feat(native-owner): add experimental Windows Codex launcher

.agents/skills/harness-adapters/SKILL.md

@@ -39,8 +39,9 @@ Muse, Gemini, and AGY are verified only for crewmate and scout work, never a sec
 
 ## Detection
 
-`../../../bin/fm-harness.sh` prints firstmate's own harness from verified environment markers and process ancestry, and owns how they combine.
-A marker names its harness, but a structural ancestor of a different harness outranks it, because a marker is ordinary environment state a child or a multiplexer can retain while ancestry is what proves who owns the process tree.
+`../../../bin/fm-harness.sh` prints firstmate's own harness and owns how native-owner verification, verified environment markers, and process ancestry combine.
+For the [experimental native Windows Codex launcher](../../../docs/native-windows-codex.md), durable home records select native-owner verification before marker and ancestry detection; an unverified or unsupported native-owner result remains `unknown`, without falling back to those other signals.
+Outside that native path, a marker names its harness, but a structural ancestor of a different harness outranks it, because a marker is ordinary environment state a child or a multiplexer can retain while ancestry is what proves who owns the process tree.
 Only `FM_PI_HARNESS=pi-signed` at the launch boundary together with `PI_CODING_AGENT=true` selects Pi-signed; shared unmarked launcher ancestry remains Pi.
 omp publishes no marker of its own; `FM_OMP_HARNESS=omp` is Firstmate's launch marker and the anchored process name `omp` is its ancestry evidence, as `references/harness/omp.md` records.
 `../../../bin/fm-spawn.sh` owns worker marker establishment, while the README launch command owns the signed-primary boundary.

.gitattributes

@@ -1,2 +1,5 @@
 # Bash parses shell scripts with LF line endings on every supported platform.
 *.sh text eol=lf
+# Extensionless Bash helpers must survive Windows clones.
+tests/fixtures/native-owner/jq text eol=lf
+bin/native-owner/tools/jq text eol=lf

.gitignore

@@ -13,3 +13,6 @@ __pycache__/
 config/
 
 .tools/
+# Local native candidate build; never distributed as a tracked executable.
+/bin/fm-native-owner.exe
+/bin/fm-native-owner.build

CONTRIBUTING.md

@@ -63,8 +63,11 @@ Coordinate any workflow rollback with its required-check names so a retired chec
   A local `config/backend` file explicitly overrides runtime auto-detection for new task endpoints and stays gitignored; spawn-supported values are `tmux`, `herdr` (which has its own required CI lane), and `zellij`, `orca`, and `cmux`, which remain experimental with no dedicated real-backend CI lane, while `codex-app` is documented only in `docs/codex-app-backend.md`.
   It does not make `data/` tracked.
 - Helper scripts in `bin/` are plain bash.
-  Each starts with a usage header comment; keep it accurate when you change behavior.
-  Test scripts and helpers in `tests/` are plain bash too.
+  The restricted experimental native Windows Codex launcher is the sole scoped exception: `bin/fm-native-codex.ps1` and the C# and JavaScript implementation under `bin/native-owner/` may use PowerShell, C#, and JavaScript.
+  Matching fixtures under `tests/fixtures/native-owner/` may use those languages too.
+  This exception does not extend to other helpers, other platforms, or future implementations.
+  Each Bash helper starts with a usage header comment; keep it accurate when you change behavior.
+  Test scripts and helpers in `tests/` are plain bash too, except for the matching native Windows fixtures above.
   `bin/fm-lint.sh` must pass: it is the single owner of the lint definition (the shellcheck file set, config, pinned shellcheck version, pinned actionlint workflow lint, and the backend-purity check rejecting direct Beads CLI calls in core `bin/` scripts).
   CI uses its full canonical partitions; the no-mistakes pre-push gate uses its context-selected default.
   `docs/fm-test-portable-shards.md` owns partition verification and performance evidence.

