ack) != nil || ack.ErrorCode != want {
 						t.Fatalf("receipt %d: %+v", i, ack)
@@ -106,8 +106,8 @@ func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
 				}
 			}
 			release.Do(func() { close(sender.release) })
-			waitFor(t, func() bool { return router.ActiveRuns() == 0 }, "durable completion")
-			frames := sender.snapshot()
+			waitFor(t, func() bool { return hasFrame(&sender.recSender, proto.TypeDone, "ordered") }, "durable completion")
+			frames := sender.snapshot()[base:]
 			if len(frames) == 0 || frames[len(frames)-1].Type != proto.TypeDone || calls.Load() != 1 || session.cancels() != 1 {
 				t.Fatalf("invalid terminal order/calls: %+v, calls=%d cancels=%d", frames, calls.Load(), session.cancels())
 			}
@@ -118,14 +118,14 @@ func TestDurableCompletionWaitsForSteeringReceiptSend(t *testing.T) {
 	}
 }
 
-func TestShutdownReleasesSteeringWorkerAndCompletionBarrier(t *testing.T) {
+func TestShutdownReleasesSteeringWorkerAndReceiptJoin(t *testing.T) {
 	for _, phase := range []string{"native", "receipt_send"} {
 		t.Run(phase, func(t *testing.T) {
 			sender := &blockedReceiptSender{entered: make(chan struct{}), release: make(chan struct{}), exited: make(chan struct{})}
 			registry := agent.NewRegistry()
 			entered, exited := make(chan struct{}), make(chan struct{})
 			var session *fakeSession
-			registry.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				session = &fakeSession{out: out, closeOutOnCancel: true}
 				return &steeringSession{fakeSession: session, steer: func(ctx context.Context, _ proto.PromptSteerPayload) error {
 					close(entered)
@@ -136,15 +136,13 @@ func TestShutdownReleasesSteeringWorkerAndCompletionBarrier(t *testing.T) {
 					}
 					return nil
 				}}, nil
-			})
+			}))
 			router, err := dispatch.New(dispatch.Config{Registry: registry, Sender: sender})
 			if err != nil {
 				t.Fatal(err)
 			}
 			defer router.Shutdown(context.Background())
-			if err = router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "shutdown", proto.PromptRequestPayload{AgentKind: "codex", ReleaseOnCompletion: true})); err != nil {
-				t.Fatal(err)
-			}
+			startRun(t, router, &sender.recSender, "shutdown", proto.PromptRequestPayload{AgentKind: "codex"})
 			if err = router.Handle(context.Background(), mustEnv(t, proto.TypePromptSteer, "shutdown", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text")})); err != nil {
 				t.Fatal(err)
 			}
@@ -152,7 +150,7 @@ func TestShutdownReleasesSteeringWorkerAndCompletionBarrier(t *testing.T) {
 			if phase == "receipt_send" {
 				<-sender.entered
 				session.out <- mustEnv(t, proto.TypeDone, "shutdown", proto.DonePayload{})
-				waitFor(t, func() bool { return router.SteeringClosedForTest("shutdown") }, "completion barrier")
+				waitFor(t, func() bool { return router.SteeringClosedForTest("shutdown") }, "receipt join")
 			}
 			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 			defer cancel()
diff --git a/apps/daemon/internal/dispatch/receipt_shutdown_test.go b/apps/daemon/internal/dispatch/receipt_shutdown_test.go
index 4455f59ac..e736bf867 100644
--- a/apps/daemon/internal/dispatch/receipt_shutdown_test.go
+++ b/apps/daemon/internal/dispatch/receipt_shutdown_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"errors"
@@ -47,23 +45,21 @@ func TestShutdownCancelsCompletionErrorSend(t *testing.T) {
 	sender := &shutdownAllSendsBlockSender{entered: make(chan struct{}), terminal: make(chan context.Context, 1), rescue: make(chan struct{})}
 	registry := agent.NewRegistry()
 	var session *fakeSession
-	registry.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(registry, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		session = &fakeSession{out: out, closeOutOnCancel: true}
 		return &steeringSession{fakeSession: session, steer: func(context.Context, proto.PromptSteerPayload) error { return nil }}, nil
-	})
+	}))
 	router, err := dispatch.New(dispatch.Config{Registry: registry, Sender: sender})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err = router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "shutdown-terminal", proto.PromptRequestPayload{AgentKind: "codex", ReleaseOnCompletion: true})); err != nil {
-		t.Fatal(err)
-	}
+	startRun(t, router, &sender.recSender, "shutdown-terminal", proto.PromptRequestPayload{AgentKind: "codex"})
 	if err = router.Handle(context.Background(), mustEnv(t, proto.TypePromptSteer, "shutdown-terminal", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text")})); err != nil {
 		t.Fatal(err)
 	}
 	<-sender.entered
 	session.out <- mustEnv(t, proto.TypeDone, "shutdown-terminal", proto.DonePayload{})
-	waitFor(t, func() bool { return router.SteeringClosedForTest("shutdown-terminal") }, "completion barrier")
+	waitFor(t, func() bool { return router.SteeringClosedForTest("shutdown-terminal") }, "receipt join")
 	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 	defer cancel()
 	shutdownErr := router.Shutdown(ctx)
diff --git a/apps/daemon/internal/dispatch/router.go b/apps/daemon/internal/dispatch/router.go
index 90610b186..ae283d321 100644
--- a/apps/daemon/internal/dispatch/router.go
+++ b/apps/daemon/internal/dispatch/router.go
@@ -1,6 +1,6 @@
 // Package dispatch wires inbound WebSocket frames to the agent layer.
-// It owns one Session per active RunID, a per-session pump goroutine
-// that forwards the agent's events to the transport, and a
+// It owns one Turn per active RunID, a per-Turn output goroutine that
+// forwards the agent's events to the transport, and a
 // permission_id → run_id index so permission_decision frames route
 // back to the right session.
 //
@@ -38,9 +38,8 @@ type Router struct {
 	suspension          *proto.EnvironmentSuspendPayload
 	mu                  sync.Mutex
 	sessions            map[string]*sessionState // RunID → state
-	idle                map[string]map[*sessionState]struct{}
-	permIndex           map[string]string // permID  → RunID
-	askIndex            map[string]string // askID   → RunID
+	permIndex           map[string]string        // permID  → RunID
+	askIndex            map[string]string        // askID   → RunID
 	applied             map[string]appliedInteractionDecision
 	shutdownAttempt     *shutdownAttempt
 	shutdownCh          chan struct{} // closed by Shutdown
@@ -66,31 +65,24 @@ type appliedInteractionDecision struct {
 }
 
 // sessionState is the dispatcher's per-run bookkeeping. The agent
-// owns the close of out; the dispatcher cancels ctxCancel to wind
-// down. traceparent captures the prompt_request's W3C trace so every
-// outbound frame stamps env.Trace with the same value, completing
+// owns the close of out; preparedHandoff owns release. traceparent
+// captures the execution_start's W3C trace so every outbound frame
+// stamps env.Trace with the same value, completing
 // frontend → server → daemon → agent → server attribution.
 type sessionState struct {
-	capabilities        proto.AgentKindCapabilities
-	runID               string
-	environmentID       string
-	stateKey            string
-	session             agent.Session
-	out                 chan proto.Envelope
-	ctx                 context.Context
-	ctxCancel           context.CancelFunc
-	pendingIDs          map[string]struct{}
-	pendingAsks         map[string]struct{}
-	traceparent         string
-	idleTimer           *time.Timer
-	idleLease           uint64
-	retain              bool
-	releaseOnCompletion bool
-	steering            map[string]steeringReceipt
-	steerBusy           bool
-	steeringClosed      bool
-	steeringDone        chan struct{}
-	preparedHandoff     *preparedHandoff
+	capabilities    proto.AgentKindCapabilities
+	runID           string
+	environmentID   string
+	session         agent.Turn
+	out             chan proto.Envelope
+	ctx             context.Context
+	pendingIDs      map[string]struct{}
+	pendingAsks     map[string]struct{}
+	traceparent     string
+	steering        map[string]steeringReceipt
+	steerBusy       bool
+	steeringClosed  bool
+	preparedHandoff *preparedHandoff
 }
 
 // Config is the constructor input. Registry and Sender are required;
@@ -132,7 +124,6 @@ func New(cfg Config) (*Router, error) {
 		sender:              cfg.Sender,
 		log:                 log,
 		sessions:            make(map[string]*sessionState),
-		idle:                make(map[string]map[*sessionState]struct{}),
 		permIndex:           make(map[string]string),
 		askIndex:            make(map[string]string),
 		applied:             make(map[string]appliedInteractionDecision),
@@ -183,8 +174,6 @@ func (r *Router) Handle(ctx context.Context, env proto.Envelope) error {
 		return r.handleExecutionStart(ctx, env)
 	case proto.TypeExecutionRelease:
 		return r.handleExecutionRelease(ctx, env)
-	case proto.TypePromptRequest:
-		return r.handlePromptRequest(ctx, env)
 	case proto.TypePromptCancel:
 		return r.handlePromptCancel(ctx, env)
 	case proto.TypeFunctionResult:
@@ -237,8 +226,8 @@ func (r *Router) drain(ch <-chan proto.Envelope) {
 	}
 }
 
-// cleanupSession removes the session from registry maps. Called from
-// pump's defer so it runs exactly once.
+// cleanupSession removes the session from registry maps. Called once
+// when its prepared release settles.
 func (r *Router) cleanupSession(s *sessionState) {
 	r.mu.Lock()
 	delete(r.sessions, s.runID)
@@ -248,84 +237,5 @@ func (r *Router) cleanupSession(s *sessionState) {
 	for askID := range s.pendingAsks {
 		delete(r.askIndex, askID)
 	}
-	if !s.retain || s.session == nil || s.stateKey == "" || r.closed {
-		r.mu.Unlock()
-		return
-	}
-	states := r.idle[s.stateKey]
-	if states == nil {
-		states = make(map[*sessionState]struct{})
-		r.idle[s.stateKey] = states
-	}
-	states[s] = struct{}{}
-	r.scheduleIdleLocked(s)
-	r.mu.Unlock()
-}
-
-func sessionStateKey(req proto.PromptRequestPayload) string {
-	return req.AgentStateKey
-}
-
-func (r *Router) touchIdleLocked(stateKey string) {
-	if stateKey == "" {
-		return
-	}
-	for state := range r.idle[stateKey] {
-		r.scheduleIdleLocked(state)
-	}
-}
-
-func (r *Router) scheduleIdleLocked(state *sessionState) {
-	if state.idleTimer != nil {
-		state.idleTimer.Stop()
-	}
-	state.idleLease++
-	lease := state.idleLease
-	state.idleTimer = time.AfterFunc(r.idleTimeout, func() {
-		r.expireIdle(state, lease)
-	})
-}
-
-func (r *Router) expireIdle(state *sessionState, lease uint64) {
-	r.mu.Lock()
-	states := r.idle[state.stateKey]
-	if _, ok := states[state]; !ok || state.idleLease != lease || r.suspension != nil {
-		r.mu.Unlock()
-		return
-	}
-	r.shutdownWG.Add(1)
-	defer r.shutdownWG.Done()
-	delete(states, state)
-	if len(states) == 0 {
-		delete(r.idle, state.stateKey)
-	}
-	state.retain = false
 	r.mu.Unlock()
-
-	state.ctxCancel()
-	if err := state.session.Cancel(context.Background()); err != nil {
-		r.log.Warn("idle session cancel failed", "run_id", state.runID, "state_key", state.stateKey, "err", err)
-	}
-}
-
-// emitTerminalError synthesises error + done for a run that couldn't
-// even be started. Stamps env.Trace from ctx so the gateway can
-// attribute these frames to the same trace_id.
-func (r *Router) emitTerminalError(ctx context.Context, runID, msg string) {
-	traceparent := ""
-	if carrier, ok := obslog.TraceFromContext(ctx); ok {
-		traceparent = carrier.String()
-	}
-	errEnv, err := proto.NewEnvelopeWithTrace(proto.TypeError, runID, proto.ErrorPayload{Error: msg}, traceparent)
-	if err == nil {
-		if sendErr := r.sender.Send(ctx, errEnv); sendErr != nil {
-			r.log.ErrorContext(ctx, "emit terminal error frame failed", "run_id", runID, "err", sendErr)
-		}
-	}
-	doneEnv, err := proto.NewEnvelopeWithTrace(proto.TypeDone, runID, proto.DonePayload{}, traceparent)
-	if err == nil {
-		if sendErr := r.sender.Send(ctx, doneEnv); sendErr != nil {
-			r.log.ErrorContext(ctx, "emit terminal done frame failed", "run_id", runID, "err", sendErr)
-		}
-	}
 }
diff --git a/apps/daemon/internal/dispatch/router_test.go b/apps/daemon/internal/dispatch/router_test.go
index 1e9b0ff15..918f6a06c 100644
--- a/apps/daemon/internal/dispatch/router_test.go
+++ b/apps/daemon/internal/dispatch/router_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"errors"
@@ -60,6 +58,8 @@ func (s *recSender) typesFor(runID string) []string {
 // fakeSession is a controllable session. The test owns its out
 // channel and manipulates outbound traffic / cancel observability.
 type fakeSession struct {
+	runID               string
+	input               proto.MessageInput
 	cancelCalls         int
 	submitCalls         []permCall
 	askCalls            []askCall
@@ -133,36 +133,28 @@ func (s *fakeSession) submissions() []permCall {
 // helpers
 // ---------------------------------------------------------------------
 
-// newHarness builds a Router whose registry exposes a single
-// fake_alpha factory that records inputs and exposes the in-flight
-// session.
+// harness is a Router whose fake_alpha kind starts a recorded fakeSession
+// for each Turn.
 type harness struct {
 	router  *dispatch.Router
 	sender  *recSender
 	reg     *agent.Registry
-	gotReq  chan proto.PromptRequestPayload
 	gotSess chan *fakeSession
 }
 
 func newHarness(t *testing.T) *harness {
-	return newHarnessWithIdleTimeout(t, time.Hour)
-}
-
-func newHarnessWithIdleTimeout(t *testing.T, idleTimeout time.Duration) *harness {
 	t.Helper()
 	h := &harness{
 		sender:  &recSender{},
 		reg:     agent.NewRegistry(),
-		gotReq:  make(chan proto.PromptRequestPayload, 16),
 		gotSess: make(chan *fakeSession, 16),
 	}
-	h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "fake_alpha", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Permissions: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-		sess := &fakeSession{out: out, ctx: ctx}
-		h.gotReq <- req
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "fake_alpha", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Permissions: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, runID string, input proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
+		sess := &fakeSession{runID: runID, input: input, out: out}
 		h.gotSess <- sess
 		return sess, nil
-	})
-	r, err := dispatch.New(dispatch.Config{Registry: h.reg, Sender: h.sender, IdleTimeout: idleTimeout})
+	}))
+	r, err := dispatch.New(dispatch.Config{Registry: h.reg, Sender: h.sender})
 	if err != nil {
 		t.Fatalf("dispatch.New: %v", err)
 	}
@@ -170,58 +162,20 @@ func newHarnessWithIdleTimeout(t *testing.T, idleTimeout time.Duration) *harness
 	return h
 }
 
-func TestCompletedSessionCancelsAfterIdleTimeout(t *testing.T) {
-	h := newHarnessWithIdleTimeout(t, 40*time.Millisecond)
-	defer h.router.Shutdown(context.Background())
-
-	env := mustEnv(t, proto.TypePromptRequest, "run_idle", proto.PromptRequestPayload{
-		AgentKind: "fake_alpha", ConversationID: "conv-idle", AgentStateKey: "conv-idle/agent/fake_alpha",
+// sessionExecutor runs each Turn through start on a disposable Executor.
+func sessionExecutor(start func(context.Context, string, proto.MessageInput, chan<- proto.Envelope) (agent.Session, error)) agent.ExecutorFactory {
+	return preparationExecutorFixture(func(context.Context, proto.PromptRequestPayload) (agent.Prepared, error) {
+		return &controlledPreparation{start: start}, nil
 	})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("Handle prompt_request: %v", err)
-	}
-	sess := <-h.gotSess
-	close(sess.out)
-	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "active run cleanup")
-
-	select {
-	case <-sess.ctx.Done():
-		t.Fatal("completed session cancelled before idle timeout")
-	case <-time.After(15 * time.Millisecond):
-	}
-	waitFor(t, func() bool { return sess.cancels() == 1 }, "idle session cancellation")
 }
 
-func TestNewPromptResetsCompletedSessionIdleTimeout(t *testing.T) {
-	h := newHarnessWithIdleTimeout(t, 80*time.Millisecond)
-	defer h.router.Shutdown(context.Background())
-
-	stateKey := "conv-renew/agent/fake_alpha"
-	first := mustEnv(t, proto.TypePromptRequest, "run_first", proto.PromptRequestPayload{
-		AgentKind: "fake_alpha", ConversationID: "conv-renew", AgentStateKey: stateKey,
-	})
-	if err := h.router.Handle(context.Background(), first); err != nil {
-		t.Fatalf("Handle first prompt: %v", err)
-	}
-	firstSession := <-h.gotSess
-	close(firstSession.out)
-	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "first run cleanup")
-	time.Sleep(50 * time.Millisecond)
-
-	second := mustEnv(t, proto.TypePromptRequest, "run_second", proto.PromptRequestPayload{
-		AgentKind: "fake_alpha", ConversationID: "conv-renew", AgentStateKey: stateKey,
-	})
-	if err := h.router.Handle(context.Background(), second); err != nil {
-		t.Fatalf("Handle second prompt: %v", err)
-	}
-	secondSession := <-h.gotSess
-
-	time.Sleep(45 * time.Millisecond)
-	if firstSession.cancels() != 0 {
-		t.Fatal("new prompt did not renew the completed session idle timeout")
-	}
-	close(secondSession.out)
-	waitFor(t, func() bool { return firstSession.cancels() == 1 }, "renewed idle session cancellation")
+// startRun prepares a dedicated Executor for run, starts the Run with input
+// "input" and waits until it accepts operations.
+func startRun(t *testing.T, r *dispatch.Router, s *recSender, run string, config proto.PromptRequestPayload) {
+	t.Helper()
+	ready := executorAdmission(t, r, s, "prepare-"+run, noEnvironmentPreparation("session-"+run, config))
+	startExecutorTurn(t, r, s, "prepare-"+run, run, ready)
+	waitFor(t, func() bool { return r.RunStartedForTest(run) }, "run "+run+" to accept operations")
 }
 
 func mustEnv(t *testing.T, typ, id string, payload any) proto.Envelope {
@@ -237,22 +191,15 @@ func mustEnv(t *testing.T, typ, id string, payload any) proto.Envelope {
 // tests
 // ---------------------------------------------------------------------
 
-func TestHandlePromptRequestInvokesFactoryAndForwardsOutput(t *testing.T) {
+func TestExecutionStartRunsInputAndForwardsOutput(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_1", proto.PromptRequestPayload{
-		AgentKind: "fake_alpha", Input: proto.TextInput("hi"), ConversationID: "c1",
-	})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("Handle prompt_request: %v", err)
-	}
-
-	req := <-h.gotReq
-	if req.RunID != "run_1" || req.AgentKind != "fake_alpha" || *req.Input[0].Content[0].Text != "hi" {
-		t.Errorf("factory got %+v, want run_1/fake_alpha/hi", req)
-	}
+	startRun(t, h.router, h.sender, "run_1", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
+	if sess.runID != "run_1" || len(sess.input) != 1 || *sess.input[0].Content[0].Text != "input" {
+		t.Errorf("Turn got run %q input %+v, want run_1/input", sess.runID, sess.input)
+	}
 
 	// Session emits a delta + done; both should reach the sender.
 	sess.out <- mustEnv(t, proto.TypeDelta, "run_1", proto.DeltaPayload{Delta: "hello", Sequence: 1})
@@ -261,69 +208,70 @@ func TestHandlePromptRequestInvokesFactoryAndForwardsOutput(t *testing.T) {
 
 	waitForTypes(t, h.sender, "run_1", []string{proto.TypeDelta, proto.TypeDone})
 
-	// Pump should have removed the session.
+	// Settlement should have removed the Run.
 	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "active runs to drop to 0")
 }
 
-func TestHandlePromptRequestRejectsDuplicateRunID(t *testing.T) {
+func TestExecutionStartRejectsDuplicateRunID(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_dup", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("first Handle: %v", err)
-	}
-	<-h.gotReq // drain first
+	startRun(t, h.router, h.sender, "run_dup", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 
-	// Second prompt_request with same RunID should NOT spin up a second factory call.
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("duplicate Handle: %v", err)
+	// Another Executor must not start a second Turn for the same RunID.
+	second := executorAdmission(t, h.router, h.sender, "prepare-dup", noEnvironmentPreparation("session-dup", proto.PromptRequestPayload{AgentKind: "fake_alpha"}))
+	start := mustEnv(t, proto.TypeExecutionStart, "prepare-dup", proto.ExecutionStartPayload{Handle: second.Handle, ExecutorID: second.ExecutorID, RunID: "run_dup", Input: proto.TextInput("input")})
+	if err := h.router.Handle(context.Background(), start); err == nil {
+		t.Fatal("duplicate Run started")
+	}
+	if status := waitPreparationStatus(t, h.sender, "prepare-dup", "rejected", ""); status.ErrorCode != "run_conflict" {
+		t.Fatalf("duplicate start status = %+v, want run_conflict", status)
 	}
 
 	select {
-	case extra := <-h.gotReq:
-		t.Fatalf("factory invoked twice for duplicate run, second req=%+v", extra)
+	case extra := <-h.gotSess:
+		t.Fatalf("Turn started twice for duplicate run, second run=%s", extra.runID)
 	case <-time.After(50 * time.Millisecond):
 	}
 	close(sess.out)
 }
 
-func TestHandlePromptRequestUnsupportedKindEmitsErrorDone(t *testing.T) {
+func TestExecutionPrepareRejectsUnknownKind(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_x", proto.PromptRequestPayload{AgentKind: "fake_beta"})
-	err := h.router.Handle(context.Background(), env)
-	if !errors.Is(err, agent.ErrUnsupportedKind) {
-		t.Errorf("Handle unsupported = %v, want ErrUnsupportedKind", err)
+	env := mustEnv(t, proto.TypeExecutionPrepare, "prepare_x", noEnvironmentPreparation("x", proto.PromptRequestPayload{AgentKind: "fake_beta"}))
+	if err := h.router.Handle(context.Background(), env); err == nil {
+		t.Error("unknown kind admitted")
 	}
-	got := h.sender.typesFor("run_x")
-	want := []string{proto.TypeError, proto.TypeDone}
-	if !slices.Equal(got, want) {
-		t.Errorf("sender frames for run_x = %v, want %v", got, want)
+	if status := waitPreparationStatus(t, h.sender, "prepare_x", "rejected", ""); status.ErrorCode != "resource_unavailable" {
+		t.Errorf("unknown kind status = %+v, want resource_unavailable", status)
+	}
+	if got, want := h.sender.typesFor("prepare_x"), []string{proto.TypePreparationStatus}; !slices.Equal(got, want) {
+		t.Errorf("sender frames for prepare_x = %v, want %v", got, want)
 	}
 }
 
-func TestHandlePromptRequestMissingRunIDIsError(t *testing.T) {
+func TestExecutionStartRequiresRunID(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	if err := h.router.Handle(context.Background(), env); err == nil {
+	ready := executorAdmission(t, h.router, h.sender, "prepare", noEnvironmentPreparation("session", proto.PromptRequestPayload{AgentKind: "fake_alpha"}))
+	start := mustEnv(t, proto.TypeExecutionStart, "prepare", proto.ExecutionStartPayload{Handle: ready.Handle, ExecutorID: ready.ExecutorID, Input: proto.TextInput("input")})
+	if err := h.router.Handle(context.Background(), start); err == nil {
 		t.Fatal("expected error on missing run id")
 	}
+	if status := waitPreparationStatus(t, h.sender, "prepare", "rejected", ""); status.ErrorCode != "invalid_start" {
+		t.Fatalf("missing run id status = %+v, want invalid_start", status)
+	}
 }
 
 func TestHandlePromptCancelInvokesSessionCancel(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_2", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("prompt_request: %v", err)
-	}
-	<-h.gotReq
+	startRun(t, h.router, h.sender, "run_2", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 	sess.closeOutOnCancel = true
 
@@ -348,11 +296,7 @@ func TestPermissionRequestIsIndexedAndDecisionRoutes(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_p", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("prompt_request: %v", err)
-	}
-	<-h.gotReq
+	startRun(t, h.router, h.sender, "run_p", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 
 	// Session emits a permission_request; pump should index it.
@@ -361,7 +305,7 @@ func TestPermissionRequestIsIndexedAndDecisionRoutes(t *testing.T) {
 	})
 	sess.out <- permEnv
 	// Wait until sender records — indexing happens before send.
-	waitFor(t, func() bool { return len(h.sender.snapshot()) >= 1 }, "permission_request to be forwarded")
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypePermissionRequest, "run_p") }, "permission_request to be forwarded")
 
 	dec := mustEnv(t, proto.TypePermissionDecision, "perm_abcd1234", proto.PermissionDecisionPayload{DeliveryID: "delivery-perm-1", Approved: true})
 	if err := h.router.Handle(context.Background(), dec); err != nil {
@@ -389,32 +333,6 @@ func TestPermissionRequestIsIndexedAndDecisionRoutes(t *testing.T) {
 	close(sess.out)
 }
 
-func TestPermissionCancelDeindexes(t *testing.T) {
-	h := newHarness(t)
-	defer h.router.Shutdown(context.Background())
-
-	env := mustEnv(t, proto.TypePromptRequest, "run_p2", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	_ = h.router.Handle(context.Background(), env)
-	<-h.gotReq
-	sess := <-h.gotSess
-
-	sess.out <- mustEnv(t, proto.TypePermissionRequest, "run_p2", proto.PermissionRequestPayload{RequestID: "perm_xx", Tool: "Bash"})
-	waitFor(t, func() bool { return len(h.sender.snapshot()) >= 1 }, "perm forwarded")
-	sess.out <- mustEnv(t, proto.TypePermissionCancel, "perm_xx", nil)
-	waitFor(t, func() bool { return len(h.sender.snapshot()) >= 2 }, "perm_cancel forwarded")
-
-	// A decision for the cancelled perm should be a no-op (session never sees it).
-	if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePermissionDecision, "perm_xx", proto.PermissionDecisionPayload{DeliveryID: "delivery-cancelled"})); err != nil {
-		t.Fatalf("decision: %v", err)
-	}
-	if calls := sess.submissions(); len(calls) != 0 {
-		t.Errorf("expected zero submissions after cancel, got %+v", calls)
-	}
-	assertDecisionAck(t, h.sender, "delivery-cancelled", false, "not_pending")
-
-	close(sess.out)
-}
-
 func TestPermissionDecisionUnknownPermIsNoop(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
@@ -429,11 +347,7 @@ func TestPromptForUserChoiceDecisionRoutesToSession(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_ask", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("prompt_request: %v", err)
-	}
-	<-h.gotReq
+	startRun(t, h.router, h.sender, "run_ask", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 
 	// Envelope.ID is the run id (server-side dispatch fans on it); the
@@ -445,7 +359,7 @@ func TestPromptForUserChoiceDecisionRoutesToSession(t *testing.T) {
 		ToolUseID: "toolu_42",
 	})
 	sess.out <- askEnv
-	waitFor(t, func() bool { return len(h.sender.snapshot()) >= 1 }, "prompt_for_user_choice forwarded")
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypePromptForUserChoice, "run_ask") }, "prompt_for_user_choice forwarded")
 
 	dec := mustEnv(t, proto.TypePromptForUserChoiceDecision, "ask_abcd1234", proto.PromptForUserChoiceDecisionPayload{
 		DeliveryID: "delivery-ask-1", QuestionAnswers: []proto.PromptForUserChoiceQuestionAnswer{{QuestionID: "q0", Answers: []string{"yes"}}},
@@ -486,11 +400,7 @@ func TestPromptForUserChoiceDecisionClearsIndexOnAgentUnknown(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_ask_u", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("prompt_request: %v", err)
-	}
-	<-h.gotReq
+	startRun(t, h.router, h.sender, "run_ask_u", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 	sess.askErr = agent.ErrUnknownAsk
 