bin/backends/herdr.sh

@@ -3083,7 +3083,7 @@ fm_backend_herdr_composer_state() {  # <target> -> empty|pending|pending-unprove
   verdict=$(fm_composer_classify_screen "$caps" "$cap")
   if [ "$verdict" = need-identity ]; then
     if ! identity=$(fm_backend_herdr_composer_identity "$target" 2>/dev/null) || [ -z "$identity" ]; then
-      identity=probe-absent
+      identity='probe-absent'
     fi
     verdict=$(fm_composer_classify_screen "$caps" "$cap" '' "$identity")
     [ "$verdict" != need-identity ] || verdict=unknown

bin/fm-backlog-transition-lib.sh

@@ -55,6 +55,18 @@
 # closes a row that reads as an open captain call. An answer that closes the row
 # first applies any supported retained artifact from the validated record, then
 # replay simply retires the record.
+#
+# EMPTY-FLEET ADMISSION. fm_backlog_markdown_empty <backlog-file> accepts a
+# readable, non-symlink markdown file only when its nonblank LF or CRLF lines are
+# either `# Backlog` alone or the optional `# Backlog` title followed by the
+# `## In flight`, `## Queued`, and `## Done` empty section skeleton.
+# fm_backlog_empty_fleet_preflight <state-dir> <data-dir> additionally rejects
+# task, close-recovery, inbox, and handoff work records, requires the configured
+# backlog owner to resolve to markdown, and applies that semantic empty-file
+# check when the backlog exists. Both functions write nothing, return 0 only for
+# recognized empty state, and otherwise return non-zero with the refusal in
+# FM_BACKLOG_EMPTY_ERROR. Callers must source fm-tasks-axi-lib.sh first so backend
+# selection and configuration errors retain their owning contract.
 
 # Set by fm_backlog_transition_applies for a return-1 exemption.
 # shellcheck disable=SC2034 # Output global, read by the sourcing caller.
@@ -72,6 +84,9 @@ FM_BACKLOG_ROW_HOLD_KIND=
 # retained_incomplete | answered | stale | noop.
 # shellcheck disable=SC2034 # Output global, read by the sourcing caller.
 FM_BACKLOG_CLOSE_REPLAY_RESULT=
+# Set by the empty-markdown and empty-fleet admission helpers when they refuse.
+# shellcheck disable=SC2034 # Output global, read by the sourcing caller.
+FM_BACKLOG_EMPTY_ERROR=
 
 # Bounded execution is fm-timeout-lib.sh's alone; source it rather than
 # re-deriving a deadline here. It is stateless, so the memoisation reason this
@@ -149,6 +164,95 @@ fm_backlog_file() {  # <data-dir>
   fi
 }
 
+fm_backlog_markdown_empty() {  # <backlog-file>
+  local file=$1
+  FM_BACKLOG_EMPTY_ERROR=
+  if [ ! -r "$file" ] || [ ! -f "$file" ] || [ -L "$file" ]; then
+    FM_BACKLOG_EMPTY_ERROR="backlog is not a readable regular file at $file"
+    return 1
+  fi
+  if ! LC_ALL=C awk '
+    {
+      sub(/\r$/, "")
+      if (length($0) != 0) lines[++count]=$0
+    }
+    END {
+      start=1
+      if (lines[1] == "# Backlog") start=2
+      if (count == 1 && start == 2) exit 0
+      if (count - start + 1 != 3) exit 1
+      if (lines[start] != "## In flight") exit 1
+      if (lines[start + 1] != "## Queued") exit 1
+      if (lines[start + 2] != "## Done") exit 1
+    }
+  ' "$file"; then
+    FM_BACKLOG_EMPTY_ERROR="backlog contains work or an unrecognized empty skeleton at $file"
+    return 1
+  fi
+}
+
+fm_backlog_empty_fleet_preflight() {  # <state-dir> <data-dir>
+  local state=$1 data=$2 record root backend file
+  FM_BACKLOG_EMPTY_ERROR=
+  if [ -e "$state" ] || [ -L "$state" ]; then
+    if ! fm_backlog_directory_present "$state" "state directory"; then
+      FM_BACKLOG_EMPTY_ERROR=$FM_BACKLOG_TRANSITION_ERROR
+      return 1
+    fi
+    for record in "$state"/*.meta "$state"/*.status "$state"/*.backlog-close \
+      "$state"/*.inbox "$state"/.backlog-handoff-*.wake-pending \
+      "$state"/handoff/*.outbox.md; do
+      if [ -e "$record" ] || [ -L "$record" ]; then
+        FM_BACKLOG_EMPTY_ERROR="work-bearing task record is present at $record"
+        return 1
+      fi
+    done
+  fi
+  if [ ! -e "$data" ] && [ ! -L "$data" ]; then
+    root=${data%/*}
+    [ -n "$root" ] || root=/
+    if [ -e "$root/.tasks.toml" ] || [ -L "$root/.tasks.toml" ]; then
+      FM_BACKLOG_EMPTY_ERROR="the experimental empty-fleet preflight cannot validate a configured backlog without its data directory"
+      return 1
+    fi
+    return 0
+  fi
+  if ! fm_backlog_directory_present "$data" "data directory"; then
+    FM_BACKLOG_EMPTY_ERROR=$FM_BACKLOG_TRANSITION_ERROR
+    return 1
+  fi
+  for record in "$data"/handoff/*.outbox.md; do
+    if [ -e "$record" ] || [ -L "$record" ]; then
+      FM_BACKLOG_EMPTY_ERROR="work-bearing handoff record is present at $record"
+      return 1
+    fi
+  done
+  root=$(fm_backlog_root "$data") || {
+    FM_BACKLOG_EMPTY_ERROR=${FM_BACKLOG_TRANSITION_ERROR:-"data directory cannot be resolved: $data"}
+    return 1
+  }
+  if ! fm_backlog_config_present "$root" "$(fm_backlog_authorized_root "$data")"; then
+    FM_BACKLOG_EMPTY_ERROR=$FM_BACKLOG_TRANSITION_ERROR
+    return 1
+  fi
+  backend=$(fm_tasks_axi_backend "$root" 2>&1) || {
+    FM_BACKLOG_EMPTY_ERROR=$backend
+    return 1
+  }
+  if [ "$backend" != markdown ]; then
+    FM_BACKLOG_EMPTY_ERROR="the experimental empty-fleet preflight does not accept a non-markdown backlog backend"
+    return 1
+  fi
+  file=$(fm_backlog_file "$data") || {
+    FM_BACKLOG_EMPTY_ERROR=${FM_BACKLOG_TRANSITION_ERROR:-"backlog path cannot be resolved"}
+    return 1
+  }
+  if [ ! -e "$file" ] && [ ! -L "$file" ]; then
+    return 0
+  fi
+  fm_backlog_markdown_empty "$file"
+}
+
 # The directory a backlog's own `.tasks.toml` is resolved from.
 fm_backlog_root() {  # <data-dir>
   local data parent