@@ -500,7 +410,7 @@ func TestPromptForUserChoiceDecisionClearsIndexOnAgentUnknown(t *testing.T) {
 		ToolUseID: "toolu_y",
 	})
 	sess.out <- askEnv
-	waitFor(t, func() bool { return len(h.sender.snapshot()) >= 1 }, "prompt_for_user_choice forwarded")
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypePromptForUserChoice, "run_ask_u") }, "prompt_for_user_choice forwarded")
 
 	dec := mustEnv(t, proto.TypePromptForUserChoiceDecision, "ask_xxxxxxxx", proto.PromptForUserChoiceDecisionPayload{
 		DeliveryID: "delivery-ask-gone", QuestionAnswers: []proto.PromptForUserChoiceQuestionAnswer{{QuestionID: "q0", Answers: []string{"yes"}}},
@@ -524,18 +434,14 @@ func TestPromptForUserChoiceDecisionKeepsIndexOnTransientAgentError(t *testing.T
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 
-	env := mustEnv(t, proto.TypePromptRequest, "run_ask_retry", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
-	if err := h.router.Handle(context.Background(), env); err != nil {
-		t.Fatalf("prompt_request: %v", err)
-	}
-	<-h.gotReq
+	startRun(t, h.router, h.sender, "run_ask_retry", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 	sess.askErr = errors.New("temporary stdin failure")
 
 	sess.out <- mustEnv(t, proto.TypePromptForUserChoice, "run_ask_retry", proto.PromptForUserChoicePayload{
 		AskID: "ask_retry", Questions: []proto.PromptForUserChoiceQuestion{{ID: "q0", Question: "Retry?"}},
 	})
-	waitFor(t, func() bool { return len(h.sender.snapshot()) >= 1 }, "prompt_for_user_choice forwarded")
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypePromptForUserChoice, "run_ask_retry") }, "prompt_for_user_choice forwarded")
 
 	decision := mustEnv(t, proto.TypePromptForUserChoiceDecision, "ask_retry", proto.PromptForUserChoiceDecisionPayload{
 		DeliveryID: "delivery-ask-retry", QuestionAnswers: []proto.PromptForUserChoiceQuestionAnswer{{QuestionID: "q0", Answers: []string{"yes"}}},
@@ -598,10 +504,7 @@ func TestHandleDeviceShutdownCancelsAllSessions(t *testing.T) {
 	defer h.router.Shutdown(context.Background())
 
 	for _, rid := range []string{"r1", "r2", "r3"} {
-		if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, rid, proto.PromptRequestPayload{AgentKind: "fake_alpha"})); err != nil {
-			t.Fatalf("start %s: %v", rid, err)
-		}
-		<-h.gotReq
+		startRun(t, h.router, h.sender, rid, proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	}
 	sessions := make([]*fakeSession, 3)
 	for i := range sessions {
@@ -631,7 +534,7 @@ func TestHandleAfterShutdownReturnsErrRouterClosed(t *testing.T) {
 	if err := h.router.Shutdown(context.Background()); err != nil {
 		t.Fatalf("Shutdown: %v", err)
 	}
-	err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "r", proto.PromptRequestPayload{AgentKind: "fake_alpha"}))
+	err := h.router.Handle(context.Background(), mustEnv(t, proto.TypeExecutionPrepare, "r", noEnvironmentPreparation("session", proto.PromptRequestPayload{AgentKind: "fake_alpha"})))
 	if !errors.Is(err, dispatch.ErrRouterClosed) {
 		t.Errorf("post-shutdown Handle = %v, want ErrRouterClosed", err)
 	}
@@ -640,10 +543,7 @@ func TestHandleAfterShutdownReturnsErrRouterClosed(t *testing.T) {
 func TestShutdownWaitsForPumpDrain(t *testing.T) {
 	h := newHarness(t)
 
-	if err := h.router.Handle(context.Background(), mustEnv(t, proto.TypePromptRequest, "rs", proto.PromptRequestPayload{AgentKind: "fake_alpha"})); err != nil {
-		t.Fatalf("prompt_request: %v", err)
-	}
-	<-h.gotReq
+	startRun(t, h.router, h.sender, "rs", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	sess := <-h.gotSess
 
 	// Background: emit one frame then close out shortly after
diff --git a/apps/daemon/internal/dispatch/runtime_preparation.go b/apps/daemon/internal/dispatch/runtime_preparation.go
index 1ed576542..1c777f0fe 100644
--- a/apps/daemon/internal/dispatch/runtime_preparation.go
+++ b/apps/daemon/internal/dispatch/runtime_preparation.go
@@ -114,7 +114,7 @@ func (r *Router) handleRuntimePrepare(ctx context.Context, env proto.Envelope) e
 }
 
 func (r *Router) runtimePreparationResourcesBusyLocked() bool {
-	if r.workspaceWrite != nil || r.workspaceExport != nil || len(r.workspaceReads) != 0 || len(r.sessions) != 0 || len(r.idle) != 0 || len(r.executors) != 0 {
+	if r.workspaceWrite != nil || r.workspaceExport != nil || len(r.workspaceReads) != 0 || len(r.sessions) != 0 || len(r.executors) != 0 {
 		return true
 	}
 	for _, p := range r.preparations {
diff --git a/apps/daemon/internal/dispatch/runtime_preparation_test.go b/apps/daemon/internal/dispatch/runtime_preparation_test.go
index feb7fbf6e..d8a3399f9 100644
--- a/apps/daemon/internal/dispatch/runtime_preparation_test.go
+++ b/apps/daemon/internal/dispatch/runtime_preparation_test.go
@@ -169,7 +169,7 @@ func TestRuntimePreparationBeginRequiresExactBindingAndBounds(t *testing.T) {
 }
 
 func TestRuntimePreparationPreparationExcludesOwnedResources(t *testing.T) {
-	for _, mode := range []string{"write", "export", "read", "run", "idle", "executor", "preparation"} {
+	for _, mode := range []string{"write", "export", "read", "run", "executor", "preparation"} {
 		t.Run(mode, func(t *testing.T) {
 			r, sender, environment, session := capabilitiesTestRouter(t)
 			switch mode {
@@ -181,8 +181,6 @@ func TestRuntimePreparationPreparationExcludesOwnedResources(t *testing.T) {
 				r.workspaceReads = map[string]struct{}{"read": {}}
 			case "run":
 				r.sessions["run"] = &sessionState{}
-			case "idle":
-				r.idle["state"] = map[*sessionState]struct{}{}
 			case "executor":
 				r.executors[session] = &executorState{}
 			case "preparation":
@@ -202,7 +200,6 @@ func TestRuntimePreparationPreparationExcludesOwnedResources(t *testing.T) {
 			r.workspaceExport = nil
 			r.workspaceReads = nil
 			clear(r.sessions)
-			clear(r.idle)
 			clear(r.executors)
 			clear(r.preparations)
 			shutdownCapabilitiesRouter(t, r)
diff --git a/apps/daemon/internal/dispatch/shutdown.go b/apps/daemon/internal/dispatch/shutdown.go
index c40d4875e..cc7229aff 100644
--- a/apps/daemon/internal/dispatch/shutdown.go
+++ b/apps/daemon/internal/dispatch/shutdown.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/MiniMax-AI/OpenAgentCore/apps/daemon/internal/agent"
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
@@ -31,31 +30,12 @@ func (r *Router) Shutdown(ctx context.Context) error {
 		}
 	}
 
-	first := !r.closed
-	var victims []sessionCancellation
-	for _, state := range r.sessions {
-		state.retain = false
-		if state.preparedHandoff != nil {
-			victims = append(victims, r.sessionCancellationLocked(state, true))
-		} else if first {
-			victims = append(victims, sessionCancellation{runID: state.runID, ctxCancel: state.ctxCancel, session: state.session})
-		}
-	}
-	if first {
+	victims := r.sessionCancellationsLocked()
+	if !r.closed {
 		r.closed = true
 		if r.runtimePreparation != nil {
 			r.runtimePreparation.cancel()
 		}
-		for _, states := range r.idle {
-			for state := range states {
-				state.retain = false
-				if state.idleTimer != nil {
-					state.idleTimer.Stop()
-				}
-				victims = append(victims, sessionCancellation{runID: state.runID, ctxCancel: state.ctxCancel, session: state.session})
-			}
-		}
-		r.idle = make(map[string]map[*sessionState]struct{})
 		// Prepared release claims exist before this signal can interrupt output.
 		close(r.shutdownCh)
 	}
@@ -78,19 +58,10 @@ func (r *Router) Shutdown(ctx context.Context) error {
 func (r *Router) runShutdownAttempt(attempt *shutdownAttempt, victims []sessionCancellation) {
 	var releaseErr error
 	for _, victim := range victims {
-		if victim.handoff != nil {
-			// The cleanup operation has its own fixed native deadline. The
-			// Shutdown caller's deadline only bounds its wait for this attempt.
-			if err := r.awaitPreparedNativeRelease(context.Background(), victim.release, victim.attempt); err != nil {
-				releaseErr = errors.Join(releaseErr, fmt.Errorf("dispatch: prepared run %s: %w", victim.runID, err))
-			}
-			continue
-		}
-		victim.ctxCancel()
-		if victim.session != nil {
-			if err := victim.session.Cancel(context.Background()); err != nil {
-				r.log.Warn("session.Cancel failed", "run_id", victim.runID, "err", err)
-			}
+		// The cleanup operation has its own fixed native deadline. The
+		// Shutdown caller's deadline only bounds its wait for this attempt.
+		if err := r.awaitPreparedNativeRelease(context.Background(), victim.release, victim.attempt); err != nil {
+			releaseErr = errors.Join(releaseErr, fmt.Errorf("dispatch: prepared run %s: %w", victim.runID, err))
 		}
 	}
 	r.shutdownWG.Done()
@@ -153,21 +124,7 @@ func (r *Router) handleDeviceShutdown(ctx context.Context, env proto.Envelope) e
 	if r.runtimePreparation != nil {
 		r.runtimePreparation.cancel()
 	}
-	victims := make([]sessionCancellation, 0, len(r.sessions))
-	for _, state := range r.sessions {
-		state.retain = false
-		victims = append(victims, r.sessionCancellationLocked(state, true))
-	}
-	for _, states := range r.idle {
-		for state := range states {
-			state.retain = false
-			if state.idleTimer != nil {
-				state.idleTimer.Stop()
-			}
-			victims = append(victims, sessionCancellation{runID: state.runID, ctxCancel: state.ctxCancel, session: state.session})
-		}
-	}
-	r.idle = make(map[string]map[*sessionState]struct{})
+	victims := r.sessionCancellationsLocked()
 	preparations := r.closePendingPreparationsLocked()
 	executors := r.closeIdleExecutorsLocked()
 	r.mu.Unlock()
@@ -180,36 +137,27 @@ func (r *Router) handleDeviceShutdown(ctx context.Context, env proto.Envelope) e
 }
 
 type sessionCancellation struct {
-	runID     string
-	ctxCancel context.CancelFunc
-	session   agent.Session
-	handoff   *preparedHandoff
-	release   *preparedRelease
-	attempt   *preparedReleaseAttempt
+	runID   string
+	handoff *preparedHandoff
+	release *preparedRelease
+	attempt *preparedReleaseAttempt
 }
 
-func (r *Router) sessionCancellationLocked(state *sessionState, retry bool) sessionCancellation {
-	if state.preparedHandoff != nil {
-		release, attempt := r.claimPreparedReleaseLocked(state, true, "", retry)
-		return sessionCancellation{runID: state.runID, handoff: state.preparedHandoff, release: release, attempt: attempt}
+// sessionCancellationsLocked claims release of every active Run, retrying a
+// failed native attempt. Router.mu must be held.
+func (r *Router) sessionCancellationsLocked() []sessionCancellation {
+	victims := make([]sessionCancellation, 0, len(r.sessions))
+	for _, state := range r.sessions {
+		release, attempt := r.claimPreparedReleaseLocked(state, true, "", true)
+		victims = append(victims, sessionCancellation{runID: state.runID, handoff: state.preparedHandoff, release: release, attempt: attempt})
 	}
-	return sessionCancellation{runID: state.runID, ctxCancel: state.ctxCancel, session: state.session}
+	return victims
 }
 
 func (r *Router) cancelSessions(ctx context.Context, sessions []sessionCancellation) {
 	for _, session := range sessions {
-		if session.handoff != nil {
-			if err := r.awaitPreparedRelease(ctx, session.handoff, session.release, session.attempt); err != nil {
-				r.log.Warn("prepared session release failed", "run_id", session.runID, "err", err)
-			}
-			continue
-		}
-		session.ctxCancel()
-		if session.session == nil {
-			continue
-		}
-		if err := session.session.Cancel(ctx); err != nil {
-			r.log.Warn("session.Cancel failed", "run_id", session.runID, "err", err)
+		if err := r.awaitPreparedRelease(ctx, session.handoff, session.release, session.attempt); err != nil {
+			r.log.Warn("prepared session release failed", "run_id", session.runID, "err", err)
 		}
 	}
 }
diff --git a/apps/daemon/internal/dispatch/steering.go b/apps/daemon/internal/dispatch/steering.go
index cd6acfcf2..97a08a399 100644
--- a/apps/daemon/internal/dispatch/steering.go
+++ b/apps/daemon/internal/dispatch/steering.go
@@ -98,12 +98,7 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 	}
 	session := state.session
 	steerer, supportsSteering := session.(agent.Steerer)
-	if input.DurableReceipt {
-		if _, ok := session.(agent.DurableSteerer); !ok || (!state.releaseOnCompletion && state.preparedHandoff == nil) {
-			ack.ErrorCode, ack.Error = "unsupported", "Durable input receipts require a supported Turn settlement contract."
-			return &ack
-		}
-	} else if !supportsSteering {
+	if !input.DurableReceipt && !supportsSteering {
 		ack.ErrorCode, ack.Error = "unsupported", "This engine does not support active-turn input."
 		return &ack
 	}
@@ -120,8 +115,6 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 	ack.ErrorCode, ack.Error = "in_flight", "This input is awaiting an engine receipt."
 	state.steering[input.InputID] = steeringReceipt{fingerprint: fingerprint, ack: ack, durable: input.DurableReceipt}
 	state.steerBusy = true
-	finished := make(chan struct{})
-	state.steeringDone = finished
 	r.shutdownWG.Add(1)
 	go func() {
 		defer r.shutdownWG.Done()
@@ -129,7 +122,6 @@ func (r *Router) queueSteering(ctx context.Context, env proto.Envelope, input pr
 		defer func() {
 			r.mu.Lock()
 			state.steerBusy = false
-			close(finished)
 			r.mu.Unlock()
 		}()
 		ctx, stop := r.shutdownContext(ctx)
@@ -180,25 +172,3 @@ func (r *Router) shutdownContext(parent context.Context) (context.Context, conte
 	}()
 	return ctx, cancel
 }
-
-// Close admission before taking the last worker: its lifetime includes the
-// receipt send, so a durable Done cannot close the gateway subscription first.
-func (r *Router) finishSteering(state *sessionState) error {
-	r.mu.Lock()
-	state.steeringClosed = true
-	finished := state.steeringDone
-	r.mu.Unlock()
-	if finished == nil {
-		return nil
-	}
-	timer := time.NewTimer(steeringCallTimeout + steeringSendTimeout)
-	defer timer.Stop()
-	select {
-	case <-finished:
-		return nil
-	case <-r.shutdownCh:
-		return context.Canceled
-	case <-timer.C:
-		return context.DeadlineExceeded
-	}
-}
diff --git a/apps/daemon/internal/dispatch/steering_lifetime.go b/apps/daemon/internal/dispatch/steering_lifetime.go
index b696de6a4..adbfbe054 100644
--- a/apps/daemon/internal/dispatch/steering_lifetime.go
+++ b/apps/daemon/internal/dispatch/steering_lifetime.go
@@ -9,7 +9,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto"
 )
 
-func (r *Router) steerDurably(sendCtx context.Context, state *sessionState, session agent.Session, env proto.Envelope, input proto.PromptSteerPayload, fingerprint [32]byte) error {
+func (r *Router) steerDurably(sendCtx context.Context, state *sessionState, session agent.DurableSteerer, env proto.Envelope, input proto.PromptSteerPayload, fingerprint [32]byte) error {
 	ctx, cancel := context.WithCancel(state.ctx)
 	defer cancel()
 	stopShutdown := context.AfterFunc(sendCtx, cancel)
@@ -17,7 +17,7 @@ func (r *Router) steerDurably(sendCtx context.Context, state *sessionState, sess
 	timer := time.AfterFunc(steeringCallTimeout, cancel)
 	defer timer.Stop()
 	var once sync.Once
-	return session.(agent.DurableSteerer).SteerWithReceipt(ctx, input, func() {
+	return session.SteerWithReceipt(ctx, input, func() {
 		once.Do(func() {
 			if !timer.Stop() || ctx.Err() != nil {
 				return
diff --git a/apps/daemon/internal/dispatch/steering_lifetime_test.go b/apps/daemon/internal/dispatch/steering_lifetime_test.go
index c51b87b87..9a2419768 100644
--- a/apps/daemon/internal/dispatch/steering_lifetime_test.go
+++ b/apps/daemon/internal/dispatch/steering_lifetime_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"sync/atomic"
@@ -28,7 +26,7 @@ func TestDurableSteeringWaitsBeyondTransportDeadline(t *testing.T) {
 	var session *fakeSession
 	var calls atomic.Int32
 	release := make(chan struct{})
-	h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		session = &fakeSession{out: out, closeOutOnCancel: true}
 		return &durableSteeringSession{steeringSession: &steeringSession{fakeSession: session}, phased: func(ctx context.Context, input proto.PromptSteerPayload, written func()) error {
 			calls.Add(1)
@@ -40,11 +38,9 @@ func TestDurableSteeringWaitsBeyondTransportDeadline(t *testing.T) {
 				return ctx.Err()
 			}
 		}}, nil
-	})
-	ctx := context.Background()
-	if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, "durable", proto.PromptRequestPayload{AgentKind: "codex", ReleaseOnCompletion: true})); err != nil {
-		t.Fatal(err)
-	}
+	}))
+	startRun(t, h.router, h.sender, "durable", proto.PromptRequestPayload{AgentKind: "codex"})
+	base := len(h.sender.snapshot())
 	input := proto.PromptSteerPayload{InputID: "extra", Input: proto.TextInput("additional"), DurableReceipt: true}
 	env := mustEnv(t, proto.TypePromptSteer, "durable", input)
 	if err := handleSteeringAndWait(t, h, env); err != nil {
@@ -54,7 +50,7 @@ func TestDurableSteeringWaitsBeyondTransportDeadline(t *testing.T) {
 		t.Fatalf("write phase: %+v", ack)
 	}
 	time.Sleep(11 * time.Second)
-	if len(h.sender.snapshot()) != 1 {
+	if len(h.sender.snapshot()) != base+1 {
 		t.Fatal("native wait ended at transport deadline")
 	}
 	if err := handleSteeringAndWait(t, h, env); err != nil {
@@ -64,12 +60,12 @@ func TestDurableSteeringWaitsBeyondTransportDeadline(t *testing.T) {
 		t.Fatalf("cached phase: %+v", ack)
 	}
 	close(release)
-	waitFor(t, func() bool { return len(h.sender.snapshot()) == 3 }, "native acceptance")
+	waitFor(t, func() bool { return len(h.sender.snapshot()) == base+3 }, "native acceptance")
 	if ack := lastSteeringAck(t, h.sender, "durable", "extra"); !ack.Accepted || ack.Written {
 		t.Fatalf("final phase: %+v", ack)
 	}
 	session.out <- mustEnv(t, proto.TypeDone, "durable", proto.DonePayload{})
-	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "completion")
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypeDone, "durable") }, "completion")
 	frames := h.sender.snapshot()
 	if calls.Load() != 1 || frames[len(frames)-1].Type != proto.TypeDone {
 		t.Fatal("replayed input or incorrect completion order")
@@ -82,7 +78,7 @@ func TestDurableSteeringTransportTimeoutAndShutdown(t *testing.T) {
 			h := newHarness(t)
 			defer h.router.Shutdown(context.Background())
 			exited := make(chan struct{})
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				return &durableSteeringSession{steeringSession: &steeringSession{fakeSession: &fakeSession{out: out, closeOutOnCancel: true}}, phased: func(ctx context.Context, _ proto.PromptSteerPayload, written func()) error {
 					defer close(exited)
 					if phase == "written" {
@@ -91,11 +87,10 @@ func TestDurableSteeringTransportTimeoutAndShutdown(t *testing.T) {
 					<-ctx.Done()
 					return ctx.Err()
 				}}, nil
-			})
+			}))
 			ctx := context.Background()
-			if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, "run", proto.PromptRequestPayload{AgentKind: "codex", ReleaseOnCompletion: true})); err != nil {
-				t.Fatal(err)
-			}
+			startRun(t, h.router, h.sender, "run", proto.PromptRequestPayload{AgentKind: "codex"})
+			base := len(h.sender.snapshot())
 			if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptSteer, "run", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text"), DurableReceipt: true})); err != nil {
 				t.Fatal(err)
 			}
@@ -105,12 +100,12 @@ func TestDurableSteeringTransportTimeoutAndShutdown(t *testing.T) {
 				case <-time.After(12 * time.Second):
 					t.Fatal("blocked write was not bounded")
 				}
-				waitFor(t, func() bool { return len(h.sender.snapshot()) == 1 }, "unknown receipt")
+				waitFor(t, func() bool { return len(h.sender.snapshot()) == base+1 }, "unknown receipt")
 				if ack := lastSteeringAck(t, h.sender, "run", "one"); ack.Written || ack.Accepted || ack.ErrorCode != "outcome_unknown" {
 					t.Fatalf("transport uncertainty: %+v", ack)
 				}
 			} else {
-				waitFor(t, func() bool { return len(h.sender.snapshot()) == 1 }, "written phase")
+				waitFor(t, func() bool { return len(h.sender.snapshot()) == base+1 }, "written phase")
 				stopCtx, cancel := context.WithTimeout(ctx, time.Second)
 				defer cancel()
 				if err := h.router.Shutdown(stopCtx); err != nil {
@@ -125,32 +120,3 @@ func TestDurableSteeringTransportTimeoutAndShutdown(t *testing.T) {
 		})
 	}
 }
-
-func TestDurableSteeringRequiresOptInAndAdapter(t *testing.T) {
-	for _, supported := range []bool{false, true} {
-		t.Run(map[bool]string{false: "old-adapter", true: "retained-run"}[supported], func(t *testing.T) {
-			h := newHarness(t)
-			defer h.router.Shutdown(context.Background())
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(_ context.Context, _ proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
-				s := &steeringSession{fakeSession: &fakeSession{out: out, closeOutOnCancel: true}, steer: func(context.Context, proto.PromptSteerPayload) error { t.Error("unexpected legacy call"); return nil }}
-				if !supported {
-					return s, nil
-				}
-				return &durableSteeringSession{steeringSession: s, phased: func(context.Context, proto.PromptSteerPayload, func()) error {
-					t.Error("unexpected phased call")
-					return nil
-				}}, nil
-			})
-			ctx := context.Background()
-			if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, "run", proto.PromptRequestPayload{AgentKind: "codex", ReleaseOnCompletion: !supported})); err != nil {
-				t.Fatal(err)
-			}
-			if err := handleSteeringAndWait(t, h, mustEnv(t, proto.TypePromptSteer, "run", proto.PromptSteerPayload{InputID: "one", Input: proto.TextInput("text"), DurableReceipt: true})); err != nil {
-				t.Fatal(err)
-			}
-			if ack := lastSteeringAck(t, h.sender, "run", "one"); ack.ErrorCode != "unsupported" {
-				t.Fatalf("capability gate: %+v", ack)
-			}
-		})
-	}
-}
diff --git a/apps/daemon/internal/dispatch/steering_test.go b/apps/daemon/internal/dispatch/steering_test.go
index c989afd7c..bf5b214e9 100644
--- a/apps/daemon/internal/dispatch/steering_test.go
+++ b/apps/daemon/internal/dispatch/steering_test.go
@@ -1,7 +1,5 @@
 package dispatch_test
 
-import "github.com/MiniMax-AI/OpenAgentCore/internal/harnessconfig"
-
 import (
 	"context"
 	"errors"
@@ -33,7 +31,7 @@ func TestSteeringReceiptsAndRetries(t *testing.T) {
 			h := newHarness(t)
 			defer h.router.Shutdown(context.Background())
 			calls, starts := 0, 0
-			h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+			registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 				starts++
 				return &steeringSession{
 					fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
@@ -45,17 +43,15 @@ func TestSteeringReceiptsAndRetries(t *testing.T) {
 						if input.InputID != "input-1" || *input.Input[0].Content[0].Text != "additional text" {
 							t.Errorf("input lost: %+v", input)
 						}
-						if len(h.sender.snapshot()) != 0 {
+						if hasFrame(h.sender, proto.TypePromptSteerAck, "run-1") {
 							t.Error("ack sent before engine accepted input")
 						}
 						return engineError
 					},
 				}, nil
-			})
+			}))
 			ctx := context.Background()
-			if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, "run-1", proto.PromptRequestPayload{AgentKind: "codex"})); err != nil {
-				t.Fatal(err)
-			}
+			startRun(t, h.router, h.sender, "run-1", proto.PromptRequestPayload{AgentKind: "codex"})
 			input := proto.PromptSteerPayload{InputID: "input-1", Input: proto.TextInput("additional text")}
 			env := mustEnv(t, proto.TypePromptSteer, "run-1", input)
 			// An ack transport failure must not cause another native invocation.
@@ -94,7 +90,7 @@ func TestSteeringReadinessAndUnsupportedRuns(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 	calls := 0
-	h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		return &steeringSession{
 			fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
 			steer: func(context.Context, proto.PromptSteerPayload) error {
@@ -105,11 +101,9 @@ func TestSteeringReadinessAndUnsupportedRuns(t *testing.T) {
 				return nil
 			},
 		}, nil
-	})
+	}))
 	ctx := context.Background()
-	if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, "run-1", proto.PromptRequestPayload{AgentKind: "codex"})); err != nil {
-		t.Fatal(err)
-	}
+	startRun(t, h.router, h.sender, "run-1", proto.PromptRequestPayload{AgentKind: "codex"})
 	input := proto.PromptSteerPayload{InputID: "input-1", Input: proto.TextInput("extra")}
 	env := mustEnv(t, proto.TypePromptSteer, "run-1", input)
 	for _, expected := range []string{"not_ready", ""} {
@@ -132,16 +126,14 @@ func TestSteeringReadinessAndUnsupportedRuns(t *testing.T) {
 	if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptCancel, "run-1", nil)); err != nil {
 		t.Fatal(err)
 	}
-	waitFor(t, func() bool { return h.router.ActiveRuns() == 0 }, "cancel cleanup")
+	waitFor(t, func() bool { return hasFrame(h.sender, proto.TypeDone, "run-1") }, "cancel cleanup")
 	if err := handleSteeringAndWait(t, h, env); err != nil {
 		t.Fatal(err)
 	}
 	if ack := lastSteeringAck(t, h.sender, "run-1", "input-1"); ack.ErrorCode != "run_inactive" {
 		t.Fatalf("inactive: %+v", ack)
 	}
-	if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, "run-2", proto.PromptRequestPayload{AgentKind: "fake_alpha"})); err != nil {
-		t.Fatal(err)
-	}
+	startRun(t, h.router, h.sender, "run-2", proto.PromptRequestPayload{AgentKind: "fake_alpha"})
 	session := <-h.gotSess
 	defer close(session.out)
 	if err := handleSteeringAndWait(t, h, mustEnv(t, proto.TypePromptSteer, "run-2", input)); err != nil {
@@ -172,7 +164,7 @@ func TestSteeringDoesNotBlockOtherRunCancellation(t *testing.T) {
 	defer h.router.Shutdown(context.Background())
 	entered, release := make(chan struct{}), make(chan struct{})
 	defer close(release)
-	h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		return &steeringSession{
 			fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
 			steer: func(context.Context, proto.PromptSteerPayload) error {
@@ -181,12 +173,10 @@ func TestSteeringDoesNotBlockOtherRunCancellation(t *testing.T) {
 				return agent.ErrSteeringRejected
 			},
 		}, nil
-	})
+	}))
 	ctx := context.Background()
 	for _, run := range []struct{ id, engine string }{{"run-1", "codex"}, {"run-2", "fake_alpha"}} {
-		if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, run.id, proto.PromptRequestPayload{AgentKind: run.engine})); err != nil {
-			t.Fatal(err)
-		}
+		startRun(t, h.router, h.sender, run.id, proto.PromptRequestPayload{AgentKind: run.engine})
 	}
 	other := <-h.gotSess
 	other.closeOutOnCancel = true
@@ -206,9 +196,7 @@ func TestSteeringDoesNotBlockOtherRunCancellation(t *testing.T) {
 	if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptCancel, "run-2", nil)); err != nil {
 		t.Fatal(err)
 	}
-	if other.cancels() != 1 {
-		t.Fatal("other run cancellation blocked")
-	}
+	waitFor(t, func() bool { return other.cancels() == 1 }, "other run cancellation")
 }
 