bin/fm-bootstrap.sh

@@ -199,6 +199,10 @@ DATA="${FM_DATA_OVERRIDE:-$FM_HOME/data}"
 # deferred network stage sets, so an ordinary bootstrap run records nothing.
 # shellcheck source=bin/fm-timing-lib.sh disable=SC1091
 . "$SCRIPT_DIR/fm-timing-lib.sh"
+# Sourced only for fm_session_pid_valid: the lock identity this script compares
+# is not always a local pid.
+# shellcheck source=bin/fm-session-lock-lib.sh disable=SC1091
+. "$SCRIPT_DIR/fm-session-lock-lib.sh"
 
 # Network-phase selection (see the header). An unrecognized value resolves to
 # `all` so a malformed override runs every step rather than silently dropping a
@@ -213,7 +217,7 @@ network_phase() { [ "$FM_BOOTSTRAP_NETWORK_PHASE" != skip ]; }
 network_mutation_authorized() {
   local expected=${FM_BOOTSTRAP_NETWORK_LOCK_PID:-} current
   [ -n "$expected" ] || return 0
-  case "$expected" in *[!0-9]*) return 1 ;; esac
+  fm_session_pid_valid "$expected" || return 1
   [ -f "$STATE/.lock" ] && [ ! -L "$STATE/.lock" ] || return 1
   current=$(cat "$STATE/.lock" 2>/dev/null) || return 1
   [ "$current" = "$expected" ]

bin/fm-claude-stop-autoarm.sh

@@ -11,14 +11,15 @@
 #     secondmate home) with AGENTS.md, bin/, and the effective state dir - the
 #     exact fm-turnend-guard.sh scope. Child crew/scout worktrees stay inert.
 #   - Identity: only when THIS session holds state/.lock, as
-#     bin/fm-session-lock-lib.sh decides it: the recorded pid is a harness
-#     ancestor, or a live lock was recorded under this same trusted Claude
-#     session id (which is what keeps a background session arming after its
-#     transient helper chain is recycled).
-#     When an existing numeric owner fails the shared harness-liveness predicate,
-#     the hook delegates guarded recovery to bin/fm-lock.sh and then re-verifies
-#     ownership. A live owner, missing lock, malformed lock, or unresolved
-#     ancestry remains inert, so a competing session never arms or rewakes.
+#     bin/fm-session-lock-lib.sh decides it: the recorded owner belongs to this
+#     session's verified identity set, or a live lock was recorded under this
+#     same trusted Claude session id (which is what keeps a background session
+#     arming after its transient helper chain is recycled).
+#     When an existing recognized owner is proven dead by the shared liveness
+#     predicate, the hook delegates guarded recovery to bin/fm-lock.sh and then
+#     re-verifies ownership. A live or unknown owner, missing lock, malformed
+#     lock, or unresolved identity remains inert, so a competing session never
+#     arms or rewakes.
 #   - AFK: while state/.afk exists the away daemon owns the watcher and triage;
 #     this hook exits 0 and NEVER rewakes the primary (checked again at
 #     translation time so a mid-cycle AFK transition is honored).
@@ -59,8 +60,8 @@
 #     until the synchronous guard has consumed its attended fail-open.
 #
 # The epoch ledger state/.claude-autoarm-epoch records the latest claim
-# generation and outcome, and binds rewake outcomes to the session-lock pid and
-# watcher recovery generation, so the synchronous Stop guard
+# generation and outcome, and binds rewake outcomes to the session-lock owner
+# identity and watcher recovery generation, so the synchronous Stop guard
 # (bin/fm-turnend-guard.sh --claude) can allow a stop whose recovery this hook
 # already owns, instead of forcing a duplicate continuation for the same event
 # epoch. The failure marker
@@ -124,17 +125,17 @@ fm_hook_payload_is_foreign_host "$PAYLOAD" && exit 0
 fm_primary_scope_matches "$FM_ROOT" "$STATE" || exit 0
 
 # --- identity: only the lock-owning session's hooks may arm ------------------
-# A prior session may have died after leaving its numeric harness pid in .lock.
-# Use the shared liveness predicate to recognize only that stale-owner case.
+# A prior session may have died after leaving its harness identity in .lock.
+# Use the shared liveness predicate to recognize only that stale-owner case; it
+# resolves a tagged identity too, so a dead Windows session is still recoverable
+# rather than being read as a malformed lock nobody may ever clear.
 # Defer the mutating claim until after the unchanged AFK and need gates, so an
 # idle or away home remains byte-for-byte inert. Missing or malformed locks are
 # uncertainty rather than stale-owner evidence and remain inert.
 RECOVER_SESSION_LOCK=0
 if ! fm_session_lock_owned_by_self "$STATE"; then
   LOCK_PID=$(cat "$STATE/.lock" 2>/dev/null || true)
-  case "$LOCK_PID" in
-    ''|*[!0-9]*) exit 0 ;;
-  esac
+  fm_session_pid_valid "$LOCK_PID" || exit 0
   fm_harness_pid_alive "$LOCK_PID" && exit 0
   RECOVER_SESSION_LOCK=1
 fi

bin/fm-harness.sh

@@ -52,18 +52,22 @@
 #   Ancestry - the nearest harness process in this process's parent chain. This
 #              is the structural fact about who actually owns the process tree,
 #              so it is what settles a disagreement.
-# detect_own is the single owner of how the two combine; harness_marker and
-# harness_ancestry only report evidence. Record each newly verified env marker
-# in harness_marker, and each newly verified command name in harness_ancestry.
+#   Native owner - a launch-bound identity published by the experimental Windows
+#              launcher and authenticated through its native owner endpoint.
+#              When selected by its home record, it precedes marker and ancestry.
+# detect_own is the single owner of how the three combine; harness_marker and
+# harness_ancestry only report their evidence. Record each newly verified env
+# marker in harness_marker, and each newly verified command name in
+# harness_ancestry.
 set -u
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
 FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
 CONFIG="${FM_CONFIG_OVERRIDE:-$FM_HOME/config}"
 
-# shellcheck source=bin/fm-cursor-lib.sh
-. "$SCRIPT_DIR/fm-cursor-lib.sh"
+# shellcheck source=bin/fm-session-lock-lib.sh
+. "$SCRIPT_DIR/fm-session-lock-lib.sh"
 # shellcheck source=bin/fm-gemini-lib.sh
 . "$SCRIPT_DIR/fm-gemini-lib.sh"
 
@@ -395,6 +399,14 @@ harness_family() {
 #     a harness-shaped path in some node process's arguments is weaker evidence
 #     than a harness publishing its own identity.
 detect_own() {
+  local native_harness
+  case "$(uname -s)" in MINGW*|MSYS*|CYGWIN*)
+    if fm_native_owner_selected; then
+      native_harness=$(fm_native_owner_call harness 2>/dev/null) || { echo unknown; return; }
+      case "$native_harness" in codex) echo codex ;; *) echo unknown ;; esac
+      return
+    fi ;;
+  esac
   local marker ancestry strength harness
   marker=$(harness_marker)
   ancestry=$(harness_ancestry)