 func lastSteeringAck(t *testing.T, sender *recSender, runID, inputID string) proto.PromptSteerAckPayload {
@@ -235,7 +223,7 @@ func TestSteeringCapacityPreservesExistingReceipts(t *testing.T) {
 	h := newHarness(t)
 	defer h.router.Shutdown(context.Background())
 	calls := 0
-	h.reg.RegisterKind(proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, harnessconfig.Configuration{}, func(ctx context.Context, req proto.PromptRequestPayload, out chan<- proto.Envelope) (agent.Session, error) {
+	registerExecutorKind(h.reg, proto.SupportedAgentKind{Kind: "codex", Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported, Steering: proto.CapabilitySupported, DurableInputReceipts: proto.CapabilitySupported})}, sessionExecutor(func(_ context.Context, _ string, _ proto.MessageInput, out chan<- proto.Envelope) (agent.Session, error) {
 		return &steeringSession{
 			fakeSession: &fakeSession{out: out, closeOutOnCancel: true},
 			steer: func(context.Context, proto.PromptSteerPayload) error {
@@ -243,11 +231,8 @@ func TestSteeringCapacityPreservesExistingReceipts(t *testing.T) {
 				return nil
 			},
 		}, nil
-	})
-	ctx := context.Background()
-	if err := h.router.Handle(ctx, mustEnv(t, proto.TypePromptRequest, "run-1", proto.PromptRequestPayload{AgentKind: "codex"})); err != nil {
-		t.Fatal(err)
-	}
+	}))
+	startRun(t, h.router, h.sender, "run-1", proto.PromptRequestPayload{AgentKind: "codex"})
 	for i := range 257 {
 		input := proto.PromptSteerPayload{InputID: fmt.Sprintf("input-%d", i), Input: proto.TextInput("extra")}
 		if err := handleSteeringAndWait(t, h, mustEnv(t, proto.TypePromptSteer, "run-1", input)); err != nil {
diff --git a/apps/daemon/internal/dispatch/suspend.go b/apps/daemon/internal/dispatch/suspend.go
index 003c9ce2f..a5e024746 100644
--- a/apps/daemon/internal/dispatch/suspend.go
+++ b/apps/daemon/internal/dispatch/suspend.go
@@ -41,14 +41,6 @@ func (r *Router) Quiesce(ctx context.Context, request proto.EnvironmentSuspendPa
 			return ErrRouterBusy
 		}
 	}
-	for _, states := range r.idle {
-		for state := range states {
-			if state.environmentID != request.EnvironmentID || state.steerBusy || len(state.pendingIDs) != 0 || len(state.pendingAsks) != 0 {
-				r.mu.Unlock()
-				return ErrRouterBusy
-			}
-		}
-	}
 	for _, owner := range r.executors {
 		if owner.invalid || owner.preparing || owner.run != nil || owner.admission != nil || owner.environmentID != request.EnvironmentID {
 			r.mu.Unlock()
@@ -61,14 +53,6 @@ func (r *Router) Quiesce(ctx context.Context, request proto.EnvironmentSuspendPa
 			p.timer.Stop()
 		}
 	}
-	for _, states := range r.idle {
-		for state := range states {
-			state.idleLease++
-			if state.idleTimer != nil {
-				state.idleTimer.Stop()
-			}
-		}
-	}
 	for _, owner := range r.executors {
 		owner.idleLease++
 		if owner.timer != nil {
@@ -104,10 +88,5 @@ func (r *Router) Resume(request proto.EnvironmentSuspendPayload, sender Sender)
 	for _, owner := range r.executors {
 		r.scheduleExecutorIdleLocked(owner)
 	}
-	for _, states := range r.idle {
-		for state := range states {
-			r.scheduleIdleLocked(state)
-		}
-	}
 	return nil
 }
diff --git a/apps/daemon/internal/dispatch/suspend_test.go b/apps/daemon/internal/dispatch/suspend_test.go
index 64049b954..b713218ae 100644
--- a/apps/daemon/internal/dispatch/suspend_test.go
+++ b/apps/daemon/internal/dispatch/suspend_test.go
@@ -15,11 +15,13 @@ type suspendSender func(context.Context, proto.Envelope) error
 
 func (s suspendSender) Send(ctx context.Context, env proto.Envelope) error { return s(ctx, env) }
 
-type suspendedSession struct{ cancelled atomic.Int32 }
+type suspendedExecutor struct{ closed atomic.Int32 }
 
-func (s *suspendedSession) CancellationOutcome() proto.DonePayload { return proto.DonePayload{} }
+func (e *suspendedExecutor) StartTurn(context.Context, string, proto.MessageInput, chan<- proto.Envelope) (agent.Turn, error) {
+	return nil, errors.New("suspended executor must not start a Turn")
+}
 
-func (s *suspendedSession) Cancel(context.Context) error { s.cancelled.Add(1); return nil }
+func (e *suspendedExecutor) Close(context.Context) error { e.closed.Add(1); return nil }
 
 func suspensionRouter(t *testing.T, sender Sender) *Router {
 	t.Helper()
@@ -37,7 +39,7 @@ func suspensionRouter(t *testing.T, sender Sender) *Router {
 
 func TestQuiesceRejectsEveryUnsettledResource(t *testing.T) {
 	cases := map[string]func(*Router){
-		"active":     func(r *Router) { r.sessions["run"] = &sessionState{ctxCancel: func() {}} },
+		"active":     func(r *Router) { r.sessions["run"] = &sessionState{} },
 		"preparing":  func(r *Router) { r.preparations["p"] = &preparationState{owns: true} },
 		"receipt":    func(r *Router) { r.preparations["p"] = &preparationState{busy: true} },
 		"read":       func(r *Router) { r.workspaceReads = map[string]struct{}{"read": {}} },
@@ -90,7 +92,7 @@ func TestQuiesceDrainsPendingReceiptAndFencesConcurrentAdmission(t *testing.T) {
 	}
 	admitted := make(chan error, 1)
 	go func() {
-		admitted <- r.Handle(context.Background(), proto.Envelope{Type: proto.TypePromptRequest, ID: "late"})
+		admitted <- r.Handle(context.Background(), proto.Envelope{Type: proto.TypeExecutionPrepare, ID: "late"})
 	}()
 	select {
 	case err := <-quiet:
@@ -106,23 +108,23 @@ func TestQuiesceDrainsPendingReceiptAndFencesConcurrentAdmission(t *testing.T) {
 	}
 }
 
-func TestQuiescePreservesIdleOwnerAgainstExpiredTimerAndRequiresExactResume(t *testing.T) {
+func TestQuiescePreservesIdleExecutorAgainstExpiredTimerAndRequiresExactResume(t *testing.T) {
 	sender := suspendSender(func(context.Context, proto.Envelope) error { return nil })
 	r := suspensionRouter(t, sender)
-	session := &suspendedSession{}
-	state := &sessionState{runID: "run", environmentID: "env", stateKey: "state", session: session, ctxCancel: func() {}, retain: true}
+	native := &suspendedExecutor{}
+	owner := &executorState{id: "executor", sessionID: "session", environmentID: "env", native: native, cancel: func() {}}
 	r.mu.Lock()
-	r.idle["state"] = map[*sessionState]struct{}{state: {}}
-	r.scheduleIdleLocked(state)
-	oldLease := state.idleLease
+	r.executors[owner.sessionID] = owner
+	r.scheduleExecutorIdleLocked(owner)
+	oldLease := owner.idleLease
 	r.mu.Unlock()
 	request := proto.EnvironmentSuspendPayload{EnvironmentID: "env", SuspendID: "attempt"}
 	if err := r.Quiesce(context.Background(), request); err != nil {
 		t.Fatal(err)
 	}
-	r.expireIdle(state, oldLease)
-	if session.cancelled.Load() != 0 {
-		t.Fatal("pre-snapshot timer killed retained owner")
+	r.expireIdleExecutor(owner, oldLease)
+	if native.closed.Load() != 0 {
+		t.Fatal("pre-snapshot timer closed retained owner")
 	}
 	wrong := request
 	wrong.SuspendID = "obsolete"
@@ -133,10 +135,10 @@ func TestQuiescePreservesIdleOwnerAgainstExpiredTimerAndRequiresExactResume(t *t
 		t.Fatal(err)
 	}
 	r.mu.Lock()
-	newLease := state.idleLease
+	newLease := owner.idleLease
 	r.mu.Unlock()
-	r.expireIdle(state, newLease)
-	if session.cancelled.Load() != 1 {
+	r.expireIdleExecutor(owner, newLease)
+	if native.closed.Load() != 1 {
 		t.Fatal("normal idle expiration was not restored")
 	}
 }
@@ -164,7 +166,7 @@ func TestQuiesceDrainDeadlineCannotReopenAdmission(t *testing.T) {
 	if err := r.Quiesce(ctx, proto.EnvironmentSuspendPayload{EnvironmentID: "env", SuspendID: "attempt"}); !errors.Is(err, context.Canceled) {
 		t.Fatalf("quiesce=%v", err)
 	}
-	if err := r.Handle(context.Background(), proto.Envelope{Type: proto.TypePromptRequest, ID: "late"}); !errors.Is(err, ErrRouterQuiesced) {
+	if err := r.Handle(context.Background(), proto.Envelope{Type: proto.TypeExecutionPrepare, ID: "late"}); !errors.Is(err, ErrRouterQuiesced) {
 		t.Fatalf("deadline reopened admission: %v", err)
 	}
 	r.shutdownWG.Done()
diff --git a/apps/daemon/internal/dispatch/workspace_write.go b/apps/daemon/internal/dispatch/workspace_write.go
index cd4722a6a..7aa41f555 100644
--- a/apps/daemon/internal/dispatch/workspace_write.go
+++ b/apps/daemon/internal/dispatch/workspace_write.go
@@ -58,7 +58,7 @@ func (r *Router) handleWorkspaceWrite(ctx context.Context, env proto.Envelope) e
 			}
 			return r.sendWorkspaceWrite(ctx, env.ID, rejectedWorkspaceWrite("write_capacity"))
 		}
-		if !r.localWorkspace.AcceptsFileWrite(request.EnvironmentID, request.SessionID) || len(r.sessions) != 0 || len(r.idle) != 0 || len(r.workspaceReads) != 0 {
+		if !r.localWorkspace.AcceptsFileWrite(request.EnvironmentID, request.SessionID) || len(r.sessions) != 0 || len(r.workspaceReads) != 0 {
 			r.mu.Unlock()
 			return r.sendWorkspaceWrite(ctx, env.ID, rejectedWorkspaceWrite("resource_unavailable"))
 		}
diff --git a/apps/daemon/internal/localworkspace/binding.go b/apps/daemon/internal/localworkspace/binding.go
index fe8bca207..5ee7fbf31 100644
--- a/apps/daemon/internal/localworkspace/binding.go
+++ b/apps/daemon/internal/localworkspace/binding.go
@@ -69,7 +69,7 @@ func (b *Binding) Configure(r proto.PromptRequestPayload) (proto.PromptRequestPa
 		return r, nil
 	}
 	if b == nil || r.LocalEnvironment == nil || r.LocalEnvironment.ID != b.environment || r.AgentStateKey != b.stateKey ||
-		r.DisableExecutionEnvironment || r.ConversationID != "" {
+		r.DisableExecutionEnvironment {
 		return r, errors.New("request does not match the dedicated local Environment")
 	}
 	if !r.WorkspaceReadOnly || r.LocalEnvironment.NetworkAccess != "" || len(r.LocalEnvironment.AllowedDomains) > 0 {
diff --git a/apps/daemon/internal/localworkspace/binding_test.go b/apps/daemon/internal/localworkspace/binding_test.go
index 9aad690f0..6d5bc80a5 100644
--- a/apps/daemon/internal/localworkspace/binding_test.go
+++ b/apps/daemon/internal/localworkspace/binding_test.go
@@ -26,7 +26,7 @@ func testBinding(t *testing.T) (*Binding, proto.PromptRequestPayload) {
 	}
 	b.networkAccess = "disabled"
 	b.capabilityRoot = t.TempDir()
-	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: "agents-api-" + session, ReleaseOnCompletion: true}
+	return b, proto.PromptRequestPayload{LocalEnvironment: &proto.LocalEnvironment{ID: environment, NetworkAccess: "disabled", WorkspaceDirectory: "/workspace", CapabilitySources: &agentcapabilities.Input{}}, AgentStateKey: "agents-api-" + session}
 }
 
 func TestBindingRejectsScopeOverrides(t *testing.T) {
@@ -95,14 +95,6 @@ func TestBindingPrepareRejectsOtherWorkspaceRoot(t *testing.T) {
 	}
 }
 
-func TestBindingAllowsRetainedExecutor(t *testing.T) {
-	b, req := testBinding(t)
-	req.ReleaseOnCompletion = false
-	if _, err := b.Configure(req); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestCapabilityLayoutUsesOperatorDirectories(t *testing.T) {
 	b, _ := testBinding(t)
 	for _, directory := range []string{filepath.Join(b.workspace, "capabilities"), filepath.Join(os.Getenv("OAC_RUNTIME_HOME"), "capabilities")} {
diff --git a/apps/daemon/internal/transport/ws_test.go b/apps/daemon/internal/transport/ws_test.go
index 13d5e2390..163de36cb 100644
--- a/apps/daemon/internal/transport/ws_test.go
+++ b/apps/daemon/internal/transport/ws_test.go
@@ -186,9 +186,9 @@ func TestRecvDeliversServerSentFrames(t *testing.T) {
 	}
 	defer conn.Close()
 
-	// Server pushes a prompt_request down to the daemon.
+	// Server pushes a prompt_cancel down to the daemon.
 	serverConn := <-gw.connCh
-	pushed, _ := proto.NewEnvelope("prompt_request", "run_abc", map[string]string{"prompt": "hi"})
+	pushed, _ := proto.NewEnvelope(proto.TypePromptCancel, "run_abc", proto.PromptCancelPayload{DeliveryID: "cancel"})
 	raw, _ := json.Marshal(pushed)
 	if err := serverConn.WriteMessage(websocket.TextMessage, raw); err != nil {
 		t.Fatalf("server write: %v", err)
@@ -196,8 +196,8 @@ func TestRecvDeliversServerSentFrames(t *testing.T) {
 
 	select {
 	case env := <-conn.Recv():
-		if env.Type != "prompt_request" || env.ID != "run_abc" {
-			t.Errorf("received %+v, want prompt_request/run_abc", env)
+		if env.Type != proto.TypePromptCancel || env.ID != "run_abc" {
+			t.Errorf("received %+v, want prompt_cancel/run_abc", env)
 		}
 	case <-time.After(2 * time.Second):
 		t.Fatal("never received the server-pushed frame")
diff --git a/apps/daemon/internal/wireconformance/wire_test.go b/apps/daemon/internal/wireconformance/wire_test.go
index 328737c23..9af45ecba 100644
--- a/apps/daemon/internal/wireconformance/wire_test.go
+++ b/apps/daemon/internal/wireconformance/wire_test.go
@@ -159,7 +159,7 @@ func connectRuntime(t *testing.T, peer *corePeer, setupErr error) *runtimeSide {
 	kinds := agent.NewRegistry()
 	kinds.RegisterKind(proto.SupportedAgentKind{Kind: prototest.HarnessKind, Available: true, Capabilities: prototest.Capabilities(proto.AgentKindCapabilities{EnvironmentNone: proto.CapabilitySupported})},
 		harnessconfig.Configuration{}, func(context.Context, proto.PromptRequestPayload, chan<- proto.Envelope) (agent.Session, error) {
-			return nil, errors.New("prepared execution must not use prompt_request")
+			return nil, errors.New("prepared execution must not use the direct Session factory")
 		})
 	kinds.RegisterExecutor(prototest.HarnessKind, func(context.Context, proto.PromptRequestPayload) (agent.Executor, error) {
 		return rt.executor, setupErr
diff --git a/apps/daemon/testdata/onboarding/main.go b/apps/daemon/testdata/onboarding/main.go
index 4ead4f620..3252f0bdb 100644
--- a/apps/daemon/testdata/onboarding/main.go
+++ b/apps/daemon/testdata/onboarding/main.go
@@ -37,7 +37,7 @@ type harness struct {
 }
 
 func (h *harness) prepare(_ context.Context, req proto.PromptRequestPayload) (agent.Executor, error) {
-	if req.RunID != "" || len(req.Input) != 0 || req.ConversationID != "" {
+	if req.RunID != "" || len(req.Input) != 0 {
 		return nil, errors.New("preparation submitted fixture input")
 	}
 	if !req.DisableExecutionEnvironment || !req.DisableSubagents || len(req.FunctionTools) > 0 || req.MCPHTTPServers != nil {
diff --git a/docs/runtime-protocol.md b/docs/runtime-protocol.md
index fdd0e943b..6b74785a0 100644
--- a/docs/runtime-protocol.md
+++ b/docs/runtime-protocol.md
@@ -53,7 +53,7 @@ A declaration describes what the Runtime can do. Core admits a public feature on
 
 `permissions` gates permission decisions inside the Runtime. Core has no admission rule for `usage` and `resume`.
 
-The prompt request (`prompt_request`, or the configuration of `execution_prepare`) carries the opt-ins Core sets for each Run:
+The `execution_prepare` configuration carries the opt-ins Core sets for each Run:
 
 | Field | Set by Core |
 | --- | --- |
@@ -98,7 +98,7 @@ The linked source files define the required fields, validators, limits and finit
 | --- | --- | --- |
 | `runtime_prepare` | `runtime_prepare_result` | [Initialization and capability transfer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/runtime_prepare.go) |
 | `execution_prepare`, `execution_start`, `execution_release` | `preparation_status` | [Execution admission](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/preparation.go) |
-| `prompt_request`, `prompt_cancel`, `device_shutdown` | `delta`, `thinking`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat` | [Requests](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go), [events and capabilities](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
+| `prompt_cancel`, `device_shutdown` | `delta`, `thinking`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat` | [Requests](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go), [events and capabilities](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
 | `permission_decision`, `prompt_for_user_choice_decision` | `permission_request`, `permission_cancel`, `prompt_for_user_choice`, `interaction_decision_ack` | [Requests](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go), [interactions](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
 | `prompt_steer` | `prompt_steer_ack` | [Active input receipts](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/steering.go) |
 | `function_result` | `function_call`, `interaction_decision_ack` | [Function calls](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/functions.go) |
@@ -127,8 +127,6 @@ Preparation and start run outside the receive loop and router lock. An admission
 
 Idle expiry of an Executor is a Runtime resource policy, separate from Core's active-Turn concurrency. On shutdown the Runtime closes active and idle Executors, keeps any target whose close failed and allows a later serialized retry. An ordinary disconnection closes the failed transport and keeps the exact router until shutdown succeeds; a wait timeout or failed cleanup never authorizes reconnection, and process shutdown keeps waiting rather than discarding owned native resources. Workspace operations keep their binding and settlement rules across Turn boundaries and Executor closure.
 
-`prompt_request` starts a Run directly, without an admission handle. It is not a fallback after a failed prepared start.
-
 ## Active input receipts
 
 Core delivers active input as `prompt_steer` with `durable_receipt: true`, one input at a time per Run, and waits for its receipt before sending the next:
@@ -139,7 +137,7 @@ Core delivers active input as `prompt_steer` with `durable_receipt: true`, one i
 | `written` acknowledgement | Core waits at most 30 seconds from delivery for `written`; otherwise the input outcome is unknown |
 | Receipt send | Each receipt send has its own 5-second, shutdown-aware budget |
 | Native acceptance | `accepted` arrives under the Turn lifetime, with no automatic redelivery |
-| Done | Before `done`, the Runtime waits at most 15 seconds (the write and send budgets) for an in-flight input |
+| Done | The Runtime sends `done` after native Turn settlement and after the receipt send of any in-flight input; the native write and receipt send budgets bound that input |
 
 Neither `written` nor a send failure advances Core's input cursor. Once cancellation is sent, its receipt owns the terminal outcome even if an input becomes unknown first; Core records `cancel_unconfirmed` when no cancellation confirmation arrives within 15 seconds. A cancellation receipt carries the stopped Turn's confirmed continuity snapshot when no `done` is emitted.
 
@@ -199,7 +197,7 @@ Core runs an idle directory read on the Worker's Session scheduling reservation
 
 ## MCP connection authority
 
-Every public `MCPHTTPServer` in a prompt request carries an explicit `connection_origin`; a missing or unknown value rejects rather than selecting a default, and Core freezes the public default before dispatch. The Runtime validates the origin with the common validator before selecting a factory and resolves public and installed MCP into transient effective bindings. The [Environment contract](../contracts/agents-api/environments.md#public-mcp-connection-origin) owns the supported combinations, native limits and failure ownership.
+Every public `MCPHTTPServer` in an `execution_prepare` configuration carries an explicit `connection_origin`; a missing or unknown value rejects rather than selecting a default, and Core freezes the public default before dispatch. The Runtime validates the origin with the common validator before selecting a factory and resolves public and installed MCP into transient effective bindings. The [Environment contract](../contracts/agents-api/environments.md#public-mcp-connection-origin) owns the supported combinations, native limits and failure ownership.
 
 ## Contract verification
 
diff --git a/docs/zh/runtime-protocol.md b/docs/zh/runtime-protocol.md
index 0a13af57b..e721f6133 100644
--- a/docs/zh/runtime-protocol.md
+++ b/docs/zh/runtime-protocol.md
@@ -1,7 +1,7 @@
 ---
 title: "Core–Runtime 协议"
 source: docs/runtime-protocol.md
-source_hash: fd5bcb71c9234310a449fad97a30a899027133ca8df862e8a3306f6bd3dacae8
+source_hash: 1d425cdf68ffd76fbf4ebb856fcf7af8a96eea93e28b1686292eeb0184376664
 ---
 
 此协议在 Runtime daemon 获取机器凭据后连接 Core 与 daemon，定义 daemon 连接上消息的含义和顺序。wire 类型、限制和验证器仅在 [`internal/agentdaemon/proto`](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/internal/agentdaemon/proto) 中定义一次；Core 的 [gateway](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/services/core/internal/runtimegateway) 与参考 Runtime 的 [dispatcher](https://github.com/MiniMax-AI/OpenAgentCore/tree/main/apps/daemon/internal/dispatch) 都使用它们，因此无需同步第二套 payload schema。签发凭据和打开连接的 HTTP 路由见[机器连接 API](../../contracts/agents-api/zh/machine-api.md)。
@@ -55,7 +55,7 @@ wire 上每个字段都是 JSON boolean，所有字段都必须出现，包括 `
 
 `permissions` 控制 Runtime 内部权限决定。Core 对 `usage` 和 `resume` 没有准入规则。
 
-prompt 请求（`prompt_request` 或 `execution_prepare` 的配置）携带 Core 为各 Run 设置的显式启用项：
+`execution_prepare` 的配置携带 Core 为各 Run 设置的显式启用项：
 
 | 字段 | Core 设置方式 |
 | --- | --- |
@@ -100,7 +100,7 @@ User-choice decision 携带 `question_answers`：每个已提供回答都有明
 | --- | --- | --- |
 | `runtime_prepare` | `runtime_prepare_result` | [初始化与能力传输](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/runtime_prepare.go) |
 | `execution_prepare`, `execution_start`, `execution_release` | `preparation_status` | [执行准入](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/preparation.go) |
-| `prompt_request`, `prompt_cancel`, `device_shutdown` | `delta`, `thinking`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat` | [请求](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go)、[事件与能力](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
+| `prompt_cancel`, `device_shutdown` | `delta`, `thinking`, `output_message`, `tool_call`, `usage`, `error`, `done`, `heartbeat` | [请求](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go)、[事件与能力](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
 | `permission_decision`, `prompt_for_user_choice_decision` | `permission_request`, `permission_cancel`, `prompt_for_user_choice`, `interaction_decision_ack` | [请求](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/outbound.go)、[交互](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/inbound.go) |
 | `prompt_steer` | `prompt_steer_ack` | [活动输入回执](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/steering.go) |
 | `function_result` | `function_call`, `interaction_decision_ack` | [Function 调用](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/internal/agentdaemon/proto/functions.go) |
@@ -129,8 +129,6 @@ preparation 和 start 在 receive loop 与 router lock 之外运行。admission
 
 Executor 空闲到期属于 Runtime 资源策略，与 Core 的活动 Turn 并发限制独立。关闭时 Runtime 关闭活动和空闲 Executor，保留关闭失败的目标，并允许稍后串行重试。普通断连会关闭失败的 transport 并保留原 router，直到 shutdown 成功；等待超时或清理失败不授权重连，进程 shutdown 继续等待，不丢弃自己拥有的原生资源。工作区操作在跨 Turn 和 Executor 关闭后仍保留绑定与结算规则。
 
-`prompt_request` 不经过 admission handle，直接启动 Run。它不是 prepared start 失败后的回退。
-
 ## 活动输入回执 {#active-input-receipts}
 
 Core 通过 `prompt_steer` 交付活动输入，设置 `durable_receipt: true`，每个 Run 一次交付一个输入，并等待回执后再发送下一个：
@@ -141,7 +139,7 @@ Core 通过 `prompt_steer` 交付活动输入，设置 `durable_receipt: true`
 | `written` 确认 | Core 从交付开始最多等待 30 秒取得 `written`；否则输入结果未知 |
 | 回执发送 | 每次发送回执都有独立的 5 秒预算，并感知 shutdown |
 | 原生接受 | `accepted` 在 Turn 生命周期内到达，不自动重新交付 |
-| Done | `done` 前，Runtime 最多等待 15 秒（写入与发送预算），等待正在处理的输入 |
+| Done | Runtime 在原生 Turn 结算完成、且正在处理的输入的回执发送结束后才发送 `done`；该输入受原生写入与回执发送预算限制 |
 
 `written` 和发送失败都不会推进 Core 的 input cursor。取消发出后，即使输入先变为未知，终结结果也由取消回执负责；15 秒内没有取消确认时，Core 记录 `cancel_unconfirmed`。未发出 `done` 时，取消回执携带已停止 Turn 的已确认 continuity snapshot。
 
@@ -201,7 +199,7 @@ Core 在 Worker 的 Session 调度预约上运行空闲目录读取，活动执
 
 ## MCP 连接权限 {#mcp-connection-authority}
 
-prompt request 中每个公开 `MCPHTTPServer` 都携带明确的 `connection_origin`；值缺失或未知时拒绝，不选择默认值，Core 在 dispatch 前冻结公开默认值。Runtime 在选择 factory 前用公共 validator 验证 origin，并将公开和已安装 MCP 解析为临时 effective binding。[Environment 契约](../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)负责支持的组合、原生限制和故障所有权。
+`execution_prepare` 配置中每个公开 `MCPHTTPServer` 都携带明确的 `connection_origin`；值缺失或未知时拒绝，不选择默认值，Core 在 dispatch 前冻结公开默认值。Runtime 在选择 factory 前用公共 validator 验证 origin，并将公开和已安装 MCP 解析为临时 effective binding。[Environment 契约](../../contracts/agents-api/zh/environments.md#public-mcp-connection-origin)负责支持的组合、原生限制和故障所有权。
 
 ## 契约验证 {#contract-verification}
 
diff --git a/internal/agentdaemon/proto/envelope.go b/internal/agentdaemon/proto/envelope.go
index da98ad3df..11772622a 100644
--- a/internal/agentdaemon/proto/envelope.go
+++ b/internal/agentdaemon/proto/envelope.go
@@ -12,7 +12,7 @@
 // a lookup table.
 //
 // Envelope.ID correlation:
-//   - prompt_request / prompt_cancel: ID = RunID.
+//   - prompt_cancel: ID = RunID.
 //   - delta / tool_call / usage / error / done: ID = originating RunID.
 //   - permission_request: ID = RunID; payload.request_id is the interaction ID.
 //   - permission_decision / permission_cancel: ID = interaction ID.
diff --git a/internal/agentdaemon/proto/outbound.go b/internal/agentdaemon/proto/outbound.go
index 799d09835..03e4acfbf 100644
--- a/internal/agentdaemon/proto/outbound.go
+++ b/internal/agentdaemon/proto/outbound.go
@@ -7,12 +7,6 @@ import (
 
 // Type constants for server → daemon frames.
 const (
-	// TypePromptRequest triggers one prompt cycle. Envelope.ID = RunID;
-	// the daemon stamps every resulting upstream frame with the same
-	// ID so the gateway can fan them back to the matching StreamPrompt
-	// subscriber.
-	TypePromptRequest = "prompt_request"
-
 	// TypePromptCancel aborts an in-flight prompt. Envelope.ID =
 	// RunID. Idempotent — cancelling an unknown / already-finished
 	// run is a no-op on the daemon side.
@@ -35,22 +29,16 @@ const (
 	TypeDeviceShutdown = "device_shutdown"
 )
 
-// PromptRequestPayload is the daemon-side view of a connector.PromptInput,
-// trimmed to fields a daemon agent actually needs. Kept separate from
-// PromptInput so future agent implementations can evolve the wire shape
-// without touching the connector surface.
+// PromptRequestPayload is the execution configuration that execution_prepare
+// carries. execution_start supplies the Run identity and input.
 type PromptRequestPayload struct {
 	MaxConcurrentSubagents *int `json:"max_concurrent_subagents,omitempty"`
 	// AgentKind selects which agent implementation the daemon
 	// dispatches to.
 	AgentKind string `json:"agent_kind"`
 
-	// ConversationID is the Core Session ID of a prompt_request Run. Preparation
-	// and Executor configurations leave it empty, and no adapter reads it.
-	ConversationID string `json:"conversation_id"`
-
-	// RunID is the ID of the Core Turn this prompt executes; mirrored
-	// back on every upstream frame via Envelope.ID.
+	// RunID and Input are empty in an execution_prepare configuration.
+	// Adapters set them from execution_start when they start a Turn.
 	RunID string `json:"run_id"`
 
 	// Input preserves ordered user messages and content.
@@ -73,10 +61,8 @@ type PromptRequestPayload struct {
 
 	// AgentStateKey is the stable daemon-side state directory key.
 	// WorkspaceReadOnly prepares temporary native state that cannot start a Run.
-	WorkspaceReadOnly bool   `json:"workspace_read_only,omitempty"`
-	AgentStateKey     string `json:"agent_state_key,omitempty"`
-	// ReleaseOnCompletion closes the native writer before acknowledging Done.
-	ReleaseOnCompletion          bool           `json:"release_on_completion,omitempty"`
+	WorkspaceReadOnly            bool           `json:"workspace_read_only,omitempty"`
+	AgentStateKey                string         `json:"agent_state_key,omitempty"`
 	RequireExistingNativeSession bool           `json:"require_existing_native_session,omitempty"`
 	ObserveMessages              bool           `json:"observe_messages,omitempty"`
 	ObserveSubagentIdentities    bool           `json:"observe_subagent_identities,omitempty"`
diff --git a/internal/agentdaemon/proto/workspace_read_preparation.go b/internal/agentdaemon/proto/workspace_read_preparation.go
index 5869ca3b2..754d85011 100644
--- a/internal/agentdaemon/proto/workspace_read_preparation.go
+++ b/internal/agentdaemon/proto/workspace_read_preparation.go
@@ -4,8 +4,7 @@ package proto
 // The native adapter supplies temporary state; this request cannot resume or start.
 func ValidWorkspaceReadPreparation(r PromptRequestPayload) bool {
 	return r.WorkspaceReadOnly && r.LocalEnvironment != nil && r.AgentStateKey != "" &&
-		r.ReleaseOnCompletion && r.RunID == "" && len(r.Input) == 0 &&
-		r.ConversationID == "" && r.AgentSessionID == "" &&
+		r.RunID == "" && len(r.Input) == 0 && r.AgentSessionID == "" &&
 		!r.RequireExistingNativeSession && !r.DisableExecutionEnvironment &&
 		len(r.AgentOptions) == 0 && r.ExecutionControls == nil && r.MCPHTTPServers == nil &&
 		len(r.FunctionTools) == 0 && !r.ToolSearch && !r.ObserveMessages &&
diff --git a/scripts/name-allowlist.json b/scripts/name-allowlist.json
index 0cb022c51..b2bd58c18 100644
--- a/scripts/name-allowlist.json
+++ b/scripts/name-allowlist.json
@@ -214,6 +214,16 @@
     "regex": "\"agents-api-(?:session)?\"",
     "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
   },
+  {
+    "path": "apps/daemon/internal/cli/claude_sdk_live_linux_test.go",
+    "regex": "\"agents-api-registered-acceptance\"",
+    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
+  },
+  {
+    "path": "services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go",
+    "regex": "\"agents-api-mcp-bearer-acceptance\"",
+    "reason": "Executor ownership validates the current Core and local-workspace AgentStateKey namespace; this change does not introduce an alternate identity or compatibility path."
+  },
   {
     "path": "apps/daemon/internal/localworkspace/capabilities.go",
     "regex": "\"agents-api-\"",
diff --git a/services/core/internal/execution/delivery.go b/services/core/internal/execution/delivery.go
index 3cd1e1833..70b9c331f 100644
--- a/services/core/internal/execution/delivery.go
+++ b/services/core/internal/execution/delivery.go
@@ -50,24 +50,24 @@ func abort(peer *runtimegateway.Session, runID string) {
 	_ = send(context.Background(), peer, proto.TypePromptCancel, runID, proto.PromptCancelPayload{})
 }
 
-func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, peer *runtimegateway.Session, request proto.PromptRequestPayload, first int64, prepared *preparedStart) (result Result, status string) {
+func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, peer *runtimegateway.Session, request proto.PromptRequestPayload, runID string, input proto.MessageInput, first int64, prepared *preparedStart) (result Result, status string) {
 	changed, unsubscribeChanges := d.notifications.subscribe(tenantID, sessionID)
 	defer unsubscribeChanges()
 	status = sessions.TurnFailed
 	result.AppliedThrough = first
-	subscription, err := peer.SubscribeDurable(request.RunID)
+	subscription, err := peer.SubscribeDurable(runID)
 	if err != nil {
 		result.ErrorCode = "device_disconnected"
 		return
 	}
 	upstream := subscription.Events
-	defer peer.Unsubscribe(request.RunID)
+	defer peer.Unsubscribe(runID)
 	defer func() {
 		if status == sessions.TurnFailed {
-			abort(peer, request.RunID)
+			abort(peer, runID)
 		}
 	}()
-	journal := &journal{writer: d.sessionExecution, tenant: tenantID, session: sessionID, turn: request.RunID, next: 1,
+	journal := &journal{writer: d.sessionExecution, tenant: tenantID, session: sessionID, turn: runID, next: 1,
 		observeSubagents: request.ObserveSubagentIdentities}
 	defer func() {
 		finishCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
@@ -82,17 +82,11 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 			result.ErrorCode, status = "event_stream_incomplete", sessions.TurnFailed
 		}
 	}()
-	var preparationEvents <-chan proto.Envelope
+	preparationEvents := prepared.sub.Events
 	var executorRetried, nativeObserved bool
 	inputStarted := time.Now()
 	firstTextObserved := false
-	if prepared != nil {
-		preparationEvents = prepared.sub.Events
-		err = prepared.start(ctx, request)
-	} else {
-		err = send(ctx, peer, proto.TypePromptRequest, request.RunID, request)
-	}
-	if err != nil {
+	if err = prepared.start(ctx, runID, input); err != nil {
 		result.ErrorCode = "delivery_unknown"
 		return
 	}
@@ -105,7 +99,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 	var pending *pendingInput
 	var cancelSent time.Time
 	var cancelReply <-chan cancellationResult
-	functions := &functionExchange{kind: request.AgentKind, turns: d.SessionsReader, sessions: d.sessionExecution, tenant: tenantID, session: sessionID, turn: request.RunID, tools: request.FunctionTools}
+	functions := &functionExchange{kind: request.AgentKind, turns: d.SessionsReader, sessions: d.sessionExecution, tenant: tenantID, session: sessionID, turn: runID, tools: request.FunctionTools}
 	done := false
 	cancelCtx, stopCancellation := context.WithCancel(ctx)
 	defer stopCancellation()
@@ -124,7 +118,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				result.ErrorCode = "preparation_interrupted"
 				return
 			}
-			started, err := prepared.started(env, request.RunID)
+			started, err := prepared.started(env, runID)
 			if err != nil {
 				var rejection *preparationRejection
 				if errors.As(err, &rejection) && rejection.operation == proto.TypeExecutionStart && rejection.code == "executor_unavailable" && !executorRetried && !nativeObserved && cancelReply == nil {
@@ -137,7 +131,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 						result.ErrorCode = "device_disconnected"
 						return
 					}
-					replacement, prepareErr := d.prepareTurnExecutor(ctx, peer, tenantID, sessionID, request.RunID, request, sessions.TurnInProgress)
+					replacement, prepareErr := d.prepareTurnExecutor(ctx, peer, tenantID, sessionID, runID, request, sessions.TurnInProgress)
 					if prepareErr != nil {
 						result.ErrorCode = "executor_recovery_failed"
 						return
@@ -145,7 +139,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 					prepared = replacement
 					defer prepared.close()
 					preparationEvents = prepared.sub.Events
-					if prepared.start(ctx, request) != nil {
+					if prepared.start(ctx, runID, input) != nil {
 						result.ErrorCode = "delivery_unknown"
 						return
 					}
@@ -201,7 +195,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 			nativeObserved = true
 			if !firstTextObserved && hasText(env) {
 				firstTextObserved = true
-				recordFirstText(ctx, sessionID, request.RunID, inputStarted)
+				recordFirstText(ctx, sessionID, runID, inputStarted)
 			}
 			writeErr := journal.observe(ctx, env)
 			if result.mergeObservation(env) != nil {
@@ -278,7 +272,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				}
 				continue
 			}
-			turn, err := d.SessionsReader.GetTurn(ctx, tenantID, sessionID, request.RunID)
+			turn, err := d.SessionsReader.GetTurn(ctx, tenantID, sessionID, runID)
 			if err != nil {
 				result.ErrorCode = "execution_state_unavailable"
 				if ctx.Err() != nil {
@@ -291,7 +285,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				return
 			}
 			if !turn.CancelRequestedAt.IsZero() {
-				cancelReply = requestCancellation(cancelCtx, peer, request.RunID)
+				cancelReply = requestCancellation(cancelCtx, peer, runID)
 				cancelSent = time.Now()
 				continue
 			}
@@ -303,7 +297,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 				continue
 			}
 			if pending == nil {
-				inputs, err := d.SessionsReader.ListTurnInputs(ctx, tenantID, sessionID, request.RunID, result.AppliedThrough, 1)
+				inputs, err := d.SessionsReader.ListTurnInputs(ctx, tenantID, sessionID, runID, result.AppliedThrough, 1)
 				if err != nil {
 					result.ErrorCode = "execution_state_unavailable"
 					if ctx.Err() != nil {
@@ -338,7 +332,7 @@ func (d *Dispatcher) deliver(ctx context.Context, tenantID, sessionID string, pe
 					result.ErrorCode = "message_input_unsupported"
 					return
 				}
-				if send(ctx, peer, proto.TypePromptSteer, request.RunID, proto.PromptSteerPayload{InputID: strconv.FormatInt(pending.sequence, 10), Input: pending.input, DurableReceipt: true}) != nil {
+				if send(ctx, peer, proto.TypePromptSteer, runID, proto.PromptSteerPayload{InputID: strconv.FormatInt(pending.sequence, 10), Input: pending.input, DurableReceipt: true}) != nil {
 					result.ErrorCode = "input_outcome_unknown"
 					return
 				}
diff --git a/services/core/internal/execution/directory_preparation.go b/services/core/internal/execution/directory_preparation.go
index 177f98571..e159eace3 100644
--- a/services/core/internal/execution/directory_preparation.go
+++ b/services/core/internal/execution/directory_preparation.go
@@ -25,7 +25,7 @@ func (d *Dispatcher) readPreparedDirectory(ctx context.Context, peer *runtimegat
 }
 
 func (d *Dispatcher) withPreparedWorkspace(owner context.Context, peer *runtimegateway.Session, session sessions.Session, environment sessions.Environment, bound sessions.ExecutionDevice, consume func(context.Context, string) error) error {
-	req := proto.PromptRequestPayload{AgentKind: session.Engine, AgentStateKey: "agents-api-" + session.ID, ReleaseOnCompletion: true, WorkspaceReadOnly: true}
+	req := proto.PromptRequestPayload{AgentKind: session.Engine, AgentStateKey: "agents-api-" + session.ID, WorkspaceReadOnly: true}
 	if err := d.configurePreparedEnvironment(session, environment, bound, &req); err != nil {
 		return ErrExecutionUnavailable
 	}
diff --git a/services/core/internal/execution/dispatcher.go b/services/core/internal/execution/dispatcher.go
index 7a1545402..909fb9702 100644
--- a/services/core/internal/execution/dispatcher.go
+++ b/services/core/internal/execution/dispatcher.go
@@ -116,13 +116,12 @@ func (d *Dispatcher) Run(ctx context.Context, tenantID, sessionID, turnID string
 	if _, err := d.sessionExecution.TransitionTurn(ctx, tenantID, sessionID, turnID, sessions.TurnTransition{ExpectedStatus: sessions.TurnQueued, Status: sessions.TurnInProgress}); err != nil {
 		return sessions.Turn{}, err
 	}
-	req.ConversationID, req.RunID, req.Input = sessionID, turnID, text
-	release, err := peer.TrackExecutionDelivery(req.RunID)
+	release, err := peer.TrackExecutionDelivery(turnID)
 	if err != nil {
 		return d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
 	}
 	defer release()
-	result, status := d.deliver(ctx, tenantID, sessionID, peer, req, through, prepared)
+	result, status := d.deliver(ctx, tenantID, sessionID, peer, req, turnID, text, through, prepared)
 	return d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, result, status)
 }
 
diff --git a/services/core/internal/execution/executor_preparation.go b/services/core/internal/execution/executor_preparation.go
index 11fafdf9d..1e3854e32 100644
--- a/services/core/internal/execution/executor_preparation.go
+++ b/services/core/internal/execution/executor_preparation.go
@@ -18,7 +18,6 @@ func (d *Dispatcher) prepareTurnExecutor(ctx context.Context, peer *runtimegatew
 	if err != nil {
 		return nil, err
 	}
-	request.RunID, request.ConversationID, request.Input = "", "", nil
 	if err = send(ctx, peer, proto.TypeExecutionPrepare, prepared.requestID, proto.ExecutionPreparePayload{SessionID: session, Configuration: request}); err == nil {
 		err = d.awaitTurnExecutor(ctx, tenant, session, turn, expectedStatus, prepared)
 	}
diff --git a/services/core/internal/execution/preparation.go b/services/core/internal/execution/preparation.go
index ca815d02e..089a04eff 100644
--- a/services/core/internal/execution/preparation.go
+++ b/services/core/internal/execution/preparation.go
@@ -128,9 +128,9 @@ func (d *Dispatcher) awaitPreparation(ctx context.Context, tenant, session strin
 	}
 }
 
-func (p *preparedStart) start(ctx context.Context, request proto.PromptRequestPayload) error {
+func (p *preparedStart) start(ctx context.Context, runID string, input proto.MessageInput) error {
 	p.startSentAt = time.Now()
-	return send(ctx, p.peer, proto.TypeExecutionStart, p.requestID, proto.ExecutionStartPayload{Handle: p.handle, ExecutorID: p.executorID, RunID: request.RunID, Input: request.Input})
+	return send(ctx, p.peer, proto.TypeExecutionStart, p.requestID, proto.ExecutionStartPayload{Handle: p.handle, ExecutorID: p.executorID, RunID: runID, Input: input})
 }
 
 func (p *preparedStart) started(env proto.Envelope, runID string) (bool, error) {
diff --git a/services/core/internal/execution/prepared_dispatch.go b/services/core/internal/execution/prepared_dispatch.go
index 6cb5817f6..751578383 100644
--- a/services/core/internal/execution/prepared_dispatch.go
+++ b/services/core/internal/execution/prepared_dispatch.go
@@ -111,17 +111,16 @@ func (d *Dispatcher) RunEnvironmentInput(ctx context.Context, lease Ownership, t
 	if run.Reservation.Receipts[0].Replayed {
 		return run, nil
 	}
-	req.RunID = run.Reservation.Receipts[0].TurnID
-	req.Input = messages
+	turnID := run.Reservation.Receipts[0].TurnID
 	through := run.Reservation.Receipts[len(run.Reservation.Receipts)-1].Sequence
-	releaseDelivery, err := peer.TrackExecutionDelivery(req.RunID)
+	releaseDelivery, err := peer.TrackExecutionDelivery(turnID)
 	if err != nil {
-		run.Turn, err = d.finishRun(tenantID, sessionID, req.RunID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
+		run.Turn, err = d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, Result{ErrorCode: "delivery_unknown", AppliedThrough: through}, sessions.TurnFailed)
 		return run, err
 	}
 	defer releaseDelivery()
-	result, status := d.deliver(owner, tenantID, sessionID, peer, req, through, prepared)
-	result, status = d.captureCompletedArtifacts(owner, peer, session, environment, bound.Device, req.RunID, result, status)
-	run.Turn, err = d.finishRun(tenantID, sessionID, req.RunID, snapshot.Agent.Model, result, status)
+	result, status := d.deliver(owner, tenantID, sessionID, peer, req, turnID, messages, through, prepared)
+	result, status = d.captureCompletedArtifacts(owner, peer, session, environment, bound.Device, turnID, result, status)
+	run.Turn, err = d.finishRun(tenantID, sessionID, turnID, snapshot.Agent.Model, result, status)
 	return run, err
 }
diff --git a/services/core/internal/runtimegateway/cancellation_test.go b/services/core/internal/runtimegateway/cancellation_test.go
index aeae810b7..cead32b38 100644
--- a/services/core/internal/runtimegateway/cancellation_test.go
+++ b/services/core/internal/runtimegateway/cancellation_test.go
@@ -58,7 +58,7 @@ func TestArchivedReceiptTracksDeliveryBeyondDoneAndRejectsNewWork(t *testing.T)
 	if _, err := peer.TrackExecutionDelivery("new-run"); err == nil {
 		t.Fatal("new delivery admitted while draining")
 	}
-	for _, kind := range []string{proto.TypePromptRequest, proto.TypePromptSteer, proto.TypeExecutionPrepare, proto.TypeRuntimePrepare, proto.TypeWorkspaceWrite, proto.TypeWorkspaceRead} {
+	for _, kind := range []string{proto.TypeExecutionStart, proto.TypePromptSteer, proto.TypeExecutionPrepare, proto.TypeRuntimePrepare, proto.TypeWorkspaceWrite, proto.TypeWorkspaceRead} {
 		env, _ := proto.NewEnvelope(kind, "run", nil)
 		if err := peer.Send(t.Context(), env); err == nil {
 			t.Fatal("drain permitted new operation", kind)
diff --git a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
index 8183f6cab..a4b7d2ea1 100644
--- a/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
+++ b/services/core/internal/runtimegateway/mcp_bearer_live_linux_test.go
@@ -86,18 +86,41 @@ func TestLiveMCPBearerGatewayColdContinuation(t *testing.T) {
 		t.Helper()
 		turn := &mcpBearerTurn{}
 		turns = append(turns, turn)
-		runID := uuid.NewString()
-		request := proto.PromptRequestPayload{AgentKind: "codex", ConversationID: "mcp-bearer-acceptance", RunID: runID, Input: proto.TextInput(prompt), AgentStateKey: "mcp-bearer-acceptance", AgentSessionID: resume, ReleaseOnCompletion: true, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, AgentOptions: map[string]any{"model": "MiniMax-M3"}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
+		runID, prepareID := uuid.NewString(), uuid.NewString()
+		request := proto.PromptRequestPayload{AgentKind: "codex", AgentStateKey: "agents-api-mcp-bearer-acceptance", AgentSessionID: resume, ObserveMessages: true, DisableExecutionEnvironment: true, DisableSubagents: true, MCPHTTPServers: &servers, AgentOptions: map[string]any{"model": "MiniMax-M3"}, ExecutionControls: &proto.ExecutionControls{WebSearch: "disabled", TextVerbosity: "medium"}}
+		send := func(kind, id string, payload any) {
+			t.Helper()
+			envelope, err := proto.NewEnvelope(kind, id, payload)
+			if err != nil || peer.Send(ctx, envelope) != nil {
+				t.Fatal("cannot dispatch the private MCP request")
+			}
+		}
+		statuses, err := peer.SubscribePreparation(prepareID)
+		if err != nil {
+			t.Fatal("cannot subscribe to preparation before real daemon dispatch")
+		}
+		defer peer.UnsubscribePreparation(prepareID)
+		send(proto.TypeExecutionPrepare, prepareID, proto.ExecutionPreparePayload{SessionID: "mcp-bearer-acceptance", Configuration: request})
+		var ready proto.PreparationStatusPayload
+		for ready.State != "ready" {
+			select {
+			case event, ok := <-statuses.Events:
+				if !ok || event.DecodePayload(&ready) != nil || ready.State != "preparing" && ready.State != "ready" {
+					t.Fatal("real daemon did not prepare the private MCP Executor")
+				}
+			case <-ctx.Done():
+				t.Fatal("real daemon preparation timed out")
+			}
+		}
 		sub, err := peer.SubscribeDurable(runID)
 		if err != nil {
 			t.Fatal("cannot subscribe before real daemon dispatch")
 		}
 		defer peer.Unsubscribe(runID)
-		envelope, err := proto.NewEnvelope(proto.TypePromptRequest, runID, request)
-		if err != nil || peer.Send(ctx, envelope) != nil {
-			t.Fatal("cannot dispatch the private MCP request")
-		}
+		send(proto.TypeExecutionStart, prepareID, proto.ExecutionStartPayload{Handle: ready.Handle, ExecutorID: ready.ExecutorID, RunID: runID, Input: proto.TextInput(prompt)})
 		mcpBearerCollectTurn(t, ctx, sub, runID, turn, expected, token, provider)
+		// The Executor stays warm after Done; closing it makes the next Turn a cold continuation.
+		send(proto.TypeDeviceShutdown, "", proto.DeviceShutdownPayload{Reason: "cold continuation"})
 		turn.NativeLaunches = mcpBearerReleased(t, root)
 		turn.BearerEnvironmentReference = mcpBearerConfigReference(t, root, token)
 		return turn
diff --git a/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go b/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go
index d8d85d26e..e2d70ae89 100644
--- a/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go
+++ b/services/core/internal/runtimegateway/mcp_bearer_process_linux_test.go
@@ -197,7 +197,7 @@ func mcpBearerReleased(t *testing.T, root string) int {
 			return launches
 		}
 		if time.Now().After(deadline) {
-			t.Fatal("Done did not release the owned native process")
+			t.Fatal("the owned native process was not released")
 		}
 		time.Sleep(25 * time.Millisecond)
 	}
diff --git a/services/core/internal/runtimegateway/session.go b/services/core/internal/runtimegateway/session.go
index 7d166ce87..7ae93c4d0 100644
--- a/services/core/internal/runtimegateway/session.go
+++ b/services/core/internal/runtimegateway/session.go
@@ -99,7 +99,7 @@ type Session struct {
 
 	// supportedKinds is the latest daemon-advertised agent_kind snapshot,
 	// updated from heartbeat frames and read by the connector before
-	// dispatching prompt_request so unsupported engines fail on the server.
+	// sending execution_prepare so unsupported engines fail on the server.
 	kindsMu        sync.RWMutex
 	kindsSeen      bool
 	supportedKinds []runtimedevice.SupportedAgentKind
diff --git a/services/core/internal/runtimegateway/session_test.go b/services/core/internal/runtimegateway/session_test.go
index a30e8a66d..9990ef097 100644
--- a/services/core/internal/runtimegateway/session_test.go
+++ b/services/core/internal/runtimegateway/session_test.go
@@ -342,10 +342,11 @@ func TestSession_SendWritesToWire(t *testing.T) {
 	sess.Start()
 	defer sess.Close("test done")
 
-	env, _ := proto.NewEnvelope(proto.TypePromptRequest, "run-1", proto.PromptRequestPayload{
-		AgentKind: "fake_alpha",
-		RunID:     "run-1",
-		Input:     proto.TextInput("hello"),
+	env, _ := proto.NewEnvelope(proto.TypeExecutionStart, "prepare-1", proto.ExecutionStartPayload{
+		Handle:     "handle-1",
+		ExecutorID: "executor-1",
+		RunID:      "run-1",
+		Input:      proto.TextInput("hello"),
 	})
 	if err := sess.Send(context.Background(), env); err != nil {
 		t.Fatalf("Send: %v", err)
diff --git a/services/core/tests/integration/deployment_model_providers_http_test.go b/services/core/tests/integration/deployment_model_providers_http_test.go
index 7e25421a1..b796d6ebf 100644
--- a/services/core/tests/integration/deployment_model_providers_http_test.go
+++ b/services/core/tests/integration/deployment_model_providers_http_test.go
@@ -279,7 +279,7 @@ func TestLegacySessionWithoutProviderCannotStartWork(t *testing.T) {
 		if executor.conn.ReadJSON(&frame) != nil {
 			break
 		}
-		if frame.Type == proto.TypeExecutionPrepare || frame.Type == proto.TypePromptRequest {
+		if frame.Type == proto.TypeExecutionPrepare {
 			t.Fatal("provider-free work reached the executor", frame.Type)
 		}
 	}
diff --git a/services/core/tests/integration/dispatch_test.go b/services/core/tests/integration/dispatch_test.go
index 40de3c693..36141beec 100644
--- a/services/core/tests/integration/dispatch_test.go
+++ b/services/core/tests/integration/dispatch_test.go
@@ -229,7 +229,7 @@ func TestExecutionDispatchSteeringAndNativeContinuity(t *testing.T) {
 	request := h.read(testExecutionRequest)
 	var prompt proto.PromptRequestPayload
 	_ = request.DecodePayload(&prompt)
-	if inputTextForTest(t, prompt.Input) != "Initial input" || prompt.ConversationID != h.session.ID || prompt.AgentOptions["model"] != "test-model" || prompt.AgentOptions["system_prompt"] != "Keep this instruction." {
+	if inputTextForTest(t, prompt.Input) != "Initial input" || prompt.AgentStateKey != "agents-api-"+h.session.ID || prompt.AgentOptions["model"] != "test-model" || prompt.AgentOptions["system_prompt"] != "Keep this instruction." {
 		t.Fatalf("wrong resolved request: %+v", prompt)
 	}
 	if _, err := h.bound().Run(ctx, uuid.NewString(), h.session.ID, first.TurnID); !errors.Is(err, sessions.ErrNotFound) {
diff --git a/services/core/tests/integration/executor_fixture_test.go b/services/core/tests/integration/executor_fixture_test.go
index 36008c6e6..7cf9a56a2 100644
--- a/services/core/tests/integration/executor_fixture_test.go
+++ b/services/core/tests/integration/executor_fixture_test.go
@@ -47,7 +47,7 @@ func (h *dispatchHarness) executionFrame(env proto.Envelope) (proto.Envelope, bo
 		}
 		h.write(env.ID, proto.TypePreparationStatus, proto.PreparationStatusPayload{Handle: admission.handle, ExecutorID: admission.executor, Revision: 2, State: "started", RunID: start.RunID})
 		request := admission.prepare.Configuration
-		request.RunID, request.ConversationID, request.Input = start.RunID, admission.prepare.SessionID, start.Input
+		request.RunID, request.Input = start.RunID, start.Input
 		projected, err := proto.NewEnvelope(testExecutionRequest, start.RunID, request)
 		if err != nil {
 			h.t.Fatal(err)
diff --git a/services/core/tests/integration/harness_onboarding_test.go b/services/core/tests/integration/harness_onboarding_test.go
index f60c5342a..e98e2934a 100644
--- a/services/core/tests/integration/harness_onboarding_test.go
+++ b/services/core/tests/integration/harness_onboarding_test.go
@@ -262,7 +262,7 @@ func startOnboardingPeer(t *testing.T, h *dispatchHarness) (<-chan proto.PromptR
 					return
 				}
 				request := p.Configuration
-				request.RunID, request.ConversationID, request.Input = start.RunID, p.SessionID, start.Input
+				request.RunID, request.Input = start.RunID, start.Input
 				started <- request
 			}
 			if e.Type == proto.TypeExecutionRelease {
diff --git a/services/core/tests/integration/prepared_dispatch_test.go b/services/core/tests/integration/prepared_dispatch_test.go
index 8a01bb556..bbb1f066f 100644
--- a/services/core/tests/integration/prepared_dispatch_test.go
+++ b/services/core/tests/integration/prepared_dispatch_test.go
@@ -77,7 +77,7 @@ func TestPreparedDispatchPromotesOriginalBatchAndPersistsCompletion(t *testing.T
 	result := runPreparedDispatch(h, t.Context(), pending)
 	frame := h.read(proto.TypeExecutionPrepare)
 	var prepare proto.ExecutionPreparePayload
-	if frame.DecodePayload(&prepare) != nil || len(prepare.Configuration.Input) != 0 || prepare.Configuration.RunID != "" || prepare.Configuration.ConversationID != "" || prepare.Configuration.LocalEnvironment == nil || prepare.Configuration.LocalEnvironment.ID != h.device.EnvironmentID || prepare.Configuration.DisableExecutionEnvironment {
+	if frame.DecodePayload(&prepare) != nil || len(prepare.Configuration.Input) != 0 || prepare.Configuration.RunID != "" || prepare.Configuration.LocalEnvironment == nil || prepare.Configuration.LocalEnvironment.ID != h.device.EnvironmentID || prepare.Configuration.DisableExecutionEnvironment {
 		t.Fatal("invalid preparation configuration", prepare)
 	}
 	session, err := sessionAdapter(h.s).GetSession(t.Context(), h.tenant, h.session.ID)

From 6fc76ad2094de3029eeea0eca9a5373b73613cb6 Mon Sep 17 00:00:00 2001
From: SaladDay <1203511142@qq.com>
Date: Wed, 7 Oct 2026 19:51:51 +0800
Subject: [PATCH 9/9] Close executors that Shutdown invalidates while their Run
 retires (#482)

Shutdown marks every executor invalid but closes only owners without a
Run, leaving a running owner's close to its prepared release. The release
reads r.closed and owner.invalid once, before joining operations and
retiring the Run. When Shutdown took the lock after that reuse decision
and before the Run let go of the owner, nobody closed the executor: it
stayed in r.executors with no close in flight, and Shutdown reported
"cleanup unconfirmed" for a healthy native executor. Device shutdown
has the same window and left the owner permanently invalid.

When the release retires an owner that was invalidated without a close,
start the close under shutdownWG so Shutdown waits for it. Report an
executor that remains without a close error as "cleanup has not
settled" instead of wrapping a nil error.
---
 apps/daemon/internal/dispatch/prepared_handoff.go | 5 +++++
 apps/daemon/internal/dispatch/shutdown.go         | 6 +++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/apps/daemon/internal/dispatch/prepared_handoff.go b/apps/daemon/internal/dispatch/prepared_handoff.go
index 23377efe7..31e55a248 100644
--- a/apps/daemon/internal/dispatch/prepared_handoff.go
+++ b/apps/daemon/internal/dispatch/prepared_handoff.go
@@ -262,6 +262,11 @@ func (r *Router) runPreparedRelease(state *sessionState, handoff *preparedHandof
 	}
 	if !owner.invalid {
 		r.scheduleExecutorIdleLocked(owner)
+	} else if owner.closeDone == nil {
+		// Shutdown invalidated this owner after the reuse decision above and
+		// left its close to this Run, which held it.
+		r.shutdownWG.Add(1)
+		go func() { defer r.shutdownWG.Done(); _ = r.closeExecutor(owner) }()
 	}
 	r.mu.Unlock()
 
diff --git a/apps/daemon/internal/dispatch/shutdown.go b/apps/daemon/internal/dispatch/shutdown.go
index cc7229aff..5c350dccb 100644
--- a/apps/daemon/internal/dispatch/shutdown.go
+++ b/apps/daemon/internal/dispatch/shutdown.go
@@ -90,7 +90,11 @@ func (r *Router) runShutdownAttempt(attempt *shutdownAttempt, victims []sessionC
 		}
 	}
 	for _, owner := range r.executors {
-		attempt.err = errors.Join(attempt.err, fmt.Errorf("dispatch: executor %s cleanup unconfirmed: %w", owner.id, owner.closeErr))
+		cause := owner.closeErr
+		if cause == nil {
+			cause = errors.New("cleanup has not settled")
+		}
+		attempt.err = errors.Join(attempt.err, fmt.Errorf("dispatch: executor %s: %w", owner.id, cause))
 	}
 	close(attempt.done)
 	r.mu.Unlock()